HACCP Plan for a Restaurant: Write One Your Kitchen Actually Follows

What a restaurant HACCP plan must cover, in kitchen terms

A restaurant HACCP plan is a written food safety system. It maps how food moves through your kitchen, marks the points where a hazard can be controlled, and sets a limit, a check, and a fix for each one. The FDA builds it on seven principles, and every one of them points back to a step your cooks already do.

The seven principles read like a spec for the plan itself:

• Conduct a hazard analysis. List what can make a guest sick at each step.
• Determine the critical control points (CCPs). Find the steps where a cook can stop that hazard.
• Establish critical limits. Set the number that marks safe from unsafe.
• Establish monitoring procedures. Decide who checks, how, and how often.
• Establish corrective actions. Write what happens when a check fails.
• Establish verification procedures. Confirm the plan still works.
• Establish record-keeping. Keep the logs that prove it.

In a kitchen, the same handful of steps carry most of the risk, from receiving cold deliveries and cold holding to cooking, cooling, reheating, and hot holding. The FDA Food Code sets the limits most plans borrow.

• Cold and hot holding. Cold food stays at 41F or below and hot food at 135F or above, so the range between them, 41F to 135F, is the danger zone.
• Reheating. Reheat to 165F within 2 hours.
• Cooling. Cool cooked food from 135F to 70F within 2 hours, then to 41F within 6 hours total.

Confirm these against your local health department before you rely on them, because a city or state can set a stricter rule.

Why HACCP plans get written once and never run

Most HACCP plans fail for one reason: nobody runs them.

• Filed in a binder. The plan gets written for the inspector, printed, and filed in a binder by the office door. Service starts, and the kitchen runs on habit instead of the plan.
• Manual records. The records are usually where it breaks first. One single-site operator put a full-time person on manual batch and lot tracking just to hold food-safety certification, and it still did not scale.
• No time mid-service. When a check means finding the binder, a pen, and a spare minute mid-service, it does not happen.

A plan runs when each check is short, owned by a role, and done in the same place every shift. The rest of this guide turns the plan into that.

Turn each critical control point into a daily check someone completes

A plan runs when every control point becomes a line someone works through, not a paragraph someone reads. For each control point, write four things.

• What. The limit.
• Who. Who checks it.
• When. How often.
• Proof. The reading they record.

Put them in one place your team sees every shift.

The table below is the whole template. Copy it, fill the limits for your own menu, and print it for the pass. Confirm each limit with your local health authority before you rely on it; they set the floor and a city can go stricter.

Build the next step into the check itself. A reading that is only pass or fail tells a cook nothing to do.

Tie each limit to its first action. If the walk-in reads 46F against a 41F limit, check the temperature of the food inside before you move anything, because the air warms faster than the product.

What to record when a check fails, and the next step to take

A failed check is the one that matters most, so record it in full. Write the exact reading, not a tick that says it passed. "Walk-in 46F at 2pm" tells the next shift and the inspector what happened; a checkmark hides it.

For every failure, log four things.

• What. The reading.
• When. The time.
• Action. The action you took.
• Who. Who did it.

That log is your corrective action, and it is what verification and an auditor look for.

Allergens sit inside this same records problem. A guest's allergy question needs an answer that matches what is in the dish today, not last month's recipe. The US now lists 9 major allergens after sesame joined in 2023, and every one has to be right.

• Ingredient-level tags. Supy carries allergen tags at the ingredient level and cascades them into every recipe that uses the ingredient, so one change updates the whole menu.
• One-click allergen matrix. You can export a one-click allergen matrix as a PDF, aligned to FDA, FSA and SFDA standards, as one audit-ready document. See how the same records work in recipe management.

Batch and lot tracking is the other record an auditor asks for. Supy's batch production tracking ties what you made to the ingredients that went into it, so a recall or a trace starts from a record instead of a memory.

Run one HACCP plan across several sites without it drifting

Give 6 kitchens one plan and each keeps its own binder, so one site's version stops matching the next within weeks. The floor is the same, but the extras are not.

• Temperature checks. One group checks temperatures on a fixed schedule.
• Container labels. Another labels every container with a date and time.
• Internal standard. A third runs its own internal standard where no regulator inspects at all.

Write the shared limits once, then let each site add its local rule as a named extra, not a rewrite.

Records are what make or break the multi-site version. When each kitchen keeps its logs on paper, head office cannot see today's compliance without visiting the site. Keep the records where a group reads them from one place.

• Allergens. The allergen matrix as one document across every location.
• Batches. Batch tracking recorded the same way in every kitchen.
• Counts. Counts and controls that work per site.

The same pattern runs the counts in stock count controls across sites, and restaurant inventory management holds the records behind it.

Supy's live cross-outlet sync means an ingredient or allergen change made once reaches every site's recipes, so the record a manager pulls in one kitchen matches the one next door.

Start this week with one page, not the whole binder. Pick the four or five control points your menu actually runs on, assign each check to a role, and write the first action for a failed reading before you print anything. A plan that fits on a clipboard and names who does what will outrun a perfect one nobody opens.