HACCP and Restaurants

One question that frequently comes up in the food safety business is about restaurants and how they manage a food safety system as compared to food manufacturers. Restaurants are not regulated directly by the FDA, and do not receive inspections the way food factories do. Because of this, and because restaurants very greatly in their size and capital requirements, there is a tremendous range in Hazard Analysis Critical Control Point (HACCP) based food safety programs for restaurants, if they exist at all. So let’s take a look at what HACCP is, and start to think about how restaurants approach building a program.

To start, the easiest way to think of a HACCP plan is to picture a security plan for your home (I’m not going to use apartments or condos in this example, but it would be the same for any living space). Unlike for residential properties, in the food business, HACCP plans are required, so we have to think of the home security plan as mandatory, with the local police department doing periodic inspections to make sure that houses have security measures in place. In order to create an appropriate security plan, we need to begin with an accurate drawing of the property, which includes entry points, windows, trash removal, water pipes, air ducts and how people move through the house.  The next step in putting the security plan for your house in place is to determine the most likely way someone or something undesirable is going to get into the home, and mapping out how to stop intruders at each point.

Is it through the front door? Backdoor? Windows? Climbing up to a second story? Through the basement? Is the chimney a potential source of entry? Is the garage attached? You get the idea.

This is our hazard analysis. It is essential that we put in a major effort in figuring this step out because not only do we need to make sure we keep intruders out, but we also do not want to erect a system that prevents us from living a functional life. The trick to a good HACCP plan is determining the broadest range of hazards, and then focusing at all times on controlling the most likely hazards, and to have appropriately attentive measures to protect against the less likely intruders. We also need to remember to have expert advice and information as the basis for any analysis. Random websites, hear say and the security measures our parents had back in the day is not acceptable on their own. We need to show that the information we’re using is based on science and facts. Ultimately, the strength of your hazard analysis determines if the plan is going to work at all.

Once we have our hazard analysis completed, the next step is to put the deterrents and detection devices in place to create the necessary level of security. That could be an alarm system, floodlights, bushes or trees next to windows, security cameras, grating over windows, even a pet. The most important part of putting these systems in place is to make sure it fits our specific house. Copying our neighbor’s plan or using a premade plan is not acceptable, as it might leave gaps for our house.

Any security measure is going to be what is called either a prerequisite program (think of the bushes blocking the windows, the window grates or the flood light) if it is in place to prevent problems and not the focal point of the plan, or a control point if it is something we check every day to make sure it is working. For our home, the locks on the door are going to be a control point as well as the alarm system. The security camera will either be a prerequisite or a control point based on how you choose to use it. If its there to scare people away, then it is a prerequisite program, if you check the security feed every day, it is a control point (and possible critical).

This idea of critical control points is the area I find that causes the most confusion in the food business. Calling something a critical control point (or even a non-critical control point) means that we have to continuously monitor, verify and validate the functionality of the action. For our home security analogy, we’ll call the locks a non-critical control (meaning that if the lock is not engaged, there is a backup system, the alarm, to prevent entry). That means the alarm is going to be the critical control point, meaning it must be on in order for the house to be secure.

For anything we call a control point (critical or otherwise), we must have a plan in place to check that the lock and the alarm are on (this is the monitor step and the verification step, and we have to have to have a written record every time we check, and a time stamped record for when were are not at home.) Beyond checking it every day, we have to challenge the control points (this is the validation step). So that means we are going to bring a large friend to see if they can break the door down. We might also try to pick the locks or even use a crow bar to see if we can pry it open. If you think this sounds excessive or ridiculous, then you are getting a sense of how food safety specialists often feel as they set up CCPs. Doing a validation test of the alarm system is pretty easy but time consuming. We would notify the alarm company and the police in advance, wait until the middle of the night, trigger the alarm and test to see how that the police show up, and even track how long it takes.

In a different post, I’m going to get specific about how restaurants set up their food safety programs, but in the meantime, if you have any questions, please feel free to reach out to me at brian@kellermanconsulting.com or on my cell phone at 614-309-3414 and I can answer any particulars.