How to Build a HACCP Plan for Restaurants

A HACCP plan is a build, not a binder

Most operators already know what HACCP is. If you don't, our plain-English guide to HACCP covers the seven principles and where the whole thing came from. This article is the next step: how you build the plan for a working restaurant, and, more to the point, how you build one that doesn't fall apart the first time a shift runs short-staffed.

The mistake we see most often is treating the plan as a document to be produced rather than a process to be mapped. Teams download a template, fill in the blanks, print it, and file it. Then a menu changes, a supplier switches, a new cook estimates a cook temp instead of checking it, and the binder quietly stops describing what happens in the kitchen. A HACCP plan that doesn't match the line isn't a plan. It's paperwork.

So we'll build it the way the FDA and NACMCF recommend: five preliminary steps to understand your food and your process, then the seven principles applied on top of that understanding. Do the prep work well and the principles almost write themselves.

The build in one line: Figure out how food moves through your kitchen, find the handful of steps where it can become unsafe, set an exact limit at each of those steps, and prove, every shift, that you hit it. Before you write anything: the five preliminary steps

Before you write anything: the five preliminary steps

The seven principles get all the attention, but the work that makes them accurate happens first. Skip these and you'll write critical limits for a process you never mapped.

1. Assemble your HACCP team. You don't need a food scientist. You need the people who know what really happens on the line: a chef or kitchen manager, someone from food safety or QA, and, at an enterprise, someone from operations who can speak for how every store runs, not just the flagship. The team's job is to keep the plan honest, to say "that's the SOP, but here's what the closing crew actually does at 10 p.m." Write down who's on the team and who owns the plan. That ownership line matters more than it looks. A plan with no owner drifts.

2. Describe the food. List what you make and the details that affect safety: ingredients, whether items are raw or ready-to-eat, how they're stored, and their shelf life. Pay special attention to your TCS foods, the time/temperature-control-for-safety items that carry most of your biological risk. For a broad menu, you don't have to describe all 200 items individually. Group them by process instead, which brings us to the trick that makes HACCP manageable.

3. Identify how the food is used and who eats it. "Cook and serve immediately" is a different risk profile than "cool, hold overnight, and reheat tomorrow." And a menu served to a general audience is different from one served to a highly susceptible population: a hospital, a school, a senior-living dining room. Note both. If any part of your operation feeds an at-risk group, your critical limits and your tolerance for error tighten accordingly.

4. Map the flow of food. This is the step people rush, and it's the one that carries the whole plan. Draw how food moves from the back door to the guest: receiving → storage → prep → cook → hold → cool → reheat → serve. Most operators find they don't need a separate diagram for every dish.

You can sort your entire menu into a few process categories:

• No cook: salads, cut fruit, deli items assembled cold

• Same-day cook and serve: grill, fry, sauté; cooked and served in one shift

• Complex / multi-step: cooked, cooled, held, and reheated across a day or more (soups, braises, sauces, batch-prepped proteins)

The complex category is where hazards multiply, because food passes through the temperature danger zone more than once. Mapping by process instead of by recipe is what keeps a HACCP plan for a restaurant from turning into a 300-page document nobody maintains.

5. Walk the line and verify the diagram. A flow diagram drawn in an office is a guess. Walk the actual kitchen during a real shift and confirm it. You'll almost always find a step you missed: a holding cabinet, a second cooling stage, a garnish that's handled after cooking. Fix the diagram to match reality before you go any further. Everything downstream inherits this diagram's accuracy.

Apply the seven principles to your kitchen

Now the framework does its work. With an accurate flow diagram in hand, the seven principles become a series of decisions about specific points on that diagram rather than abstract requirements. Here's each principle as a build action.

The two that trip teams up are principles 2 and 3. Not every step is a critical control point. Flag ten CCPs on a burger and you'll monitor none of them well. Be ruthless: a CCP is a step where control is essential and where failure isn't caught later. And critical limits must be a number, not a vibe. "Cook until done" isn't a limit. "165°F for 15 seconds" is.

For principle 7, keep the line the live guide ends on: if it isn't written down, as far as the health department is concerned, it didn't happen. A clean record showing you caught a problem and fixed it does more for you in an inspection than a suspiciously flawless log ever will.

Turn the plan into daily execution

A finished plan is worth exactly as much as the crew's ability to run it at 7 p.m. on a Friday. This is where most HACCP programs either hold or quietly fail, and it's where a plan built for one kitchen has to survive being copied across many.

Standardize the process, not just the recipe. The critical limits and monitoring steps should be identical whether the store is in Toledo or Tucson. Identical standards are the only thing that lets a regional director compare locations honestly instead of adjudicating forty different versions of "close enough." The same logic applies to prep and date labeling: a use-by date calculated the same way at every location is one less thing standing between your plan and what's happening on a shelf.

Make monitoring hard to skip and easy to prove. Paper logs invite pencil-whipping: filling in the whole shift from memory at close. A check that records itself in the moment, on the device the cook is already holding, removes both the temptation and the doubt. A temperature verified on BOHA! Temp or a prep task confirmed on BOHA! Checklist becomes an audit-ready record instead of a clipboard in a drawer.

Give headquarters a live view. The entire reason to run a system is that someone above store level can see when a limit gets blown and whether the corrective action happened. Connect monitoring, corrective actions, and verification into one record, the way BOHA! HACCP reporting does, and three disconnected chores become a single, defensible trail. Without that visibility, you don't have a program. You have binders you hope are current.

If you want the deeper argument for connected records over paper, we made it here: digital HACCP records that prove compliance

Keep the plan alive

A HACCP plan is never truly finished. Reassess it at least once a year, and any time you change something that touches a critical control point:

• A new menu item or a reformulated recipe
• A supplier or ingredient switch
• New equipment: a different oven, cooler, or holding cabinet
• A change to your process, like adding cook-chill or grab-and-go

Build the review into a calendar the same way you'd schedule an equipment PM, or fold it into an existing restaurant audit program so HACCP reassessment isn't one more separate thing to track. Plans don't expire on a date; they expire the day the kitchen changes and the document doesn't. Tie your plan to a connected food safety and compliance system and those updates push to every location at once, instead of store by store and hope-for-the-best.

Start from a template, not a blank page

You don't have to build the structure from scratch. We put the five preliminary steps, the seven principles, a sample flow diagram, and blank CCP and monitoring tables into one editable worksheet you can adapt to your menu.

→ Download the free HACCP Plan Template for Restaurants

Fill in your process, walk your line to verify it, and you've got the honest first draft of a plan you can run.

See how BOHA! HACCP reporting connects monitoring, corrective actions, and verification into one record, or talk to our team about your current plan.

Frequently asked questions

What is the first step in developing a HACCP plan?

Assembling your HACCP team and describing your food and process, the preliminary steps, come before the seven principles. In practice, the first real work is mapping the flow of food, because every hazard analysis and critical control point is tied to a step on that diagram.

How do you write a HACCP plan for a restaurant?

Work through the five preliminary steps (team, product description, intended use, flow diagram, on-site verification), then apply the seven principles to the steps on your diagram: identify hazards, choose critical control points, set critical limits, define monitoring, set corrective actions, add verification, and keep records.

When is a HACCP plan required for a restaurant?

A full, formal plan is federally required for specific processes: juice, seafood, and USDA-regulated meat and poultry. Most retail restaurants need one only when they do something a health department flags as specialized: reduced-oxygen packaging (sous vide, vacuum-sealing), curing, smoking for preservation, or acidifying rice for sushi. Those typically require a HACCP plan variance from your local authority.

What is pencil-whipping, and why does it matter for HACCP records?

Pencil-whipping is filling in a paper log after the fact, often from memory, rather than recording each check as it happens. It's the single biggest reason paper HACCP records fail an inspector's scrutiny: a log with no gaps and no variation, all in the same pen, reads as reconstructed rather than real. Timestamped digital records remove the opportunity.

How often should a HACCP plan be reviewed?

At least annually, and any time you change a menu item, recipe, supplier, or piece of equipment that affects a critical control point.

How do you know if a HACCP plan is working?

Through verification: calibrated thermometers, manager review of monitoring logs, and periodic reassessment of the plan itself. Consistent records that show limits being met, and corrective actions being taken and logged when they aren't, are the proof that the system is functioning.