How to capture cook and cool monitoring on the floor as a critical control point log — the limit, the reading, the time, the signature — and set the rule that a batch can't advance until the reading is in-limit.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can turn a cook or cool step from a number you write down into a control point you can't walk past: a log that captures the limit, the reading, the time, and who took it, with the rule that the batch does not advance until the reading is in-limit — and the corrective action already written for the runs where it isn't. It helps to have a batch record you can trace first, because the CCP log lives inside it.
The batch record from the last lesson already captures readings — a temperature at the kettle, a pH after mixing. Most of those are good practice: you want to know the number, and a note if it drifts. A few are different in kind. At a couple of steps, the reading is the one thing standing between the batch and a hazard that cooking or cooling exists to hold back. Miss it there, and nothing downstream catches it.
That step is a . The term comes from HACCP — FDA's Hazard Analysis and Critical Control Point guidelines — where determining CCPs is the second of the seven principles. The idea is narrow on purpose: not every check is a CCP, and calling everything critical drains the word. A CCP is a step where, if control slips, the product is unsafe and no later step will save it.
Critical limits and monitoring are HACCP disciplines in their own right, and the Getting Certified track builds them from the ground up. But most operators meet them for real the first time they have to gate a cook or a cool step, which is why this lesson teaches them here. For an FDA-registered manufacturer, the same idea also lives in your food safety plan under a different name: under 21 CFR 117.135, a process preventive control for a step like heat processing or refrigerating must name the parameters that control the hazard and the maximum or minimum value each must be held to. Whether your plan calls it a CCP or a process preventive control, the record you keep on the floor is the same — a CCP log.
Strip a CCP log to its frame and it holds four things.
The critical limit
The the step has to meet: an internal temperature, a time, or both together. It is written on the log before the run, not decided at the reading. A limit you set after seeing the number is not a limit.
The reading
The value the operator actually measured — the internal temperature at the coldest point, the pH, whatever the limit is judged against. One honest number, taken where the standard says to take it.
The time
When the reading was taken. For a cook this is a single stamp; for a cool it is several, because cooling is a curve, not a checkpoint — the limit is about how fast the food falls, so a reading without its time proves nothing.
Who took it
The operator's initials or signature against each reading. is only worth the accountability behind it. Under 21 CFR 117.145, monitoring of a preventive control has to be documented in records — a reading nobody signed is a reading nobody can stand behind.
That is what separates a CCP log from an ordinary in-process check: it is tied to a limit set in advance and to a corrective action set in advance, and it is monitored on a schedule your plan defines. The batch record notes the number; the CCP log judges it.
Two steps show up as CCPs in almost every heat-process operation, and they are worth knowing cold.
Cook is a step: hold the food hot enough, long enough, to knock the target pathogen down to a safe level. The limit is a minimum internal temperature paired with a time. As a familiar reference, the FDA Food Code — the model code states adopt for restaurants and retail — sets poultry at 165°F, comminuted (ground) meat at 155°F for 17 seconds, and many whole cuts at 145°F for 15 seconds. Those are the retail numbers; treat them as a sanity check, not as automatically yours.
Cool is the one that drifts, because it is a curve you have to stay ahead of. Cooked food has to get back down through the range where pathogens grow fastest before they can. The FDA Food Code's two-stage limit, in section 3-501.14, is the reference most operations start from: cool from 135°F to 70°F within 2 hours, and from 135°F all the way to 41°F within 6 hours total. The first stage is the tight one — the food spends it in the part of the range where growth is fastest, so you get only 2 of the 6 hours to clear it. Food built from ingredients already at room temperature, with no cook step, gets a single-stage limit instead: down to 41°F within 4 hours, under section 3-501.14(B).
Confirm your own limit — don't inherit a number
The FDA Food Code is a model code written for retail and food service, not the rule that binds a manufacturer. As an FDA-registered facility, your binding critical limits are the ones in your own validated food safety plan under 21 CFR 117; a meat or poultry plant follows USDA FSIS lethality and stabilization guidance — Appendix A for cooking, Appendix B for cooling — instead. Use the Food Code figures as a reference and a starting point, then validate the limit for your product and your process, and put that number, not a remembered one, on the log.
Here is the line between a CCP log and a nicer in-process check, and it is the whole point of the lesson.
Capturing a reading and gating on it are different things. A batch can carry a failed cooling curve and still get packed and shipped if nothing in the process stops it — the number sat on a sheet and the work moved on. Gating means the step cannot advance until the reading is in-limit and signed off. The cook isn't "done" until the temperature is confirmed at or above the limit; the batch doesn't leave the cooler until the curve is confirmed under it. On paper, that is a supervisor's sign-off that has to happen before the next step starts. The gate is what turns monitoring into control instead of record-keeping.
Software built for food can carry the gate for you: capture the cook and cool readings against each batch, block a run from being finished until those readings are recorded, and flag a reading that falls outside its limit for a decision. Bettr Manager, the operations platform this site is part of, works that way — one way to hold the gate, not the only one; a disciplined paper log with a real sign-off reaches the same place, and in both a person still makes the call on a batch that misses.
A gate is only honest if you have decided, in advance, what happens when a reading fails. That decision is the , and it belongs on the log next to the limit, written before the run.
HACCP makes corrective action its fifth principle, and 21 CFR 117.150 spells out what one has to cover for a manufacturer. When a limit is missed, the procedure has to identify and correct the immediate problem, reduce the chance it recurs, evaluate every batch the failure could have affected for safety, and keep any food you can't show is unadulterated out of commerce — all of it documented. In plain terms: fix the step, figure out why, decide whether the product is safe, and don't let anything unsafe leave.
Say a cooling batch is still reading 90°F at the 2-hour mark, past the 70°F its limit demanded. The numbers here are made up to show the shape. The pre-written corrective action names exactly what happens: the batch is held, not moved; a named person evaluates whether it can be safely reworked or has to be discarded; the reading, the miss, the action taken, and who evaluated the food all go on the log. If your food safety plan puts affected product on a formal QA hold while that judgment is made, this is where the two connect — the gate stops the batch, and the hold keeps it stopped until someone qualified releases it. What you never do is let the batch move on because the shift was busy.
A cook or cool step with a real limit, a signed reading, a gate, and a written corrective action is a step you can defend — to an auditor, to a customer, and to yourself. The batch record proves which lots went in; the CCP log proves the batch was made safe before it moved. Together they are most of what a production record owes.
The next thing that quietly breaks operations is smaller and less dramatic than a blown cooling curve: units. A recipe made in pounds, sold by the case, returned by the each — and the counts stop tying out. That is where this course goes next. First, put a gate on one real step.
Do this in your operation