How to Write a HACCP Plan for a Central Commissary

A central commissary is a factory feeding restaurants — batch production at scale, then distribution to outlets that finish and serve the food. The hazard profile sits between manufacturing and foodservice: you’ve got production volumes that demand factory discipline, but the product’s safety is completed by outlet staff you don’t directly supervise. Your HACCP plan has to control what happens in your building and define what the outlets must do — because the cook-chill chicken you ship is only as safe as the outlet’s reheating.

This guide walks the Codex 12 steps for a commissary supplying multiple outlets: central production, cook-chill, cold distribution, outlet finishing. The plan covers your operation fully and the outlet handoff explicitly.

Step 1: Build the team — including the outlet link

QA/food safety lead, production manager, maintenance, sanitation, procurement, logistics — plus whoever owns the outlet relationship (operations manager, franchise support). The outlet handoff is part of the hazard analysis, so the person who knows what outlets actually do belongs on the team. One member with formal HACCP training. Document it.

Step 2: Describe the system — products AND distribution

Products grouped by process category (cook-serve components, cook-chill, cook-freeze, RTE components). For each: formulation, allergens, packaging, shelf life. Distribution described as part of the product: transport method, temperature requirements, maximum transit time, outlet storage requirements, outlet finishing instructions (reheating temps, holding limits). The product isn’t finished until the outlet finishes it — describe the whole chain.

Step 3: Who eats it, where?

Outlet customers — general population including the vulnerable. Multiple outlets, multiple service teams, one central product. An incident traces back to you regardless of which outlet served it. That traceability cuts both ways: your records must identify which outlet got which batch.

Step 4: Diagram kitchen to outlet

Receiving → storage → prep → cooking → cooling → portioning/packing → cold storage → dispatch/transport → outlet receiving → outlet storage → outlet reheating/finishing → service. Detail the transport leg: vehicles, equipment, routes, durations. Detail the outlet steps your instructions cover. Walk the commissary; ride the delivery route; visit an outlet. Sign, date.

Step 5: Hazard analysis — two kitchens, one plan

• Biological: standard production hazards — Salmonella, C. perfringens, B. cereus, S. aureus, L. monocytogenes in RTE components — plus distribution hazards: cold chain breaks in transit, outlet storage abuse, outlet reheating failures. The analysis must assess each outlet-controlled step: what happens if the outlet holds too long, reheats inadequately, stores at the wrong temperature?
• Chemical: allergens — central labeling must survive to the outlet; outlet staff need allergen information per product. Cleaning chemicals, vehicle contamination.
• Physical: metal, glass, plastic — plus transport damage to packaging.

For outlet-controlled steps, the analysis documents the hazard, the required outlet control, and how you verify it (outlet audits, temperature monitoring, training). “The outlet handles it” without verification isn’t a control.

Step 6: CCPs

• Cooking — validated time-temperatures per product.
• Cooling — the cook-chill CCP; at commissary scale, cooling large batches is the highest-risk production step.
• Cold storage and dispatch temperature.
• Transport temperature — ≤5 °C maintained to the outlet.
• Metal detection — post-packing.
• Outlet reheating/holding: typically prerequisite-based (outlet procedures + verification) — run the tree, document it, and make the verification real.

Step 7: Critical limits

• Cooking: poultry 74 °C/165 °F; ground beef 71 °C/160 °F; pork/fish 63 °C/145 °F; reheating at outlet 74 °C/165 °F.
• Cooling: 60→21 °C in 2 h, →5 °C in 6 h total — validated for your batch sizes and containers. At commissary scale, this validation is non-trivial: a 50-liter batch doesn’t cool like a 5-liter one.
• Storage/transport: ≤5 °C throughout, validated transit times per route.
• Outlet holding: ≥60 °C hot / ≤5 °C cold, maximum holding times defined in outlet instructions.
• Metal detection: validated test-piece sizes.

Step 8: Monitoring

Cooking: per-batch time-temperature. Cooling: per-batch logging — at scale, multiple probes per batch; the center of the largest container is what matters. Storage: continuous recording. Transport: loading and arrival temperatures, every delivery. Outlet: defined checks per your outlet procedures (reheating temps, holding checks). Named positions at the commissary; defined outlet roles with training.

Step 9: Corrective actions

Production deviations: hold, assess, rework within validation or destroy — standard. Transport deviation: hold at outlet, assess time-temperature, QA disposition — the outlet needs a decision procedure, not a phone call and a guess. Outlet deviations: the outlet instruction sheets include corrective actions (reheat, discard rules), because the outlet staff face the deviation in real time.

Step 10: Verification

Calibration across the operation. Cooling validation studies at real batch sizes. Transport validation per route and season. Outlet verification program: audits, temperature monitoring review, training verification — proportional to the risk the outlet controls. Independent review of CCP records. Finished-product and environmental testing per your plan. Supplier verification. Trend everything.

Step 11: Records — traceable to the outlet

The plan, the hazard analysis, production logs per batch, cooling logs, storage charts, transport logs (loading/arrival per delivery), deviation records, calibration logs, outlet audit records, training records. Batch-to-outlet traceability — which batch went to which outlet, when. When the complaint comes in, you need that link in minutes, not days.

Step 12: Reassess — products, outlets, routes

Annual minimum, plus: new products, new outlets, route or vehicle changes, seasonal changes, outlet audit findings, complaints, deviation trends. New outlets get assessed before supply starts — their storage, reheating, and handling capability is part of your hazard control.

Things that actually work

Validate cooling at scale. The cooling CCP is where commissaries most often fail — validations done on small batches, production running ten times larger. Validate the largest batch in the largest container, then don’t exceed it without revalidation.

Make outlet instructions foolproof. Reheating temps, holding limits, storage requirements, corrective actions — written for outlet staff, in their language, laminated, at the point of use. The outlet executes your plan’s final steps; the instructions are the plan at that point.

Audit the outlets. Not as punishment — as verification. The hazard analysis assigns controls to the outlets; verification confirms they’re happening. Audit findings feed back into the plan.

Trace by batch to outlet. Delivery records linking batch codes to outlets, retained and retrievable. Targeted response to a problem — one outlet, one batch — versus broadcast panic across the network. The traceability design pays for itself the first time you need it.

War stories

The cooling validation gap. Cooling validated on 10-liter batches in the test kitchen. Production ran 80-liter batches in deep containers — center temperatures stayed in the danger zone for 7 hours. The logs showed the procedure was “followed.” The procedure didn’t match the validation. C. perfringens doesn’t care about your procedure; it cares about time and temperature. Validate production reality.

The outlet that improvised. Outlet reheating instructions: 74 °C. Outlet practice: “until it feels hot.” No thermometer at the outlet, no training on the requirement, no verification visits in two years. The commissary’s plan assigned a control to the outlet and then never checked. Assign, instruct, train, verify — all four, or the control doesn’t exist.

The summer route. Transport validated in spring — 45-minute routes, mild weather. Summer: same routes, 38 °C ambient, traffic delays, arrival temperatures at 9 °C. The validation didn’t cover the season. Validate per season, monitor every delivery, and build the seasonal variation into the plan.

The untraceable delivery. Customer complaint — suspected foodborne illness, one outlet, one evening. Delivery records showed the outlet received “assorted products” with no batch linkage. The investigation couldn’t determine which production batch was implicated, so the hold expanded to everything. Batch-to-outlet traceability isn’t bureaucracy; it’s the difference between a targeted hold and a network-wide panic.

Common mistakes

Validating the test kitchen, not production. Cooling validated on 10-liter batches while production runs 80-liter batches in deep containers — center temperatures in the danger zone for 7 hours. Validate production reality: real batch sizes, real containers, real loads.

Assigning outlet controls without verifying them. The plan assigns reheating to the outlet — 74°C on paper, “until it feels hot” in practice, no thermometer, no training, no verification visits in two years. Assign, instruct, train, verify — all four, or the control doesn’t exist.

Validating one season. Transport validated in spring; summer brings 38°C ambient and traffic delays with arrival temperatures at 9°C. Validate per season, monitor every delivery, and build seasonal variation into the plan.

Shipping without batch linkage. Delivery records saying “assorted products” with no batch-to-outlet traceability — one complaint expands the hold to the whole network. Traceability to the outlet is what makes a targeted hold possible.

Letting the plan cover only the commissary. The truck’s plan covered the truck while the food’s safety was decided in an unmonitored process elsewhere. The plan covers the whole operation — every handoff, every site, every step.

Treating distribution as someone else’s problem. The product leaves the dock and the food safety thinking stops. Cold distribution is part of the hazard analysis: validate the routes, monitor the deliveries, own the chain to the outlet.

Checklist — before you call this plan done

• [ ] Team includes outlet-operations knowledge; training documented
• [ ] Products grouped by process; distribution (transport, outlet storage, outlet finishing) described as part of the system
• [ ] Full chain diagrammed — commissary through transport to outlet service; verified at each stage
• [ ] Hazard analysis assesses outlet-controlled steps with required controls and verification
• [ ] CCPs: cooking, cooling (validated at scale), storage, transport, metal detection
• [ ] Critical limits include outlet reheating/holding requirements in outlet instructions
• [ ] Monitoring: per-batch production, loading/arrival per delivery, defined outlet checks
• [ ] Corrective actions include outlet-level decision procedures for transport and holding deviations
• [ ] Verification: calibration, cooling validation at scale, transport validation per season, outlet audit program, independent record review
• [ ] Records: batch-to-outlet traceability retrievable in minutes
• [ ] Annual reassessment; new products, outlets, routes, or seasons trigger review