The 2-Hour Cooling Limit Overrun Nobody Flagged
A 40-seat bistro runs a cook-chill line for its house chili: 30 lb batches are cooked, cooled in 2-inch hotel pans, then portioned and refrigerated for service over three days. The HACCP plan sets the cooling CCP as 135°F to 70°F within 2 hours, then 70°F to 41°F within a further 4 hours. On Sunday the closing manager logged the batch at 72°F after 2 hours 10 minutes and 38°F at 5 hours 50 minutes, then portioned and dated it without comment. On Tuesday evening, after 12 lb had been sold, the person in charge reviewed the log while preparing for an audit and spotted the first-stage overrun. The remaining 18 lb is dated for service through Wednesday.
1. Was the cooling CCP met? What is the defensible disposition of the 18 lb in the walk-in, and can the product be made safe by reheating?
Read the worked answer
The CCP was not met. The plan has two limits; the total of 5 h 50 min is under the 6-hour cumulative window, but the 2-hour first stage is a separate limit, not a target to be averaged against the total. The first stage exists precisely to move product through the range where Clostridium perfringens and Bacillus cereus multiply fastest. Two hours and ten minutes in that range is a deviation, and a deviation means the product is of unknown safety, not proven unsafe - but the operator cannot assume it is fine.
Reheating does not fix it. Reheating to 165°F kills vegetative cells but does not destroy the heat-stable toxins that B. cereus and S. aureus can produce during a slow cool. Reheating a suspect batch therefore converts a temperature problem into a toxin problem.
Disposition: discard the remaining 18 lb and record it. The 12 lb already sold cannot be recalled; document the lot, monitor for complaints, and be ready to answer the regulator. If the operation wants to keep product, that decision belongs to the regulatory authority, not to the kitchen - call before releasing, not after.
2. The closing manager wrote the numbers down but never compared them to the limit. Where in the food safety system did this fail, and what belongs in the corrective action record?
Read the worked answer
The failure is at the monitoring-to-verification handoff, not at the thermometer. Monitoring produced data; nobody evaluated it against the critical limit at the time it was generated. A log that is only reviewed days later is a historical record, not a control.
A corrective action record should carry:
- Date, time, batch ID, amount, and where the product is (cooler shelf, label).
- The measured values and the limit that was exceeded.
- The disposition decision and who made it, with the product physically segregated or destroyed so it cannot re-enter service.
- Root cause: pan depth and stacking, chill water/ice availability, probe calibration, or a manager who did not know the 2-hour mark was a hard stop.
- The preventive change and its owner, plus a verification date.
Verification is the next batch: log the 2-hour reading live, on the floor, before the manager goes home, and confirm three consecutive batches comply before closing the corrective action.
3. What change to the cooling process and recordkeeping would you make, and how would you verify it works without simply trusting the new paperwork?
Read the worked answer
Change the process, not the form. Options, in order of reliability:
- Reduce the thermal load - shallower pans, smaller batches, or an ice bath/ice wand so the first stage is achievable with margin, not by 10 minutes.
- Add a hard checkpoint: a probe reading at 2 hours with an alarm or a second signature, so the batch fails while there is still product and time to act rather than after the fact.
- Calibrate probes and record the calibration; an uncalibrated probe makes every downstream record arguable.
Verify with data, not signatures. Trial three batches, recording temperatures at 30-minute intervals, and show the curve clears 70°F well inside 2 hours. Compare against the new limit to build in margin. Then check the written records against your own spot readings for a month - a log that always reads perfectly is a warning sign, not reassurance.
Finally, re-train on why the 2-hour mark is a stop, not a target, and update the HACCP plan's basis for the limit so an auditor can see the reasoning.