Foodservice establishments continue to cause the greatest number of foodborne illness outbreaks (approximately 60 percent) every year among all causes of foodborne outbreaks in the U.S. When I published the first article on the need for foodservice establishments to focus on achieving active managerial control of food safety risk in 2016,1 I reported then that 60 percent of all foodborne disease outbreaks in the U.S. were caused by foodservice establishments [as reported then by the U.S. Centers for Disease Control and Prevention (CDC)].

Today, when you look at the most currently available data (2020) on the number of foodborne disease outbreaks caused per year by foodservice establishments,2 nothing has changed. According to this data, there were 184 outbreaks (out of 299 total = 61 percent), 3,074 illnesses, 337 hospitalizations, and three deaths caused by foodservice establishments in one year.

A Paradigm Shift is Needed

Traditionally, the foodservice industry has relied on checklists that require employees to verify that they have performed certain actions—for example, checking the temperature of food. These checklists often include other, nonspecific, related actions to control only some hazards associated with food preparation. Although following these checklists certainly helps reduce some foodborne illnesses and outbreaks, unless each hazard associated with the prepared menu is identified and matched to the proper control of that hazard, many hazards will be missed, leading to a continuation of sporadic foodborne illnesses and outbreaks in this industry.

FSMSs based on HACCP are Key to this Paradigm Shift

The most effective FSMSs are based on the development of a Hazard Analysis and Critical Control Points (HACCP) plan called Process HACCP, which is HACCP tailored specifically for foodservice establishments. This process approach to HACCP is recommended by the FDA Food Code to assist foodservice establishments in achieving active managerial control of food safety risk.4,5 It also includes the need for a PRP to define and control potential hazards (using the FSMS) associated with sourcing safe ingredients, cleaning and sanitation, employee health, hand hygiene, and other common food processes that occur in a foodservice establishment.

A Process HACCP plan is designed by first defining the flow of food preparation in a kitchen (like the flow of food in a manufacturing facility production line) for all products prepared and sold on a restaurant's menu (Figure 1). Each recipe/procedure (menu item) is defined that involves sourcing ingredients, receiving and storing ingredients, preparing ingredients (e.g., thawing, marinating, cooking), and serving menu items, to determine if potential hazards exist at each process. An example of a hazard is Salmonella or Clostridium perfringens on raw chicken, which can contaminate hands/gloves and food contact surfaces. These hazard controls at each process (Figure 1) can either be a Critical Control Point, or CCP (e.g., cooking the chicken to 165°F) and/or a Prerequisite Control Point, or PCP (e.g., ensuring that areas where raw chicken is prepared are properly cleaned and sanitized, and that employees wash hands and wear gloves properly after handling raw chicken).

FIGURE 1. The flow of food preparation processes common in all foodservice establishments, which is used to develop a Process HACCP plan based on the menu of the business (source: FDA 2017). Note the example PCPs and CCPs of a menu item that would be monitored at each process step to ensure that the controls are present.

The flow of food preparation processes

Multiple unique and different hazards can be associated with one or more process steps to prepare just one menu item in a foodservice establishment, as there can be one common hazard associated with all of the process steps in the preparation of all menu items (e.g., employees working when sick with Hepatitis A or norovirus). Every foodservice establishment performs one or more of the same eight primary food preparation processes in common for all menu items prepared and served to customers (Figure 1), regardless of what the menu items are, so this is not as daunting as it may sound. For example, some foodservice businesses may not perform every process (e.g., they may not cool down and then reheat foods), but all will follow the same flow of food processes, and often perform additional activities or not perform others based on the recipe and menu (e.g., limited-time offerings may require cook, cool, and reheat processes not normally used in the regular food preparation plans for the menu, or the business may remove menu items). The literature contains more information on how to develop a Process HACCP plan for foodservice.5

Need for a PRP to develop the most effective FSMS

As discussed above, not all controls in a Process HACCP plan are CCPs in the flow of food processes, but they may include important control measures found in the PRP. These are referred to as Prerequisite Control Points (PCPs) to differentiate them from CCPs, but they are equally important. PCPs are derived from elements of a predefined PRP. These elements define activities that may introduce additional hazards (e.g., cross-contact of allergens in the kitchen) that are not defined by the Process HACCP plan. The minimum recommended components of a PRP necessary for an effective FSMS in a foodservice operation include:

  • Methods to ensure equipment maintenance
    • Equipment to ensure temperature measuring devices are calibrated
    • Cooking equipment is calibrated, and hot and cold holding equipment provides the correct temperature
    • Refrigeration and freezer equipment provides the correct environmental temperature to keep prepared foods at the correct internal temperature
    • Ware washing equipment is operating according to manufacturer's specifications.
  • Methods to ensure allergen management and control in food preparation and storage (in relation to customer avoidance messaging, if any)
  • Methods to ensure safe chemical use and storage around foods, and employee safety that meet Occupational Safety and Health Administration (OSHA) requirements for foodservice businesses6
  • Methods to ensure safe water use for food and in the manufacture of ice
  • An effective pest prevention program to prevent pest infestations
  • Methods to ensure no bare-hand contact with any ready-to-eat (RTE) food to prevent the cross-contamination of food from hands, and where handwash sinks should be located to facilitate
  • Methods to ensure proper handwashing to prevent the cross-contamination of foods from hands, including when wearing gloves
  • Methods to ensure restriction and exclusion of sick employees who have known signs, symptoms, or diagnosis of foodborne illnesses to prevent the cross-contamination of foods from hands, including cuts and burns7
  • Personal hygiene requirements of employees (clean clothing, hair restraints, eating/smoking/drinking restrictions, jewelry restrictions)
  • A cleaning and sanitation component for the direct prevention of cross-contamination of RTE foods by raw animal foods, how to clean and sanitize food-contact surfaces, cutting boards, dishware and dishwashing equipment, utensils, floors, and high-touch surfaces
  • Methods to ensure safe sources of foods using only food-safe ingredient and packaging suppliers (e.g., GFSI and FDA FSMA compliant supplier food manufacturing facilities; meet requirements for FDA food packaging in contact with food)
  • Methods to ensure ingredients are not used past their safe expiration date, using first-in first-out (FIFO) (e.g., date marking and execution)
  • Methods to ensure that if an ingredient/food product in use has been recalled by FDA, an approved supplier, or by a CDC "do not consume" communication, the restaurant is alerted and takes action to remove the ingredient product from prep, storage, and service.

In fact, these last three points (FIFO and use of approved sources of foods/packaging) in a PRP will help manage the critical foodborne illness risk factor of unsafe ingredient and food sources. When this factor is not under control, it can increase the number of potential hazards in all other food preparation processes; this has led to many foodborne illness outbreaks from foodservice establishments, even when the source of food was safe when ordered but became unsafe after it was recalled, and the business was not aware of the recall.

Many multi-unit retail foodservice businesses have established supply chain management programs to ensure that each facility/location uses approved sources of food ingredients and products vetted by corporate program specifications. A foundation of these specifications should be a supplier's compliance to FDA's FSMA rules to manufacture human foods.8 One of the first elements that a supply chain management program should include is a review of and expectation that all suppliers have developed a food safety plan for each product, and that high-risk products are monitored to ensure execution of this FDA requirement. For more details on how a foodservice business can develop a supply chain food safety management program based on FDA FSMA rules, see the literature.9

PRPs Must Include a Detailed Sanitation Component

One of the most important elements of a PRP is the sanitation procedures, training of employees and managers, and evidence for proper execution in the FSMS. Sanitation within the PRP plays a key role in the prevention of foodborne illnesses and outbreaks, including the prevention of allergens. Establishing and monitoring PCPs in the FSMS of each facility is critical. The CDC lists 30 contributing factors that lead to the majority of foodborne illness outbreaks in the categories of contamination of hands/gloves and surfaces, proliferation of pathogens, and survival of pathogens.10 A study by CDC of 114 foodborne disease outbreaks reported to the National Environmental Assessment Reporting System (NEARS) showed that contamination of hands and surfaces (via cross-contamination) attributed to 81 percent of outbreaks investigated,11 showing just how important foodservice sanitation is in the prevention of foodborne illnesses.

FDA's Food Code and most state regulatory foodservice facility plan review documents include requirements for the cleanability of surfaces including floors (and grout between tiles), walls, ceilings, food prep tables, food contact surfaces, sinks, etc. They also include restrictions on some surface types, such as floor carpeting. Equipment (ANSI-certified) placement in the design is also critical to ensure cleanability, especially where the surface meets the walls or other equipment/tables. Environmental surfaces in a foodservice establishment can harbor food debris, which can lead to the development of biofilms or biological hazards (e.g., Listeria monocytogenes can produce a biofilm on stainless steel surfaces and then grow to larger numbers of bacteria on the surface).

All surfaces must be accessible and cleanable, and the cleaning and sanitizing to remove all biological (e.g., microbial pathogens) and chemical (e.g., allergens) hazards, even if not a food contact surface, should be included. If these surfaces are neglected, they can lead to cross-contamination as the biofilms accumulate and are released on food contact surfaces or touched by employees that can then transmit the biofilms to other food preparation surfaces or food. Floors and equipment on floors are one of the top areas in a restaurant for the persistence of pathogens, and improper use of reusable mops and mop water may contribute to this risk. Pathogens like Salmonella, Listeria, and norovirus can easily cross-contaminate other surfaces during body fluid cleanup procedures, when aerosolized from employees walking on floors, the movement of wheels on carts, and during the mopping procedure. One of the largest protracted outbreaks (from 2008–2019) in a restaurant was due to persistent Salmonella in the restaurant found on numerous environmental surfaces.12 Thus, improper sanitation of floors and drains can contribute to the spread of pathogens that lead to foodborne illness outbreaks.

Another important sanitation design requirement is to ensure proper cleaning, sanitation, and location of the utility sinks and mop storage. Since these sinks are used for preparing chemicals for cleaning and/or storing cleaning tools and chemicals, they should be located away from food storage, prep, and customer service areas. If it is necessary that the sinks be located inside the kitchen area, then they should be "guarded" by splash guards that prevent splashing of any solution or chemicals onto other surfaces, especially clean dishware, handwash sinks, and food prep areas.

Dishware sanitation is important to include in the sanitation component of a PRP, and includes the storage and washing area surface sanitation, as well as the racks and shelving used to separate and store clean dishware from dirty dishware. Dirty dishware cleaning and storage areas must be adequately separated from clean dishware, and adequate space must be available for drying dishware. Otherwise, a single cross-contamination event may arise due to stacking wet dishware. For example, if a dirty container that held raw chicken comes into contact with a clean container that will later be used to store prepared RTE chicken salad, this could easily cause a large outbreak of foodborne illnesses. A best practice is to design the clean dishware storage area with racks and slots that will accommodate every individual clean dishware item to drip dry without stacking.

When I first started leading food safety management at a large foodservice business enterprise (my first experience working in the food industry after a career in public health for infectious disease prevention), I noticed that many of the chemicals we were using at that time did not kill or eliminate foodborne pathogens, according to their product descriptions and certification labels. The few chemicals that did have efficacy (via EPA registration for efficacy and safety on food contact surfaces) available to the food industry required more than ten minutes of contact time to achieve efficacy against microbial surrogates of foodborne pathogens. I remember asking several of my chemical suppliers why they did not make a sanitizer that killed norovirus or Listeria, to which they did not have an answer. Things have changed now for the better, but there is still an impulse to choose the lowest-cost sanitizer without regard to its efficacy (contact times too long to feasibly kill any of the foodborne pathogens on surfaces when used in foodservice).

To ensure sanitation, sanitizers should be selected that include these attributes:

  • The sanitizer is food contact surface safe (rinse or no rinse)
  • The sanitizer is safe to use by employees (according to OSHA requirements13)
    • Bleach-containing products can emit toxic fumes when used around some detergents
  • The sanitizer is effective against all major foodborne pathogens, including norovirus
    • The sanitizer is effective against these pathogens after short contact times (too much time reduces compliance; the preference is less than 30 seconds)
  • The sanitizer remains effective during storage
  • Know if a cleaner or detergent is needed to clean a surface before sanitizing it (some sanitizers clean and sanitize)
    • Some cleaners leave residue on surfaces.

An important element of the sanitation component of a PRP is the proper use of cleaning tools by employees. Separate cleaning and sanitation tools (color-coded to indicate use) are commonly used in food manufacturing facilities to prevent the cross-contact of allergens from one area to another and/or the cross-contamination of food processing equipment between raw and RTE processing equipment. It is especially important to segregate cleaning tools used for restrooms in foodservice environments from all other cleaning tools because hazards such as norovirus and Hepatitis A are transmitted to surfaces in restrooms, where they can be "moved" from these areas to kitchen surfaces.14 Likewise, using reusable cloth towels to clean surfaces and storing these towels incorrectly can transmit hazards like Salmonella from raw chicken prep surfaces to food contact surfaces.15 

PRPs Must Define the Controls (PCPs) in the FSMS

As a PRP is critical to the safe preparation and service of food, the FSMS must include the establishment and inclusion of the controls of each PCP, its critical limits, and a means to monitor the control, as is also done with the Process HACCP defined CCPs at each process (Figure 2). To ensure that the PRP elements (especially the sanitation requirements) are implemented into the FSMS, define each SOP and its related PCP to control the hazard(s), ensure that employees are trained on their proper execution, and check the PCPs regularly during operations. For example, the FSMS should define when employees must wear single-service gloves when handling RTE foods, and provide the necessary training of employees and managers trained on how to monitor the proper use of gloves.16 This training must include corrective actions for when managers observe an employee not using gloves properly, to prevent cross-contamination of foods during the food prep processes.

FIGURE 2. Example use of PCPs defined in the PRP and CCPs defined in the Process HACCP plan. The Process HACCP and the PCP together define the hazards and their priority control measures that must be performed during each step of each food preparation process (source in part: FDA 2017). Some PCPs may be assessed outside of the food preparation processes (not shown).

Process HACCP plan

Each of these PCPs and the proper controls within a FSMS are discussed in more detail in the literature.5 The hazards that can occur without determining PCPs and their controls (e.g., an employee working while sick with norovirus, not wearing single-use gloves when handling RTE foods, surfaces not sanitized properly, etc.) can lead to even larger foodborne disease outbreaks than a single missed CCP control, such as not cooking a single chicken breast properly during the food prep process (which likely would make only one customer sick). Both controls are important, of course, and this is why the FSMS must include PCPs specific to personal hygiene and other controls within the PRP, including sanitation PCPs.

FSMSs with the Proper PRPs to Prevent Foodborne Outbreaks

In a study performed by FDA using FDA inspections of restaurants across the U.S., the restaurants that developed and executed a FSMS by a Certified Food Safety Manager (e.g., ServSafe certified) had the lowest number of foodborne illness risk factors.17 These procedures, collectively termed the PRP when used along with the Process HACCP plan (Figure 3) to develop a FSMS, provide for the most comprehensive means for controlling all hazards associated with foodservice business.

FIGURE 3. How the Process HACCP plan plus the PRP are used to create a FSMS. After the hazards have been identified in the food preparation processes used to serve the menu and in the PRP, and the controls have been identified that must be in place to prevent the hazards, then the FSMS is developed to enable training of employees and the foodservice business to monitor the controls and take appropriate action to ensure that each is in place.

Process HACCP plan plus the PRP

The primary reason a FSMS is so effective is because it uses a strong foundation of HACCP in the identification of hazards in all food preparation processes of any menu, and it includes a requirement to identify and address additional hazards that occur during basic operational procedures in a foodservice business. If all foodservice businesses implemented a FSMS using these methods, it would guarantee a paradigm shift of fewer foodborne illnesses and outbreaks in the U.S. every year, and the value of these businesses would likely increase.


  1. King, Hal. "Implementing Active Managerial Control Principles in a Retail Food Business." Food Safety Magazine February/March 2016.
  2. U.S. Centers for Disease Control and Prevention (CDC). "National Outbreak Reporting System (NORS)." February 3, 2022.
  3. King, Hal. "Off-Premises Dining Safety in the Restaurant and Foodservice Business." Food Safety Magazine June/July 2021.
  4. U.S. Food and Drug Administration (FDA). "Food Code 2017: Annex 4." March 7, 2022.
  5. King, Hal. Food Safety Management Systems. Springer (2020).
  6. U.S. Department of Labor, Occupational Safety and Health Administration (OSHA). "Safety and Health Topics: Young Workers—Restaurant Safety."
  7. FDA. Retail Food Protection: Employee Health and Personal Hygiene Handbook. March 7, 2022.
  8. FDA. "Food Safety Modernization Act (FSMA)." June 9, 2022.
  9. King, Hal and Wendy Bedale. Hazard Analysis and Risk-Based Preventive Controls. Elsevier (October 2, 2017).
  10. CDC. Environmental Health Services. "Contributing Factor Definitions." January 31, 2022.
  11. CDC. "CDC's National Environmental Assessment Reporting System (NEARS): 2015 Summary Report."
  12. Nettleton, William D., Bethany Reimink, Katherine D. Arends, Douglas Potter, Justin J. Henderson, Stephen Dietrich, and Mary Franks. "Protracted, Intermittent Outbreak of Salmonella Mbandaka Linked to a Restaurant—Michigan, 2008–2019." CDC Morbidity and Mortality Weekly Report. August 20, 2021.
  13. OSHA. "Young Worker Safety in Restaurants eTool."
  14. King, Hal. "Breaking the Chain of Infectious Disease Transmission in a Retail Foodservice Business." Food Safety Magazine August/September 2020.
  15. King, Hal. "Is It Time to Change How We Clean and Sanitize Food Contact Surfaces with Reusable Wiping Towels?" Food Safety Magazine August/September 2018.
  16. King, Hal. "The Need for a Glove-Use Management System in Retail Foodservice." Food Safety Magazine June/July 2019.
  17. FDA. "Factsheet: The Occurrence of Foodborne Illness Risk Factors in Fast Food and Full-Service Restaurants 22013–2014."

Hal King, Ph.D., is Managing Partner of Active Food Safety,, and a member of the Editorial Advisory Board of Food Safety Magazine. He can be reached at