HACCP for Restaurants: The 7 Principles With an Example Plan

HACCP (Hazard Analysis and Critical Control Points) is a preventive food safety system. You identify the biological, chemical and physical hazards in each food process, pick the steps where those hazards must be controlled, set a measurable limit at each one, then monitor, correct and record. In a restaurant, that mostly means controlling time and temperature during cooking, cooling, reheating and holding.

The stakes are well documented. The CDC estimates that about 48 million Americans get sick from foodborne disease each year, with 128,000 hospitalizations and 3,000 deaths, and more than half of US foodborne outbreaks are associated with restaurants, delis, banquet facilities, schools and other food service settings. HACCP is how you stop your kitchen from becoming one of those statistics, and how you prove to an inspector that you did.

What Is HACCP in Food Safety?

HACCP in food safety is a written, science-based method for preventing foodborne illness by controlling hazards at specific points in the process instead of inspecting the finished plate. The FDA describes it as a systematic approach to identifying, evaluating and controlling food safety hazards. It began in food manufacturing; restaurants use the same seven principles, applied to menu processes rather than factory lines.

The difference between HACCP and “being careful” is that every control has a number, a person, a frequency and a record. “Cook the chicken properly” is a hope. “Probe three thighs per batch, 165°F minimum, line cook records it, chef reviews the log at close” is HACCP.

HACCP sits on top of basic programs that keep the whole kitchen clean and orderly, called prerequisite programs (covered below). Without those, a HACCP plan is paperwork.

What Are the 7 Principles of HACCP?

The seven HACCP principles, from the FDA’s HACCP Principles and Application Guidelines, are: conduct a hazard analysis, determine critical control points, establish critical limits, establish monitoring procedures, establish corrective actions, establish verification procedures, and establish record-keeping. Here is what each one means on a restaurant line.

Before applying the principles, the FDA guidelines list five preliminary tasks: assemble a HACCP team, describe the food and how it’s distributed, describe its intended use and consumers, draw a flow diagram of the process, and verify that diagram on the floor. In a restaurant the team is usually the chef, the kitchen manager and whoever owns food safety; the “verify on the floor” step is where you find out that the cooling procedure on paper isn’t what happens at 11 pm.

Hazard Analysis: The Three Hazard Types

Walk your food flow step by step: receiving, storage, prep, cooking, cooling, reheating, holding and service. For each step ask what could go wrong, how likely it is and how bad it would be.

CCPs Versus Control Points

A common mistake in restaurant HACCP plans is naming too many CCPs. A CCP is a step where losing control could make someone sick and nothing later in the process would catch it. Cooking raw chicken is a CCP. Washing lettuce is important, but it’s a control point handled by your standard procedures. A plan with 25 CCPs gets ignored; a plan with four that are actually monitored works.

Monitoring should rely on fast physical measurements (temperature, time, pH) rather than lab tests, because you need the answer before the food leaves the kitchen.

Example HACCP Plan: Roast Chicken Thighs

Here is a complete worked example for one menu item. The FDA’s guidance for food service groups menu items into three processes by how many times the food passes through the temperature danger zone (41°F to 135°F): food with no cook step, food prepared for same-day service, and complex preparation that is cooked, cooled and reheated. Batch-roasted chicken that is hot held for lunch, with leftovers cooled and reheated the next day, is the third and riskiest kind.

Product: Bone-in chicken thighs, roasted in batches of 40, hot held for lunch service; unsold portions are cooled, stored and reheated for the next day’s service.

Flow: Receive → cold store → prep → cook → hot hold → cool → cold store → reheat → hot hold → serve.

Significant hazards: Salmonella and Campylobacter in raw poultry (killed by cooking); spores of Clostridium perfringens and Bacillus cereus that survive cooking and can grow during slow cooling or warm holding.

The other steps are control points handled by standard procedures rather than CCPs. Raw chicken is received at 41°F or below from an approved supplier and rejected otherwise. The walk-in holds 41°F or below and is logged twice a shift. Cooked, cooled chicken gets a date label: ready-to-eat food held under refrigeration for more than 24 hours can be kept up to 7 days at 41°F, counting the day of preparation as day 1. Raw poultry lives on the bottom shelf, below everything else.

The critical limits come from the FDA Food Code (cooking in section 3-401.11, cooling in 3-501.14, reheating in 3-403.11, holding in 3-501.16). Your state may have adopted an older edition, so confirm the numbers with your health department before you print the plan.

Once this one plan works, the others go faster. The FDA’s operator manual for applying HACCP principles makes the point that you don’t need a separate plan for every dish: items in the same process share the same controls, with critical limits specific to each food. Your braised short rib, chili and rice all run through the same cool-and-reheat CCPs as the chicken.

Food Code Temperatures Every Restaurant HACCP Plan Uses

Restaurant critical limits come from the FDA Food Code, not from consumer cooking charts. The USDA’s home-cooking guidance (for example, 160°F for ground beef or 145°F with a 3-minute rest) is written for consumers; health inspectors grade you against the Food Code version your state adopted.

TCS means time/temperature control for safety: foods such as cooked rice, meat, dairy, cut melon and cut leafy greens that need temperature control to stay safe. The danger zone in the Food Code is 41°F to 135°F, which is why both holding limits sit on its edges.

Where Does the HACCP System Begin?

In a restaurant, the HACCP system begins when food is received. The FDA defines the flow of food in retail and food service as the path food follows from receiving through service, so receiving is the first operational step in every restaurant HACCP plan, and the first chance to keep a hazard out of the building rather than control it later.

Upstream of the back door, the control is purchasing: buying only from approved sources, such as inspected plants and suppliers with documented food safety programs. That part of the job is about supplier audit standards and, for many fresh foods, the FDA’s food traceability rule.

For most deliveries, receiving is a control point: check temperature, packaging and source, and reject what fails. For some foods it is effectively a critical control point because no later step can fix the problem. The FDA notes that neither cooking nor reheating destroys scombrotoxin (histamine) or ciguatera toxin in fish, so tuna, mahi mahi or mackerel received warm or from an unapproved source must be rejected at the door. Raw oysters and other shellstock, which are served without a kill step, also depend entirely on source and receiving temperature.

Is HACCP Required for Restaurants?

Most restaurants are not required to have a formal written HACCP plan. Under the FDA Food Code, a plan becomes mandatory when you use certain specialized processes, most of which also need a variance (written approval from the health department) before you start: smoking or curing to preserve food, acidifying food such as sushi rice so it can be held without refrigeration, reduced oxygen packaging, live shellfish tanks, and sprouting seeds or beans.

The variance list is section 3-502.11 of the Food Code, and section 8-201.13 ties a HACCP plan to each of those variances. The Food Code does exempt one narrow case of vacuum packing from the plan requirement: food labeled with its packing date and time, held at 41°F or below, and removed from the package within 48 hours.

Three other points matter. Federal law requires HACCP plans from seafood processors, juice processors and USDA-inspected meat and poultry plants, so a restaurant that starts wholesaling those products can cross into processor rules. Some states and cities go further than the Food Code, so ask your health department what it expects. And the 2026 edition of the FDA Food Code adds a new requirement (section 8-201.15): within four years of a jurisdiction adopting it, food establishments must develop, implement and make available a written food safety management system covering the Code’s risk-factor controls. Establishments the regulator considers minimal risk can be exempted. That system is not a full HACCP plan, and the FDA has left its required contents to be defined later, but a restaurant already running the plan and logs on this page will have most of it written.

Prerequisite Programs: The Foundation Under HACCP

Prerequisite programs are the everyday procedures that keep the whole operation sanitary, so that the HACCP plan only has to deal with the hazards that remain. If handwashing, cleaning and pest control fail, no amount of temperature logging will save you.

• Cleaning and sanitizing schedules for surfaces, equipment and refrigeration
• Employee health and hygiene: handwashing, glove use, an illness reporting and exclusion policy
• Approved suppliers and receiving checks
• Equipment maintenance and thermometer calibration
• Pest management
• Chemical storage and labeling, always below and away from food
• Allergen procedures, from order taking to plating

The USDA’s four food safety steps, clean, separate, cook and chill, are the short version of these programs for staff training. The two that cause the most trouble in restaurants are separation and handwashing. Color-coded cutting boards (red for raw meat, yellow for poultry, blue for seafood, green for produce) make separation visible, and a rule that nobody washes raw chicken in the sink stops a common splash route for Salmonella.

HACCP Monitoring Logs You Can Print

Logs are where HACCP succeeds or fails. Keep each one to a single page, put it where the task happens (the cooling log on the walk-in door, not in the office), and make the corrective-action column impossible to skip.

Food thermometers used for these checks need to be accurate to within 2°F, which is why the calibration log exists. Digital loggers and wireless sensors can replace the refrigeration and cooling logs; they don’t replace a manager reading them. Ask your health department how long it wants records kept, and keep them at least that long.

The Human Factor

Every log above depends on a cook with a thermometer in a hurry. The CDC’s Environmental Health Specialists Network studies show where restaurants slip: about 5% of food workers reported working while vomiting or with diarrhea in the past year; about 1 in 4 did not always wash hands between handling raw meat and ready-to-eat food; over half did not consistently wear gloves when touching ready-to-eat food; and just over half of workers who cooked did not usually use a thermometer. Younger, less experienced workers and staff at independent restaurants showed the largest gaps.

Chains probably do better because they write procedures down and train to them. An independent operator has to build that deliberately:

• Explain the reason behind each limit. A cook who knows what 155°F does to E. coli in a burger probes more reliably than one told to “check the temp.”
• Train on the log itself: hand a new cook the cooling log and walk through a real batch.
• Make illness exclusion workable. If missing a shift means missing rent, sick people come in.
• Repeat it. One onboarding session fades; short refreshers at pre-shift keep it alive.

Certified food protection managers are trained in HACCP principles, and many jurisdictions require at least one on staff; our guide to food safety certification covers the options. The CDC’s outbreak data on what actually makes guests sick is summarized in our CDC foodborne illness prevention guide.

Your HACCP Routine: Daily, Weekly, Monthly

Daily

• Refrigeration and hot-holding temperatures logged
• Every CCP batch probed and recorded
• Cooling logs completed and signed off the next morning
• Date labels checked; expired items discarded
• Sick employees excluded per policy

Weekly

• All thermometers calibrated and logged
• Logs reviewed for gaps, missing initials and repeated deviations
• Deep clean of high-risk areas

Monthly

• Internal walk-through of each process on the flow diagram
• HACCP plan updated for new menu items, equipment or suppliers
• Training records checked
• Pest control reports reviewed

Quarterly

• Refresher training for all kitchen staff
• Plan reviewed against any incidents, complaints or near-misses
• Supplier documentation checked against your approved list

Where to Start

Pick your highest-risk process, usually anything cooked, cooled and reheated, and write the plan for one item using the table above. Run it for two weeks, fix what the logs reveal, then extend the same controls to every item in that process. Same-day items and no-cook items (salads, raw bar, sandwiches) come next. For the regulatory side of food safety, inspections and allergen law, see our food safety compliance guide.