When a HACCP Plan Is Required

HACCP means hazard analysis and critical control points. It is a preventive system for identifying food-safety hazards, deciding which steps need control, setting measurable limits where appropriate, monitoring those limits, and responding when control is lost. Whether a written HACCP plan is legally required depends on the business, process, product, regulator, and applicable code. “Every food business must have a HACCP plan” is too broad.

Retail and food-service establishments

Restaurants and other retail food operations generally work under the state or local retail food code, which may adopt or adapt the FDA Food Code. The model Food Code requires an establishment to obtain regulatory approval and maintain a written HACCP plan for specified specialized processes, such as certain reduced-oxygen packaging, curing, smoking for preservation, or using additives to render food non-TCS. Other variances or alternative procedures can also require a plan. The exact section and approval process depend on the locally adopted code.

This does not mean an ordinary restaurant must always write a complete HACCP plan for every menu item. Every establishment still needs effective food-safety controls, employee knowledge, and compliance with the adopted code. Some jurisdictions or contracts may require broader plans, so check local rules and regulator instructions.

Federal product-specific HACCP rules

HACCP and FSMA preventive controls

HACCP and FSMA preventive controls share hazard analysis and preventive logic, but the regulations are not interchangeable. FSMA requires covered facilities to maintain a written food-safety plan that includes hazard analysis and risk-based preventive controls. The rule offers preventive-control options, including process, allergen, sanitation, supply-chain, and other controls when indicated by the hazard analysis. Certain seafood and juice facilities already subject to product-specific HACCP rules are exempt from specified FSMA requirements, subject to the statute and regulations.

How to decide which rule applies

1. Identify the operation: restaurant/retail, food manufacturing, seafood processing, juice processing, meat/poultry, or another setting.
2. Identify the food process and whether a specialized method or hazard creates a plan requirement.
3. Find the regulator and current rule: state/local code for retail, FDA rule for covered FDA-regulated facilities, or USDA-FSIS rule for meat and poultry.
4. Check exemptions, variances, and local amendments; do not infer them from a generic HACCP checklist.
5. Use the required plan format and obtain review or approval where the rule calls for it.

Exam traps

• Assuming all restaurants must keep a HACCP plan for all food operations.
• Assuming that because a process is safe, it is exempt from a required written plan or variance.
• Treating FSMA preventive-controls plans as identical to every HACCP plan.
• Forgetting that state and local authorities adopt and amend the FDA Food Code.
• Applying retail rules to a manufacturing facility or vice versa.

Key takeaway

Start with the product and operation. Retail rules, seafood/juice HACCP, FSMA preventive controls, and USDA meat/poultry HACCP have different scopes. For a restaurant exam question, focus on the adopted food code and the specialized processes that trigger a regulator-approved plan.

Start with the process and the regulatory trigger

A HACCP plan is not automatically required for every food establishment or every menu item. Whether one is required depends on the process, applicable Food Code provision, and the regulatory authority. The FDA model code identifies activities that require a variance and a HACCP plan, such as certain specialized processes. Examples can include reduced-oxygen packaging, curing, smoking for preservation, using additives to render a food non-TCS, or custom processing animals, depending on the exact facts and provision. Ordinary cooking and cooling controls still need management even when a formal HACCP plan is not mandated.

Distinguish a HACCP plan from routine procedures

A written procedure may be required for a specific control without being the same as a full HACCP plan and variance. Conversely, a process that changes the hazard profile or removes normal safeguards may require prior regulatory review. Ask: Is the method specifically listed? Does it require a variance? Is a written plan required by the adopted code? Has the authority approved it before operation? Never begin a specialized process merely because equipment is available or a vendor provides a recipe.

Worked scenario: reduced-oxygen packaging

A kitchen wants to vacuum-package cooked fish for extended refrigerated storage. This changes the oxygen environment and can create conditions for serious hazards such as botulism or Listeria growth. The operator should identify the exact Food Code section, consult the regulator before starting, obtain a variance where required, and submit a HACCP plan that explains hazards, critical limits, monitoring, corrective actions, verification, and records. A generic sous-vide recipe or refrigerator log does not satisfy those requirements by itself.

What a useful plan demonstrates

A complete plan is specific to the food, process, equipment, and facility. It identifies hazards at each step, the critical control points, measurable limits, who monitors them and how often, what happens when a limit is missed, and how the operation verifies that the system works. Records should let a reviewer reconstruct the process. A plan is not a binder that remains unchanged when ingredients, packaging, cook equipment, or shelf life changes; re-evaluate it when the process changes.

Exam traps

Do not answer “HACCP for all food” or “HACCP never needed in retail.” The correct response is process-specific and authority-led. Identify the special process, find the adopted provision, and determine whether it requires a variance, a plan, or both. The FDA Food Code is a model; state and local rules and approvals control actual operations.

Review before changing the menu

A process that was approved for one recipe may not cover a new ingredient, package size, machine, cooling method, or shelf life. Notify the authority and revise the plan when a meaningful process change affects hazards or critical limits. Keep the approved version accessible to the employees who perform the steps, not only in an office binder. If the regulator requires a variance, wait for approval before beginning the process. A demonstration batch is still food processing and is not exempt from the requirements.