A food safety plan is a written system of policies, procedures and monitoring that an operator uses to proactively control foodborne-illness risk factors. In retail food service it is built on active managerial control of the five CDC risk factors, and it may incorporate HACCP principles for higher-risk processes.
What a food safety plan is (and which kind you need)
"Food safety plan" means slightly different things in two regulatory worlds:
- Retail and food service (restaurants, cafeterias, grocery kitchens): the FDA Food Code promotes a food safety management system built on active managerial control. This is the plan most kitchen operators need.
- Food manufacturing/processing: under the FDA's FSMA Preventive Controls rule (21 CFR Part 117), facilities must have a formal written Food Safety Plan prepared by a Preventive Controls Qualified Individual.
This guide focuses on the retail food safety management system, since that is what health departments evaluate in a commercial kitchen. The underlying goal is identical to HACCP: prevent hazards before they cause illness rather than catch problems after the fact.
Active managerial control and the five CDC risk factors
Active managerial control (AMC) is the FDA's term for management's deliberate, ongoing effort to control the factors most often responsible for foodborne illness — not just reacting when an inspector writes a violation. The FDA Food Code Annex identifies the five CDC-recognized risk factors that a plan must address:
- Food from unsafe sources — approved suppliers only.
- Inadequate cooking — hitting required internal temperatures.
- Improper holding temperatures / time — cold and hot holding, cooling, the danger zone.
- Contaminated equipment — cleaning, sanitizing, preventing cross-contamination.
- Poor personal hygiene — handwashing, glove use, and excluding ill employees.
A good plan names a specific control, a monitoring method, and a corrective action for each of these five areas.
What a written food safety plan contains
There is no single mandatory FDA template for a retail plan, but an effective one typically includes:
- Standard operating procedures (SOPs) for each risk factor — for example, a cooking-temperature SOP, a cooling SOP, and a handwashing SOP.
- Monitoring procedures — who checks what, how often, and with what tool (thermometer logs, cooling logs, sanitizer test strips).
- Critical limits or targets — the specific temperatures, times and concentrations that define "safe" (e.g., poultry to 165°F, sanitizer at label ppm).
- Corrective actions — what to do when a limit is missed (reheat, discard, re-cool, re-train).
- Verification and record-keeping — manager review of logs, thermometer calibration records, and training documentation.
- An employee health policy — reportable symptoms and illnesses, and exclusion/restriction rules.
Keep it practical and specific to your menu and equipment. A plan the staff can actually follow beats an exhaustive binder no one opens.
How a food safety plan relates to HACCP
HACCP (Hazard Analysis and Critical Control Points) is the scientific framework a food safety plan draws from. In retail settings, the FDA encourages the voluntary use of HACCP principles — you apply hazard analysis and control-point thinking to your specific processes rather than filing a formal HACCP plan for everything. Its guide Managing Food Safety: A Manual for the Voluntary Use of HACCP Principles for Operators of Food Service and Retail Establishments walks operators through this.
Certain higher-risk processes, however, do require a formal, written HACCP plan and often a variance — for example, reduced-oxygen packaging (ROP), sous-vide, curing, smoking as a method of preservation, or sprouting seeds. For those, see our dedicated HACCP guide. For everyday cooking, holding and cleaning, active managerial control with strong SOPs is the expected standard.
Building and maintaining your plan
Practical steps to stand up a plan:
- Map your menu's flow of food — receiving, storage, prep, cook, hold, cool, reheat, serve — and note where each risk factor appears.
- Write short SOPs for the highest-risk steps first (cooking temps, cooling, handwashing, sanitizing).
- Create simple logs and train staff to complete them in real time.
- Assign a manager to review logs daily and act on deviations.
- Review and update whenever the menu, equipment, or staff change, and after any inspection finding.
A plan is a living system. The record-keeping isn't paperwork for its own sake — it's the evidence that your controls are working, and it's what a health inspector will ask to see.
Frequently asked
Is a written food safety plan legally required for a restaurant?
It depends on your jurisdiction and processes. The FDA Food Code strongly promotes active managerial control and food safety management systems, and many health departments expect written SOPs. A formal written HACCP plan is required for specific higher-risk processes like reduced-oxygen packaging, curing or sous-vide, usually with a variance.
What is active managerial control?
Active managerial control is management taking purposeful, ongoing steps to prevent foodborne illness by controlling the five CDC risk factors — unsafe sources, undercooking, improper holding, contaminated equipment, and poor hygiene. It emphasizes proactive systems (SOPs, monitoring, corrective actions) over simply reacting to inspection violations.
What are the five CDC risk factors?
They are the practices most often linked to foodborne illness: food from unsafe sources, inadequate cooking, improper holding temperatures and time, contaminated equipment or cross-contamination, and poor personal hygiene. A retail food safety plan should have a specific control and monitoring step for each one.
What's the difference between a food safety plan and a HACCP plan?
A retail food safety plan is a broad management system built on active managerial control and voluntary HACCP principles. A formal HACCP plan is a specific, documented set of critical control points required for defined higher-risk processes (ROP, sous-vide, curing, smoking for preservation), often needing a variance from the health authority.
Do I need a food safety plan under FSMA?
FSMA's Preventive Controls rule (21 CFR Part 117) requires a formal written Food Safety Plan for many food manufacturing and processing facilities, prepared by a Preventive Controls Qualified Individual. Most restaurants and retail food establishments are regulated under the Food Code instead and follow a food safety management system rather than the FSMA plan.