HACCP Plan for Restaurants in Plain English
Write a practical HACCP food safety plan for your restaurant: the seven principles in kitchen terms, a worked chicken example and the records to keep.
Updated 8 min read
On this page
Key takeaways
- Most countries expect a written food safety system based on HACCP principles, scaled to your size.
- HACCP means: find the hazards, control the critical points, set limits, monitor, correct, check and keep records.
- Write it from your real menu and kitchen, not from a template that does not match what you cook.
- A plan on a shelf protects nobody: train the team, record checks daily and review it when anything changes.
In short: HACCP stands for Hazard Analysis and Critical Control Points. It is a way of finding what could make food unsafe, deciding where you must control it, and proving that you do. For a restaurant it becomes a simple set of rules, a few checks each day and some records.
UK and US references are as of October 2026. This is general information; check your local authority for the requirements that apply to you.
HACCP sounds like paperwork for factories. For a restaurant it is the habit of thinking: where can this go wrong, how do we stop it, and how do we know we did? Written down, it is also the document inspectors ask to see.
What the law asks for
In the UK, GOV.UK says that if you run a food business you need a food safety management system and that it must meet the HACCP principles. Its seven principles are:
- Identify the food hazards that need to be avoided, removed or reduced.
- Identify the critical control points (CCPs), where a hazard must be prevented, removed or reduced.
- Set limits for each critical control point.
- Monitor the critical control points.
- Put checks in place to confirm the system is working.
- Take corrective action when a critical control point has a problem.
- Keep records of your systems, checks and corrective actions.
Source: GOV.UK, food safety management systems. The law expects the system to be proportionate to the size and nature of the business. In England and Wales, the Food Standards Agency offers free Safer Food, Better Business packs for small businesses, built on HACCP principles; if you use a different system that works, you do not have to switch. Scotland and Northern Ireland have their own regulators and guidance, so check theirs if you trade there.
In the US, requirements come from state and local health departments, many of which adopt the FDA Food Code. Some operations, such as certain special processes, need a written HACCP plan. Ask your county health department what applies.
The three kinds of hazard
- Biological: bacteria, viruses and parasites. This is the main concern in restaurants: undercooked chicken, rice left warm, cross contamination from raw meat.
- Chemical: cleaning products, pesticide, allergens and unapproved additives.
- Physical: glass, metal, plastic, bone or anything that should not be in the food.
Allergens are treated both as a chemical hazard and, in many countries, as a separate legal duty. See allergen information for online orders.
Step 1: Draw the flow of food
List what you cook and group dishes into a few types that share steps: raw meat and poultry, fish, ready to eat cold food, vegetarian hot dishes, rice and pasta, desserts. For each type, draw the path from delivery to the table:
Delivery, storage, preparation, cooking, hot holding or cooling, reheating if needed, service.
Walk the real kitchen and correct the drawing. A flow chart that matches the building is far more useful than one from a book. See kitchen layout.
Step 2: List the hazards at each step
For every step ask: what could go wrong here? Then ask how likely and how serious it is.
Step 3: Find the critical control points
A critical control point is a step where control is essential, and no later step will fix a failure. Cooking chicken is the classic one. If it is not cooked to a safe temperature, you cannot remove the bacteria later. Others usually include chilled storage, hot holding, cooling cooked food and reheating.
Not every step is a CCP. Cleaning is controlled through prerequisite programmes (the cleaning schedule, pest control, hand washing, supplier checks). Use both: prerequisites for the basics, CCPs for the points where a failure is critical.
Step 4: Set limits you can measure
Each CCP needs a limit that someone can check with a thermometer, a timer or a visual standard. Examples used in many places:
- Chilled food stored at or below the legal limit. In the UK the legal maximum is 8°C and the Food Standards Agency advises 5°C or below as good practice.
- Cooked food held hot at 63°C or above in the UK, or at 135°F (57°C) in the FDA Food Code.
- Food cooked to a core temperature that kills bacteria, for example 70°C for two minutes in UK guidance, or 165°F (74°C) for poultry in the FDA Food Code.
Check the exact numbers for your own country and your own authority. See temperature logs for the full list.
Step 5: Say how you will monitor
For each CCP write who checks, how, how often and where it is recorded. "The opening cook checks each fridge with a probe and writes the reading on the daily sheet before 10:00" is a monitoring step. "We keep an eye on it" is not.
Step 6: Decide the corrective action in advance
What happens when a limit is missed? Write the answer now, so no one improvises in the middle of service. For example:
- Fridge above limit: check the door and the load, move food to another fridge, recheck in an hour, and discard food that has been out of temperature for longer than your rules allow. Call the engineer.
- Chicken below the cooking limit: keep cooking and re check. Record it.
- Delivery arrives warm: reject it.
Name who has authority to discard food. Hesitation is how unsafe food reaches a table.
A worked example: grilled chicken
A simplified table with made up details for one dish. Use your own limits.
| Step | Hazard | Control | Limit | Check | If it fails |
|---|---|---|---|---|---|
| Delivery | Bacteria growth in transit | Check temperature and condition | Chilled at or below your legal limit | Probe on arrival, record | Reject delivery |
| Storage | Growth, cross contamination | Raw chicken on the bottom shelf, covered | Fridge at or below limit | Fridge check twice a day | Move, re check, discard if out too long |
| Prep | Cross contamination | Colour coded board and knife, wash hands | No contact with ready to eat food | Supervisor check | Clean and disinfect, retrain |
| Cooking (CCP) | Survival of bacteria | Cook to safe core temperature | Your limit, for example 70°C for 2 minutes | Probe each batch | Continue cooking, re check |
| Hot holding (CCP) | Growth | Keep hot | 63°C or above | Probe every two hours | Reheat once or discard |
| Service | Cross contamination | Clean utensils, no bare hands | Observation | Replace |
Make one table for each food type, not each dish.
Step 7: Verify and keep records
Verification asks: is the system working? Examples are a weekly manager review of the records, calibrating thermometers, checking that staff can explain the plan, supplier audits, and an annual review. Records are your evidence: daily checks, temperature logs, cleaning sign offs, training records, supplier information, corrective actions and the plan itself. See the temperature logs and cleaning schedule guides for working formats.
GOV.UK states that if your business is involved in a food safety incident, you will need to show these records as evidence of how you keep food safe.
Train the team
The best plan is only as good as the people who follow it. In induction, explain the few CCPs and show how to do each check. See staff training. Test understanding with questions such as "what do you do if the fridge reads 11°C?".
Staff illness is also part of food safety. GOV.UK's guidance says staff with diarrhoea or vomiting must not return to work until they have had no symptoms for 48 hours. Put this in your induction and your plan.
Review it
Review the plan at least once a year and whenever something changes: a new dish, supplier, equipment or layout, a new law, a complaint or an incident. Put the date and the reviewer on the first page. Inspectors like to see that the plan is alive.
Where software helps and where it does not
Your own plan and records remain your responsibility. Digital sheets can make records easier to keep and find. DineHarbor does not replace a food safety management system; it supports related parts, such as keeping allergen and calorie information with each menu item. Always keep your official allergen process under the control of a trained person.
A starting checklist
- Menu grouped by food type.
- Flow chart for each type.
- Hazards, CCPs and limits written down.
- Monitoring sheet in place.
- Corrective actions agreed.
- Records filed.
- Team trained and tested.
- Review date set.
Planning your kitchen systems before opening? Start the 30 day free trial with no card needed.
Questions and answers
Is a HACCP plan a legal requirement for restaurants?
In the UK and the EU, food businesses must put in place procedures based on HACCP principles, in proportion to their size, and GOV.UK says a food safety management system must meet the HACCP principles. In the US, rules are set at state and local level, often based on the FDA Food Code. Check your authority.
Can I use Safer Food, Better Business instead of writing my own?
In England and Wales many small caterers use the Food Standards Agency's free Safer Food, Better Business packs, which are built on HACCP principles. You must fill them in for your own operation, and keep the records.
How long does it take to write a HACCP plan?
A small restaurant can draft one in a few days using its menu and a flow chart for each type of food. The real work is the daily checks and the training afterwards.
How often should I review my food safety plan?
At least once a year and whenever the menu, a supplier, equipment, the layout or the law changes. Also review after any incident or complaint.
Who should write the plan?
The person who runs the kitchen, with input from the team, because they know how food really moves. A food safety consultant can help but cannot replace that knowledge.
See it in DineHarbor
About the author
Editorial team
The DineHarbor team writes this blog for restaurant owners and managers. Every article is checked against the product before it is published, so what we describe is what the software does.
All articles by DineHarbor team
