HACCP Basics for Food Service

HACCP stands for Hazard Analysis and Critical Control Points. It's a preventive system for food safety. Instead of testing a finished dish and hoping it passes, you work out in advance where things could go wrong, set a limit at each key step, watch that limit, and keep records that prove you did.

HACCP started in the 1960s as a way to make safe food for the space program. Today, it's the basis of food safety in manufacturing, and it's used in many retail and restaurant operations. You may be asked to run a HACCP plan, follow one or help write one as you move into a lead or manager role.

A guide can't certify you to write a plan. Formal HACCP courses exist, and your regulator may need to review or approve a plan before you use it.

What You Will Be Able to Do

• Explain what HACCP is for and when a retail or food service business needs a plan.
• Name the seven principles in order.
• Tell the difference between a critical control point and a control point.
• Set a critical limit, a monitoring step and a corrective action for a process.
• Keep records that show the plan is working.

Where HACCP Fits

Prerequisite programs come first. These are the everyday basics: handwashing, cleaning and sanitizing, pest control, supplier approval, staff training and equipment upkeep. If those aren't in place, a HACCP plan won't save you.

HACCP adds focused control at the steps with the highest risk.

Under the FDA Food Code, a food business needs a HACCP plan for certain specialized processes, and it usually needs a variance from the regulator as well. Examples include:

• Smoking food to preserve it, rather than to add flavor
• Curing food
• Using food additives to make food shelf-stable, such as acidifying sushi rice
• Packaging food using reduced oxygen methods, such as sous vide or vacuum packing
• Keeping live shellfish in a display tank
• Sprouting seeds or beans
• Custom processing animals

Many ordinary restaurants aren't required to have a full plan, but they still use the same thinking in their active managerial control. The 2026 Food Code also adds a section on when a food safety management system is required. Check what your jurisdiction has adopted, because the Food Code is a model and your local code is the law.

Three Kinds of Process

FDA's retail HACCP guidance groups menu items by how many times they pass through the danger zone, between 41°F and 135°F. This helps you decide where control matters most.

Complex foods go through the danger zone more than once, so they usually need the most attention.

The Seven Principles

1. Conduct a Hazard Analysis

List each step in the flow of food for a menu item, then ask what could go wrong. Hazards fall into three classes:

• Biological: Salmonella in raw chicken, Listeria in deli food, toxins from slow cooling
• Chemical: Sanitizer residue, undeclared allergens, excess nitrite
• Physical: Bone fragments, glass, metal shavings

Some systems treat allergens as their own hazard. Focus on hazards that are likely and serious.

2. Determine Critical Control Points

A critical control point (CCP) is a step where you can apply control to prevent, remove or reduce a hazard to a safe level, and where no later step will correct a failure.

Cooking raw chicken to 165°F is a classic CCP, because it destroys Salmonella. If you miss it, nothing that happens later fixes the problem.

A control point (CP) is any step where you manage something, but losing control doesn't by itself create a safety risk. It may be about quality, or a later step may still make the food safe. Seasoning a sauce or trimming fat is a control point. Keeping lettuce crisp is a control point. Safety depends on the CCPs.

Keep the number of CCPs small. If everything is critical, nothing gets proper attention.

3. Establish Critical Limits

A critical limit is a measurable value that separates safe from unsafe. It has to be something a person can check.

"Cook until done" is not a critical limit.

4. Establish Monitoring Procedures

Monitoring answers four questions: what you will check, how you'll check it, how often, and who does it.

For example: "The line cook checks the internal temperature of the thickest piece in each batch of chicken with a calibrated probe, and writes it in the cook log."

Monitoring needs to happen often enough that you'd catch a failure while you can still fix it. Checking cooler temperatures once a day may be too late.

5. Establish Corrective Actions

A corrective action is what you do when a limit is missed. Decide this ahead of time, so that nobody has to guess in the middle of a rush.

A good corrective action does two things: it deals with the affected food, and it fixes the cause so that the failure doesn't happen again.

6. Establish Verification Procedures

Verification proves that the system works, not just that one reading passed. It's usually done by a manager or someone other than the person monitoring.

Examples include:

• Calibrating thermometers
• Reviewing logs each day and initialing them
• Watching a worker take a temperature
• Checking that corrective actions were taken
• Reviewing the plan whenever the menu, recipe, supplier or equipment changes

7. Establish Record-Keeping and Documentation

If it isn't written down, you can't prove it happened. Keep the plan itself, your monitoring logs, your corrective action records, your calibration records and your supplier records. Follow your regulator's rules on how long to keep them.

Fill in logs at the time of the check. Don't fill in a week of readings at once. Falsified records can do more damage than a missed reading, because they hide a real risk and they destroy trust with your inspector.

Worked Example: A Pot of Chili

Chili is a complex process, because it's cooked, cooled, stored, reheated and held.

Different operations may label steps differently. Some would treat receiving as a prerequisite instead of a CCP. That's fine if the reasoning is sound and the plan works.

Building a Plan: The Five Preliminary Steps

Before applying the seven principles, formal HACCP planning usually covers these:

1. Assemble a team with people who know the food and the process.
2. Describe the food and how it's distributed.
3. Describe who will eat it. Children and older adults change the risk.
4. Draw a flow diagram of each step.
5. Walk through the kitchen to confirm the diagram matches reality.

Common Mistakes

Check Your Understanding

1. A kitchen's plan lists "keep the salad crisp" as a CCP. Is that right?

No. That's about quality, so it's a control point. A CCP is a step needed for safety, with no later step that can fix a failure.

2. Your cook log shows a chicken batch at 160°F, and the cook wrote "OK". What's wrong here?

The reading missed the critical limit of 165°F, so the corrective action was needed. The batch should have kept cooking, and the log should show what was done. A manager reviewing the log should follow up.

3. Your restaurant wants to start vacuum packing cooked short ribs to hold them for a week. What should you check first?

Reduced oxygen packaging is a specialized process. Under the Food Code, it generally calls for a HACCP plan, and may require approval or a variance from your regulator. Check with your local health department before you start.

4. A manager compares cooler logs against a calibrated thermometer each week. Which principle is this?

Verification. It's checking that the system is working and that the readings can be trusted.

Key Takeaways

• HACCP prevents problems rather than testing for them after the fact.
• The seven principles are hazard analysis, CCPs, critical limits, monitoring, corrective actions, verification and record-keeping.
• A CCP is essential for safety. A control point isn't.
• Limits must be measurable, and each one needs a written corrective action.
• Some specialized processes require a HACCP plan and approval from your regulator.
• Prerequisite programs such as cleaning and handwashing have to be in place first.