Bakery HACCP Plan Example, With a Worksheet

A bakery's HACCP plan starts with one fact: baking is a kill step. Raw eggs and raw flour can carry Salmonella and E. coli, and the oven is what destroys them, so baking to a validated internal temperature is the first critical control point. Most bread needs little else. The other critical points come from what happens after the oven, a cream cheese or custard filling that has to be cooled fast and kept cold, and from the label, because a wrong label on a nut product can hurt someone badly. In the example below, a wholesale bakery's sourdough and cream cheese danishes come down to three critical control points: baking, cooling the danishes, and labeling. Below is the hazard analysis, the plan, a week of monitoring, and a free worksheet.

The short version

• List each step from receiving to delivery, and the hazards at each: biological, chemical (allergens) and physical.
• Baking is a kill step for Salmonella in eggs and E. coli in flour: a critical control point with a validated internal temperature.
• Fillings and toppings that need refrigeration add a cooling critical control point.
• A wrong label is the bakery's allergen hazard: a critical control point at packing.
• Cold storage, cleaning and allergen changeovers are prerequisite programs, logged but not CCPs.
• Each CCP has a limit, monitoring, a corrective action, verification and a record.
• TaroStack keeps each batch's readings on its batch record, with its lot. More below.

When a bakery needs a plan

FDA doesn't call it HACCP for bakeries. A registered bakery that doesn't qualify for an exemption needs a written food safety plan under FDA's preventive controls rule, with a hazard analysis, preventive controls, monitoring, corrective actions, verification, a supply-chain program and a recall plan (21 CFR 117.126). The controls it names are the same ideas: process controls such as baking temperatures, and allergen controls that include labeling (21 CFR 117.135(c)). Wholesale buyers and auditors often ask for a HACCP plan by name, so a bakery's HACCP plan tends to become the heart of its food safety plan. A bakery selling mostly over its own counter is regulated by its state and local health department under the Food Code instead. What a food safety plan holds is in what is a food safety plan. This is general information, not legal advice.

An example: the hazard analysis

Flint Hills Bakery, a made-up wholesale bakery in Topeka, Kansas, I use in these examples, makes sourdough, walnut bread and cream cheese danishes for cafés and grocers:

The mixing step's walnut hazard is real, but it's controlled by the changeover and caught at the label, so it isn't a CCP itself. Allergens in a bakery are the subject of allergen matrix template.

The plan

The cooling limit follows the Food Code's cooling times for foods that need time and temperature control, which states adopt for retail food (FDA Food Code). The baking temperatures are examples: a bakery's own limits come from its validation, the evidence that its time and temperature destroy the hazard in its products.

A week of monitoring

The October 7 danishes came out at 161°F, under the limit; they went back in, were probed again at 167°F, and both readings and the action are on the record, which is what an auditor looks for. How long to keep the records is in how long should HACCP records be kept.

Get the worksheet

Download the bakery HACCP worksheet. Three sheets: the hazard analysis, step by step; the plan, one row for each critical control point with its limit, monitoring, corrective action, verification and record; and a monitoring log, where each reading is checked against its limits and a reading outside them is flagged. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.

Where this stops working

A log on a clipboard records the reading. It's kept apart from the batch, so when a café asks whether last Tuesday's danishes were cooled in time, or a lot needs pulling, the reading, the lot and the customers who got it are three different pieces of paper.

How TaroStack does it

TaroStack keeps each batch's readings on its batch record, with its lot.

Readings on the batch record. Fields of your own on the batch record, numbers, tick boxes and initials, hold the oven-load probe readings, the cooling checks at 2 and 6 hours, and the label check, and printable batch-record forms carry the same fields for the kitchen. Checklists like these are records you keep, not a promise of compliance.

Each batch its lot. A batch of danishes takes its flour, cream cheese and eggs off stock, records the lots it consumed, and gets a lot of its own, CD-1007, with its dates.

From batch to café. Each order records the lots each customer got as it ships, so one recall report shows which cafés have a batch and what's still on your shelves.

Batches, batch records with fields of your own, lots and recalls are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.

Questions people also ask

What are the critical control points in a bakery?

In the example: baking, as the kill step for Salmonella and E. coli; cooling for products with cream fillings; and labeling, for allergens.

Does a bakery need a HACCP plan?

A registered bakery that isn't exempt needs a food safety plan under FDA's preventive controls rule; buyers often ask for a HACCP plan, which becomes its core.

What temperature kills bacteria in baking?

It depends on the product and is set by validation. The example uses 190°F inside bread and 165°F at a danish's center.

Is mixing a critical control point?

Not in the example. Allergen cross-contact at mixing is controlled by changeover cleaning and caught at the label check.