Restaurant Food Safety Plan: What to Write and How to Keep It
A restaurant food safety plan is a written set of procedures that shows how you find food hazards, control them, check that the controls work and fix problems when they don’t. Most restaurants do not need a full HACCP plan, but nearly every operation needs written procedures, trained managers and records that match what happens on the line. The plan is only as strong as the person in charge who runs it, which is why a certified food protection manager is the foundation of a plan that holds up. Our online Certified Food Protection Manager course is built for exactly that role.
TL;DR
-
A food safety plan is written documentation: hazards, controls, monitoring, corrective actions, verification and records.
-
A full HACCP plan is usually required only for specialized processes, and your local health department decides what applies to you.
-
Build the plan around your own menu and process flow, not a generic template.
-
Records, observed practice and written procedures must agree. A binder nobody follows protects no one.
-
Train your team and certify your person in charge so the plan runs when you are not in the room.
-
Provide ongoing training and development opportunities for every level of your team. The Food Service Leadership Academy, offered by My Food Service License, is an excellent way to support continuous growth through convenient, engaging micro-learning lessons that help employees build their skills and advance their leadership capabilities.
Table of Contents
What a restaurant food safety plan actually is
Think of the plan as your kitchen’s rulebook, written down. It says what can go wrong with the food you serve, what you do to prevent it, who checks, how often, and what happens when a check fails.
FDA describes a food safety plan as written documentation built around hazard analysis and, when needed, preventive controls, monitoring, corrective actions, verification, and records. That guidance is written for food manufacturers, but the logic carries into a restaurant kitchen: find the hazard, control it, prove you controlled it.
How it differs from a HACCP plan
HACCP (Hazard Analysis and Critical Control Point) is one specific, formal way to build a plan. FDA calls it a systematic, preventive approach that identifies, evaluates, and controls hazards reasonably likely to occur, and it rests on seven principles. It centers on critical control points (CCPs), the steps where a failure would make food unsafe, and on critical limits, such as a minimum cooking temperature, that each CCP must meet.
A restaurant food safety plan is the broader idea. It can include HACCP-style controls for the few risky processes you run, plus everyday procedures for receiving, storage, sanitation, allergens, and employee health.
Does your restaurant have to have one?
The answer depends on where you are and what you cook. The FDA Food Code is a model code, not federal law that applies automatically to every restaurant. State and local agencies adopt or adapt it, so your governing rule is your state, county, or city code. Your local health department is the final word.
Two patterns hold across most jurisdictions.
Standard operations rarely need a formal HACCP plan. Maryland’s planned Food Code adoption, for example, says a HACCP plan would not be required for standard cooking, cooling, reheating, holding, or serving when you follow Food Code time-and-temperature controls.
Specialized processes do. The same Maryland document lists processes that would require a HACCP plan, including smoking food to extend shelf life, reduced-oxygen packaging, juice processing, acidifying a TCS food (one that needs time and temperature control) so it becomes non-TCS, and sprouting seeds or beans. New York City’s HACCP checklist adds that curing, drying meat or poultry, and certain fermentation processes require Department of Health approval. In New York State, an operator must submit a HACCP plan before starting an activity that requires one.
Even when no HACCP plan is mandated, the Food Code expects management to control risk. The 2022 Food Code puts responsibility on the Person in Charge (PIC) to maintain active managerial control and emphasizes written procedures as tools for controlling the risk factors behind foodborne illness. FDA’s December 2024 supplement says a written food safety management system must be implemented during all operating hours and available to the regulator on request, except for establishments deemed minimal risk. Whether your jurisdiction has adopted that language is a question for your health department, but writing the plan now puts you ahead of it.
Building or remodeling? Under the 2022 Food Code, plan review is needed before you construct a food establishment, convert an existing structure, or make extensive remodeling, a change in establishment type or a change in food operation. That is a separate submission from your food safety plan, and your regulator may add its own requirements.
How to build the plan, step by step
FDA’s HACCP guidelines give a sequence that works well as a backbone for any restaurant plan. Here it is adapted for a working kitchen.
1. Put management behind it
The plan starts with a commitment from whoever runs the operation. Name the person in charge for every shift. If nobody owns the plan on a Saturday night, nobody follows it.
This is where certification matters most. A Certified Food Protection Manager has been trained to recognize hazards and run controls. Our CFPM course is state-approved, self-paced, and available in English and Spanish, so managers on different shifts can each complete it on their own schedule.
2. Assemble a small team
FDA’s guidance calls for a knowledgeable team. In a restaurant, that means the owner or general manager, the chef or kitchen manager, and a line cook who actually does the work. The cook will tell you which step in your written procedure nobody really follows.
3. Describe your food and how it is used
List your menu items grouped by how they are made: raw to cooked, cooked and held hot, cooked and chilled for later, served raw or undercooked, ready-to-eat with no cooking step. Note who eats it. If you serve children, older adults, or people with weakened immune systems, say so, because it changes how strict your controls should be.
4. Map the process flow
Draw the path each food group takes: receiving, storage, thawing, preparation, cooking, holding, cooling, reheating, serving. Then walk the kitchen and check that the drawing matches reality. FDA’s steps include mapping and verifying the process flow for this reason: the flow on paper is often not the flow on the line.
Colorado’s school-food template shows how far the detail goes, with separate procedures for receiving, storage, thawing, preparing, holding, cooling, reheating and serving, plus recordkeeping. Your plan should be at least that specific to your own menu.
5. Analyze the hazards
At each step, ask what could go wrong. FDA says the analysis should consider ingredients and raw materials, each process step, storage and distribution, and final preparation and use, covering biological, chemical, and physical hazards.
In a restaurant, that usually looks like this:
| Step | Typical hazard | Typical control |
|---|---|---|
| Receiving | Food delivered warm or from an unapproved source | Check temperature on arrival, reject out-of-range product |
| Storage | Raw meat dripping onto ready-to-eat food | Store ready-to-eat food above raw, by cooking temperature |
| Cooking | Pathogens survive | Cook to the minimum internal temperature for each food |
| Hot or cold holding | Bacteria multiply | Hold at required temperatures, check on a schedule |
| Cooling | Slow cooling in deep containers | Shallow pans, ice baths, timed checks |
| Prep | Cross-contamination, allergens | Color-coded boards, cleaning and sanitizing between tasks |
Our guide to safe food storage temperatures, timing and setup covers the storage row in more detail.
6. Set critical limits for the steps that matter most
A critical limit is a measurable line: a cooking temperature, a hold temperature, a cooling time. Write the number, not “cook thoroughly.” Post the numbers where cooks work. Our minimum cooking temperatures poster and proper holding temperatures poster put the limits at eye level on the line.
7. Decide how each control is monitored
FDA says monitoring procedures must specify what is checked, how, how often, and by whom, and that results must be recorded and compared with the critical limits. “The cook checks the chicken” is not a procedure. “The grill cook probes the thickest part of every batch and initials the cook log” is.
8. Write corrective actions in advance
When a limit is missed, the person on shift should not have to improvise. New York City’s checklist calls for predetermined, documented actions when a critical limit is not met. Typical examples: keep cooking until the product reaches temperature, discard food held too long in the danger zone, recalibrate or replace a bad thermometer. Record what happened and what you did.
9. Verify that the plan works
Verification is not the same as monitoring. Monitoring is the cook probing the chicken. Verification is the manager checking that the whole system works. FDA describes verification as activities that confirm the plan is valid and operating as intended, including record review, calibration, observation, and other objective checks. Build a weekly manager review: read the logs, watch a shift, check thermometer calibration, and sign the review.
10. Keep records and revise
Records are the proof. More on them next.
What to record, and for how long
FDA’s regulator manual says records should cover, as they apply to your operation, receiving, storage, cooking, cooling, reheating, holding, sanitation, pH, calibration and other CCP activities, along with who checked, the method and frequency, signatures or initials, deviations, corrective actions, verification and revision history.
A practical starter set for most restaurants:
-
Receiving log with delivery temperatures
-
Cooking and hot-holding temperature log
-
Cooling log with start time, checkpoint temperatures and finish time
-
Cold-holding and walk-in temperature log
-
Thermometer calibration log
-
Sanitizer concentration checks
-
Corrective action log
-
Employee training records and certificates
Retention rules differ by jurisdiction. In New York City, records for food prepared under an approved HACCP plan must be kept at least 90 days after service or consumption. Ask your local health department how long yours must be kept.
Training is part of the plan
FDA’s guidance says your plan should include training procedures and evidence that employees and managers understand their duties. The inspector is not only reading paper. According to FDA’s inspection workbook, regulators verify employee and manager knowledge and training documentation alongside the records.
A simple training structure that matches how kitchens work:
| Role | Training | Where to start |
|---|---|---|
| Person in charge, managers, chefs | Food protection manager certification | CFPM course and proctored exam |
| Line cooks, prep, servers | Food handler basics | Food Handler course |
| Staff serving guests with allergies | Allergen awareness | Allergy Awareness Training |
| Operations with specialized processes | HACCP principles | HACCP Manager Course |
Certification and course requirements vary by state and county, so check what your jurisdiction requires. If you operate in California or Arizona, our pages on California food safety programs and requirements and Arizona food safety programs and requirements are a good place to start.
Getting the plan ready for an inspection
Inspectors compare three things: what your plan says, what your records show, and what they see. FDA’s regulator manual organizes verification around document review, record review, and on-site observation. A plan is credible only when all three agree. A binder that sits on a shelf while the line does something else will not hold up.
The FDA inspection workbook shows what is checked in an existing HACCP system: required monitoring on selected dates, accuracy and consistency of records, documented corrective action when limits are missed, calibration, and employee and manager knowledge. Prepare for each:
-
Pick three random days from last month and check that every log is complete and initialed.
-
Find a missed limit in the records and confirm the corrective action is written next to it.
-
Calibrate every probe and record it.
-
Quiz a cook on your hold temperatures and cooling steps. If they cannot explain it, retrain.
-
Keep the plan on site where a regulator can ask for it.
Self-audits help. Ventura County’s guidance recommends using a checklist for periodic self-audits, which it says can reduce or eliminate health-code violations before routine inspections. Run one monthly, rotate who conducts it, and file the result with your records.
Put the plan in the hands of a certified manager
A written plan does nothing until someone with authority runs it every shift. If your person in charge is not yet certified, the quickest path is our online course and exam.
The Online Certified Food Protection Manager course is $115, in English or Spanish. The Food Protection Manager exam with online proctoring is $99 and is taken remotely, with no scheduling required. The course and exam togetherare $149. The program is self-paced, includes practice quizzes, and certification is immediate upon passing. Group discounts are available for teams, and the Food Handler course is $29.99.
If your menu includes smoking, curing, or reduced-oxygen packaging, the HACCP Manager Certification Course ($249) teaches the framework your regulator will expect.
Our perspective
We see the food safety plan as the heartbeat of a kitchen, and the person in charge is what keeps it beating. Templates are easy to download. What protects guests is a manager who understands why a cooling log exists, can explain a corrective action to a new cook and knows what to do when a thermometer reads wrong.
That is why our programs start with the manager. Our Food Protection Manager course is state-approved, so the knowledge you gain is recognized and the certificate is yours as soon as you pass the exam which is ANSI ANAB-CFP nationally accredited. Self-paced lessons and practice quizzes fit around a restaurant’s real schedule, and the proctored exam can be taken from home.
Pair certified managers with trained staff and clear posters at every station, and the plan stops being paperwork. It becomes how your team works.
My Food Service License
FAQ
Is a food safety plan the same as a HACCP plan?
No. A HACCP plan is one formal type of food safety plan, built on seven principles and focused on critical control points. A restaurant food safety plan can be broader, covering everyday procedures like receiving, sanitation, and allergens. Your health department tells you whether you need a formal HACCP plan.
Do all restaurants need a HACCP plan?
No. Under Food Code-based rules, standard cooking, cooling, reheating, holding, and serving usually do not require one. Specialized processes such as smoking for preservation, curing, or reduced-oxygen packaging typically do. Confirm with your state or local health department before you start any of them.
What should be in a restaurant food safety plan?
At minimum: your menu grouped by process, a flow of each process, hazards and controls at each step, critical limits, monitoring procedures with who and how often, corrective actions, verification steps, training procedures and record forms. Keep revision dates so you can show the plan is maintained.
Who is responsible for the plan?
The Person in Charge (PIC) is responsible for active managerial control under the FDA Food Code. In practice, the owner or general manager approves the plan, and a certified manager runs it on every shift.
How long should I keep food safety records?
It depends on your jurisdiction. New York City, for example, requires 90 days after service for food prepared under an approved HACCP plan. Ask your local health department for your requirements and keep records at least that long.
Sources
-
FDA: Draft Guidance, Hazard Analysis and Risk-Based Preventive Controls, The Food Safety Plan
-
Food Protection Task Force: Food Establishment Plan Review Guidance
-
Ventura County: Guidance for Retail Food Facility Inspections
Recommended
We strive to keep all program details and requirements as accurate and current as possible. However, regulations may vary by location. For the most reliable and up-to-date information, please confirm requirements directly with your local state or jurisdiction.
