Food Safety Plan for US Restaurants: FDA 2022 Guide

The short version. In the US, HACCP is the international standard behind every state's food safety regulations. But US operators call it a Food Safety Plan — and that is what the health inspector asks for when they walk in. FDA Food Code 2022 is the federal framework. Your state adopts it (California enforces it through CalCode §113700-114437). Seven principles. Critical temperatures in °F. Nine allergens. And documentation that has to reflect what actually happens in your kitchen — not what you wish happened. This guide gives you the full method.

What is a food safety plan — and why does the US call it that?

HACCP (Hazard Analysis and Critical Control Points) is the name of the international methodology. US operators and health departments use the term Food Safety Plan — that is what you will see on FDA documents, state inspection forms, and health department guidance.

Same framework. Different name. And if the health inspector asks you for your "food safety plan" and you hand them something titled "HACCP binder," that is fine. What matters is the content.

Before I get into the detail: most operators I have worked with know they are supposed to have a food safety plan. The problem is the day the inspector walks in and asks to see it. Fifteen minutes of hunting through a filing cabinet, temperature logs from three months ago, and an allergen section that still does not include sesame. That is where the violation comes from — not from the cooking.

Is a food safety plan mandatory in US restaurants?

Yes. No exceptions.

FDA Food Code 2022 — the federal model food code — requires every food establishment to implement a food safety management system based on HACCP principles. States adopt and enforce the FDA Food Code (California through CalCode §113700+). There is no exemption for small operators, independent restaurants, or food trucks.

The practical enforcement mechanism: your health inspector checks that your food safety plan exists, is current, matches your actual operation, and that your PIC (Person in Charge) can explain the procedures. Per FDA Food Code §2-102.11, the PIC must be able to demonstrate knowledge of food safety principles — including the contents of your food safety plan.

Breach consequences in California range from administrative notice to conditional permit suspension and emergency closure for imminent health hazards.

What the health inspector checks first

When the health inspector walks into your kitchen, these are the items that swing the score:

• Temperature traceability: are your logs current, dated, with no gaps?
• Food safety plan: does it exist, is it signed, does it match what is actually happening?
• Date marking: TCS food labeled with prep date and discard date per §3-501.17?
• Food handling: raw and ready-to-eat foods separated, FIFO followed?
• Staff training: food handler cards current, PIC knowledge demonstrable?

The 7 HACCP principles — how they apply in your US kitchen

A food safety plan is built on 7 structured principles applied in order. It is not a menu you pick from — it is a chain. One gap and you are exposed.

Principle 1 — Analyze hazards

Identify every biological hazard (bacteria, viruses, parasites — Salmonella, Listeria, E. coli O157:H7 are the big three in restaurant contexts), chemical (cleaning chemical residue, allergen cross-contact), and physical (bone fragments, glass, foreign objects) that can appear at every step of your operation.

Practical approach: map every step — receiving, cold storage, thawing, prep, cooking, cooling, hot holding, service — and list what can go wrong at each one.

Principle 2 — Identify Critical Control Points (CCPs)

A CCP is a step where a control measure is essential to prevent or eliminate a hazard. Classic restaurant CCPs:

• Cooking: the step where heat eliminates pathogens
• Cooling: the step where improper cooling allows pathogen growth
• Cold holding: the ongoing control that keeps TCS food safe

Do not confuse CCPs with Prerequisite Programs (PRPs): PRPs are baseline measures (cleaning, pest control, employee hygiene). CCPs are the specific points where failure directly causes foodborne illness.

Principle 3 — Set critical limits

For each CCP, you set a hard threshold. The FDA Food Code 2022 key temperatures (all in °F):

Principle 4 — Establish monitoring

Define who checks, when, and how. Temperature logs are the most visible example: who reads the walk-in, how often, on what record? The monitoring has to be systematic, traceable, and realistic. A monitoring plan nobody follows because it is too burdensome is legally worthless — and practically dangerous.

Principle 5 — Define corrective actions

If a limit is breached, what is the documented procedure? If your walk-in climbs to 48°F overnight, you need a written decision: what happens to the food? Discard? Cook immediately? Document the corrective action taken and who made the call.

Without a written corrective procedure you are exposed twice: you cannot prove you reacted correctly, and you cannot show the inspector your system handles failures.

Principle 6 — Verify the system works

Audit your food safety plan regularly: does it still match your operation? Changed your menu, added catering, hired new staff? Your food safety plan needs to move with you. Annual reviews minimum. Verification also means internal self-audits and microbiological swabs of food contact surfaces.

Principle 7 — Document and keep records

Everything gets written down. Temperature readings, corrective actions, training delivered, pest control visits, receiving logs, allergen incidents. Documentation is the proof you are in control — without it, you have nothing to show the inspector.

This is the most neglected principle. And the one that costs the most when the inspector walks in unannounced.

The 6 documents inside a complete food safety plan

Your food safety plan bundles six categories of documentation. Together they cover every risk area the health inspector evaluates.

1. Good Hygiene Practices (GHPs)

Staff hygiene procedures, uniform policy, hand washing protocol, illness reporting policy. FDA Food Code §2-201.11 requires you to exclude or restrict sick employees. Your policy for managing this — and documenting it — belongs here.

2. HACCP plan (the 7 principles applied to your operation)

The actual hazard analysis for your kitchen, your CCPs, your critical limits, monitoring frequency, corrective actions. This section should describe your restaurant, not a generic food service template.

3. Cleaning and sanitizing procedures

Cleaning schedule, frequencies, approved products, concentrations, traceability of who cleaned what and when. The signed cleaning schedule is one of the first things inspectors look for. Unsigned = unverified.

4. Allergen management

FDA recognizes 9 major allergens under FALCPA + FASTER Act (sesame added January 2023): Milk, Eggs, Fish, Shellfish, Tree Nuts, Peanuts, Wheat, Soybeans, Sesame.

Your allergen documentation needs to cover: menu item allergen matrix, cross-contact prevention procedures, staff training on allergen awareness. California SB 68 (CalCode §114094.5) adds disclosure requirements for chains with 15+ locations — check your specific obligations. For all restaurants, allergen accuracy is a Priority Foundation violation if missing.

5. Staff training documentation

Food handler cards (required by California SB 476 — all food handlers must have an ANSI-accredited card within 30 days of hire), food safety manager certification for your PIC (ServSafe or equivalent ANSI-CFP program), internal training records.

A trained team without documentation is a team that does not exist in the inspector's eyes.

6. Pest control

Pest control contract, inspection visit frequency, intervention reports, corrective actions taken. An active pest control program with documented visits is standard expectation.

Case study — two inspections, two outcomes

La Verrerie, 2017. Hotel-restaurant in France. Inspector walked in on a Tuesday morning. I had documentation — somewhere. I spent 30 minutes hunting for temperature logs in front of the inspector. Three weeks of records were missing because the cook who usually did them had been sick. That gap in traceability cost me.

What I would have given for a system that logs records automatically and flags the gap the moment it happens.

The Lunch Wagon, 2024. Food truck in France, taken over in financial difficulty. Inspector showed up the day after I was told to expect one. Time spent pulling together documentation: zero minutes. Why? Because temperature logs, cleaning records, and training documents had been entered in real time from the first day. Open the tool, export, show the inspector. Clean pass.

The difference was not the level of hygiene. It was the traceability method.

Paper vs digital food safety plan — what actually changes

The paper cost is not zero. 30 minutes a day at $18/hour of labor is over $3,200/year in time. Not counting the catch-up nights before inspection.

If you want to see what a digital food safety program looks like for your kitchen, the demo takes 20 minutes.

Common food safety plan mistakes in US restaurants

Writing the plan once at opening and never updating it. The inspector compares what your document says with what they see. Any gap between the two is an automatic non-conformity — regardless of how good your actual practices are.

Using a generic template without adapting it. Inspectors recognize templates that do not describe an actual kitchen. Your food safety plan has to describe your menu, your team, your suppliers, your CCPs.

Not including sesame in your allergen list. The FASTER Act made sesame the 9th FDA major allergen effective January 1, 2023. If your allergen documentation still lists 8 allergens, it is out of date.

Temperature logs with gaps. "We do them most days" is not traceability. Every day, every unit, dated and initialed.

No corrective action records. An operation with zero non-conformities ever is not more likely to pass — it is more likely to look suspicious. The inspector does not believe a refrigerator has never drifted. Show them you caught it, documented it, and fixed it.

The bottom line

A food safety plan is not an admin chore you do once and file away. It is the living proof that your kitchen controls food safety risk every day.

Three things to take away:

1. The 7 principles are a chain. You cannot set up monitoring (Principle 4) without knowing your CCPs (Principle 2). Skip a step and you have holes. The method is sequential.

2. The plan has to live with your operation. New menu item, new supplier, new hire — update the plan in the same move. A food safety plan frozen at opening will get caught at inspection.

3. Documentation is your defense. The day something goes wrong — a customer complaint, a bad reading, an inspection — your records speak for you. Without them, you have nothing. With them kept current, you handle the situation in five minutes.

I learned that lesson the hard way in 2017 — 30 minutes hunting for temperature logs in front of an inspector. That has not happened to me again. Not because I got more careful with paper. Because I stopped relying on paper for the parts that can be automated.

Ready to build a food safety plan your health inspector can actually work with? Start with the demo at /us/demo.

Last updated May 2026. Written by Cyril Quesnel, founder of Onrush. Sources: FDA Food Code 2022 (fda.gov/food/fda-food-code), California Retail Food Code §113700-114437, CDC (cdc.gov/foodsafety), FASTER Act (Public Law 117-11).