How to keep the records your HACCP plan generates in a form that proves control and survives an audit — made as the work happens, signed, dated, kept for the right length of time, and stored so any one of them is minutes away.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can keep the records your plan throws off in a shape an auditor accepts on sight — the actual reading written down as the work happened, signed and dated by the person who did it, held for as long as the rule that binds you says, and filed so you can put your hand on any single one in minutes. Principle 7 is the least glamorous of the seven and the one an audit spends the most time on, because it is where the plan proves it was run and not just written.
Principle 7 of the HACCP Principles and Application Guidelines — the method US regulators publish, developed by the National Advisory Committee on Microbiological Criteria for Foods — is to establish record-keeping and documentation procedures. Notice the word establish. By the time you reach it, the records already exist; Principles 1 through 6 produced every one of them. Principle 7 is not new work. It is keeping what you already made so it holds up.
The guidelines sort the records into two families. The first is the plan and what it stands on: the hazard analysis with the reasoning behind it, the written plan itself — the team and their responsibilities, the product description and intended use, the flow diagram you proved on the floor, and the summary table that lists each CCP with its critical limit, monitoring, corrective actions, and verification — plus supporting documentation like your validation records.
The second family is the records the plan generates every day it runs:
That is the pile. The rest of this lesson is about the qualities that turn a pile of paper into records that pass.
FDA's Preventive Controls rule spells out the plain standard for the foods it covers, and it is the same standard every framework holds you to. Under 21 CFR 117.305, a record must contain the actual values and observations obtained during monitoring; be accurate, indelible, and legible; be created concurrently with the activity it documents; and carry enough identifying information — the plant, the date and, when it matters, the time, the signature or initials of the person who did the work, and the product and lot code where it applies.
Two of those are where records quietly fail.
The actual value, not a checkmark. The rule says actual values and observations. A cook log that reads "OK" or carries a tick in a box is not a record of the cook; it is a record that someone glanced at it. The number you read — the real 168 degrees, the real pH 4.1 — is the evidence. A checkmark throws the evidence away and keeps the ceremony.
Signed by the person who did the work. For meat and poultry, USDA's Food Safety and Inspection Service is blunt in 9 CFR 417.5(b): each entry on a HACCP record must be made at the time the specific event occurs, include the date and time recorded, and be signed or initialed by the establishment employee making the entry. The SQF Food Safety Code, Edition 9, says the same in clause 2.2.3.2 — records must be legible and confirmed by the people who did the monitoring. Three authorities, one rule: the person who took the reading signs it, at the moment they took it.
That word concurrently in 21 CFR 117.305 is the one first-timers underrate, and it is the classic audit finding. A is the only kind the rule recognizes. FSIS puts the same fence around it — the entry is made at the time the specific event occurs — and the reason is not bureaucratic. A monitoring record exists to prove the CCP was watched in real time. A log filled in from memory at the end of the shift, or a binder tidied up the night before the audit, proves the opposite: that nobody was watching when it counted.
An auditor can spot a reconstruction from across the room — the ink is too uniform, the handwriting too calm, the numbers too round, every entry made in one sitting. Once they see it on one record they distrust all of them, and a plan whose records cannot be trusted is a plan that, as far as the audit is concerned, was never run.
Whether the record lives on paper or in software does not decide this — 21 CFR 117.305 accepts original records, true copies, and electronic records equally. What decides it is when the entry was made. That is the practical argument for capturing records where the work is done, as it is done. In Bettr Manager, a production run carries its batch record and its cooking and cooling CCP logs on the run itself, and the run cannot be marked finished until those logs are complete — so the reading is captured as the batch is made rather than rebuilt afterward, and the CCP logs export to an FDA- or USDA-formatted sheet when an auditor asks for them. It does not set your retention periods or judge a record for you; that stays your job. It is one way to keep contemporaneous records instead of reconstructing a binder under deadline.
A finished record is not done when the batch ships. It has a , and the number is not the same across frameworks — so do not carry one you remember from somewhere else.
More than one of these can apply to you at once, and when they do, the longest governs in practice. Your plan documents are a special case: keep the hazard analysis and the written plan for as long as they are in use. Because these figures move and more than one may bind you, look up your own retention rule at the source rather than trusting a number in a lesson — this one was verified on July 14, 2026.
Keeping a record is only half the requirement; being able to find it is the other half, and the rules say so directly. Under 21 CFR 117.315, records may be stored offsite only if they can be retrieved and provided onsite within 24 hours of an official request — and electronic records count as onsite as long as they are accessible from an onsite location. FSIS allows monitoring records offsite after six months on the same 24-hour retrieval condition (9 CFR 417.5(e)). SQF clause 2.2.3.3 asks that records be readily accessible, retrievable, and securely stored against loss, damage, deterioration, and unauthorized access.
Read those together and the standard is plain: a record you cannot produce inside the window is, to an auditor, a record you do not have. It is the same test a mock recall puts on your traceability — can you pull the specific record for a specific lot on a specific day, fast, under pressure. Decide now where each record lives and who can put a hand on it, and that test stops being a scramble.
Finish Principle 7 and you have the whole HACCP plan: the five preliminary steps, the seven principles, and a record for every one of them that can prove control. For a seafood, juice, or meat-and-poultry operation running a mandated HACCP plan, that is the standard.
But if you are an FDA-registered manufacturer of most other foods, HACCP is the foundation and not the finish line. FSMA's Preventive Controls rule asks for more than a classic HACCP plan — a written food safety plan, preventive controls that reach beyond CCPs into allergens, sanitation, and your supply chain, a recall plan, and a qualified individual to sign it all off. What that rule adds, and who is allowed to write it, is the next course.
Do this in your operation