HACCP plan for a restaurant: when you need one and what goes in it

When does a restaurant need a HACCP plan?

The FDA Food Code 2022 is a model code that states and localities adopt, often with changes and often an older edition. Under it, a food establishment must submit a HACCP plan in two broad situations, both described in §8-201.13:

• Before getting a variance. Section 3-502.11 says a variance is required for smoking food as a method of preservation rather than flavour, curing food, using food additives such as vinegar to make food non-TCS (acidified sushi rice is the classic example), reduced oxygen packaging outside the conditions in §3-502.12, operating a molluscan shellfish life-support display tank, custom processing animals, sprouting seeds, and other methods your regulator decides need one.
• Before reduced oxygen packaging without a variance under §3-502.12. That covers vacuum packaging raw or cooked food, cook-chill, and sous vide where the food is packaged and held rather than served right away.

Some regulators also ask for a HACCP plan when a restaurant has repeat violations, serves a highly susceptible population, or runs a commissary for food trucks. If you're not sure, the cheapest answer is a phone call to your inspector. Our guide to when a HACCP plan is required walks through each trigger.

What are the 7 HACCP principles in kitchen terms?

1. Hazard analysis. For every step from receiving to service, list what could go wrong: bacteria growing, toxins forming, chemicals or bones getting in: and decide which hazards are likely enough and severe enough to control.
2. Critical control points. The steps where control is essential: usually cooking, cooling, cold holding, and any packaging step.
3. Critical limits. Measurable numbers. Poultry cooked to 165°F for under one second (§3-401.11(A)(3)). Ground beef to 155°F for 17 seconds (§3-401.11(A)(2)). Cooling from 135°F to 70°F within 2 hours and to 41°F within 6 hours total (§3-501.14). Cold holding at 41°F or below (§3-501.16).
4. Monitoring. Who checks, with what tool, how often. "Line cook probes the thickest piece of each batch with a calibrated thermometer and records it."
5. Corrective actions. What happens to the food when a limit is missed, keep cooking, reheat, or discard, and how you fix the cause.
6. Verification. A manager reviews the logs, thermometers are calibrated, and the plan gets reviewed when the menu changes.
7. Record keeping. The logs that prove you did it. For ROP and cook-chill under §3-502.12, records must be kept for at least six months.

What goes in a restaurant HACCP plan?

Section 8-201.14 lists the contents a regulator can ask for: a categorisation of the types of TCS food covered; a flow diagram per food or group of foods identifying CCPs; the ingredients, recipes or formulations and equipment; a CCP summary listing the hazard, critical limit, monitoring method and frequency, the person responsible, the corrective action, verification method and records; supporting documents such as worker training; and any other information the regulatory authority requests. A plan that mirrors that list is much easier to review. Most inspectors also expect a cover page with the permit number and the person in charge, and a sign-off table showing who reviewed the plan and when.

How do I decide if a step is a CCP?

Run each step through four questions, the classic Codex decision tree. Is there a control measure at this step for the hazard? Is this step designed to eliminate the hazard or cut it to a safe level? Could contamination or growth reach unsafe levels here? Will a later step remove it? If the step is built to control the hazard, or nothing later will fix it, it's a CCP. That's why cooking and cooling almost always are, and prep usually isn't: handwashing and sanitizing handle prep as prerequisite programs.

What are prerequisite programs?

The everyday routines that keep the CCPs working: handwashing, excluding sick workers, cleaning and sanitizing, allergen control, pest control, approved suppliers and thermometer calibration. You don't need a CCP for each one. A short written SOP and a training record is usually enough, and §8-201.14 asks for supporting documents such as training plans.

Which critical control points do most restaurants have?

Receiving (cold TCS food at 41°F or below, §3-202.11), cooking to the right temperature for the product, cooling in two stages, cold and hot holding, reheating to 165°F for 15 seconds for hot holding (§3-403.11), and, for special processes, the packaging, chilling and storage limits in §3-502.12, such as cook-chill or sous vide food held at 34°F or below for up to 30 days or 41°F or below for up to 7 days. Our builder assigns these automatically based on what you select, and shows each citation.

Why do restaurant HACCP plans get sent back?

The common reasons a plan bounces back: limits written as "cook thoroughly" instead of numbers; no corrective action for the food itself; monitoring frequencies nobody can follow during service; curing or dry-aging plans with no validation; and logs that don't match the plan. Write limits as numbers with the citation, keep monitoring realistic, and make the logs the same document your cooks already fill in.

Finally, remember a plan only counts if it's followed. Train the cooks on the specific CCPs, keep the logs where the work happens, and review them weekly.