HACCP Plan for Restaurants: Principles and a Worked Example

What is HACCP in a restaurant?

HACCP, short for hazard analysis and critical control points, is a way of keeping food safe by finding the few steps where a hazard can still be stopped, putting a measurable limit on each one, and keeping a record that the limit was met. The Codex Alimentarius, the food standards published by FAO and WHO, calls it "science-based and systematic" and says it puts control on significant hazards "rather than relying mainly on end-product testing." A kitchen can't test a plate before it leaves the pass. It controls what decides whether the plate is safe: the temperature the chicken reached, the hours the stock took to cool.

HACCP sits on top of the basics, it doesn't replace them. Codex says prerequisite programmes, including good hygiene practices, should be in place first, because HACCP "will not be effective without prior implementation of prerequisite programmes including GHPs." In a restaurant that means handwashing, cleaning and sanitizing, pest control, supplier checks and an employee illness policy are already running. The plan adds tighter control on the handful of steps where those basics aren't enough alone.

The test for what belongs in a plan is simple. Wiping a counter is hygiene. Cooking chicken to 165°F is a control point, because nothing later in the kitchen can fix undercooked chicken.

Do restaurants need a HACCP plan?

Most US restaurants aren't required to hold a formal HACCP plan, but a restaurant needs one when the FDA Food Code, as adopted by its state or county, ties a specialized process to a variance. The trigger is section 8-201.13, "When a HACCP Plan is Required." Before the activity starts, the operator has to submit a plan for approval if a plan is required by law, if a variance is required under section 3-502.11, or if the regulator decides a preparation method needs a variance.

Section 3-502.11 is the list that matters, as reproduced in a Massachusetts regional board of health guide: smoking food to preserve it rather than flavor it, curing food, using additives or components such as vinegar to preserve food or make it no longer time/temperature control for safety, packaging that food in reduced oxygen unless it stays within section 3-502.12, running a live shellfish display tank, custom-processing animals for personal use, and sprouting seeds or beans. Cook-chill and sous vide bagging fall under the reduced oxygen rules, so a kitchen that bags and chills food ahead can meet this section sooner than it expects. Packaging juice you treat on site to a 5-log reduction needs a plan too, under section 3-404.11, without a variance.

The 2026 Food Code adds a different requirement. Released September 17, 2026, it creates section 8-201.15, "When a Food Safety Management System is Required." Per Food Safety Magazine, covered establishments must develop and maintain a written system within four years of their regulator adopting the 2026 Code, use it during all hours of operation, and make it available on request, and the regulator can exempt operations that pose minimal risk. FDA's summary describes it as "a preventative strategy that can help manage and control factors that can contribute to foodborne illness." It is not the same as a HACCP plan, and the Code is a model, not federal law: each state, county or city decides when to adopt it, and many are still on the 2017 or 2022 editions, per FoodHandler. Read the exact wording of section 8-201.15 when your jurisdiction adopts it. Section numbers in this guide follow the long-standing Code; FDA's list of 2026 changes doesn't mention section 8-201.13 and lists section 3-502.11 only for a new paragraph in its public health explanation.

Our view: if you run an à la carte kitchen with no curing, smoking or reduced oxygen packing, the law probably doesn't ask you for a plan today. Write one anyway for the dish or process that would hurt the most guests if it failed. What doesn't work is a generic template filed in a binder. Codex says the approach "should be customized to each food business," and a plan with no numbers from your own kitchen is paper.

What are the seven principles of HACCP?

The seven principles are Codex's steps for building a HACCP system, from finding hazards to keeping records. Codex words them as follows, and the right-hand column shows what each one looks like on a line.

Codex applies the seven in 12 successive steps. The first five are preparation: assemble the team, describe the product, describe its intended use, draw the flow diagram, and confirm that diagram on site. Steps 6 to 12 are the seven principles in order.

How do you write a restaurant HACCP plan?

Write a restaurant HACCP plan one dish or process at a time, working along the flow of food from receiving to the plate, and finish a single page before starting the next. The steps follow Codex's 12 with the paperwork cut down.

1. Put a small team on it. The chef, the GM and a cook from the station. Codex asks that the right knowledge be available, and the person who makes the dish on a Friday knows where it goes wrong.
2. Describe the dish and how it is served. Ingredients, hold time, and who eats it.
3. Draw the flow, then walk it during service. Codex has a separate step to confirm the diagram against the real operation, because the process on paper and the one at 7 p.m. differ.
4. List the hazards at each step and mark which ones the basics already control and which need a control point.
5. Set a limit with a number and a source. Codex calls for validated limits, so use the Food Code, your national norm or the USDA, not a number chosen by feel.
6. Write the monitoring and the fix. Who probes, when, and the corrective action in one sentence.
7. Name who verifies, and who isn't the person monitoring.
8. Review it when anything changes. Codex lists a new process, ingredient, product or piece of equipment as reasons to review.

Small kitchens get room to adapt. Codex says flexible approaches are "available and encouraged" for small businesses, including a HACCP-based system that doesn't follow the layout of its 12 steps, as long as all seven principles are considered. It also allows businesses to adapt a generic plan from the competent authority or a trade association to the site. Ask your health department first whether it publishes one.

Food safety

Health Inspection Self-Audit Checklist

A 53-point self-audit organized the way a US health inspection actually runs, built on the FDA Food Code, so you catch what they'll catch first.

PDFExcel

What are the critical control points in a restaurant kitchen?

A critical control point is a step where a mistake can't be corrected later, which in most restaurant kitchens means cooking, cooling, reheating and hot holding for food made ahead. The example below is hypothetical: braised chicken thighs cooked in the morning, chilled in the walk-in, and reheated to order at dinner.

The cooling row is where this dish most often fails. The CDC says almost 1 million people get C. perfringens food poisoning each year in the United States, most often from foods cooked in large batches and held at unsafe temperatures, with chicken and gravy among the foods it names.

Receiving and cold storage are real risks, but we would handle them as prerequisite programmes with a temperature log (41°F or below in the walk-in) rather than as extra control points. Sanitizer strength and handwashing are the same: they matter, they aren't CCPs. Codex's own example of an observable critical limit is applying the correct label with allergen information, which fits any house-made item you pack and label for take-home.

Food safety

Food Temperature Log

A cold and hot holding log plus a two-stage cooling log, built to FDA Food Code 2022 numbers, with a corrective action column that does something.

PDFExcel

What HACCP records and verification do you need?

A HACCP system needs two kinds of paper: the documentation that explains the plan, and the records that show it was followed. Codex lists the documentation as the team, the hazard analysis, the CCP decisions, the limits and the support for them, and any changes made to the plan. The records are the monitoring readings, the deviations with their corrective actions, and the verification checks.

Codex is relaxed about the format. It says a simple system can work, may use existing paperwork such as delivery invoices and checklists, and can be electronic. It asks that monitoring records be signed or initialled by the person who did the check and show the result and the time. For a kitchen that means a name and a clock time next to every reading.

Verification is the part kitchens skip. Codex says it should be carried out by someone other than the person who monitors and handles corrective actions. Its examples map well to a restaurant:

• review the monitoring records to confirm the CCPs are staying under control;
• review corrective actions, including what happened to the product and why;
• calibrate or check the accuracy of the thermometers;
• watch the steps being done as the plan describes them;
• review the whole plan periodically and whenever something changes.

Codex sets no fixed frequency, only "sufficient" to show the system works. Weekly, by the GM or an area manager, is a sensible start, and a missed limit that repeats three weeks running is a signal that the limit or the method is wrong, not the cook. The compliance guide covers the self-audit that feeds this review.

Where Restaurant Codex fits

Restaurant Codex runs the monitoring and record half of a plan you have already written. In Operations, a cooling check or a hot-hold probe becomes a scheduled task with a photo the app requires, the assignee gets a push when it's due and when it's overdue, and the location's managers get an alert about an hour late. The plan and its SOPs live in the Knowledge Base, next to the recipes, and Training adds a manager's practical sign-off at the station.

It doesn't choose your critical control points, set or validate your limits, or do the verification for you. Those need a person who knows the menu, and verification, under the Codex Alimentarius principles, by someone other than the cook doing the monitoring. Someone also still has to calibrate the thermometers.