The sushi rice HACCP plan

Why cooked rice is time/temperature control for safety food

Dry rice is shelf stable. Cooked rice is not. The Food Code's definition of time/temperature control for safety (TCS) food includes any plant food that has been heat-treated, and a pot of cooked rice is exactly that.

FDA Food Code 2022, 1-201.10(B), Time/temperature control for safety food (2)(a)

An animal FOOD that is raw or heat-treated; a plant FOOD that is heat-treated or consists of raw seed sprouts, cut melons, cut leafy greens, cut tomatoes or mixtures of cut tomatoes

The organism behind it is Bacillus cereus. Its spores live on raw rice and survive cooking. The cook even wakes them up. Leave the rice warm on the counter and they grow and make toxin that reheating does not destroy.

FDA Food Code 2022, Annex 3, public health reasons for 3-501.19

Food cooked according to Food Code guidelines should be free of vegetative cells. However, the heat requirements are not sufficient to kill spores of C. perfringens or B. cereus and may actually serve as a heat shock that activates the spores. B. cereus is found commonly in outbreaks attributed to inadequate hot holding of starchy foods like rice, and has been isolated in a multitude of food products.

A normal TCS food stays hot (at 135°F or above) or cold (at 41°F or below). Sushi rice can do neither and still be sushi rice: hot rice wrecks the fish, cold rice goes hard. So kitchens need another control.

Two legal ways to hold sushi rice at room temperature

Route 1 starts with this line of 3-502.11. Using vinegar to make a food non-TCS is one of the activities that needs a variance before you do it:

FDA Food Code 2022, 3-502.11(C)

Using FOOD ADDITIVES or adding components such as vinegar:

FDA Food Code 2022, 3-502.11(C)(2)

To render a FOOD so that it is not TIME/TEMPERATURE CONTROL OF SAFETY FOOD

And because a variance is required under 3-502.11, 8-201.13(A)(2) requires a HACCP plan with it. Annex 3 says so in plain words, and adds that it does not matter whether the vinegar is for preservation or for making the food non-TCS:

FDA Food Code 2022, Annex 3, public health reasons for 1-201.10(B)

If a facility adjusts the pH of a food using vinegar, lemon juice, or citric acid for purposes other than flavor enhancement, a variance is required under ¶ 3-502.11(C). A HACCP plan is required whether the food is a TCS food as in subparagraph 3-502.11 (C)(1) or not a TCS food, as in subparagraph 3-502.11(C)(2).

What does not need a variance: vinegar for flavor, on rice you keep under temperature control or under Time as a Public Health Control. The variance is about relying on the acid for safety.

Table B: where the pH line comes from

The TCS definition in 1-201.10(B) has two tables that decide whether a food's pH and water activity (aw) make it safe without temperature control. First, which table applies to rice:

FDA Food Code 2022, Annex 3, 1-201.10(B) decision tree instructions

Use Table A for foods that are heat-treated and packaged OR use Table B for foods that are not heat-treated or heat-treated but not packaged.

Cooked rice is heat-treated but not packaged, so it is Table B. Here it is, cell for cell:

Read it like this. Seasoned sushi rice is moist, so unless a lab has measured its water activity lower, it sits in the bottom row (aw above 0.92). In that row only one cell is non-TCS: pH below 4.2. From 4.2 to 4.6 the answer is PA, product assessment, which means a lab challenge study on your recipe. Above 4.6, also PA.

FDA Food Code 2022, 1-201.10(B), Table B

** PA means Product Assessment required

That is why sushi rice plans use pH below 4.2, not the 4.6 you may have seen elsewhere. Annex 4 of the Food Code names it directly as the example critical limit for this process:

FDA Food Code 2022, Annex 4, Principle #3: Establish Critical Limits

The critical limit for the acidification of sushi rice, a pH of <4.2, sets the maximum limit for pH necessary to control the growth of spore- and toxin-forming bacteria.

The variance and the HACCP plan

A variance request under 8-103.11 has three parts: what you want to do and which code sections it touches, why it is safe, and the HACCP plan. For sushi rice, Annex 3 tells you what "why it is safe" should look like:

FDA Food Code 2022, Annex 3, public health reasons for 1-201.10(B)

A standardized recipe validated by lab testing for pH and aw would be an appropriate part of the variance request with annual (or other frequency as specified by the regulatory authority) samples tested to verify compliance with the conditions of the variance.

In practice the package your health department sees has:

• A standard recipe. Rice, water and seasoning by weight, cook method, mixing method, batch size. Weighed, not eyeballed, so every batch is the same recipe the lab tested.
• Lab validation. pH (and water activity, as Annex 3 suggests) for that recipe from a food lab, plus the schedule for repeat samples your regulatory authority asks for.
• The CCP. Acidification, with the critical limit pH below 4.2, monitored every batch with a calibrated meter.
• Corrective actions. What happens to a batch that reads at or above the limit, and who decides.
• Holding. How long acidified rice is held and how it is labeled. Your variance sets this; ask for what you actually need for a service.
• Records and training. pH log, calibration log, corrective actions, and who on the bar is trained to test.

Only your regulatory authority grants a variance. Some grant sushi rice variances routinely, some prefer Time as a Public Health Control, and a few do not grant them at all. Ask before you buy a meter.

Measuring pH so the number holds up

The critical limit sits right on the edge of a Table B column. That is why the tool and the method matter as much as the recipe.

Use a meter, not strips

pH strips change color in bands, and you judge the band by eye under kitchen light. Near the limit, the band that means pass and the band that means fail can look almost the same, and seasoned rice can stain the pad. A pH meter with a probe suited to food gives you a number with decimals you can write on the log and compare to 4.2. A plan reviewer can check a logged number. They cannot check a color.

Calibrate with buffers

A pH meter drifts. Before testing, calibrate it with fresh buffer solutions, at least one below your limit and one above it so the reading you care about falls between them, following the meter maker's instructions. Record each calibration on the log. Replace buffers when they expire or look contaminated, rinse the probe between readings, and store it the way the maker says (a dried-out probe reads wrong).

Test every batch, the same way every time

1. Season and mix the batch fully. Vinegar does not spread evenly on its own.
2. Take small amounts from several spots in the batch and combine them.
3. Prepare the sample the way your plan says (usually blended with distilled water), the same way every time, so readings compare.
4. Read once the meter settles. Log batch, time, reading and initials on the pH log.
5. Below 4.2: label the batch and release it. At or above: corrective action.

The meter check is the CCP. The lab test is verification: it proves the recipe works, while your batch tests prove each batch followed it.

Example: the acidified sushi rice CCP

A sushi bar makes several batches of rice a day and wants to hold each batch on the bar for a full service. It has a variance under 3-502.11(C). The plan has one critical control point: the pH test.

The full plan, with recipe sheet layout, training outline and blank logs, is the sushi rice sample plan.

The simpler route: Time as a Public Health Control

Many sushi kitchens skip the variance entirely. Under 3-501.19 you keep treating the rice as TCS food, but you control it with time instead of temperature. No pH meter, no lab, no variance, no HACCP plan.

The 4-hour route

This is the one that fits sushi rice, because the rice comes off the cooker hot.

FDA Food Code 2022, 3-501.19(B)(1)

the FOOD shall have an initial temperature of 5°C (41ºF) or less when removed from cold holding temperature control, or 57°C (135°F) or greater when removed from hot holding temperature control

FDA Food Code 2022, 3-501.19(B)(3)

The FOOD shall be marked or otherwise identified to indicate the time that is 4 hours past the point in time when the FOOD is removed from temperature control

FDA Food Code 2022, 3-501.19(B)(4)

within 4 hours from the point in time when the FOOD is removed from temperature control

FDA Food Code 2022, 3-501.19(B)(5)

The FOOD in unmarked containers or PACKAGES, or marked to exceed a 4-hour limit shall be discarded.

So: the rice leaves the cooker or warmer at 135°F or above, someone writes the discard time (4 hours later) on the container, and anything left at that time goes in the bin. A container with no time on it is discarded too.

The 6-hour route

3-501.19(C) allows up to 6 hours, but the food has to start at 41°F or less and never go above 70°F. Freshly made sushi rice does not start cold, so this route rarely fits.

FDA Food Code 2022, 3-501.19(C)(1)

The FOOD shall have an initial temperature of 5ºC (41ºF) or less when removed from temperature control and the FOOD temperature may not exceed 21ºC (70ºF) within a maximum time period of 6 hours

The written procedures

TPHC is not paperwork-free. The procedures are written before you start and kept on site:

FDA Food Code 2022, 3-501.19(A)(1)

Written procedures shall be prepared in advance, maintained in the FOOD ESTABLISHMENT and made available to the REGULATORY AUTHORITY upon request that specify:

• How you meet each subparagraph. 3-501.19(A)(1)(a) asks for your methods of compliance with (B)(1) to (4), or (C)(1) to (5) for the 6-hour route: how you confirm the starting temperature, how you mark the time, how you make sure it is used or discarded on time.
• Cooling, if it applies. If any food is cooked and refrigerated before time control starts, how you meet the cooling rule:

FDA Food Code 2022, 3-501.19(A)(1)(b)

Methods of compliance with § 3-501.14 for FOOD that is prepared, cooked, and refrigerated before time is used as a public health control.

Write who marks the containers, what the label says, and who checks for expired rice. One page is usually enough. The free checker writes it for you if TPHC is your route.

Variance vs TPHC, side by side

If your batches are used up inside 4 hours anyway, TPHC is almost always the easier answer. The variance earns its keep when rice must sit longer than that.

Common mistakes

• Using the 4.6 number. pH 4.6 is the line in Table A and in the ROP rules. For moist sushi rice, Table B puts the non-TCS line at 4.2.
• Strips on the log. A color match is not a reading. Use a calibrated meter and record the number.
• No calibration record. A reading from an uncalibrated meter proves nothing. Log every calibration.
• Eyeballing the seasoning. The lab validated a recipe. A scoop of vinegar is a different recipe.
• Testing the vinegar mix, not the rice. The limit is for the seasoned rice.
• Acidifying without the variance. Holding acidified rice at room temperature past 4 hours without a variance is the write-up. Until the variance is granted, run TPHC.
• Unmarked containers under TPHC. 3-501.19(B)(5) says they are discarded.

Frequently asked questions

Keep reading