HACCP Plan for Restaurants: The 7 Principles Step by Step

1. What Is a HACCP Plan for Restaurants and Why Do You Need One?

A HACCP plan for restaurants is a practical document that identifies the hazards that could make your food unsafe, the points that must be controlled to prevent those hazards, how those points are monitored, and what is done when something goes wrong. HACCP stands for "Hazard Analysis and Critical Control Points", an internationally recognized preventive system that the Codex Alimentarius defines in seven principles.

The core idea of the system is that it prevents the problem before it happens instead of discovering it after the dish has reached the customer. Rather than relying on luck or on the chef's experience alone, every critical step is defined by a number that is measured and recorded.

Why does a restaurant need one?

• Preventing food poisoning by focusing on the highest-risk points.
• Standardizing work across shifts and branches, so safety does not depend on which chef is on duty.
• Demonstrating due diligence to regulators through organized records.
• Making training easier, because the limits and procedures are written down and clear.

In this guide we focus on building the plan and applying it inside the restaurant. Obtaining an accredited certificate from a certification body is a separate path with its own requirements. A good plan starts from your real kitchen and your actual menu, not from a copied ready-made template.

2. What Are the Preliminary Steps Before Applying the 7 HACCP Principles?

The Codex Alimentarius defines five preliminary steps that come before the seven principles, and skipping them is one of the most common reasons plans fail in restaurants:

• Assemble the HACCP team: usually the kitchen manager or executive chef, the quality officer and an operations supervisor. In small restaurants it may be just two people, and an external consultant can be brought in.
• Describe the products: for each item or group of similar items: ingredients, preparation method, storage and service method, and shelf life.
• Identify the intended use and consumers: is the dish eaten immediately or delivered? Is it served to vulnerable groups such as children in schools or patients in hospitals?
• Draw the process flow diagram: from receiving to storage to preparation to cooking to holding or cooling to service.
• Verify the diagram on site: the team walks through the kitchen and compares the diagram with what actually happens, because reality often differs from paper.

In addition, the plan needs strong prerequisite programs, such as staff hygiene, a cleaning and sanitizing program, pest control, equipment maintenance and supplier approval. These programs control general hazards, so the critical control points stay few and focused.

A practical tip: do not write a plan for each dish separately. Group dishes by preparation process, such as dishes cooked and served immediately, dishes cooked, cooled and then reheated, and dishes that are not cooked at all.

3. How Do You Conduct a Hazard Analysis in a Restaurant Kitchen?

Principle 1: Conduct a hazard analysis. The team goes through every step in the process flow diagram and asks: what hazard could be introduced, increase or survive at this step? It then assesses the likelihood and severity of each hazard and identifies the appropriate control measures.

Hazards are usually classified as:

• Biological: bacteria, viruses and parasites, such as Salmonella in chicken and Bacillus cereus in rice.
• Chemical: residues of cleaning agents, pesticides, oils used for too long, and allergens, which many plans treat as a separate category.
• Physical: glass, bones in products that are supposed to be boneless, and pieces of metal and plastic.

An example for the cooling cooked rice step in a catering kitchen:

• Hazard: growth of Bacillus cereus and formation of its toxins if the rice stays in the danger zone.
• Likelihood: medium to high with large quantities.
• Severity: high, because some toxins are not destroyed by reheating.
• Control measure: rapid cooling in shallow trays within defined time and temperature limits.

Document the analysis in a simple table: step, hazard, cause, assessment and control measure. This table is the foundation on which the remaining principles are built, and the more closely it reflects your actual kitchen, the more useful it is.

4. How Do You Identify Critical Control Points and Their Critical Limits?

Principle 2: Determine the critical control points (CCPs). A critical control point is a step at which control can be applied and where that control is essential to prevent or eliminate a hazard or reduce it to an acceptable level, with no later step that corrects the failure. Many teams use a "decision tree" to help them make this determination.

In restaurants, the following critical control points come up most often:

• Cooking: because it is the step that kills bacteria in raw foods.
• Cooling after cooking.
• Reheating.
• Hot holding and cold holding of ready-to-eat foods.

Steps such as general storage and cleaning, on the other hand, are usually managed through prerequisite programs.

Principle 3: Establish validated critical limits. A critical limit is a measurable value that separates acceptable from unacceptable, such as:

• Cooking poultry until the core temperature reaches about 74°C.
• Hot holding at 60°C or above.
• Cooling from 60°C to 21°C within two hours, then to 5°C or below within a further four hours.

Limits must be based on a scientific or regulatory reference. Exact values vary slightly between references, so check the guidelines of the Saudi Food and Drug Authority (SFDA). For more details, see safe cooking temperatures.

5. How Do You Monitor Critical Control Points and Define Corrective Actions?

Principle 4: Establish a system to monitor control of the critical control points. For each point, answer four questions: what do we measure? How? When? And who measures? An example for the cooking point:

• What: the core temperature of the chicken piece.
• How: a calibrated digital probe thermometer, sanitized between measurements.
• When: for every batch coming out of the oven.
• Who: the station cook, with the supervisor reviewing the log.

Principle 5: Establish the corrective actions to be taken when monitoring indicates a deviation from the critical limit. A good corrective action achieves two things: dealing with the affected product and fixing the cause so it does not happen again. Examples:

• Chicken that has not reached the limit: cooking continues until it does, and it is measured again.
• A hot-holding unit below 60°C for an unknown period: the food is discarded, and the unit is inspected and sent for maintenance.
• A ready-to-eat food refrigerator at 10°C: the food is assessed according to how long it has been there, moved to another unit, and maintenance is called.

Write the corrective actions in advance in simple language and post them near the monitoring point, so workers do not have to improvise under peak-time pressure. Record every action: what the deviation was, what was done, who did it and when.

6. How Do You Verify Your HACCP Plan Works and Keep Records?

Principle 6: Validate the plan, then establish verification procedures to confirm the system is working as intended. Validation asks: are the limits and controls we chose actually sufficient to control the hazard? Periodic verification asks: are we applying the plan as written?

Practical verification activities for restaurants:

• Reviewing records weekly by the supervisor or quality manager, and signing them off.
• Calibrating thermometers on a defined schedule.
• Observing staff at work: is the cook actually measuring, or writing down an expected number?
• Periodic internal audits of the whole plan.
• Reviewing the plan when the menu, equipment or suppliers change, or after any complaint.

Principle 7: Establish documentation and record keeping. Documents include the plan itself, the hazard analysis, and the determination of critical points and their limits. Records include monitoring readings, corrective actions, verification and calibration results, and training records.

The signs of a weak record are familiar to any inspector: identical readings every day, a single handwriting filling a whole week, or empty boxes with no explanation. A digital record that is automatically time-stamped and linked to the user's name solves most of these problems and makes reviews much faster.

7. A Practical Example: A HACCP Plan for Chicken Shawarma in a Saudi Restaurant

Let's apply all of the above to a very popular item in Saudi Arabia: chicken shawarma. The simplified process flow: receiving chilled chicken, then cold storage, then marinating and stacking on the skewer, then cooking on the vertical rotisserie, then slicing, then final cooking on the saj or flat-top grill, then service.

The main hazards and controls:

• Receiving and storage: risk of bacterial growth. Managed through prerequisite programs: receiving at 5°C or below, and storing on the bottom shelves away from ready-to-eat food.
• Marinating and stacking: risk of bacterial growth if the chicken stays too long at room temperature, and risk of cross-contamination. The control: stacking in small batches and returning the skewer to refrigeration immediately.
• Cooking on the vertical rotisserie: this is the biggest risk, because the outer layer may look done while it has not reached a safe temperature. This is a critical control point, with a critical limit of the sliced pieces reaching about 74°C, monitored with the probe several times per shift.
• Final cooking on the saj: many restaurants use it as an extra assurance that the slices reach a safe temperature before serving.
• End of day: decide in advance what to do with the remaining skewer, and never re-chill a partially cooked skewer.

This way the item has one clear critical point with a limit, monitoring and a corrective action, while the remaining hazards are managed through the basic programs. Repeat the same approach for every group of items on your menu.

Conclusion

Building a HACCP plan for restaurants starts with the preliminary steps: a team, a description of the items, and a process flow diagram verified on site. Then come the seven principles: hazard analysis, identifying critical points, setting measurable limits, monitoring, corrective actions, verification and documentation. Start with the highest-risk items and keep the plan tied to your actual kitchen. LAEQ365 makes it easier to run the plan every day through checklists for each critical point, automatically assigned corrective actions, and digital records ready for review. To ask about using it in your establishment, contact the LAEQ365 team.

Frequently asked questions

What are the seven principles of HACCP?

According to the Codex Alimentarius, the seven principles are: conduct a hazard analysis and identify control measures; determine the critical control points; establish validated critical limits; establish a system to monitor control of the critical points; establish corrective actions for deviations; validate the plan and then establish procedures to verify that it is effective; and establish documentation and record keeping.

What is the difference between a control point and a critical control point?

A control point is any step at which a hazard can be controlled, while a critical control point is a step where control is essential to prevent or eliminate the hazard or reduce it to an acceptable level, with no later step to correct the failure. For example, cooking chicken is a critical point because it is the step that kills Salmonella before service.

Is a HACCP plan mandatory for restaurants in Saudi Arabia?

Requirements vary according to the type, activity and size of the establishment, and they are issued by the competent authorities such as the Saudi Food and Drug Authority (SFDA) and the Ministry of Municipalities and Housing. Even when formal certification is not required, applying HACCP principles helps an establishment control hazards and demonstrate due diligence. Check the latest official requirements that apply to your activity.

How many critical control points does a restaurant usually have?

There is no fixed number, but most restaurants end up with a limited number of critical points, typically recurring at the cooking, cooling, reheating, and hot and cold holding steps. A large number of critical points is often a sign of weak prerequisite programs, or of treating every step as critical without applying the decision tree correctly.

How often should a HACCP plan be reviewed?

It is advisable to review the plan periodically, at least annually in many establishments, and also whenever there is a significant change such as adding new items to the menu, changing equipment or preparation methods, changing suppliers, or after a food poisoning complaint or a negative audit result. The plan is a living document that must reflect what actually happens in the kitchen.