A HACCP plan is a written food-safety system built on 7 principles: hazard analysis, identifying critical control points, setting critical limits, monitoring, corrective actions, verification, and record-keeping. In retail food service a formal HACCP plan is required for higher-risk processes like reduced-oxygen packaging, sous-vide and curing.
What HACCP is
HACCP — Hazard Analysis and Critical Control Points — is a systematic, science-based method for identifying food-safety hazards and controlling them at the specific points in a process where control matters most. It was developed to prevent hazards proactively rather than rely on finished-product testing. The FDA, USDA and the National Advisory Committee on Microbiological Criteria for Foods (NACMCF) all define HACCP around the same seven principles.
HACCP addresses three hazard types: biological (bacteria, viruses, parasites), chemical (cleaning agents, allergens, toxins), and physical (glass, metal, bone). A plan works through each principle in order.
The 7 HACCP principles
- Conduct a hazard analysis. List the biological, chemical and physical hazards reasonably likely to occur at each step of your process, and identify preventive measures.
- Determine the critical control points (CCPs). A CCP is a step where control can be applied to prevent, eliminate or reduce a hazard to a safe level — for example, the cooking step for poultry.
- Establish critical limits. Set the measurable boundary that must be met at each CCP (e.g., cook poultry to 165°F, or hold at 41°F or below).
- Establish monitoring procedures. Define what you measure, how, how often, and who does it (temperature checks, time logs).
- Establish corrective actions. Decide in advance what happens when a critical limit is not met — reheat, discard, adjust equipment, and dispose of affected product.
- Establish verification procedures. Confirm the plan works: calibrate thermometers, review records, and periodically validate that critical limits actually control the hazard.
- Establish record-keeping and documentation. Keep the monitoring logs, corrective-action records and verification results that prove the system is functioning.
When a retail HACCP plan is required
Most restaurants control everyday hazards through active managerial control and don't file a formal HACCP plan. But the FDA Food Code requires a written HACCP plan — usually paired with a variance — for defined higher-risk operations. Under §3-502.11, an operator must obtain a variance and, per §8-201.13, submit a HACCP plan before conducting a specialized process, including:
- Reduced-oxygen packaging (ROP), including sous-vide and cook-chill — governed by the detailed criteria in §3-502.12.
- Smoking food as a method of preservation (not just for flavor).
- Curing food.
- Using food additives or adding components such as vinegar to render a food non-TCS or to preserve it.
- Custom-processing animals, sprouting seeds/beans, offering live molluscan shellfish from a display tank, or other processes the regulatory authority determines require a plan.
ROP and sous-vide are the ones most food-service operators encounter, because vacuum-sealing changes the oxygen environment and can allow dangerous anaerobic pathogens like Clostridium botulinum to grow if time and temperature aren't tightly controlled.
Identifying critical control points
Not every step is a CCP. A control point is any step where a hazard is controlled; a critical control point is a step where losing control would let a hazard reach an unsafe level with no later step to catch it. Common CCPs in food service include:
- Cooking — the kill step for pathogens (e.g., 165°F for poultry).
- Cooling — passing back through the danger zone (135°F to 41°F within 6 hours).
- Cold and hot holding — 41°F or below, 135°F or above.
- Reheating — 165°F within 2 hours for hot holding.
For each CCP you set a critical limit, monitor it, and log the result. The FDA's HACCP Principles & Application Guidelines and its retail HACCP manual provide decision trees and worked examples for making these determinations.
Frequently asked
What are the 7 principles of HACCP?
They are: (1) conduct a hazard analysis, (2) determine critical control points, (3) establish critical limits, (4) establish monitoring procedures, (5) establish corrective actions, (6) establish verification procedures, and (7) establish record-keeping and documentation. They are applied in order to build and maintain a HACCP plan.
When is a HACCP plan required in a restaurant?
The FDA Food Code requires a written HACCP plan, usually with a variance, for specialized processes: reduced-oxygen packaging (including sous-vide and cook-chill), smoking or curing for preservation, using additives to make food non-TCS, sprouting seeds, custom-processing animals, and similar higher-risk operations defined in §3-502.11 and §8-201.13.
What is a critical control point (CCP)?
A CCP is a step in a food process where a control can be applied to prevent, eliminate, or reduce a food-safety hazard to an acceptable level, and where losing control would leave no later step to fix it. Cooking, cooling, holding, and reheating are common CCPs in food service.
Do I need a HACCP plan for sous-vide?
Yes. Sous-vide is a form of reduced-oxygen packaging, so under FDA Food Code §3-502.11 and §3-502.12 it typically requires a written HACCP plan and a variance from your regulatory authority. The plan must control the risk of anaerobic pathogens like Clostridium botulinum through strict time and temperature limits.
What's the difference between a control point and a critical control point?
A control point is any step where a hazard can be controlled. A critical control point is a step where control is essential — if it fails, the hazard reaches an unsafe level and no later step will catch it. HACCP focuses monitoring and record-keeping on the critical control points.