The HACCP plan for restaurants

What is a HACCP plan?

A HACCP plan is a written document for one food process that names every step, marks the steps where a hazard has to be controlled, sets a measurable limit at each of those steps, and says who checks it, how often, what they do when it fails, and which records prove it. In a restaurant you write one for a specific process, like sous vide short rib or vacuum-packed raw beef, and you give it to your health department before you start.

The FDA Food Code defines it in one sentence:

FDA Food Code 2022, 1-201.10(B)

"HACCP plan" means a written document that delineates the formal procedures for following the HAZARD Analysis and CRITICAL CONTROL POINT principles developed by The National Advisory Committee on Microbiological Criteria for Foods.

What is HACCP, in one paragraph

HACCP stands for Hazard Analysis and Critical Control Point. It is a way of running food safety that stops guessing at the end and controls the risky steps as they happen. Instead of hoping the short rib is safe because it looks right, you find the few points where safety is won or lost (cooking, cooling, cold holding), give each a number you can measure with a probe and a clock, and write down every check. The seven principles behind it come from the National Advisory Committee on Microbiological Criteria for Foods (NACMCF). We walk through all seven on one dish in the 7 principles of HACCP, on one short rib.

A HACCP plan is not your whole food safety program. Handwashing, cleaning, pest control and employee health sit underneath it as everyday procedures. The plan covers the process that carries extra risk.

What is the first step in developing a HACCP plan?

In practice, a restaurant cannot analyze hazards in the abstract. So the hazard analysis starts with two concrete moves:

1. Name the item and the process. Not "beef dishes". Write "bone-in short rib, seasoned, sealed in a barrier bag, cooked sous vide on the 72-hour recipe, cooled in the bag, held cold, seared to order".
2. Draw its flow from the back door to the plate. Receive, store, prep, bag, cook, cool, hold, finish, serve. Then stand in the kitchen and check that the drawing matches what your cooks actually do.

With the flow on paper, the hazards are easy to see. For the short rib, the Food Code itself names the big one. Its explanation of 3-502.12 says cook-chill and sous vide

FDA Food Code 2022, Annex 3, 3-502.12

both depend on time/temperature alone as the only barrier to pathogenic growth.

The same passage goes on to name what has to be monitored: cooking, cooling and cold storage. That tells you the critical control points before you open a decision tree. Everything else in this guide follows from it.

When is a HACCP plan required?

Under the FDA Food Code 2022, section 8-201.13 sets two triggers. The first covers anything that needs a variance:

FDA Food Code 2022, 8-201.13(A)

Before engaging in an activity that requires a HACCP PLAN, a PERMIT applicant or PERMIT HOLDER shall submit to the REGULATORY AUTHORITY for approval a properly prepared HACCP PLAN as specified under § 8-201.14 and the relevant provisions of this Code if:

The list that follows names three cases: a plan is required by law (A)(1); a variance is required under 3-401.11(D)(4), 3-502.11 or 4-204.110(B) (A)(2); or your regulatory authority decides a method needs a variance (A)(3). The second trigger covers vacuum packing, sous vide and cook-chill done the standard way, without a variance:

FDA Food Code 2022, 8-201.13(B)

Before engaging in REDUCED OXYGEN PACKAGING without a VARIANCE as specified under § 3-502.12, a PERMIT applicant or PERMIT HOLDER shall submit a properly prepared HACCP PLAN to the REGULATORY AUTHORITY.

Here is what that means for the processes restaurants actually run.

Two cautions. First, your state may run an older Food Code edition or its own code, and the paragraph letters can differ; see your state's page or FDA's adoption list. Second, (A)(3) lets your regulatory authority ask for a plan for anything it decides is risky. When in doubt, ask them, or run the free checker first. For the detail on each process, read the guides for sous vide and cook-chill, vacuum packing, sushi rice, curing and smoking.

What goes in a HACCP plan: 8-201.14, part by part

Section 8-201.14 is the table of contents for every restaurant HACCP plan. It opens like this:

FDA Food Code 2022, 8-201.14

For a food establishment that is required under § 8-201.13 to have a HACCP PLAN, the PERMIT applicant or PERMIT HOLDER shall submit to the REGULATORY AUTHORITY a properly prepared HACCP PLAN that includes:

Then come seven parts, (A) to (G). A note for sous vide and cook-chill: 3-502.12(D)(1) only names two of them.

FDA Food Code 2022, 3-502.12(D)(1)

Provide to the REGULATORY AUTHORITY prior to implementation, a HACCP PLAN that contains the information as specified under ¶¶ 8-201.14 (C) and (D);

Health department forms often follow the full (A) to (G) layout, and (G) lets them ask for anything else. Writing all seven parts costs you little and saves a round of comments. Below, each part is built out on one real dish, the 72-hour short rib: bone-in, sealed raw, cooked sous vide, cooled in the bag and held cold for service.

(A) General information

FDA Food Code 2022, 8-201.14(A)

General information such as the name of the PERMIT applicant or PERMIT HOLDER, the FOOD ESTABLISHMENT address, and contact information;

The cover page. Legal business name, the permit holder, the street address of the kitchen that runs the process, your permit number, and a contact with a phone and email who can answer the reviewer's questions. Add the name of the person in charge of the process day to day. If you run two locations, each gets its own plan with its own address and equipment.

(B) The foods the plan controls

FDA Food Code 2022, 8-201.14(B)

A categorization of the types of TIME/TEMPERATURE CONTROL FOR SAFETY FOODS that are to be controlled under the HACCP PLAN;

Group the items by how they are made, not by menu section. For our kitchen: raw beef, whole intact cuts, sealed raw in barrier bags, cooked sous vide, cooled and held in the sealed bag. The short rib is the item. If you later add beef cheek done the same way, it joins this category; a sous vide egg or a cook-chill soup would be its own category with its own flow.

(C) The flow diagram

FDA Food Code 2022, 8-201.14(C)

A flow diagram or chart for each specific FOOD or category type that identifies:

Then (C)(1) each step in the process, and (C)(2) the steps that are critical control points. Here is the short rib:

Draw it from what your cooks actually do, not from a textbook. If the bags wait on the pass before they go in the bath, that is a step. A reviewer who visits will compare this drawing with your line. More examples on HACCP flow charts.

(D) Recipe, equipment and procedural controls

FDA Food Code 2022, 8-201.14(D)

The ingredients, recipes or formulations, materials and equipment used in the preparation of each specific FOOD or category type and methods and procedural control measures that address the FOOD safety concerns involved;

For the short rib this part is concrete and short:

• Ingredients and recipe: bone-in beef short rib, kosher salt, black pepper, garlic, thyme. Seasoned, sealed raw, cooked in the bath, cooled in the bag, held, seared to order.
• Materials and equipment: oxygen-barrier vacuum bags, a chamber vacuum sealer, an immersion circulator in a lidded tub, an ice bath or blast chiller, a walk-in or reach-in with a continuous time and temperature recorder, a calibrated probe thermometer and closed-cell foam tape for probing bags.
• Procedural controls: no bare-hand contact with the cooked meat (3-301.11(B)); raw prep in a separate area or at a separate time from ready-to-eat food; only trained staff use the sealer; the sealer chamber, boards and tubs are cleaned and sanitized after each batch. Sous vide plans pull these in from 3-502.12(B)(5) and (B)(6) by way of 3-502.12(D)(4).

The cook step deserves one sentence of care. The plan does not invent a cook temperature. It states the time and temperature your short rib actually reaches from the whole meat roast chart in 3-401.11(B)(1). One row of that chart:

Your bath setting and cook time sit above a row of that chart, and the plan names the row. The plan treats a short rib slab as a whole, intact beef cut under 3-401.11(B); if your reviewer reads it differently, settle that before you submit. Cooking below the chart is a different process that needs a variance under 3-401.11(D)(4), covered below.

(E) The critical control points summary

FDA Food Code 2022, 8-201.14(E)

A CRITICAL CONTROL POINTS summary for each specific FOOD or category type that clearly identifies:

This is the heart of the plan, and the part reviewers read first. For each CCP it lists seven things: (1) the CCP, (2) its significant hazards, (3) its critical limits, (4) how and how often a designated food employee or the person in charge monitors it, (5) what they do when a limit is missed, (6) how and how often the person in charge verifies that monitoring is happening, and (7) the records that prove the plan is working. Here it is for the short rib:

Two choices in that table deserve a note. The plan uses storage option (i), 34°F and up to 30 days, because this kitchen has a unit that holds 34°F. Without one, choose option (ii) instead: 41°F or less, used within 7 days. The sous vide guide compares all four options. And the cooling fix comes from FDA's own inspection guidance:

FDA Food Code 2022, Annex 5, section 7 (Assessing Cooling)

Cooked hot food may be reheated to 165 ºF for 15 seconds and the cooling process started again using a different cooling method if the food is:

Print the matching logs from our free cooking log, cooling log, cold holding log and corrective action log, or run them on a phone in ClearHACCP logs.

(F) Supporting documents

FDA Food Code 2022, 8-201.14(F)

Supporting documents such as:

• (F)(1) Training plan. Who runs the sealer, the circulator and the cooling; what they are trained on (the three CCPs, the logs, the corrective actions); how a new cook is signed off; how often everyone is refreshed. For the short rib, that is the sous chef and two line cooks, trained by the chef, signed off on a training record.
• (F)(2) Blank copies of every form. The cooking, cooling, cold holding, corrective action, thermometer calibration and verification logs, exactly as your cooks will fill them in.
• (F)(3) Scientific data, if asked. Not needed for a short rib cooked to the roast chart. Needed when you go outside the Food Code, for example cooking below the chart, where 3-401.11(D)(4)(b) asks for data showing the lower regimen is safe.

(G) Anything else your regulatory authority asks for

FDA Food Code 2022, 8-201.14(G)

Any other information required by the REGULATORY AUTHORITY.

This is where local practice lives. Depending on your health department, that can mean a sample bag label, the spec sheets for your sealer and chiller, a sketch of the prep area, your cleaning procedures, or their own application form and fee. Ask for their checklist before you write. Our sample short rib plan shows a complete plan in this order, and the examples hub has plans for other processes.

The variance request (8-103.11)

Some processes need a variance before the plan matters: written permission from your regulatory authority to do something the Food Code does not otherwise allow. Section 8-103.10 says the regulatory authority may grant one if, in its opinion, no health hazard or nuisance will result. The request itself has three parts under 8-103.11:

1. (A) A statement of the proposed variance, citing the Code sections you want modified or waived. Example: "We request a variance from 3-502.11(B) to cure pork belly for bacon on site."
2. (B) The rationale. How you will control the hazards that section protects against by other means:

   FDA Food Code 2022, 8-103.11(B)

   An analysis of the rationale for how the potential public health HAZARDS and nuisances addressed by the relevant Code sections will be alternatively addressed by the proposal;

3. (C) The HACCP plan, when 8-201.13(A) requires one, with the 8-201.14 information that is relevant to the variance.

Our short rib needs no variance: sous vide cooked to the Food Code temperatures and held under one of the 3-502.12(D) storage options needs only the plan. It would need one if the chef wanted to cook below the lowest row of the roast chart. That is 3-401.11(D)(4), and it asks for a plan with scientific data showing the lower time and temperature still makes the food safe. Our sous vide chicken guide walks through that case.

Once a variance is granted, 8-103.12 says you keep it at the restaurant, follow the plan it was based on, and keep the monitoring, verification and corrective action records for the regulatory authority to see. We prepare the variance request letter for you to submit; only your regulatory authority can grant it.

What plan reviewers check, and why plans come back

A plan reviewer reads your plan against 8-201.14, against the Food Code edition your state uses, and against their own form. Then they ask one question: does this plan describe a kitchen that can actually do this safely, every day? Every limit should be a number with a unit and a section, every CCP should have a who, a how and a how often, and the equipment and flow should match the kitchen. Some reviewers visit to see it. The gaps that send plans back:

1. Limits in words. "Cool quickly" instead of 135°F to 70°F within 2 hours and 41°F within 6 hours (3-501.14(A)).
2. No storage option, or the wrong shelf life. A sous vide plan has to pick one of the four 3-502.12(D)(2)(e) options and stay inside its days.
3. Cold storage without continuous monitoring. A sous vide unit needs an electronic system that records time and temperature continuously and is checked twice a day (3-502.12(D)(2)(f)).
4. Corrective actions that stop at "notify the manager". The plan has to say reheat, re-cool, move or discard, and when.
5. No verification. Someone other than the cook who logged it reviews the logs and checks the thermometer.
6. A flow diagram per menu instead of per item or category. (C) asks for each specific food or category type.
7. Missing blank logs or training plan. (F)(1) and (F)(2) are not optional extras.
8. Unlabeled bags. Sous vide bags carry the product name and the date packaged (3-502.12(D)(2)(h)).
9. The wrong edition. Sections quoted from a Food Code your state has not adopted.

How to submit a HACCP plan

1. Find who reviews plans. Usually your city or county health department, sometimes the state. Our state pages and FDA's adoption list show who runs which Food Code edition.
2. Ask for their form, checklist and fee. Fees vary widely. One public example: Hennepin County, Minnesota lists $417 for an initial HACCP review plus $209 a year (checked 2026-10-08).
3. Build the plan in (A) to (G) order, with blank logs, the training plan, a sample label and any equipment sheets they ask for.
4. Sign it. The permit holder submits it. You sign because you run the kitchen.
5. Submit before you start, and wait for their written answer. 8-201.13 says "before engaging in" the activity.
6. Keep the accepted plan on site, with any variance, where an inspector can see it.
7. Run the logs from day one, and update the plan before you change the recipe, the equipment or the storage option.

If your health department asks for changes to a ClearHACCP plan, send us their written comments. We revise within 2 business days, free, as many rounds as it takes for 12 months. They decide; you sign; we do the rewriting.

How long to keep HACCP records

For sous vide and cook-chill, the Food Code is specific: keep the records that confirm cooling and cold holding, make them available to your regulatory authority on request, and

FDA Food Code 2022, 3-502.12(D)(3)(b)

Hold such records for at least 6 months

For any process run under a variance or a required HACCP plan, 8-103.12(C) adds that you keep and provide on request the records showing that monitoring, verification and corrective actions are routinely done. The Food Code does not set one retention period for every process, and states and counties can set longer ones, so check yours.

Practical rule for the short rib: keep the cooking, cooling, cold holding, corrective action, calibration and verification logs for at least 6 months, and the continuous temperature record from the unit with them. Paper works if it is complete and legible. On ClearHACCP the logs live on the phone, flag a missed limit as it happens, and stay exportable free for as long as your account exists.

Frequently asked questions

Keep reading