How to Build a Restaurant HACCP Plan: Step-by-Step

Understanding the Restaurant HACCP Plan and Its Regulatory Landscape

Hazard Analysis Critical Control Point (HACCP) is a systematic, preventive approach to food safety that identifies biological, chemical, and physical hazards in the flow of food and implements scientific controls to prevent, eliminate, or reduce these hazards to safe levels. Originally developed in the 1960s by the Pillsbury Company, the United States Army, and the National Aeronautics and Space Administration (NASA) to ensure safe food for space flights, HACCP has since become the gold standard for food safety management worldwide.

In the United States, navigating the regulatory environment requires understanding the distinction between federal model codes and local laws. The U.S. Food and Drug Administration (FDA) publishes the Food Code as a model code—a set of scientifically backed recommendations designed to provide a uniform national standard for retail and food service safety. However, the FDA Food Code does not hold the force of federal law.

Instead, binding regulations are established only when state, county, or municipal health departments formally adopt an edition of the Food Code. This creates a critical jurisdiction caveat for restaurant operators. Some states quickly adopt the most current edition, such as the 2022 FDA Food Code, while others may still enforce the 2017, 2013, or even earlier editions. Additionally, certain states, such as California and Texas, implement custom state codes (e.g., the California Retail Food Code or the Texas Food Establishment Rules) that incorporate major portions of the federal model but introduce specific regional amendments.

To protect public health and maintain regulatory compliance, restaurant operators must identify the exact edition of the Food Code adopted by their local regulatory authority. Under the FDA model Food Code, a comprehensive HACCP plan is either voluntary or mandatory depending on the nature of the kitchen's operations.

When is a HACCP Plan Legally Mandated?

Under FDA Food Code Section 8-201.13, a retail food establishment must submit a properly prepared HACCP plan to the regulatory authority when applying for a variance or when conducting specialized food processes that present high public health risks. These specialized processes include:

• Smoking food as a method of food preservation rather than for flavor enhancement.
• Curing food (such as meats or fish) for preservation, color, or flavor.
• Using food additives or adding components, such as vinegar, to alter the pH or water activity ($a_w$) of a food as a method of preservation or to render it a non-Time/Temperature Control for Safety (TCS) food (e.g., sushi rice acidification).
• Operating a molluscan shellfish life-support system display tank used to store or display shellfish that are offered for human consumption.
• Packaging Time/Temperature Control for Safety food using a Reduced Oxygen Packaging (ROP) method (such as vacuum packaging, sous vide, or cook-chill), except where specific natural barriers exist or when the food is removed from the packaging within 48 hours of sealing under Section 3-502.12.
• Sprouting seeds or beans for retail sale.
• Custom processing wild game animals for personal use as food.
• Preparing food in a manner determined by the regulatory authority to require a variance and a HACCP plan.

For standard food service operations that do not perform these specialized processing methods, implementing a food safety management system based on HACCP principles remains completely voluntary. However, both the FDA and state regulatory agencies highly encourage voluntary implementation to achieve active managerial control over the primary foodborne illness risk factors identified by the Centers for Disease Control and Prevention (CDC).

---

The Preliminary Steps of HACCP Plan Development

Before applying the seven formal principles of HACCP, a restaurant operator must lay the operational groundwork. The National Advisory Committee on Microbiological Criteria for Foods (NACMCF) outlines five preliminary tasks that ensure the HACCP plan is built on accurate, site-specific data:

1. Assemble the HACCP Team: A successful plan cannot be written in a vacuum by a single manager. The team should represent the diverse functions of the restaurant, including executive chefs, line cooks, kitchen managers, corporate compliance officers, and even facility maintenance technicians. Each member brings distinct insight into how food flows, how equipment is cleaned, and how processes are actually executed on the line.
2. Describe the Food and Its Distribution: The team must define each menu item or food category, detailing its raw ingredients, preparation methods, packaging, holding temperatures, and distribution. In a standard restaurant, "distribution" refers to direct table service, takeout, or local delivery.
3. Identify the Intended Consumer and End Use: Determine who will consume the food and how it will be prepared. Is the general public the target audience, or does the restaurant serve highly susceptible populations, such as elderly residents in an assisted living facility, children in a daycare center, or patients in a healthcare environment? Highly susceptible populations require much stricter control thresholds and prohibit certain high-risk menu items (e.g., raw seed sprouts or undercooked eggs).
4. Develop a Process Flow Diagram: Create a clear, sequential visual map of every operational step the food goes through from receiving, dry or cold storage, preparation, cooking, cooling, reheating, holding, to final service.
5. Verify the Process Flow Diagram On-Site: The HACCP team must physically walk through the kitchen during active hours to verify that the draft flow diagram accurately reflects real-world operations. If a line cook performs an unmapped step—such as pre-portioning or room-temperature holding—the diagram must be modified.

---

The FDA Process Approach for Restaurants

In large-scale food manufacturing plants, a unique HACCP plan is written for each individual product. However, because commercial restaurants handle dozens of menu items with frequently changing ingredients, writing a separate plan for every recipe is operationally impractical.

To solve this challenge, the FDA developed the Process Approach to HACCP. This approach groups menu items into three broad categories based on the number of times the food passes through the Temperature Danger Zone: 41°F to 135°F (5°C to 57°C).

``` Process 1: No Cook Step Receive -> Cold Hold -> Prepare -> Cold Hold -> Serve (0 passes through the danger zone)

Process 2: Same-Day Service Receive -> Cold Hold -> Prepare -> Cook -> Hot Hold -> Serve (1 pass through the danger zone)

Process 3: Complex Food Preparation Receive -> Cold Hold -> Prepare -> Cook -> Cool -> Reheat -> Hot Hold -> Serve (Multiple passes through the danger zone) ```

Process 1: Food Preparation with No Cook Step

This category applies to menu items that do not receive a heat lethality step to destroy pathogenic bacteria. Examples include raw oysters, green salads, cold sandwiches, sliced deli meats, and house-made mayonnaise.

• The Hazard: Because there is no cooking step to kill pathogens, the primary food safety hazards are biological contamination from raw materials, bacterial growth due to cold-holding failures, and cross-contamination from raw meats or unsanitary equipment.
• The Control Strategy: Stricter supplier verification, rigorous handwashing policies, continuous refrigeration at or below 41°F (5°C), and dedicated prep areas to prevent cross-contamination.

Process 2: Food Preparation for Same-Day Service

This category applies to foods that are cooked and served hot on the same day. Examples include grilled hamburgers, baked salmon, cooked chicken breast, and freshly prepared pasta.

• The Hazard: Pathogenic survival if the food is undercooked, and rapid bacterial multiplication if the hot-holding equipment fails.
• The Control Strategy: Cooking the food to the correct minimum internal temperature and holding it hot at or above 135°F (57°C) until service. The food passes through the Temperature Danger Zone only once during the cooking process.

Process 3: Complex Food Preparation

This category applies to foods that are prepared in advance, cooked, cooled down for storage, and reheated for service on a later shift or day. Examples include beef stews, commercial gravies, lasagnas, refried beans, and large roasts.

• The Hazard: This is the highest-risk process. Food passes through the Temperature Danger Zone multiple times (once during cooking, once during cooling, and once during reheating). If cooling is too slow, spore-forming bacteria like *Clostridium perfringens* and *Bacillus cereus* can survive cooking, germinate, and multiply exponentially.
• The Control Strategy: Strict adherence to rapid two-stage cooling parameters, safe cold storage, rapid reheating to pasteurization levels, and hot-holding.

---

The 7 Principles of HACCP Applied to Restaurants

Once the menu items are organized using the Process Approach, the HACCP team applies the seven formal principles to establish active managerial control.

Principle 1: Conduct a Hazard Analysis

The team must identify the potential biological, chemical, or physical hazards that could occur at each step of the food's flow.

• Biological Hazards: Pathogenic bacteria (*Listeria*, *Salmonella*, *E. coli*), viruses (Norovirus, Hepatitis A), and parasites.
• Chemical Hazards: Cleaning compounds, sanitizers, toxic metals from copper or brass cookware, and food allergens.
• Physical Hazards: Metal fragments, glass shards, bandages, jewelry, or stones.

During this analysis, the team evaluates the likelihood of the hazard occurring and the severity of its consequences. Only hazards that are of significant public health importance require control measures under the HACCP plan.

Principle 2: Identify Critical Control Points (CCPs)

A Critical Control Point is an operational step where a control measure can be applied and is absolutely essential to prevent, eliminate, or reduce a food safety hazard to an acceptable level.

• If a later step in the process will control the hazard, the earlier step is not a CCP. For example, cold holding raw chicken is important, but the final cooking step is the CCP that eliminates vegetative pathogens.
• In Process 1 (No Cook), the primary CCP is cold-holding or receiving.
• In Process 2 (Same-Day Service), the cooking step is the primary CCP.
• In Process 3 (Complex), the cooking, cooling, reheating, and hot-holding steps are all separate CCPs.

Principle 3: Establish Critical Limits

For each identified CCP, the team must establish the scientific boundaries that separate safe food from unsafe food. Critical limits must be measurable and observable parameters, such as temperature, time, pH, or water activity.

It is vital to distinguish commercial FDA Food Code guidelines from consumer recommendations. For instance, the U.S. Department of Agriculture (USDA) home consumer guidelines define the danger zone as 40°F to 140°F (4°C to 60°C). However, the FDA Food Code establishes the commercial hot-holding minimum at 135°F (57°C) and cold-holding at 41°F (5°C).

Standard critical limits based on the 2022 FDA Food Code include:

• Cooking Poultry: 165°F (74°C) for instantaneous lethality (§ 3-401.11).
• Cooking Ground Meats (Beef, Pork): 155°F (68°C) for 17 seconds (§ 3-401.11).
• Cooking Fish and Whole Meat Cuts: 145°F (63°C) for 15 seconds (§ 3-401.11).
• Two-Stage Cooling: Cool hot foods from 135°F (57°C) to 70°F (21°C) within 2 hours, and then from 70°F (21°C) to 41°F (5°C) or below within an additional 4 hours (total time ≤ 6 hours) (§ 3-501.14).
• Reheating for Hot Holding: Reheat previously cooked and cooled TCS foods to 165°F (74°C) for 15 seconds within a maximum window of 2 hours (§ 3-403.11).

Principle 4: Establish Monitoring Procedures

Monitoring is a planned sequence of observations or measurements to assess whether a CCP is under control and to produce an accurate record for future verification. The monitoring procedure must explicitly answer four questions:

• What will be monitored? (e.g., the internal temperature of cooked chicken breasts).
• How will it be monitored? (e.g., using a calibrated thermocouple probe thermometer).
• Who will monitor it? (e.g., the designated line cook or kitchen supervisor).
• How often (frequency)? (e.g., every batch of chicken cooked, or every 2 hours during hot-holding).

Using a standardized [Food Temperature Log Template](/resources/food-temperature-log-template) makes daily temperature checks fast and reliable.

Principle 5: Establish Corrective Actions

When monitoring indicates that a critical limit has been violated at a CCP, the process has failed, and immediate action must be taken. The corrective action plan must outline:

• What immediate action will be taken to ensure public safety? (e.g., continue cooking the product until it reaches 165°F, or immediately discard hot-held food that has dropped to 120°F for more than 4 hours).
• Who is responsible for executing the corrective action?
• How will the corrective action be documented?
• How will the root cause of the failure be investigated to prevent recurrence?

Principle 6: Establish Verification Procedures

Verification involves those activities, other than daily monitoring, that prove the HACCP plan is scientifically sound and operating as written.

• Validation: Ensuring the plan's scientific foundation is correct. For example, verifying that cooking poultry to 165°F is scientifically proven to achieve a 7-log reduction of *Salmonella*.
• Routine Verification: Activities performed by management to ensure employees are executing the plan. This includes observing employees taking temperatures, reviewing daily logs, and calibrating thermometers. Standardizing these routines using a [Restaurant Line Check Template](/resources/restaurant-line-check-template) ensures that CCPs are verified before service.

Principle 7: Establish Record-Keeping and Documentation Procedures

Written records serve as legal and operational proof that the HACCP system is functioning correctly and that the restaurant is actively managing food safety. A robust record-keeping system includes:

• The written HACCP plan itself, including hazard analyses and scientific justifications.
• Daily monitoring logs (e.g., cooking logs, cooling logs, refrigeration temperature logs).
• Corrective action reports detailing any critical limit deviations and product dispositions.
• Equipment calibration logs (e.g., thermometer calibration sheets).
• Employee training records.

To prevent falsification of food safety records, operators must implement strategies to [stop pencil whipping checklists](/resources/stop-pencil-whipping-checklists) in their commercial kitchens.

---

Usable HACCP Plan Template: Critical Control Point Summary

Below is a practical, operational Critical Control Point (CCP) Summary table designed for Process 3: Complex Food Preparation (specifically for a commercial chicken soup recipe). This represents the core document required by health departments during a variance or HACCP review under FDA Food Code Section 8-201.14.

---

Inspector and Manager Food Safety Checks

When a health department inspector conducts a risk-based inspection, or when a kitchen manager performs an internal audit, they do not simply look for physical cleanliness. They focus heavily on how the kitchen actively manages critical risks.

A standard inspector/manager HACCP verification checklist includes the following operational evaluations:

• Thermometer Calibration: Are food thermometers calibrated regularly, and do they read 32°F (0°C) in an ice slush mixture?
• Raw Material Storage: Is raw meat stored below and away from ready-to-eat foods to prevent cross-contamination?
• Cold-Holding Units: Are walk-in coolers and prep tables holding food at or below 41°F (5°C)?
• Employee Health & Hygiene: Are employees actively washing their hands, and is there a strict employee illness policy excluding workers with symptoms of Norovirus, *Salmonella*, or *Shigella*?
• Prerequisite Programs (PRPs): Are foundational sanitation SOPs operating correctly? Proper facility maintenance and a robust [restaurant pest control checklist](/resources/restaurant-pest-control-checklist) serve as critical prerequisite programs that prevent external environmental hazards from compromising the food flow.

---

Common HACCP Implementation Failures and How to Prevent Them

While a written HACCP plan may look flawless on paper, its real-world execution frequently fails due to predictable operational issues. Restaurant groups must recognize and proactively address these common failures:

• Pencil Whipping (Falsifying Logs): Staff filling out an entire day's temperature logs at the end of a shift without actually taking measurements. To prevent this, transition to digital checklists that require real-time, timestamped entries and photographic proof of temperature readings.
• Lack of Staff Training and Buy-In: Employees viewing HACCP as arbitrary homework rather than a critical public safety process. Managers must explain *why* the critical limits exist, connecting a 165°F temperature directly to pathogen destruction and guest safety.
• Failure to Calibrate Equipment: Using inaccurate dial thermometers that read several degrees higher or lower than actual temperatures. Kitchen managers must implement weekly or bi-weekly calibration schedules, recording the results on a dedicated log.
• Outdated Plans: Failing to update the HACCP plan when the kitchen introduces new recipes, changes suppliers, or replaces equipment. If a restaurant shifts from buying pre-cooked sliced turkey to roasting raw whole turkey in-house, the process shifts from Process 1 (No Cook) to Process 3 (Complex), requiring an immediate update to the hazard analysis and critical control points.

---

Educational Disclaimer

*This article is designed to provide commercial kitchen operators with practical, educational guidance on how to structure a food safety management system based on the Hazard Analysis Critical Control Point (HACCP) principles. It does not constitute formal legal or regulatory advice. Because state, county, and municipal health departments adopt varying editions of the model FDA Food Code and enforce specific regional amendments, operators must consult their local regulatory authority to ensure complete legal and operational compliance.*

---

Ready to digitize your restaurant's food safety and HACCP compliance? Try Food Ops to automate your daily logs, simplify verification, and protect your guests across all your locations. Schedule a demo or explore our digital checklists today.

---

Official sources

• U.S. Food and Drug Administration (FDA) — 2022 FDA Food Code
• FDA — Managing Food Safety: A Manual for the Voluntary Use of HACCP Principles for Operators of Food Service and Retail Establishments
• FDA — HACCP Principles & Application Guidelines
• Association of Food and Drug Officials (AFDO) — Retail Food Establishment Guide for Developing a HACCP Plan
• U.S. Department of Agriculture (USDA) Food Safety and Inspection Service — The "Danger Zone" Guidelines