What is HACCP?

01The short answer

HACCP is a written argument about where your food can hurt somebody.

HACCP stands for Hazard Analysis and Critical Control Points. Codex Alimentarius — the food standards body run jointly by the FAO and WHO — defines it as "a system which identifies, evaluates, and controls hazards which are significant for food safety."

1.Codex Alimentarius Commission, General Principles of Food Hygiene, CAC/RCP 1-1969 Rev. 4 (2003), Annex on the HACCP System.

Strip the language away and it is four questions about your own kitchen:

1. Where in this process could somebody get hurt?
2. Which of those steps is the one that actually decides it?
3. What is the number that separates safe from unsafe at that step?
4. Who checks it, how often, and what do they do when it is wrong?

A HACCP plan is the written answer. Not a binder of cleaning schedules, not a staff handbook — the specific document that records the hazards you found, the steps that control them, the numbers, and the records that prove somebody checked.

The reason it reads like an engineering document is that it was one. Pillsbury built the method in the 1960s with NASA, because food for spaceflight could not be tested after the fact — you cannot recall a sandwich from orbit. So they designed the process to be provably safe as it ran, rather than sampled at the end. That is still the whole idea: you are not testing the food, you are controlling the steps.

02Do you actually need one

Most US restaurants are not legally required to have a HACCP plan. This is the part nobody says plainly.

If you run a restaurant, a truck, a café or a deli in the United States, the FDA Food Code does not require you to hold a HACCP plan for ordinary cooking and service. Grilling steaks, holding soup hot, cooling a stock overnight — none of that triggers a plan by itself.

What triggers one is a special process under Food Code § 3-502.11: reduced-oxygen packaging including sous vide and cook-chill, smoking to preserve, curing, acidification including acidified sushi rice, fermenting for safety, sprouting seeds, custom-processing game, or serving live shellfish from a non-approved source. Do one of those and you need a variance from your health authority, and a HACCP plan submitted with it.

1.FDA Food Code 2022, § 3-502.11 Variance Requirement and § 3-502.12 Reduced Oxygen Packaging — Criteria. fda.gov

I should be straight about what that means for this site. If a special process is what brings you here, HACCPlan cannot finish your plan. Sage screens seventeen of them about six questions in and stops the conversation when one comes back yes, because a variance needs a process authority — a named specialist who validates your specific process — and no software can stand in for that. You would be paying us for a document your health department will not accept.

So who has a plan written, if the law mostly does not force it? In practice, six reasons:

1. 1

   A health department asked

   The most common one by a distance. An inspector, a plan reviewer or a new-permit officer asks to see your food safety plan. They are allowed to ask whether or not the Code compels one, and "we do not have anything written down" is a bad answer to give in person.

2. 2

   A permit or licence application

   Plan review for a new build, a change of ownership, or adding a kitchen to an existing space. Many jurisdictions want the written procedures alongside the drawings.

3. 3

   A landlord, commissary or franchise requires it

   Food halls, shared commissary kitchens and franchisors routinely put it in the agreement. It is a contract requirement rather than a legal one, which does not make it optional for you.

4. 4

   Insurance

   Some carriers price on it, some ask for it after a claim.

5. 5

   You failed an inspection

   A written plan is how you show the changes are systematic rather than a promise made on the day.

6. 6

   You decided you should have it written down

   Not a regulatory reason and often the best one. A plan is how the knowledge in the head chef's head survives them leaving.

There is one more thing the Code does require of you, and people mix it up with HACCP constantly: § 2-102.12 says the person in charge must be a Certified Food Protection Manager. That is a person with an exam, not a document about your kitchen. If somebody has told you that you need "HACCP certification", it is worth finding out which of the two they actually mean — they are different things, bought in different places, and neither one is the other.

03The seven principles

The seven principles, in kitchen language.

Codex lays HACCP out as twelve steps. The first five are preparation — get your people together, describe what you make, say who eats it, draw how food moves through the room, then walk the room and check the drawing is true. The remaining seven are the principles everybody quotes.

1. 1

   Do a hazard analysis

   Walk every step from the back door to the pass and ask what could hurt somebody. Codex puts hazards in three buckets: biological (pathogens), chemical (cleaning products, allergens) and physical (glass, metal, bone). The output is not a list of everything that could conceivably go wrong — it is a judgement about which ones are actually likely here, and why.

   Principle 1
2. 2

   Find the critical control points

   A CCP is a step where control is essential — where if you get it wrong, nothing later saves it. Cooking chicken is a CCP, because nothing downstream kills what the cook did not. Wiping the counter matters enormously and is not a CCP; it is a prerequisite programme, sitting underneath.

   Principle 2
3. 3

   Set the critical limits

   The number that separates acceptable from unacceptable. 165 °F for poultry. 41 °F or below in the cold well. Cooled from 135 °F to 70 °F within two hours. A limit with no number is not a limit.

   Principle 3
4. 4

   Decide how it gets monitored

   What gets measured, with what, how often, and by whom. This is the principle that turns a plan into a clipboard. A probe thermometer and a named person beats an intention.

   Principle 4
5. 5

   Write the corrective action before you need it

   What happens when the number is wrong — not in general, but for that step. Chicken at 150 °F goes back on. The cold well at 48 °F means the food in it is assessed and probably discarded, and somebody calls the fridge engineer. Deciding this calmly in advance is the entire point.

   Principle 5
6. 6

   Verify that the system works

   Different from monitoring. Monitoring is the cook checking the chicken; verification is somebody checking that the cook is checking, that the thermometer is calibrated, and that the numbers on the sheet are plausible.

   Principle 6
7. 7

   Keep the records

   The logs, the corrective actions, the calibration. An inspector cannot see last Tuesday. Records are the only evidence that the plan is a description of what you do rather than a description of what you meant to do.

   Principle 7

04What a plan contains

What is actually in the document.

A plan an inspector will accept holds, roughly in this order: a cover sheet with the business, the effective date, a revision history and a signature; who wrote it; what you make and who eats it; a flow diagram of how food moves through the kitchen, confirmed by walking it; the hazard analysis for each step with the reasoning, not just the conclusion; a table of the control points with their limits, monitoring, corrective actions and records; the supporting procedures underneath — cleaning, pest control, receiving, allergen handling, staff illness; the blank records themselves; and a date for when it gets read again.

Two things worth knowing about that list.

It is specific to you or it is worthless. A plan describing a kitchen that is not yours fails the moment an inspector asks why the flow diagram shows a walk-in you do not have. That is the real problem with a downloaded template: not that it is wrong, but that it is about somebody else.

It is not the binder of everything. Small operators often produce two hundred pages with the staff handbook, the cleaning rota and the HACCP plan interleaved. Auditors ask for them to be separated. The supporting programmes sit underneath the plan; they are not the plan.

05What it does not do

Four things a HACCP plan will not do for you.

06What it costs

What people actually pay.

Four routes, and the right one depends on how complicated your kitchen is more than how big it is.

Software sits between the two, and this site sells some, so read the next sentence with that in mind: a generated plan is the right buy when your kitchen is ordinary — cooking, cooling, holding, serving, no special process — and wrong when it is not. We charge once for the finished plan rather than a subscription, and the whole hour of questions is free, so you can find out whether we can help before paying anything. If Sage hits a special process she stops and tells you to go and find a consultant. That is the honest boundary and it is drawn in code.

07Where to start

Start with the question, not the document.

If you are reading this because somebody asked you for a food safety plan, the first useful move is not buying anything. It is one phone call to your local health department asking which document they want to see — a plan, a certified manager, or both — because they answer that question every day and their answer is the only one that is definitive for your address.

If the answer is a plan and your kitchen does no special process, you can have the whole thing written by answering questions about your own kitchen for about an hour. Sage asks, you answer, and the plan builds in front of you — with the limits sourced to the FDA 2026 Food Code rather than invented.

Footnotes

1.Codex Alimentarius Commission, General Principles of Food Hygiene CAC/RCP 1-1969 Rev. 4 (2003) — Annex on the HACCP System and Guidelines for its Application — fao.org

2.NACMCF, HACCP Principles and Application Guidelines, 14 August 1997 — the basis of US regulatory HACCP practice — fda.gov

3.FDA Food Code 2022 — § 3-502.11 variance requirement, § 3-502.12 reduced oxygen packaging, § 2-102.12 certified food protection manager — fda.gov

Andrew Langevin·CFIA-licensed facility, Brantford ON·Published 2026-09-28·9 min read·Wikidata Q139112497