Browse all questions

A critical control point is a step where control is essential and can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level, such as a cook step that destroys pathogens. Note the scope word 'Any': bare-hand contact is controlled by the hygiene rules that run underneath HACCP, including the no-bare-hand-contact rule for ready-to-eat food, so not every step a hand touches is a CCP. Ingredient cost and how many covers a station turns describe the business, not a point where losing control would let a hazard reach the customer.

The person in charge must actively ensure that employees follow required food safety practices, such as proper handwashing, cooking, and cooling, and must know when to restrict or exclude an ill employee. The PIC's job is oversight of food safety, not doing production work personally; cooking every ticket would pull the PIC away from that oversight. Running the cash drawer and approving advertising are business duties the Food Code does not assign to the PIC.

Shiga toxin-producing E. coli is one of the reportable 'Big Six' pathogens; an employee diagnosed with it must be excluded from the food establishment, not merely restricted to warewashing or other non-food duties, and the regulatory authority must be notified. The employee generally may not return until cleared under the Food Code's reinstatement criteria, so the end of symptoms alone does not earn a return to work. Gloves do not stop an infected worker from shedding this pathogen.

When taking a complaint, the manager should stay calm and record what the person ate, the date and time, the symptoms and when they began, and how to reach the person, while showing concern and not admitting fault. This information helps the operation and the health department investigate a possible outbreak. Negotiating a settlement, refusing to talk, or collecting payment details gathers nothing an investigation can actually use.

The Food Code allows an inspector to assess the person in charge's demonstration of knowledge by asking about hazards and controls, such as which pathogen is a concern in a given food and how it is controlled. Correct answers, holding a valid manager certification, or compliance with the Code can satisfy this. Menu prices, length of service, and plating speed are not what the Code asks the PIC to demonstrate.

A food safety management system aims to control the CDC's five identified risk factors: food from unsafe sources, inadequate cooking, improper holding temperatures, contaminated equipment, and poor personal hygiene. Building procedures around these risk factors targets the actual causes of foodborne illness. Parking, seating, server sections, and the specials rotation are business decisions that control none of those five factors.

Record-keeping documents that monitoring occurred and critical limits were met, giving the operation evidence of control that supports verification and, if an illness is reported, an investigation. Good records also reveal trends before they become problems. A log filled in ahead of the check records nothing that happened, a signature is not a substitute for training, and records must be kept continuously rather than produced only when an inspection is due.

Flooding is an imminent health hazard: floodwater can carry sewage and chemicals that contaminate food and surfaces. The operation must cease operations, discard food and packaging contaminated by the water, and notify the regulatory authority, resuming only when the hazard is corrected and, where required, reopening is approved. Oven-drying saturated sacks does not remove sewage or chemical residue, and squeegeeing, mopping, or working around the water leaves the hazard in place — the kitchen floor was flooded too, not just dry storage.

The last stage of crisis response is learning from the event: analyzing the root cause and revising standard operating procedures, training, and monitoring so the same breakdown cannot recur. This continuous-improvement step turns a crisis into a stronger food safety system. Reviewing an outbreak does not exempt the operation from routine inspection, does not close the health department's file, and is not about pinning the failure on one worker.

For a specialized process like cook-chill with reduced-oxygen packaging, the manager must first secure any required variance and an approved HACCP plan, then train staff to follow it, before the process begins. Doing the paperwork after the fact leaves the operation running an unapproved, higher-risk process. New equipment and use-by labels are part of the plan but do not replace the approval, and the regulatory authority, not the supplier, is the body that grants it.

Organized invoices and lot or code information let a manager quickly determine whether the recalled lot is in the building and remove it before it can be served. Speed matters in a recall, especially a Class I recall involving a serious health risk. Suppliers do not require handwritten duplicates of invoices, and neither office decor nor tip accounting helps anyone find an affected lot.

Critical limits must be measurable values, such as a temperature, time, or concentration, so that anyone monitoring the step can objectively decide whether the critical control point is under control. Vague limits like 'cook until done' cannot be verified, and a limit that changes with whichever cook is on shift is not a limit at all. Measurable limits make monitoring, corrective action, and verification possible; how the menu looks and what guests enjoy seeing are beside the point.

A boil-water advisory means the tap water may be unsafe, so the operation must switch to bottled or treated water for drinking, ice, and food preparation, or cease operations if it cannot operate safely, following the regulatory authority's instructions. Untreated tap water can carry pathogens even when it runs clear and odorless, and an ice machine filter is not a treatment device — freezing does not kill what is in the water. The advisory takes effect when the authority issues it to the public; no individual phone call to the restaurant is coming, and waiting for one means serving unsafe water in the meantime. This may function as an imminent health hazard requiring notification.

Active managerial control means treating a recurring gap as a signal to find and fix the root cause, whether that is understaffing, unclear duties, or a training issue, so the monitoring step is consistently completed. Waiting for an inspector to raise it, removing the log so the gap cannot be seen, and writing up a shift without changing anything all hide the problem instead of solving it. The goal is a system that catches and corrects itself.

Operating a molluscan shellfish life-support display tank is a specialized process the Food Code lists as requiring a variance and a HACCP plan, because the tank water and holding conditions can affect the safety of filter-feeding shellfish. The plan must address water treatment, monitoring, and records. Note the scope word 'Only': a consumer advisory is separately required wherever raw shellfish is offered, but it does not satisfy the variance requirement on its own. The routine establishment permit does not cover the tank, and the approval comes from the regulatory health authority, not a wildlife agency.

Active managerial control is the purposeful incorporation of specific actions or procedures by management into the operation of the business to attain control over foodborne illness risk factors, and it embodies a preventive rather than a reactive approach through continuous monitoring and verification. Fixing what an inspector finds is the reactive posture the definition is written against.

A food safety management system is the specific set of actions taken to prevent foodborne illness risk factors for that operation's food and preparation, and it includes written procedures, training plans, and monitoring records that control the operational steps contributing to illness. Menus, permits, and supplier lists are business documents, not the system itself.

The Supplement added food defense to the list of subjects a person in charge must be able to demonstrate knowledge of during an inspection, and separately added a duty to train employees on food defense. The other subjects matter to running a business but are not part of the demonstration of knowledge.

The new section requires a written food safety management system to be developed and maintained, implemented in the establishment during all hours of operation, and made available to the regulatory authority on request, within four years of the jurisdiction adopting the Code. Certain low-risk operations may be exempted by the regulatory authority.

The seven principles run in order: conduct a hazard analysis, determine critical control points, establish critical limits, establish monitoring procedures, identify corrective actions, verify that the system works, and keep records. A team cannot decide where the control points are until it knows what hazards the process actually carries.

A critical limit is the measurable boundary that separates safe from unsafe at a critical control point, stated as a number a cook can check with a thermometer and a clock. Corrective action is what happens when the limit is missed, and verification is the periodic review that confirms the whole plan works.

The plan must contain a flow diagram or chart for each specific food or category that identifies each step in the process and which of those steps are critical control points. Staffing, supplier, and equipment details appear elsewhere in the submission but are not what the flow diagram is for.

For each critical control point the plan identifies the significant hazards, the critical limits, the method and frequency of monitoring by the designated employee or person in charge, the action to take if a limit is not met, how the person in charge verifies the procedures are followed, and the records kept. Price, brand, and output are not part of that summary.

Using food additives or components such as vinegar to render a food so it is not time/temperature control for safety requires a variance from the regulatory authority. A pH meter and trained staff are how the operation then proves it hits its critical limits, but they do not substitute for the variance itself.

Operating a molluscan shellfish life-support system display tank used to store or display shellfish offered for human consumption requires a variance, as do smoking for preservation, curing, using additives to preserve or render food non-TCS, most reduced-oxygen packaging, custom processing animals for personal use, and sprouting seeds or beans. Buying cured product, posting an advisory, and cooling in an ice bath are ordinary operations.

A HACCP plan is not required when reduced-oxygen packaged TCS food is always labeled with the production time and date, held at 41°F or less during refrigerated storage, and removed from its package within 48 hours after packaging. All three conditions must hold together, and a permit alone has never been one of them.

An imminent health hazard such as a fire, flood, extended interruption of electrical or water service, sewage backup, misuse of poisonous or toxic materials, the onset of an apparent outbreak, or a gross insanitary occurrence requires the permit holder to stop operations and notify the regulatory authority. The other three are ordinary problems a manager corrects on the spot.

A permit holder need not discontinue operations in an area of an establishment that is unaffected by the imminent health hazard. The regulatory authority may also agree to continued operation during an extended interruption of electrical or water service if the risk can be managed, which is why notification comes first.

The person in charge must be a certified food protection manager who has shown proficiency by passing a test that is part of an accredited program. Certain establishments the regulatory authority deems minimal risk are excepted, but seniority, ownership, and a food handler card do not satisfy the requirement.

A food establishment must have written procedures for employees to follow when responding to vomiting or diarrheal events that discharge vomitus or fecal matter onto surfaces, addressing the specific actions that minimize the spread of contamination and the exposure of employees, consumers, food, and surfaces. Supplies and contractors support the procedure but do not replace it.

The regulatory authority conducts one or more preoperational inspections to verify that the establishment is constructed and equipped in accordance with the approved plans, has established its required standard operating procedures, and complies with law. Leases, logs, and supplier letters are not that verification.

Food that has not reached 70°F within two hours has failed its first cooling limit, so it is either reheated to 165°F and cooled again from the start or discarded. Recording an excuse, waiting another hour, or moving the pan leaves food in the danger zone past the limit the plan set.

A monitoring procedure is only real when a specific employee owns it and knows how often to do it, which is why the plan identifies the method, the frequency, and the designated employee or person in charge. Unassigned checks are the ones that show up as blank rows on a log after an outbreak.

The operation matches the recall notice against its purchase records and lot numbers, pulls the affected product from inventory, and holds it in a designated area separated from food and equipment, labeled so no one uses it, until the supplier or regulator gives disposition instructions. Cooking a recalled product does not make it safe, and throwing it away destroys the evidence and the credit.

A complaint log captures the food eaten, the date and time of the meal, when symptoms started, what the symptoms are, whether a doctor was seen, and how to reach the guest, because onset time and symptoms are what narrow the list of possible pathogens. Offering compensation during the first call can look like an admission and does nothing for the investigation.

One trained spokesperson keeps the facts straight for the health department, the media, and guests, so the operation is not contradicting itself while an investigation is running. It does not limit the regulator's access, reduce anyone's duty to cooperate, or license silence.

Verification is the periodic review that confirms the plan is being followed and is actually controlling the hazard, and it draws on records, observation, and equipment checks. It is separate from monitoring, which happens continuously during production, and from record-keeping, which supplies the evidence.

A critical control point is a point in the flow of food where control can be applied and is essential to prevent, eliminate, or reduce a hazard to an acceptable level, such as cooking, cooling, or reheating. Cost, staffing, and duration describe the operation, not the point where food safety is actually decided.

Based on the risks inherent to the operation, the person in charge must demonstrate knowledge of food safety to the regulatory authority during inspections and on request, including the relationship between temperature and pathogen growth. That duty belongs to whoever is in charge at the time, not only to the owner.

Active managerial control depends on procedures people actually follow, which comes from repeated, task-specific training reinforced on the job rather than a one-time class. A binder no one can reach and a yearly meeting do not reach the overnight prep cook who is cooling the stock.

Sprouting seeds or beans requires a variance from the regulatory authority, because the warm, moist conditions that germinate a seed also multiply any Salmonella or E. coli on it. Logs and agreements may be part of what the operation proposes in support of the variance, but none of them replaces it.

Reviewing what failed and changing the procedure and the training is how a food safety management system improves, and it is the part most often skipped once service returns to normal. It is not a filing requirement, it earns no inspection credit, and it does not shift blame onto the people who followed a broken procedure.

Cleaning physically removes food residue, grease, and dirt; sanitizing then uses heat or chemicals to reduce pathogens on that already-clean surface to safe levels. They are two different steps, not one step repeated, and the order cannot be reversed: a detergent wash alone does not sanitize, and sanitizer cannot reach microbes through a layer of soil. Water temperature is not the dividing line either, because the third sink may hold either hot water or a chemical solution.

For manual hot-water sanitizing in a three-compartment sink, items must be immersed in water maintained at 171°F or hotter for at least 30 seconds; heat alone does the sanitizing, so the water has to be hot enough to kill pathogens in that half minute. 110°F is only the minimum for the detergent wash compartment, 135°F is a hot-holding temperature, and 75°F sits inside the danger zone. None of the three sanitizes, no matter how long the soak runs.

A chlorine sanitizing solution should be roughly 50 to 100 ppm, with water between 55 and 100°F and at least about 7 seconds of contact, and it is verified with chlorine test strips. 10 ppm is far too weak to sanitize, and quat strips do not read chlorine at all. 200 ppm and 500 ppm are above the range for a food-contact rinse, leaving corrosive residue, and water near 40°F slows chlorine's action badly no matter how long the contact runs. Only the 50 to 100 ppm combination sits inside all three windows at once.

Food-contact surfaces of equipment used with TCS food in continuous operation must be cleaned and sanitized at least every 4 hours, because pathogens multiply on the soil left on the blade well before that. Stretching the interval to 12 hours or to the end of the shift gives them the whole service to grow, and waiting for visible soil is later still: a slicer is unsafe long before the residue can be seen. Cleaning is also required after each use, when switching between raw and ready-to-eat food, and after any interruption.

An air gap, an unobstructed vertical space between a water outlet and the flood rim of the receiving fixture, is the most reliable backflow prevention because there is no physical connection for contaminated water to travel back through. The gap should generally be at least twice the diameter of the supply opening and never less than one inch. A closed valve and a tight gasket only hold pressure and can fail or be left open, and a hose resting in a mop bucket is the cross-connection an air gap exists to prevent.

A high-temperature dish machine must reach at least 180°F at the final rinse manifold so the dish surface itself reaches about 160°F, which is what actually sanitizes. Detergent cleans but does not sanitize, so a 120°F rinse leaves items washed and unsanitized; 140°F and 100°F are below what heat sanitizing requires, and lengthening the cycle at those temperatures does not make up the difference. Verify the rinse each shift with the machine gauge or a heat-sensitive indicator.

Toxic materials such as cleaners and pesticides must be stored in a designated area away from food, equipment, utensils, and single-service items, and below them so nothing can spill or drip down onto food. A low shelf inside the walk-in is still storage among food and is not allowed; a shelf above the prep table puts the drip path straight onto the work surface. Working containers must also be clearly labeled with the product's common name, so unlabeled bottles fail on that count as well.

The proper sequence is to scrape or pre-rinse the item, wash in the first compartment with detergent and water at 110°F or hotter, rinse in the second with clean water, sanitize in the third, and then air dry. Sanitizing before washing is useless because soil shields the microbes, and rinsing after the sanitizer washes the sanitizer back off. Towel drying or stacking items while wet recontaminates them, which is why air drying is the required last step.