HACCP and food safety plans

The first ten lessons covered many separate controls: receiving temperatures, cold storage, cooking, cooling, reheating, cross-contamination, handwashing, illness reporting, cleaning and allergens. A kitchen that does all of them most of the time still has gaps, because nobody can watch everything during a busy service. HACCP, Hazard Analysis and Critical Control Points, is a way of deciding which few steps matter most for each food, setting clear limits for them, checking them every time and writing down what happens. A food safety plan built on HACCP turns good habits into a system that keeps working when the head chef is on holiday.

This lesson explains the seven HACCP principles, shows how Juniper Street applied them to one of its menu items, describes the food safety plan the law expects of a restaurant in each country, and shows how a new dish is worked into the plan before it goes on the menu.

Where HACCP came from

HACCP was developed in the 1960s by the Pillsbury Company with NASA and the US Army laboratories to make food for astronauts. Testing finished food was not good enough: to be confident that a batch was safe, almost all of it would have had to be tested, and then there would be nothing left to eat. The answer was to control the process instead, by identifying the steps where hazards could be prevented, eliminated or reduced, and controlling those steps every time. The approach was later adopted by the food industry and by regulators around the world, and the Codex Alimentarius Commission, the international food standards body, sets out the principles that both Canada and the United States use.

Large food plants run full HACCP systems with teams, validation studies and detailed records. A restaurant does not need all of that for every dish, but the same thinking works at any scale.

The seven principles

• Conduct a hazard analysis. For each food and each step, list the biological, chemical and physical hazards that are reasonably likely to occur, and decide which ones must be controlled.
• Determine the critical control points. A critical control point (CCP) is a step at which control can be applied and is essential to prevent, eliminate or reduce a hazard to a safe level. In a restaurant the usual CCPs are cooking, cooling, reheating, and hot and cold holding.
• Establish critical limits. Each CCP gets a measurable limit, usually a temperature and a time, that separates safe from unsafe.
• Establish monitoring procedures. Decide who checks each CCP, how, and how often, such as probing every batch at the end of cooking.
• Establish corrective actions. Decide in advance what happens when a limit is missed, so that nobody has to work it out in the middle of service.
• Establish verification procedures. Check that the system is working: review the logs, calibrate thermometers, watch staff take readings, and review the plan when the menu or equipment changes.
• Establish record-keeping. Keep the logs, corrective action records and verification records, so the restaurant can show what it did.

A process flow for one dish

The first practical step is to draw the path a food takes through the kitchen. Juniper's braised chicken thighs, one of its best-selling dishes, are a good example because they go through almost every step a restaurant uses: they are received cold, stored, prepped raw, cooked in the combi oven, cooled in batches, stored again, reheated to order and held on the line during service.

Not every step is a CCP. Receiving and cold storage matter, but they are controlled by Juniper's ordinary procedures from Lesson 5, and a small problem there will still be corrected by cooking. Cooking is a CCP because it is the step that kills Salmonella and Campylobacter; if it fails, nothing later will fix it. Cooling is a CCP because slow cooling lets Clostridium perfringens spores, which survive cooking, grow to dangerous numbers. Reheating and hot holding are CCPs because the cooled chicken must be brought back through the danger zone quickly and kept out of it.

The corrective action column is the one most often left vague, and it is the most important. A cook who finds a batch at 26 °C (78 °F) after two hours of cooling, at the end of a long shift, needs to know exactly what to do without having to decide whether it is probably fine. Writing the answer down in advance takes the pressure off.

Monitoring and records

Juniper's logs are on clipboards at each station, with a column for every CCP reading, the time, the reading, the initials of the person who took it and any corrective action. The program below checks one day of cooking and cooling entries for the chicken thighs against the critical limits, the way Tomás reviews them at the end of each day.

# Review one day of CCP log entries for braised chicken thighs (BC limits).
COOK_MIN = 74      # degrees C
STAGE1 = (60, 20, 120)   # from 60 C to 20 C within 120 minutes
STAGE2 = (4, 360)        # to 4 C within 360 minutes in total

cook_log = [("batch A", [78, 76, 81]), ("batch B", [75, 72, 77])]
cool_log = [
    # (batch, temp at 2 h, temp at 6 h)
    ("batch A", 18, 3),
    ("batch B", 24, None),
]

for batch, probes in cook_log:
    low = min(probes)
    if low >= COOK_MIN:
        print(f"{batch}: cook OK (lowest {low} C)")
    else:
        print(f"{batch}: cook FAILED at {low} C -> keep cooking, re-probe")
for batch, t2, t6 in cool_log:
    if t2 > STAGE1[1]:
        print(f"{batch}: stage 1 FAILED ({t2} C at 2 h) -> reheat to 74 C and restart, or discard")
    elif t6 is None or t6 > STAGE2[0]:
        print(f"{batch}: stage 2 not met -> discard")
    else:
        print(f"{batch}: cooling OK ({t2} C at 2 h, {t6} C at 6 h)")

batch A: cook OK (lowest 76 C)
batch B: cook FAILED at 72 C -> keep cooking, re-probe
batch A: cooling OK (18 C at 2 h, 3 C at 6 h)
batch B: stage 1 FAILED (24 C at 2 h) -> reheat to 74 C and restart, or discard

Batch B shows why the review matters. One probe was below the limit at the end of cooking, and the batch also failed the first cooling stage. The log shows that the cook did keep cooking and re-probed, but the cooling failure was not caught until the review. Tomás found that batch B had been cooled in one deep hotel pan because the shallow pans were all in use; the batch was discarded, and two more sets of shallow pans were ordered.

Verification

Verification asks whether the system is doing what it is supposed to. At Juniper that means four things: Tomás or Aisha reviews and signs the logs daily; thermometers are checked weekly; someone watches a cook take a reading once a month to make sure probes go into the thickest part; and the whole plan is reviewed once a year and whenever the menu, the equipment or the staff change significantly.

Thermometers are checked with the ice-point method. A glass is filled with crushed ice and topped up with cold water, stirred, and left for a minute. The probe is held in the middle of the glass, not touching the sides or bottom, and should read 0 °C. A reading more than 1 °C off means the thermometer is adjusted, if it can be, or replaced.

# Weekly ice-point check of Juniper's probe thermometers (0 C expected, 1 C tolerance).
readings = {"line 1": 0.4, "line 2": -0.2, "prep": 1.6, "cold station": 0.0, "bar": -1.3}
for probe, r in readings.items():
    ok = abs(r - 0.0) <= 1.0
    print(f"{probe:12s} {r:+.1f} C  {'OK' if ok else 'ADJUST OR REPLACE'}")

line 1       +0.4 C  OK
line 2       -0.2 C  OK
prep         +1.6 C  ADJUST OR REPLACE
cold station +0.0 C  OK
bar          -1.3 C  ADJUST OR REPLACE

The food safety plan the law expects

BC's Food Premises Regulation requires every food premises operator to have a written food safety plan and a written sanitation plan, to follow them, and to make them available to an environmental health officer. The food safety plan identifies the critical control points for the foods the premises prepares, the critical limits, how they are monitored and what is done when a limit is missed. Island Health and the provincial FOODSAFE program provide templates. Juniper's plan groups its menu into a handful of process types, such as foods cooked and served, foods cooked, cooled and reheated, and foods served raw or not cooked, so that it does not need a separate page for every dish. The sanitation plan, from Lesson 9, covers cleaning, sanitizing, pest control and training.

Some processes are risky enough that a restaurant needs specific approval and a detailed plan before it starts. Examples include curing or smoking meat or fish, fermenting foods, making foods in reduced-oxygen packaging such as vacuum bags, and cooking sous vide. Health authorities in BC expect these to be described in a detailed HACCP-based plan, and some will ask to review the process before the food goes on the menu.

Adding a new dish

Lesson 6 promised to show how a new dish goes into the plan. In the spring Tomás wanted to add two items to the menu: a house-cured salmon gravlax for the brunch board, and roasted garlic confit, whole cloves cooked slowly in oil, to serve with bread. Both looked simple. Both raised hazards that the plan did not yet cover.

The gravlax is cured raw with salt and sugar and served without cooking. The hazards are parasites in the raw fish, Listeria, which can grow in refrigerated ready-to-eat fish, and the curing process itself. The garlic confit is low-acid garlic covered in oil, which shuts out air; if it is kept warm or stored too long, Clostridium botulinum spores in the garlic can grow and make toxin with no change in smell or appearance. Botulism from garlic in oil has caused outbreaks in both countries.

For the confit, the hazard analysis led to a simple control: small batches made daily, cooled quickly and kept at 4 °C or colder, with a house limit of four days, a date label, and no confit ever left at room temperature on the tables. For the gravlax, Tomás contacted Island Health, because curing raw fish is a process the health authority expects to see described in detail. The plan they agreed covers buying fish that has been frozen to destroy parasites, the cure recipe and time, storage at 4 °C or colder, a short shelf life and the records to keep.

This is the real value of a food safety plan. It forces the question to be asked before the dish is on the menu and a busy cook is improvising on a Saturday night.

Keeping the plan alive

A food safety plan that sits in a binder and is opened only for the inspector does very little. Juniper keeps its plan useful in three ways. The CCP limits and corrective actions for each station are printed on a card at the station, so cooks never have to look them up. Each new cook is walked through the plan for their station on their first shift and signs off on it. And the plan is the first thing reviewed after any near miss, complaint or failed log, so that every lesson learned ends up written down where the next person will find it.