EHAI Primary Food Safety cheat sheet

HACCP has seven principles in fixed order: hazard analysis; determine CCPs; set critical limits; monitor CCPs; establish corrective actions; verify; keep records.

A CCP is a step where control can prevent, eliminate, or reduce a significant hazard to an acceptable level; a control point without a measurable critical limit is not a CCP.

Critical limits must be measurable (time, temperature, pH, aw, chlorine ppm); a limit stated only as "cook thoroughly" fails verification requirements.

Danger-zone holding: keep TCS foods at 5 °C (41 °F) or below, or 57 °C (135 °F) or above; the 5–57 °C range supports rapid pathogen growth.

Two-hour/four-hour rule: TCS food held between 5 °C and 57 °C must be discarded after 4 hours cumulative; under 2 hours may be returned to temperature control.

Cooling curve (US FDA Food Code): 57 °C to 21 °C within 2 hours, then 21 °C to 5 °C within a further 4 hours (6 hours total).

Reheating for hot holding must reach 74 °C (165 °F) for 15 seconds within 2 hours; this is a separate step from initial cooking.

Hazard categories are biological, chemical, physical, and radiological; biological hazards (bacteria, viruses, parasites) cause most foodborne illness.

Prerequisite programs (GMP, sanitation, pest control, supplier approval, training, traceability) must be in place before HACCP plans are built.

Hazard analysis ranks hazards by severity (health consequence) and likelihood (probability of occurrence); only significant hazards need CCPs.

Decision-tree logic: if a later step eliminates the hazard, the earlier step is not a CCP; if no later step controls it, the step is a CCP.

Monitoring must be continuous or at a stated frequency, assigned to a named role, and recorded at the time of observation, not retrospectively.

Corrective action must address the affected product (segregate, rework, condemn), the cause, and the record; product disposition is decided before release.

Verification activities include CCP record review, calibration checks, product testing, and internal audit; validation confirms the control actually works as designed.

Calibration of thermometers and monitoring instruments is a verification task; an uncalibrated instrument invalidates the monitoring record.

Records must be retained at least as long as the shelf life of the product, typically 2 years for ambient or frozen product; include lot traceability.

Sanitation Standard Operating Procedures (SSOPs) cover cleaning frequency, chemicals, concentration, contact time, and responsible person; they are prerequisite, not HACCP.

Allergen cross-contact is a chemical hazard; control requires dedicated lines, validated cleaning, sequencing, and label verification.

Bacterial growth factors: temperature, time, moisture (aw), acidity (pH), oxygen, and nutrients; aw below 0.85 and pH below 4.6 generally inhibit pathogen growth.

High-risk foods are high-protein, high-moisture, near-neutral pH: meat, poultry, seafood, dairy, eggs, cooked rice, and cut leafy greens.

Spore-formers (Clostridium botulinum, Bacillus cereus) survive normal cooking; control relies on cooling rate, pH, aw, or pressure canning.

Listeria monocytogenes grows at refrigeration temperature and is controlled by cook-step lethality, environmental swabbing, and post-process hygiene.

Norovirus and hepatitis A are viral hazards transmitted by infected food handlers; control is handwashing, exclusion of ill workers, and no bare-hand contact with ready-to-eat food.

Bacterial doubling can occur in roughly 20 minutes at optimum temperature; a single cell can reach infectious dose within hours if time-temperature control fails.

Cross-contamination controls: colour-coded equipment, separation of raw and ready-to-eat zones, workflow from clean to dirty, and handwashing between tasks.

Personal hygiene: handwashing with soap for at least 20 seconds; exclude workers with vomiting or diarrhoea for at least 48 hours after symptoms cease (local rules may differ).

Pest control is a prerequisite program: proofing, monitoring stations, and documented corrective action when activity is detected.