The Sunday Morning Walk-In
The Riverside Cafe serves 220 covers on weekends and runs a HACCP-based plan with one critical control point for cold holding: all TCS food at 41°F (5°C) or below, verified twice daily at 7 a.m. and 3 p.m. On Sunday at 7 a.m. the manager finds the walk-in reading 50°F (10°C) with the door propped open by a case of lettuce. The last signed log entry is Friday at 3 p.m.; Saturday's entries are blank because the closing server left early. Inside are deli turkey sliced Saturday morning (47°F internal), an opened gallon of milk, raw chicken breasts in their original packaging, cut cantaloupe from Saturday, whole heads of lettuce, and unopened jars of mayonnaise. The compressor is running and the box has already recovered to 44°F.
1. The manager says the cooler is already back down to 44°F, so everything can simply be re-chilled. Work through the cooler item by item and state what is discarded, what is kept, and the principle behind each call.
Read the worked answer
The controlling fact is the missing time record, not the current reading. The last verified 38°F check was Friday at 3 p.m. Because no Saturday monitoring exists, you must assume worst case: these TCS items sat above 41°F for far longer than 4 hours. Re-chilling does not undo pathogen growth or heat-stable toxin.
- Deli turkey (47°F) - discard. Sliced RTE meat, TCS, unknown time above 41°F.
- Opened milk - discard. TCS, opened, same unmonitored window.
- Raw chicken - discard. TCS; and you cannot rescue it by cooking it later, because the hazard formed before cooking and records cannot prove otherwise.
- Cut cantaloupe - discard. Cutting makes it TCS. Whole melons would be a different answer.
- Whole lettuce heads - keep. Intact, uncut produce is not TCS; it is not a time/temperature control food.
- Unopened jars of mayonnaise - keep. Commercially sealed, shelf-stable, not TCS until opened.
When duration of abuse is unknown, the decision defaults to discard - not to 're-cool and hope.'
2. Beyond throwing food away, what must the food safety management system require here - what gets documented, what gets fixed, and who verifies it?
Read the worked answer
A deviation at a CCP triggers a corrective action, not just a trash bag.
Record now: date and time of discovery, the 50°F reading, item-by-item internal temperatures, quantities discarded, the corrective action taken, the root cause (monitoring was skipped Saturday; door propped), and the name of the person who made the call.
Fix the root cause, which is twofold:
- Behavioral - the closing server skipped the 3 p.m. check. Assign a named backup monitor, build the check into a signed closing checklist, and retrain.
- Physical - the propped door and the failing gasket/ambient issue. Add door alarms, a self-closer, and consider a continuous temperature logger with an alert.
Verification: the manager, not the person doing the check, reviews logs weekly and trends repeat deviations. Confirm the fix worked with two weeks of complete, signed logs plus a documented alarm test - an assertion that 'we talked to the staff' is not verification.
Finally, re-examine the plan itself: a twice-daily manual check on a walk-in that feeds weekend volume is a weak monitoring design, and that weakness is what produced this event.