Skip to main content
Print the logs your kitchen needs today — free, no email.Get them
HACCPLAN

Critical control points

Find the steps that actually matter.

Tell Sage what you cook and she will name your control points, with the limit on each.

About five minutes. Every number comes with the rule it came from.

For restaurants, food trucks, carts, cafés, delis, ghost kitchens and caterers in the United States, against the FDA 2026 Food Code.

What makes a control point critical

A control point is any step where you do something about a hazard. A critical control point is narrower: it is a step where, if you get it wrong, nothing later in the process will save you.

Cooking chicken is one. If it leaves the pass undercooked, no amount of careful holding, plating or service undoes that. Wiping down a prep surface is a control — it matters, it belongs in your plan — but it is not critical in this sense, because the cook step behind it is still there.

The distinction is not academic. Critical control points are the ones that need a measured limit, a monitoring routine, a written corrective action and a record. Treating everything as critical produces a plan nobody can follow; treating nothing as critical produces a plan that does not protect anyone.

Most kitchens have four to eight

They come from the food, not from a template. A café serving pastries and coffee has very few. A diner cooking eggs and ground beef to order, cooling soup overnight and holding gravy on a steam table has several.

The usual ones in a restaurant: cooking to a temperature, cooling through the danger zone, hot holding, cold holding, and reheating. Which of those apply is decided entirely by what is on your menu and whether you make food ahead.

A limit without a source is an opinion

Every critical limit in a plan should carry the paragraph it came from. Not because anybody enjoys citations, but because an inspector is entitled to ask where your number came from, and "it was on the template" is not an answer.

The limits Sage works out are drawn from the FDA Food Code and carry their fragment reference into the plan — so 165°F for poultry arrives with §3-401.11 attached to it.

What Sage will not do

She builds plans for restaurants in the United States against the FDA 2026 Food Code. She cannot finish a plan involving a special process — sous vide, reduced-oxygen or vacuum packaging, cook-chill, curing, preservation smoking, acidification including acidified sushi rice, fermentation for safety, sprouting, raw molluscan shellfish, juice HACCP, unpasteurized products or low-acid canned foods. Those are screened early and a yes stops the conversation. Canada is not supported yet. Local authorities can require more than the Food Code, and no regulator has approved, certified or guaranteed any document she produces.

Questions people ask first

What is the difference between a CCP and a prerequisite programme?
A prerequisite programme is the groundwork that makes food safety possible at all — cleaning and sanitizing, handwashing, pest control, approved suppliers. A critical control point is a specific step in making a specific food where a hazard is controlled and a failure cannot be recovered. Both belong in your plan. Only the critical control points need a measured limit, monitoring, corrective action and a record.
How many critical control points should a restaurant have?
There is no right number and padding the list is a mistake. Most restaurants land between four and eight. If your plan claims twenty, somebody has mistaken every good practice for a critical control point, and the staff who have to monitor all twenty will quietly stop.
Is cleaning a critical control point?
Almost never. Cleaning and sanitizing is a prerequisite programme — essential, written down, monitored, but not a step where a specific hazard in a specific food is controlled beyond recovery. The exception people reach for is allergen changeover, which is genuinely a control step, and it belongs in an allergen procedure rather than in the cooking CCPs.
Do I need a thermometer for every control point?
For the temperature ones, yes, and it needs calibrating. Every critical limit above is a number somebody has to measure and write down. Without a probe thermometer there is nothing to record, and a monitoring routine that cannot be performed is worse on paper than no routine at all.

A few minutes of questions beats another article

Answer for a few minutes and look at what comes back. If a special process stops you, you will know inside three minutes and you will not have paid anything.

About five minutes. Every number comes with the rule it came from.

Written by Andrew Langevin. See the documentation for what the app does in full, or the free printable logs if you just need paper tonight.