HACCP (Hazard Analysis and Critical Control Points) is a systematic way to identify food-safety hazards and control them at key steps. Most restaurants use active managerial control day to day, while certain specialized processes require a written HACCP plan and sometimes a variance. These answers explain how plans work and when inspectors expect them. Requirements, variances, and enforcement vary by state and local jurisdiction.
HACCP stands for Hazard Analysis and Critical Control Points. It is a preventive food-safety system that identifies where biological, chemical, or physical hazards can enter the food process and builds controls at the critical steps to prevent, eliminate, or reduce them to safe levels. Rather than relying only on finished-product testing, HACCP manages risk throughout receiving, storage, prep, cooking, cooling, and service. It originated in food manufacturing and is now widely used across food service. In restaurants it underlies inspection concepts even when a full written plan is not required. Specific requirements vary by jurisdiction.
A HACCP plan is a written document that maps a specific food process, identifies the hazards at each step, and defines how they will be controlled, monitored, and corrected. Its purpose is to make food safety proactive and consistent: staff know exactly what temperatures, times, and checks keep a product safe, and there is a record proving it. Plans are required for certain higher-risk processes and are a strong practice for any complex operation. They also demonstrate active managerial control to inspectors. What must be in a plan, and when it is required, varies by jurisdiction.
The seven principles are: (1) conduct a hazard analysis; (2) determine the critical control points (CCPs); (3) establish critical limits for each CCP; (4) establish monitoring procedures; (5) establish corrective actions when a limit is not met; (6) establish verification procedures to confirm the system works; and (7) establish record-keeping and documentation. Together they create a full loop, identify risks, control them, watch them, fix problems, prove it works, and document everything. These principles form the backbone of any HACCP plan. How they are applied and documented can vary by jurisdiction and process.
HACCP addresses three hazard categories: biological (bacteria, viruses, parasites, and fungi such as Salmonella, E. coli, and Norovirus), chemical (cleaning agents, sanitizers, pesticides, allergens, and toxins), and physical (foreign objects like glass, metal, plastic, or bone). The hazard analysis step examines each process point for these risks and rates their likelihood and severity. Controls are then placed where they matter most. Allergens are increasingly emphasized as a chemical hazard. Understanding all three categories is essential to a complete plan. The specific hazards prioritized can vary by operation and jurisdiction.
A critical control point is a step in the food process where a control can be applied to prevent, eliminate, or reduce a hazard to a safe level, and where losing control would create a real safety risk. Classic CCPs include cooking (to kill pathogens), cooling (to limit growth), and hot or cold holding. Not every step is a CCP, only those essential for safety with no later step to correct the hazard. Identifying the right CCPs is the heart of a HACCP plan. Which steps qualify depends on the process and can vary by jurisdiction.
A critical limit is the measurable boundary that must be met at a critical control point to keep food safe, for example, cooking poultry to an internal temperature of 165 degrees F, cooling food from 135 to 70 degrees F within two hours, or holding cold food at 41 degrees F or below. Limits are usually based on temperature, time, pH, or water activity and come from the food code or scientific standards. Staff monitor each CCP against its critical limit and act if it is not met. Exact limits vary by food and jurisdiction.
Monitoring is the planned, ongoing observation or measurement at each critical control point to confirm the critical limit is being met, for example, checking and logging cooking temperatures, cooling times, or holding temperatures at set intervals. It specifies what is measured, how, how often, and by whom. Monitoring catches problems as they happen so corrective action can be taken before unsafe food reaches customers, and the records prove control. Consistent monitoring, not occasional spot-checks, is what makes the system work. The required frequency and documentation vary by jurisdiction and process.
Corrective actions are the predetermined steps staff take when monitoring shows a critical limit was not met, for instance, continuing to cook food that did not reach its required temperature, discarding food that cooled too slowly, or adjusting equipment. A good plan spells out both what to do with the affected food and how to fix the underlying cause so it does not recur. Corrective actions must be documented. Having them decided in advance means staff respond correctly under pressure instead of improvising. The specific required actions vary by hazard and jurisdiction.
Validation is confirming, before or when a plan is set up, that the controls chosen will actually make the food safe (the science supports it). Verification is the ongoing confirmation that the plan is being followed and working, through activities like reviewing records, calibrating thermometers, testing, and periodic checks. In short, validation asks does this plan work in principle, and verification asks are we following it and is it still working. Both are HACCP principles that keep a plan credible. How they are performed and documented can vary by jurisdiction and process.
A HACCP plan requires documentation of the hazard analysis, the identified CCPs and their critical limits, monitoring records (temperature and time logs), corrective-action records, verification activities, and supporting information like standard operating procedures and calibration logs. Records prove the system is being followed and are the first thing an inspector reviewing a plan will ask for. Keep them accurate, dated, and available for the required retention period. Good records also help you spot trends and improve. The exact records and how long to keep them vary by state and local jurisdiction.
Most restaurants are not required to keep a full written HACCP plan for everyday cooking; instead they use active managerial control. A written plan (and often a variance) is typically required for specialized, higher-risk processes such as reduced-oxygen packaging (ROP) including sous vide, smoking or curing food for preservation, using food additives or acidification to preserve food (like acidifying sushi rice), sprouting seeds, or offering live shellfish tanks. If you do one of these, the health department usually requires a HACCP plan. What triggers a plan varies by state and local jurisdiction.
No. Standard restaurant operations generally rely on active managerial control, systems, training, and monitoring built around the food code, rather than a formal written HACCP plan. A full plan is reserved for specialized processes that carry higher risk, such as reduced-oxygen packaging, curing, smoking for preservation, or acidifying sushi rice. That said, HACCP principles are valuable for any operation, and some operators write voluntary plans for complex menus. Check with your health department about which of your processes, if any, require a plan. Requirements vary by state and local jurisdiction.
A variance is written approval from the regulatory authority to deviate from a specific code requirement, granted when you can show the alternative method is still safe, usually backed by a HACCP plan. You typically need a variance for specialized processes the code otherwise restricts, such as reduced-oxygen packaging beyond certain limits, smoking or curing for preservation, custom processing of animals, using acidification to make sushi rice, sprouting, or operating a live molluscan shellfish tank. The health department reviews your plan before approving. Which processes require a variance, and the application process, vary by jurisdiction.
Commonly cited processes include reduced-oxygen packaging (ROP) such as vacuum packing and sous vide held beyond short windows, smoking or curing food as a method of preservation, using food additives or acidification to preserve food or lower pH (including acidifying sushi rice at room temperature), sprouting seeds or beans, offering live shellfish from display tanks, and custom-processing animals for personal use. These carry elevated risk (for example, botulism risk with ROP), so the code requires extra controls. Confirm exactly which activities trigger a variance and plan with your local health department, as this varies by jurisdiction.
Active managerial control (AMC) is the broad, ongoing management approach of preventing foodborne-illness risk factors through training, monitoring, standard operating procedures, and daily oversight, applied across the whole operation. HACCP is a more formal, documented system focused on specific processes, with defined CCPs, critical limits, and records. AMC uses HACCP principles but does not always require a written plan; HACCP is the structured tool you apply when a process needs formal control or a variance. Most restaurants demonstrate AMC daily and use full HACCP only for specialized processes. Expectations vary by jurisdiction.
HACCP is a core part of a food safety management system, but a full system is broader. A food safety management system combines HACCP principles with prerequisite programs, good hygiene practices, supplier controls, cleaning and sanitation, pest control, training, and record-keeping, all coordinated to keep food safe. HACCP focuses on identifying and controlling hazards at critical steps; the wider system provides the foundation those controls rest on. In practice, restaurants use active managerial control as their everyday system and apply formal HACCP where required. The exact scope and terminology vary by jurisdiction.
A HACCP plan is a written document controlling hazards in a specific process; food safety certification is a personal credential proving an individual passed an accredited exam, such as a certified food protection manager or a food handler card. One is about the process, the other about the person. Many jurisdictions require at least one certified manager per establishment and, separately, may require a HACCP plan for specialized processes. See food safety certification by state for credential rules. Certification and HACCP-plan requirements are set separately and both vary by jurisdiction.
Yes, where a plan is required, inspectors will ask to see the written HACCP plan and its supporting records, monitoring logs, corrective-action records, and calibration or verification documentation, to confirm you are following it. For specialized processes done under a variance, they check that operations match the approved plan. For general operations, inspectors instead evaluate active managerial control by observing practices and asking the person in charge questions. Having your plan organized and records current makes these reviews smooth. What inspectors require and how closely they review varies by jurisdiction and process.
A standard operating procedure is a written, step-by-step instruction for a specific task, such as cooling soup, cleaning the slicer, calibrating thermometers, or washing produce, so it is done the same safe way every time regardless of who performs it. SOPs support both active managerial control and HACCP by turning good practices into repeatable routines and training tools. They reduce errors, speed training, and give inspectors evidence of control. Keep them accessible and train staff on them. While powerful, SOPs are only effective if actually followed and updated. Their required scope varies by jurisdiction.
The Food Safety Modernization Act (FSMA) mainly targets food manufacturers, processors, and importers, requiring preventive-controls plans similar in spirit to HACCP, rather than restaurants. Retail food service, including most restaurants, is regulated primarily through state and local adoption of the FDA Food Code, not directly by FSMA's preventive-controls rule. So a typical restaurant follows food-code requirements and uses active managerial control, with formal HACCP only for specialized processes. If your operation also manufactures or wholesales packaged food, FSMA rules may apply. Because adoption varies, confirm your obligations with your regulatory authority and jurisdiction.
A prerequisite program is a foundational good-practice program that must be in place for a HACCP plan to work, covering things like personal hygiene, cleaning and sanitizing, pest control, supplier and receiving controls, equipment maintenance, and facility sanitation. HACCP controls the specific hazards at critical steps; prerequisite programs control the general conditions and practices around the whole operation. Without solid prerequisites, a HACCP plan has a weak base. In restaurants these overlap heavily with everyday food-code requirements. The specific programs expected can vary by jurisdiction and by the type of operation.
A flow diagram is a simple, step-by-step map of a food product's path through your operation, from receiving through storage, prep, cooking, cooling, holding, and service. It is created early in building a HACCP plan so the team can analyze hazards at each step and pinpoint the critical control points. The diagram should reflect what actually happens in the kitchen, not an idealized version, and is verified on the floor. It makes the hazard analysis systematic and easy to communicate. The level of detail expected can vary by process and jurisdiction.
Often, yes, for certain steps. Acidifying sushi rice at room temperature to hold it without time or temperature control typically requires a variance and a HACCP plan, and reduced-oxygen packaging of fish or serving certain raw fish may involve parasite-destruction (freezing) records and additional controls. Basic cutting and plating of properly sourced, handled fish may not require a written plan. Because raw-fish operations carry specific risks, many health departments require documentation. Confirm exactly what your menu and processes trigger with your local health department, as requirements vary by jurisdiction.
Usually, yes. Sous vide and other reduced-oxygen packaging (ROP) methods create low-oxygen conditions that can favor dangerous pathogens like Clostridium botulinum and Listeria, so most jurisdictions require a written HACCP plan and often a variance to use them beyond very limited, short-hold situations. The plan must control time, temperature, and other barriers. Operators doing ROP need documented monitoring and corrective actions. Cooking sous vide and serving immediately is treated differently from packaging for storage. Confirm the specific ROP rules and variance requirements with your regulatory authority, since they vary by jurisdiction.
Review a HACCP plan whenever something changes that could affect food safety, a new menu item or process, new equipment, a different supplier, a recipe change, or a problem revealed by monitoring, and on a regular schedule (at least annually is a common practice) even without changes. Verification activities confirm it still works, and the plan is revised as needed. An outdated plan that no longer matches actual operations is a weakness. Keep documentation of reviews. The recommended review frequency and any required reapproval of a variance vary by jurisdiction.
The permit holder, owner, or operator is ultimately responsible for having and following a required HACCP plan, while the person in charge or a designated food-safety manager typically develops, maintains, and enforces it day to day, training staff and reviewing records. Every employee shares responsibility by following the procedures and completing monitoring accurately. For plans tied to a variance, the operator must ensure operations stay within the approved plan. Clear ownership keeps the plan active rather than a document on a shelf. Accountability structures can vary by operation and jurisdiction.
Frequent mistakes include writing a plan that does not match what the kitchen actually does, identifying too many or too few critical control points, setting vague critical limits, and, most commonly, monitoring inconsistently or failing to keep records. Others treat the plan as a one-time document and never review or update it after menu, equipment, or supplier changes. Some run specialized processes without the required variance. A plan only protects food if staff are trained on it and it is followed and verified daily. Keep it realistic, current, and documented. What inspectors emphasize can vary by jurisdiction.
Operating a process that requires a variance and HACCP plan, such as reduced-oxygen packaging, curing, smoking for preservation, or acidifying sushi rice, without approval is a violation that can lead to citations, orders to stop the process, discarding affected food, and in serious cases permit action. Inspectors treat unapproved high-risk processes seriously because of the associated hazards. If you want to add such a process, apply for the variance and submit your plan first. Use a health inspection self-audit to catch gaps beforehand. Enforcement steps vary by jurisdiction.