Home›Toolkits›Catering HACCP CCPs
FSSC Development Program · Catering HACCP
The four catering CCPs, cook to hot hold
Cooking, cooling, reheating and hot holding carry most of the food safety risk in a catering kitchen. This is how to set the limits, the checks and the corrections, and keep the records an assessor reads, using a working restaurant as the example.
The short answer. In our example restaurant and catering business the Annex 3 decision tree lands on four CCPs. Cooking kills vegetative pathogens, cooling stops spore formers growing, reheating kills what survived in the fridge, and hot holding keeps food out of the growth range until it is served. Each needs a measurable critical limit, a probe check at a set frequency by a trained person with a trained deputy, a correction that keeps unsafe food from guests, and a signed record. R.638 of 2018 sets the legal floor for heated food at 60 °C. The other numbers here, including the 63 °C hot holding value, are illustrative house defaults your business confirms and validates.
Why these four steps
The catering Assessment Requirements ask for a hazard analysis at every process step (requirement 3.2.2) and for CCPs and OPRPs chosen with the Annex 3 decision tree (requirement 3.2.4). In summary, a hazard becomes a CCP only when it is significant, a control measure exists, the step is the final one designed to eliminate or reduce it, and the control can be monitored continuously so a failure is corrected in time. A no at either of the last two questions makes it an OPRP.
The example business in our Catering and Food Service toolkit (TKDP-C) runs an 80 seat a la carte restaurant, a self service buffet and salad bar for about 250 office park staff a day, a takeaway counter and event catering, all from one kitchen. Its HACCP workbook has 72 hazard rows. Twelve rows answered yes to every question, and they group into four CCPs at cooking, cooling, reheating and hot holding. Chilled storage, the cold buffet, defrosting, produce sanitising, allergen orders and takeaway labelling became OPRPs 1 to 6.
| CCP | Hazard | Critical limit in the example | Checked |
|---|---|---|---|
| CCP 1 Cooking and frying | Survival of Salmonella, Campylobacter and Shiga toxin producing E. coli | 75 °C core, or 70 °C held for 2 minutes | Every batch and load, every a la carte poultry, pork, mince and fish order |
| CCP 2 Cooling | Growth of Clostridium perfringens and Bacillus cereus | 57 °C to 21 °C within 2 hours, then to 5 °C within a further 4 hours | Start and end of each stage, thickest tray |
| CCP 3 Reheating | Survival of vegetative pathogens in cook chill food | 75 °C core within 2 hours of leaving the fridge, once only | Every reheated batch |
| CCP 4 Hot holding | Growth of C. perfringens and B. cereus | 63 °C core (house). Never served below 60 °C | Set up and every hour, hot boxes at dispatch and arrival |
R.638 of 2018, regulation 8(4)(a) and Annexure E, sets core temperatures for food on food premises. Heated perishable food must be at 60 °C or hotter. Chilled perishable food must be at 5 °C or colder, and raw unpreserved fish, molluscs, crustaceans, edible offal, poultry meat and milk at 4 °C or colder. No house limit may be laxer. The cooking, cooling and reheating limits in the example come from recognised food codes and catering guidance, named beside each one, and every number sits in the Operating Parameter Schedule for the site to confirm against its own equipment, menu, client contracts and local authority.
CCP 1, cooking and frying
The cook probes the thickest part with a calibrated probe, wiped before and after, and writes the reading and time on the Cooking Core Temperature CCP Log. The Sous Chef evaluates and signs at the end of the shift. Requirement 3.2.8 asks for responsibility for monitoring and for evaluating the results to be defined, and this split shows both.
Write exceptions into the plan instead of letting the grill chef break the rule in front of the assessor. In the example, intact whole muscle beef and lamb steaks that have not been tenderised, injected or rolled, cooked to order and seared on every surface, sit outside the 75 °C limit. Burgers and anything minced never do.
When a reading is low, keep cooking and probe again, or move the food to working equipment. A dish that went out below the limit is retrieved from the guest. Food that cannot be shown to have reached the limit goes on hold for the Sous Chef to recook or discard. Cause and action go on the CCP and OPRP Deviation and Corrective Action Record. To validate the limit (requirement 3.2.7), probe the slowest heating item at your largest load for each recipe type and file it on the Validation Record for Critical Limits and Action Criteria.
CCP 2, cooling
Slow cooling is one of the most common causes of catering outbreaks. Spores of Clostridium perfringens survive cooking and germinate while a pot of stew drifts through the warm range, and Bacillus cereus does the same in rice. The example uses the two stage limit from the US FDA Food Code. The cook loads shallow trays into the blast chiller straight after cooking, records the time the core of the thickest tray reaches 57 °C as the start, and probes it again at the end of each stage on the Cooling CCP Log. Food never cools on the bench or in the cold room.
The correction must respect the reheat once rule. If stage 1 is missed, stews, sauces and meats are reheated once to the reheating limit and go straight to hot holding or service that day, which is their one reheat, or they are discarded. Food is never cooled a second time. Rice that misses either stage, and any food that misses stage 2, is discarded and entered on the Hold and Disposal Register.
CCP 3, reheating
The example limit is 75 °C at the core within 2 hours of leaving chilled storage, once only. The cook probes the centre of every batch and records the time out of the fridge, the time the limit was reached and the reading on the Reheating CCP Log. Food that misses the time, or was reheated before, is discarded, and whatever is left after service is never cooled again. Kept food carries its original batch code and cooking date, so anyone can see whether a tray has used its one reheat.
CCP 4, hot holding at the pass, buffet and events
Hot food is held at 63 °C or above, a house value stricter than the 60 °C in R.638. The cook, buffet attendant, counter staff or event chef probes every item at set up and every hour and records it on the Hot Holding and Hot Buffet Temperature Log, or the Event Transport Temperature Record for events. The gap between 63 °C and 60 °C lets you fix a failing bain-marie before the food reaches the legal minimum.
| Reading | Condition | Action |
|---|---|---|
| 63 °C or above | Any | Continue, next check within 1 hour |
| 60 °C or above, below 63 °C | Last good reading within the last hour | Fix the equipment and bring the food back to 63 °C at once |
| Below 60 °C, or no good reading in the last hour | Not reheated before, last good reading less than 2 hours earlier | Reheat once to 75 °C and return to hot holding |
| Any other case | Reheated before, or time unknown | Discard. Food below 60 °C is never served |
Two consequences catch people out. Cook chill food on the buffet has already had its one reheat, so below 60 °C it is discarded. And a sealed hot box cannot be probed on the road, so the dispatch reading is the last good reading when it is opened. That is why the example seals each box for 2 hours at most and validates each hot box model at full load for that time.
Monitoring that meets requirement 3.2.8
- Method. A numbered probe and where the tip goes.
- Frequency. A number, such as every batch or every hour, never “regularly”.
- Results. The actual reading and time, not a tick.
- Who monitors and who evaluates. The cook, and the Sous Chef or manager who signs that day.
- Deputies. A trained deputy for every shift, named in the Responsibility and Deputy Matrix and signed off on the Probe Thermometer Use and CCP Monitor Sign-off Record.
Probe verification
Requirements 3.3.1 to 3.3.3 ask for accurate, traceable devices and action when they drift. The example checks every probe at the ice point each week, where it must read between minus 1 °C and plus 1 °C. Each month it gets a two point check at the ice point and the boiling point, beside the reference thermometer, and must agree within 1 °C. Correct for altitude, because water boils at about 94 °C on the Highveld, and a probe reading 100 °C there is wrong. The reference goes to an accredited calibration laboratory every 12 months.
A probe that fails twice gets a red DO NOT USE label and the spare goes to the station. The Food Safety Coordinator completes the Out of Calibration Device Impact Assessment to decide whether food checked with it since its last pass is affected. The Probe Thermometer Verification Record lists every probe, including the two in the event kits, which are the ones most often missed.
Every limit, log and correction here is already written. The Catering and Food Service toolkit holds 257 editable documents, FDPC001 to FDPC257, with the 72 row HACCP workbook, the hazard control plan with 4 CCPs and 6 OPRPs, the four CCP logs and the Operating Parameter Schedule. R3,750, with an hour of consultation included.
The records an assessor will ask for
- Hazard Control Plan, CCP and OPRP. Everything requirement 3.2.12 lists, for each CCP.
- The CCP logs and the Event Transport Temperature Record. Real readings, signed by the evaluator.
- CCP and OPRP Deviation and Corrective Action Record. The four outcomes of requirement 3.2.9, with the Hold and Disposal Register showing what happened to the food.
- Validation Record for Critical Limits and Action Criteria. The source of each limit and the site trials.
- Probe Thermometer Verification Record. The device evidence for requirement 3.3.
- HACCP Verification Schedule and Record. Weekly review and monthly observation for requirement 3.2.10.
The gaps I find most often are a week of identical readings written up at the end of a shift, cooling logs with no 57 °C start time, a correction that says “reheated” with no time since the last good reading, and a weekend cook with no deputy sign-off. For the rest of the day, read what the assessor asks to see.
Start from a plan built for a real kitchen. Editable Word and Excel, lifetime access and a lifetime licence for one legal entity, delivered as a download after payment. R3,750, about USD 231 · EUR 200 · GBP 172 · AED 843. No VAT is added.
Questions people ask
Frequently asked questions
Is hot holding at 63 °C a legal requirement in South Africa?
No. R.638 of 2018, regulation 8(4)(a) and Annexure E, requires heated perishable food to be at 60 °C or hotter. The example uses 63 °C as a stricter house limit so a failing bain-marie is caught early. Food below 60 °C is never served.
Must every catering business have four CCPs?
No. The number comes from your own hazard analysis and the Annex 3 decision tree. A kitchen that cooks everything to order and never cooks ahead has no cooling or reheating step to control.
Does the Development Program set our critical limits?
No. Requirements 3.2.6 and 3.2.7 ask you to set measurable limits and validate them. The example draws on the law where it sets a value, recognised food codes and your own trials.
Can food be reheated twice if it reaches 75 °C each time?
Not in the example plan. Each pass through the warm range gives Clostridium perfringens and Bacillus cereus more time to grow, and some toxins survive reheating. A reheat after a failed cooling stage counts as the one reheat.