HACCP and food safety plans

The first ten lessons covered many separate controls: receiving temperatures, cold storage, cooking, cooling, reheating, cross-contamination, handwashing, illness reporting, cleaning and allergens. A kitchen that does all of them most of the time still has gaps, because nobody can watch everything during a busy service. HACCP, Hazard Analysis and Critical Control Points, is a way of deciding which few steps matter most for each food, setting clear limits for them, checking them every time and writing down what happens. A food safety plan built on HACCP turns good habits into a system that keeps working when the head chef is on holiday.

This lesson explains the seven HACCP principles, shows how Juniper Street applied them to one of its menu items, describes the food safety plan the law expects of a restaurant in each country, and shows how a new dish is worked into the plan before it goes on the menu.

Where HACCP came from

HACCP was developed in the 1960s by the Pillsbury Company with NASA and the US Army laboratories to make food for astronauts. Testing finished food was not good enough: to be confident that a batch was safe, almost all of it would have had to be tested, and then there would be nothing left to eat. The answer was to control the process instead, by identifying the steps where hazards could be prevented, eliminated or reduced, and controlling those steps every time. The approach was later adopted by the food industry and by regulators around the world, and the Codex Alimentarius Commission, the international food standards body, sets out the principles that both Canada and the United States use.

Large food plants run full HACCP systems with teams, validation studies and detailed records. A restaurant does not need all of that for every dish, but the same thinking works at any scale.

The seven principles

• Conduct a hazard analysis. For each food and each step, list the biological, chemical and physical hazards that are reasonably likely to occur, and decide which ones must be controlled.
• Determine the critical control points. A critical control point (CCP) is a step at which control can be applied and is essential to prevent, eliminate or reduce a hazard to a safe level. In a restaurant the usual CCPs are cooking, cooling, reheating, and hot and cold holding.
• Establish critical limits. Each CCP gets a measurable limit, usually a temperature and a time, that separates safe from unsafe.
• Establish monitoring procedures. Decide who checks each CCP, how, and how often, such as probing every batch at the end of cooking.
• Establish corrective actions. Decide in advance what happens when a limit is missed, so that nobody has to work it out in the middle of service.
• Establish verification procedures. Check that the system is working: review the logs, calibrate thermometers, watch staff take readings, and review the plan when the menu or equipment changes.
• Establish record-keeping. Keep the logs, corrective action records and verification records, so the restaurant can show what it did.

A process flow for one dish

The first practical step is to draw the path a food takes through the kitchen. Juniper's braised chicken thighs, one of its best-selling dishes, are a good example because they go through almost every step a restaurant uses: they are received cold, stored, prepped raw, cooked in the combi oven, cooled in batches, stored again, reheated to order and held on the line during service.

Not every step is a CCP. Receiving and cold storage matter, but they are controlled by Juniper's ordinary procedures from Lesson 5, and a small problem there will still be corrected by cooking. Cooking is a CCP because it is the step that kills Salmonella and Campylobacter; if it fails, nothing later will fix it. Cooling is a CCP because slow cooling lets Clostridium perfringens spores, which survive cooking, grow to dangerous numbers. Reheating and hot holding are CCPs because the cooled chicken must be brought back through the danger zone quickly and kept out of it.

The corrective action column is the one most often left vague, and it is the most important. A cook who finds a batch at 78 °F (26 °C) after two hours of cooling, at the end of a long shift, needs to know exactly what to do without having to decide whether it is probably fine. Writing the answer down in advance takes the pressure off.

Monitoring and records

Juniper's logs are on clipboards at each station, with a column for every CCP reading, the time, the reading, the initials of the person who took it and any corrective action. The program below checks one day of cooking and cooling entries for the chicken thighs against the critical limits, the way Tomás reviews them at the end of each day.

# Review one day of CCP log entries for braised chicken thighs (Food Code limits).
COOK_MIN = 165     # degrees F
STAGE1 = (135, 70, 120)  # from 135 F to 70 F within 120 minutes
STAGE2 = (41, 360)       # to 41 F within 360 minutes in total

cook_log = [("batch A", [172, 169, 178]), ("batch B", [167, 162, 171])]
cool_log = [
    # (batch, temp at 2 h, temp at 6 h)
    ("batch A", 64, 38),
    ("batch B", 75, None),
]

for batch, probes in cook_log:
    low = min(probes)
    if low >= COOK_MIN:
        print(f"{batch}: cook OK (lowest {low} F)")
    else:
        print(f"{batch}: cook FAILED at {low} F -> keep cooking, re-probe")
for batch, t2, t6 in cool_log:
    if t2 > STAGE1[1]:
        print(f"{batch}: stage 1 FAILED ({t2} F at 2 h) -> reheat to 165 F and restart, or discard")
    elif t6 is None or t6 > STAGE2[0]:
        print(f"{batch}: stage 2 not met -> discard")
    else:
        print(f"{batch}: cooling OK ({t2} F at 2 h, {t6} F at 6 h)")

batch A: cook OK (lowest 169 F)
batch B: cook FAILED at 162 F -> keep cooking, re-probe
batch A: cooling OK (64 F at 2 h, 38 F at 6 h)
batch B: stage 1 FAILED (75 F at 2 h) -> reheat to 165 F and restart, or discard

Batch B shows why the review matters. One probe was below the limit at the end of cooking, and the batch also failed the first cooling stage. The log shows that the cook did keep cooking and re-probed, but the cooling failure was not caught until the review. Tomás found that batch B had been cooled in one deep hotel pan because the shallow pans were all in use; the batch was discarded, and two more sets of shallow pans were ordered.

Verification

Verification asks whether the system is doing what it is supposed to. At Juniper that means four things: Tomás or Aisha reviews and signs the logs daily; thermometers are checked weekly; someone watches a cook take a reading once a month to make sure probes go into the thickest part; and the whole plan is reviewed once a year and whenever the menu, the equipment or the staff change significantly.

Thermometers are checked with the ice-point method. A glass is filled with crushed ice and topped up with cold water, stirred, and left for a minute. The probe is held in the middle of the glass, not touching the sides or bottom, and should read 32 °F. The Food Code requires food thermometers to be accurate to within 2 °F; a reading further off means the thermometer is adjusted, if it can be, or replaced.

# Weekly ice-point check of Juniper's probe thermometers (32 F expected, 2 F tolerance).
readings = {"line 1": 32.7, "line 2": 31.6, "prep": 35.0, "cold station": 32.0, "bar": 29.7}
for probe, r in readings.items():
    ok = abs(r - 32.0) <= 2.0
    print(f"{probe:12s} {r:.1f} F  {'OK' if ok else 'ADJUST OR REPLACE'}")

line 1       32.7 F  OK
line 2       31.6 F  OK
prep         35.0 F  ADJUST OR REPLACE
cold station 32.0 F  OK
bar          29.7 F  ADJUST OR REPLACE

The food safety plan the law expects

The Food Code does not require every restaurant to keep a written HACCP plan. It does require the person in charge to show active managerial control: knowing the foodborne illness risk factors, putting procedures in place to control them, training staff and monitoring that the procedures are followed. The FDA's guidance for retail food establishments suggests grouping the menu into three process types: foods with no cook step, foods prepared for same-day service, and complex food preparation in which food is cooked, cooled and reheated. Juniper's written food safety plan follows that approach and is kept at the office for the Chatham County inspector.

Some processes are risky enough that the Food Code requires a variance from the health department and a written HACCP plan before the restaurant starts. They include smoking food for preservation, curing food, using food additives to make a food shelf-stable, packaging food in reduced-oxygen packaging such as vacuum bags, custom processing of animals, sprouting seeds, and keeping live molluscan shellfish in a display tank. Sous vide cooking in vacuum bags falls under the reduced-oxygen packaging rules.

Adding a new dish

Lesson 6 promised to show how a new dish goes into the plan. In the spring Tomás wanted to add two items to the menu: a house-cured salmon gravlax for the brunch board, and roasted garlic confit, whole cloves cooked slowly in oil, to serve with bread. Both looked simple. Both raised hazards that the plan did not yet cover.

The gravlax is cured raw with salt and sugar and served without cooking. The hazards are parasites in the raw fish, Listeria, which can grow in refrigerated ready-to-eat fish, and the curing process itself. The garlic confit is low-acid garlic covered in oil, which shuts out air; if it is kept warm or stored too long, Clostridium botulinum spores in the garlic can grow and make toxin with no change in smell or appearance. Botulism from garlic in oil has caused outbreaks in both countries.

For the confit, the hazard analysis led to a simple control: small batches made daily, cooled quickly and kept at 41 °F or colder, with a house limit of four days, a date label, and no confit ever left at room temperature on the tables. The gravlax was harder. Curing is one of the processes that requires a variance and a HACCP plan under the Food Code, so Tomás contacted the Chatham County health department. The gravlax stays off the menu until the variance is approved; the draft plan covers buying fish that has been frozen to destroy parasites, the cure recipe and time, storage at 41 °F or colder, a short shelf life and the records to keep.

This is the real value of a food safety plan. It forces the question to be asked before the dish is on the menu and a busy cook is improvising on a Saturday night.

Keeping the plan alive

A food safety plan that sits in a binder and is opened only for the inspector does very little. Juniper keeps its plan useful in three ways. The CCP limits and corrective actions for each station are printed on a card at the station, so cooks never have to look them up. Each new cook is walked through the plan for their station on their first shift and signs off on it. And the plan is the first thing reviewed after any near miss, complaint or failed log, so that every lesson learned ends up written down where the next person will find it.