HACCP audit checklist for a restaurant: a self-audit you can run in an afternoon
A HACCP audit checklist for a restaurant has four parts: check the written plan against the menu, read the records for gaps, walk the kitchen and watch the plan being followed, and test the checks themselves (thermometers, cooling, cleaning). Run it yourself once a month in a short form and once a year in full. It takes about two hours for a small kitchen, and it finds the problems before an inspector does.
This guide gives the checklist in the order you would do it, a simple scoring method, the findings that come up most, and what to do with each. The daily and weekly checks that feed an audit are in the HACCP checklist for a restaurant; the audit is the step above that: someone looks at whether those checks are happening and are any good. If you do not yet have logs to audit, the free temperature log built from your menu is the quickest way to start the record.
Nothing to audit yet? Print the finished log for your menu, free No card, about two minutes.
What a HACCP audit is, and what it is not
A HACCP audit is a check that your food safety system is written down, followed and working. The formal name for part of this is verification, the sixth of the seven HACCP principles set out by the FDA and the USDA Food Safety and Inspection Service. Monitoring tells you whether today's batch was safe. Verification tells you whether the way you monitor is any good.
It is not the same as a health inspection. An inspector looks at the kitchen on one day against the code. You audit against your own plan: did we do what we wrote down, did we write the right things, and did the records get filled in when nobody was watching? An audit can pass while an inspection finds a problem, and the other way round. You want both to pass.
Three kinds of audit
- Internal (self) audit. You, a manager or a trusted cook from another shift. Free, and the one this guide covers.
- Health department inspection. The regulator, against the food code your jurisdiction has adopted. You do not choose the date.
- Third-party audit. A consultant or an auditing body, usually because a customer, a chain, a school contract or a certification scheme asks for it. See HACCP certification for a restaurant and what a consultant does.
How often should a restaurant audit its HACCP plan?
No single number is set for every restaurant, so ask your health department and any customer contract. A common pattern that works for a small kitchen:
- Weekly: the person in charge reads that week's logs and signs them (this is a verification step, not the audit).
- Monthly: a short audit: records review plus a floor walk, 30 to 45 minutes.
- Yearly: the full audit in this guide, including a read of the whole plan against the current menu.
- Whenever something changes: a new menu item with a new process, new equipment, a failed inspection item, or a food safety incident. Reassessing the plan after a change is part of the method.
Before you start: set up the audit
- Pick the auditor. Ideally someone who does not fill in the logs. If you are the cook and the manager, do the audit on a day you are not on the line, and be ruthless: you are looking for gaps, not for a pass.
- Gather the paperwork. The plan, the current menu, the last 30 days of logs, the corrective action sheets, thermometer calibration records, training records, supplier invoices or receiving records, and the last inspection report.
- Get a calibrated thermometer and a pen. You will test a few readings yourself.
- Time-box it. Two hours for a small kitchen. If you need longer, the plan is too complicated to follow on a busy night, and that is itself a finding.
Part 1: documents (30 minutes)
Put the plan beside the menu and read both. The question is whether the written plan describes the kitchen that exists today.
| Check | Pass looks like | Common failure |
|---|---|---|
| Every menu item is covered by a process in the plan | Each dish maps to a process group (cook-and-serve, cook-chill-reheat, no-cook, raw) | The special added last month has no row |
| Each critical control point has a limit, a monitor, a frequency and a corrective action | All four filled in for every CCP | "Monitor temperature" with no limit or time |
| Limits match the code you are under | 41°F cold, 135°F hot, 165°F reheating, cooking limits by food, as in the FDA Food Code or your state's version | An old limit copied from a template for another country |
| The plan names who does each task | A role for each check (opening cook, closing lead, manager) | "Staff" or nobody |
| Specialized processes have what the department asked for | Any variance, approved plan or specific log is on file | Vacuum packing or curing without a reviewed plan; see HACCP plan for vacuum sealing |
| Version and date on the plan | Reviewed date within the last year, changes listed | Undated pages from the day it was written |
| Allergen and prerequisite procedures exist | Handwashing, cleaning, pest control, receiving, allergen handling written down | Only temperature rules written |
If the plan itself is the weak spot, a worked HACCP plan example for a restaurant shows what each row should hold, and the critical control points examples show which steps count as critical.
Part 2: records review (45 minutes)
Records are where audits usually fail. A plan can be perfect and the log blank for six days. Pull the last 30 days and check each log type.
What to look for in every log
- Is every box filled? Count the blank slots. A fridge log with one gap a week is a habit problem; a whole weekend blank is a system problem.
- Are the numbers believable? A walk-in that reads exactly 38°F every day for a month, in the same handwriting, was probably filled in from memory. Real readings move.
- Is there a reading out of limit with no corrective action? This is the most serious record finding. A 47°F reading with no note about what happened to the food means the control did not work and nobody acted.
- Is it signed? Initials of the person who measured, and a weekly sign-off by a manager.
- Is it dated and legible? A smudged or undated sheet is hard to defend.
Log by log
| Record | Audit question | Where to learn more |
|---|---|---|
| Receiving | Were deliveries temperature-checked, and was anything rejected and recorded? | Receiving temperature log |
| Fridges, walk-in, freezers | Two readings a day, in limit, with action on any excursion | Refrigerator log, walk-in log, freezer log |
| Hot holding | Readings at the start and during service, with time | Hot holding temperature |
| Cooling | Start time and temperature, the two-hour and six-hour checks | Cooling log |
| Reheating | Reached 165°F within the time allowed | Reheating log |
| Thermometer calibration | Done at the stated interval, with the result | Calibration log |
| Dish machine and sanitizer | Final rinse temperature or chemical strength checked | Dishwasher log, sanitizer log |
| Cleaning and pest control | Schedule followed, service reports kept | Cleaning log, pest control log |
Pick three dates at random and trace one product through: where it was received, how it was stored, cooked, held and cooled. If you can follow one chicken thigh from the invoice to the line to the leftover tub across four different records, your record system works. If you cannot find where it was cooled, you have found a gap.
Part 3: the floor walk (30 minutes)
Now watch the kitchen during a normal service, without announcing it. You are checking that the people doing the work match the plan on paper.
- Check a thermometer yourself. Probe a cold unit and the hot line and compare with the logged reading. A difference of more than a couple of degrees means the log or the thermometer is wrong.
- Watch a cooling. Is the stock or sauce in shallow pans, uncovered or loosely covered, in an ice bath or blast chiller, with a start time written down?
- Ask a cook to show the limit. "What is the hot holding temperature, and what do you do if the soup is at 125?" The right answer is a number and an action, not "ask the chef".
- Look at hand sinks. Soap, paper towels, warm water, not blocked by a bucket.
- Look at storage order. Ready-to-eat food above raw, raw chicken on the bottom shelf, everything labelled and dated.
- Look at cross-contact for allergens. Separate utensils and a known place for allergen-free prep.
- Check chemical storage and test strips. Sanitizer buckets tested, chemicals away from food.
- Check the corrective action sheet. Does a blank one live where a cook can reach it, with a pen?
A short interview with two staff members is worth more than any form. Cooks who can explain why a limit exists follow it on a busy night. The plan for training them is in HACCP training for restaurant staff.
Part 4: verification checks (20 minutes)
These test whether the controls themselves are reliable.
- Ice-point test. Put the probe in a cup of ice water. It should read 32°F within a degree or two. Record it.
- Cooling check. Take one real batch from cooking temperature and confirm it passes through 70°F within two hours and reaches 41°F within the next four, as the Food Code expects. If your usual batch does not, the method needs to change (smaller portions, an ice wand, a blast chiller).
- Dish machine strip. Run a test strip or a temperature label through a cycle.
- Supplier paperwork. For items that need it (shellfish tags, for example), check the tags are kept for the period your code requires; see the raw oyster guide.
- Reassessment. Has the menu, equipment or supplier changed since the plan was last reviewed? If yes, the plan needs an update before the audit closes.
How to score the audit
Keep the scoring simple enough to repeat. Give each line one of three marks:
| Mark | Meaning | Deadline to fix |
|---|---|---|
| Major | A control is missing or failed and no action was taken: an out-of-limit reading with no corrective action, a CCP with no monitoring, a specialized process with no plan | Same day, before the next service where it applies |
| Minor | The control exists but the record or habit is weak: gaps in a log, no sign-off, old version of the plan | Within two weeks |
| Observation | Not wrong today but likely to become so | Next audit |
Count majors and minors per part. Then compare to last time. The trend matters more than the number: three majors falling to one over two audits is progress; a clean audit that follows a staff turnover is suspicious.
The findings that come up most
- Blank logs at weekends or on the late shift. Fix: give the check a named owner and a fixed time, and have the manager sign the page daily.
- Cooling not recorded. Fix: a one-line cooling log taped to the walk-in door, with a start time field. See the cooling log guide.
- Out-of-limit readings with no action. Fix: print the action next to the limit, so the cook does not have to remember it.
- The plan describes last year's menu. Fix: add "update the plan" to the checklist for any new dish with a new process.
- Uncalibrated thermometers. Fix: a weekly ice-point test noted on the log.
- Training records missing. Fix: a one-page sign-in at each briefing.
What to do with the findings
Write each finding as a corrective action with four things: what was wrong, what you did about it now, what will stop it happening again, and who checks. Keep the audit sheet and the actions together in the HACCP binder or folder. The next audit starts by checking last audit's actions. For how to store and correct records, see HACCP record keeping.
If the audit shows the plan is out of date or was never written for your menu, you have three routes: rewrite it yourself from a good template (what a free template covers), pay for software (HACCP software for restaurants), or have it written for you (what each option costs).
Preparing for a health inspection with the same checklist
Your audit and an inspection overlap on the high-risk items an inspector tends to weigh most: cooking temperatures, holding temperatures, cooling, handwashing, sanitizing and cross-contamination. Do the floor walk the day before an announced visit, and have the last 30 days of logs within reach. Our restaurant food safety inspection checklist covers what an inspector walks through, line by line.
Questions
Who should audit a restaurant's HACCP plan?
Someone who understands the plan and does not fill in the logs. A different manager, the owner or a consultant works. A single-owner kitchen can still audit itself if it follows a written checklist and keeps the evidence.
How long should an internal HACCP audit take?
About two hours for a small kitchen. Records review is the longest part. If the monthly short version runs past 45 minutes, the record system is too complicated.
Is a HACCP audit required by law for a restaurant?
For most general restaurants in the U.S., the retail Food Code does not require a formal HACCP plan or an audit, so the audit is good practice. If you operate under an approved plan for a specialized process, or a contract, school program or certification requires verification, then it can be required. Ask your health department.
What records should I keep from an audit?
The completed checklist, the list of findings, the corrective actions and their completion dates, and the date of the next audit. Keep them with the plan; many departments ask to see recent records on a visit, and a retention period applies in some places.
What is the difference between verification and validation?
Validation asks whether the plan, as designed, can control the hazard (is the cooking limit enough to kill what matters?). Verification asks whether you are doing what the plan says and it is working. An audit is mostly verification. Using limits from the FDA Food Code gives you validated limits for common foods.
What happens if I fail my own audit?
Nothing, and that is the point. Fix the majors straight away, set dates for the minors and re-check. A finding you found yourself is far cheaper than one in an inspection report.
Run the audit against real records: find your restaurant and print the finished log, free.
Sources
- Hazard Analysis Critical Control Point (HACCP), U.S. FDA; the seven principles, including verification and record keeping, are also set out by the USDA Food Safety and Inspection Service
- FDA Food Code 2022 (temperature limits, cooling and reheating, specialized processes), U.S. FDA
Related: all food safety guides, HACCP checklist for a restaurant.