Creating a HACCP plan means listing every step in your food preparation process, identifying the hazards at each step, and defining measurable controls that prevent those hazards from reaching your customers. This guide walks you through the entire process, from the preliminary work to the final documentation, so you end up with a plan that satisfies health inspectors and actually protects your business.
If you are not familiar with what a HACCP plan is, start with our overview of what a HACCP plan is and why your food business needs one. If you already understand the basics and want to jump straight to a template, see our HACCP plan template.
Before you start
Before you begin the seven steps of HACCP, you need to complete four preliminary tasks. These tasks give you the foundation for your hazard analysis. Skipping them leads to a plan full of gaps.
Assemble your HACCP team
Your HACCP team includes everyone responsible for food safety in your operation. For a solo food truck operator, the team is just you. For a larger catering or cloud kitchen operation, your team might include your head chef, kitchen manager, and any staff members who handle food at critical steps.
Each team member should have basic food safety training. Most states require at least one certified food protection manager per establishment. If no one on your team has formal training, consider completing a food safety manager certification before writing your plan.
List your team members with their names, roles, and food safety certifications. This becomes the HACCP team section of your plan document.
Describe your products
Write a clear description of the food products you prepare. Include:
- The categories of food you serve (grilled proteins, cold salads, soups, baked goods)
- Key ingredients, especially high-risk items like raw proteins, dairy, eggs, and the nine major allergens (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, sesame)
- How food is prepared (cooked to order, batch cooked, assembled from pre-made components)
- How food reaches the customer (served on-site, delivered, transported to event venues)
This product description gives context for every decision you make during the hazard analysis.
Identify your intended consumers
Who eats your food? The general public is the most common answer, but some operations serve populations that are more vulnerable to foodborne illness: children, elderly individuals, pregnant women, or immunocompromised individuals.
If you serve a high-risk population (hospital cafeteria, school lunch program, senior living facility), your critical limits may need to be stricter than the standard FDA Food Code minimums. For most food trucks, cloud kitchens, and caterers serving the general public, the standard limits apply.
Create your process flow diagram
Map every step your food takes from the moment raw ingredients arrive at your door to the moment the finished product reaches a customer. This flow diagram is the backbone of your hazard analysis. Every step becomes a row in your hazard analysis worksheet.
A typical flow diagram for a food truck in Texas looks like this:
- Receive ingredients at commissary kitchen
- Store in refrigeration or dry storage
- Prep at commissary (washing, cutting, marinating)
- Package and load onto truck
- Transport to service location
- Store on truck (cold holding)
- Cook to order
- Hold hot for service
- Assemble and plate
- Serve to customer
A catering operation adds transport and venue steps. A cloud kitchen adds delivery packaging and handoff steps. Your flow diagram does not need to be a fancy graphic. A numbered list is perfectly acceptable, as long as it captures every step where food is handled.
For complete flow diagram examples for different business types, see our HACCP plan examples.
Step 1: Conduct a hazard analysis
This is the most important step in the entire process. For each step in your flow diagram, identify every biological, chemical, and physical hazard that could occur.
Biological hazards
These are the hazards that cause the most foodborne illness. Bacteria like Salmonella, E. coli O157:H7, Listeria monocytogenes, and Campylobacter. Viruses like Norovirus and Hepatitis A. Parasites in undercooked seafood or meat.
Biological hazards are most likely at these steps:
- Receiving. Ingredients delivered at unsafe temperatures allow bacteria to multiply during transit.
- Storage. Refrigeration failures or improper storage (raw meat above ready-to-eat foods) create contamination risks.
- Cooking. Insufficient cooking temperatures allow pathogens to survive.
- Holding. Food held in the temperature danger zone (41°F to 135°F) allows rapid bacterial growth.
- Cooling. Cooked food that cools too slowly passes through the danger zone for too long.
Chemical hazards
Chemical hazards include allergen cross-contact, cleaning chemical residues on food contact surfaces, and pesticide residues on produce.
Allergen cross-contact is especially important for cloud kitchens running multiple brands. If one brand uses peanuts and another brand advertises as peanut-free, shared prep surfaces and equipment create a chemical hazard that must be addressed in your plan.
Physical hazards
Physical hazards include metal fragments from worn blades or grills, glass from broken containers, wood splinters from cutting boards, and personal items like bandages or jewelry. These are less common than biological hazards but still need to be identified.
Determine significance
Not every hazard at every step is significant. A hazard is significant if it is reasonably likely to occur and would cause illness or injury if not controlled. For each hazard you identify, ask two questions:
- How likely is this hazard to occur at this step?
- How severe would the consequences be if it did occur?
If the answer to both questions is "not very," the hazard is probably not significant. If either answer is "likely" or "severe," the hazard is significant and needs a preventive measure.
Document your reasoning. Inspectors want to see that you thought about each hazard, not just that you listed the obvious ones.
For each significant hazard, write down the preventive measure that controls it. This feeds directly into Step 2.
Step 2: Determine Critical Control Points
A Critical Control Point (CCP) is a step in your process where you can apply a control that is essential to preventing, eliminating, or reducing a food safety hazard to an acceptable level.
Not every step with a hazard is a CCP. A CCP is the last opportunity to control a specific hazard before the food reaches the customer. Use the CCP decision tree from the FDA HACCP principles to make this determination:
- Do preventive measures exist for this hazard at this step?
- Does this step eliminate or reduce the hazard to an acceptable level?
- Could the hazard increase to an unacceptable level if not controlled at this step?
- Will a subsequent step eliminate or reduce the hazard?
If a subsequent step will control the hazard, the current step is not a CCP. For example, if you wash produce at the prep step and then cook it at a later step, the cooking step (not the washing step) is the CCP for biological hazards on that produce, because cooking is the step that eliminates pathogens.
Most small food businesses end up with 2 to 5 CCPs. The most common ones are:
- Cooking. Almost always a CCP because heat is the primary method for eliminating biological hazards in proteins.
- Cold holding. Keeping refrigerated and cold food at 41°F or below prevents bacterial growth.
- Hot holding. Keeping cooked food at 135°F or above prevents bacterial growth during service.
- Receiving. Verifying delivery temperatures prevents contaminated ingredients from entering your operation.
- Cooling. Controlling the rate at which cooked food cools prevents bacterial growth during the transition from hot to cold.
If your plan has more than 7 CCPs, you may be over-identifying. Review each one and confirm that it is truly a point where control is essential, not just a step where good practice is helpful. For a deeper explanation of the seven principles behind this process, see the 7 HACCP principles explained.
Step 3: Establish critical limits
For each CCP, define the measurable boundary that separates safe from unsafe. Critical limits must be specific, measurable numbers, not vague descriptions.
The FDA Food Code provides the baseline critical limits for most food service operations:
| Food | Minimum Internal Temperature | Hold Time | |------|------------------------------|-----------| | Poultry (chicken, turkey) | 165°F | 15 seconds | | Ground meat (beef, pork) | 155°F | 15 seconds | | Whole meat cuts (steaks, chops) | 145°F | 15 seconds | | Fish and seafood | 145°F | 15 seconds | | Eggs for immediate service | 145°F | 15 seconds | | Hot holding | 135°F | Continuous | | Cold holding | 41°F or below | Continuous | | Cooling (stage 1) | 135°F to 70°F | Within 2 hours | | Cooling (stage 2) | 70°F to 41°F | Within 4 additional hours |
Your state may have additional or stricter requirements. Always verify your critical limits against your specific state's food code. You can find state-specific details on our state compliance pages.
Bad critical limit: "Cook chicken until done."
Good critical limit: "Cook chicken to internal temperature of 165°F for 15 seconds, measured with a calibrated probe thermometer inserted into the thickest part."
The difference is that the second version is measurable, verifiable, and leaves no room for interpretation.
Step 4: Establish monitoring procedures
For each CCP, define exactly how you will verify that critical limits are being met. Monitoring procedures answer four questions:
What is being monitored? The internal temperature of grilled chicken breast at the thickest part.
How is it monitored? Using a calibrated digital probe thermometer (brand/model if you want to be specific).
When is it monitored? Every batch of chicken before it leaves the grill, and every 2 hours for items in hot holding.
Who monitors it? The cook on duty during service, or the owner/operator for a solo food truck.
Monitoring must happen at a frequency that catches problems before unsafe food reaches customers. For cooking, that means checking every batch or every individual item. For cold holding and hot holding, checking every 2 hours is standard.
Every monitoring check must be recorded. A temperature check that is not written down might as well not have happened, because an inspector has no way to verify it occurred. This is where paper logs or digital tools like PassMyKitchen come in. Your monitoring forms should include columns for the date, time, what was checked, the reading, the initials of the person who checked, and any corrective action taken.
For guidance on setting up your temperature logging system, see our temperature log guide.
Step 5: Establish corrective actions
When monitoring reveals that a critical limit has been violated, you need a predefined response. Corrective actions should be written in advance so your team knows exactly what to do in the moment, without needing to make judgment calls under pressure.
Each corrective action plan should address four things:
- Identify the cause. Why did the deviation happen? Was the grill not hot enough? Did the cooler door get left open? Did a delivery arrive late?
- Control the affected product. What happens to the food that was outside the critical limit? Discard it? Continue cooking it? Move it to a working cooler?
- Fix the process. What do you do to prevent the deviation from continuing? Adjust the grill temperature? Repair the cooler? Change suppliers?
- Document everything. Record the deviation, the corrective action taken, who took it, and any follow-up.
Here are corrective actions for common CCP violations:
Cooking CCP: chicken reads 155°F instead of 165°F. Continue cooking until the internal temperature reaches 165°F for 15 seconds. Record the initial temperature, the corrective action, and the final temperature. If the chicken cannot be brought to temperature (equipment failure), discard it.
Cold holding CCP: cooler reads 47°F. Check how long the cooler has been above 41°F. If less than 2 hours, move food to a backup cooler or add ice immediately. If over 2 hours, discard all potentially hazardous foods that were in the cooler. Record the temperature, the estimated time above 41°F, and the action taken.
Receiving CCP: raw shrimp arrives at 50°F. Reject the delivery. Record the supplier, the product, the temperature reading, and the rejection. Contact the supplier to report the issue and request a replacement delivery.
A corrective action log with zero entries over several months is a red flag for inspectors. It suggests either perfect compliance (unlikely) or that deviations are not being recorded (more likely). Honest documentation of occasional deviations and appropriate responses actually builds inspector confidence.
Step 6: Establish verification procedures
Verification confirms that your entire HACCP system is working as designed. Monitoring checks individual CCPs in real time. Verification steps back and checks the system as a whole.
Verification activities include:
Thermometer calibration. Calibrate your thermometers at least once per week using the ice-point method: fill a cup with crushed ice and water, insert the thermometer, and confirm it reads 32°F (plus or minus 2°F). If it does not, adjust or replace the thermometer. Record each calibration with the date, the reading, and any adjustment made.
Record review. Review your monitoring records at least once per week. Look for patterns: is the same cooler consistently reading close to 41°F? Is one cook's chicken consistently reading lower temperatures than another's? Patterns can reveal problems before they become critical violations.
Internal audits. Walk through your entire operation at least once per quarter and observe whether your team is following the HACCP plan. Are they actually checking temperatures at the required frequency? Are they using the right thermometer? Are they recording results accurately?
Annual plan review. At least once per year, review the entire HACCP plan document. Has your menu changed? Have you added new equipment? Has your state updated its food code? Update the plan to reflect your current operation.
The USDA Food Safety and Inspection Service emphasizes that verification is what separates a plan on paper from a system that actually works. Without verification, you have no way to know if your monitoring is accurate, your critical limits are being met, or your corrective actions are effective.
Step 7: Establish recordkeeping
Records are the proof that your HACCP system works. Without records, everything else is just theory. Inspectors will ask to see your records, and "we do it but we don't write it down" is not an acceptable answer.
Required records for a HACCP-based food safety plan:
- Temperature logs. Daily cooking temperatures, cold holding temperatures, and hot holding temperatures for every CCP.
- Receiving logs. Temperature and condition checks for every delivery of potentially hazardous foods.
- Cleaning and sanitizing logs. Documentation that food contact surfaces, equipment, and facilities are being cleaned on schedule.
- Corrective action reports. Every time a critical limit was not met, what happened, what you did about it, and what you did to prevent it from happening again.
- Calibration records. Documentation of thermometer calibrations with dates, readings, and adjustments.
- Plan review history. Dates when the HACCP plan was reviewed and any changes made.
- Training records. Documentation that your team has been trained on the HACCP plan and their specific responsibilities.
How long should you keep records? Most health departments require a minimum of one year. Some states require two years. When in doubt, keep records for at least two years.
Paper logs work, but they get lost, damaged, and disorganized. Digital logging through PassMyKitchen keeps all your records in one place, time-stamped and backed up, always ready for an inspector to review.
Putting it all together
Once you have completed all seven steps, compile everything into a single HACCP plan document. The standard format includes:
- Cover page with business information, plan date, and signatures
- HACCP team roster with qualifications
- Product description and intended use
- Process flow diagram
- Hazard analysis worksheet (one row per process step)
- CCP summary table (one row per CCP with critical limits, monitoring, corrective actions, verification, and records)
- Blank monitoring forms for daily use
- Corrective action log template
For a detailed walkthrough of each section with fill-in guidance, see our HACCP plan template. For annotated examples showing what completed plans look like for different business types, see our HACCP plan examples.
Print your plan, or store it digitally where your entire team can access it. Make sure every team member knows where the plan is, understands the CCPs relevant to their role, and knows what to do when a critical limit is not met.
The fast way: generate your plan with PassMyKitchen
Following the seven steps above works, but it takes time. You need to research your state's food code, identify hazards specific to your menu, write custom monitoring procedures, and format everything into a professional document. Most food business owners spend 1 to 2 weeks completing this process on their own.
PassMyKitchen generates a complete, customized HACCP plan in about 30 seconds. You enter your business type, state, city, menu items, and equipment. The AI builds a plan that includes:
- State-specific critical limits and regulatory references
- Hazard analysis tailored to your exact menu
- CCPs appropriate for your business type and operation
- Monitoring procedures matched to your equipment
- Ready-to-use digital monitoring forms on your phone
Then the app helps you follow the plan every day with digital temperature logs, cleaning checklists, receiving inspections, and corrective action tracking.
Simplify your compliance with PassMyKitchen
You now know how to create a HACCP plan from scratch. But you do not have to do it manually. PassMyKitchen builds your customized plan in 30 seconds and gives you the digital tools to stay compliant every day.
Start your free trial and see your HACCP plan in 30 seconds.
Frequently asked questions
How long does it take to create a HACCP plan from scratch?
Most food business owners spend 1 to 2 weeks creating a HACCP plan manually, including research, writing, and review. The bulk of the time goes to researching your state's food code and writing the hazard analysis. With a consultant, the process takes 2 to 4 weeks including a site visit. With PassMyKitchen, you get a customized plan in about 30 seconds after completing your business profile.
Do I need a certification to create a HACCP plan?
No formal certification is required to create a HACCP plan for your own food business. However, having a food safety manager certification (like ServSafe or a state-approved equivalent) gives you the knowledge to create a stronger plan and shows inspectors that you understand food safety principles. Many states require at least one certified food protection manager per food establishment regardless of whether you write your own plan.
Can AI write an accurate HACCP plan?
Yes, when the AI is trained on current FDA Food Code requirements, state-specific regulations, and food safety science. PassMyKitchen's AI generates plans based on the same principles and critical limits that food safety consultants use. The key advantage is that the AI knows the specific food code requirements for every US state and can tailor the plan to your exact menu, equipment, and business type. The result is a plan that is more customized than a generic template and available in seconds instead of weeks. For a comparison of HACCP plan creation methods, see our HACCP plan software guide.
What do I do when I change my menu?
Every menu change requires a review of your HACCP plan. If you add a new protein (say, adding raw fish to a menu that previously only had cooked chicken), you need to update your hazard analysis because the new item introduces different biological hazards with different critical limits. If you add an allergen-containing ingredient, your chemical hazard analysis changes. If you add a new preparation method (adding a deep fryer when you previously only grilled), your flow diagram changes. Review your plan, update the affected sections, and note the revision date on the cover page. PassMyKitchen makes this easy because updating your menu in the app automatically regenerates the relevant sections of your plan.