HACCP for Craft Chocolate Makers: A Working Food Safety Plan

HACCP — Hazard Analysis and Critical Control Points — is often treated by craft chocolate makers as box-checking paperwork they do because a wholesale buyer asked for it. That's backwards. The real function of a HACCP or Preventive Controls food safety plan is operational: it's the discipline that catches food-safety problems before they produce recalls, customer illnesses, or FDA enforcement actions. Most craft chocolate operations run food-safe in practice but not on paper — and the paper is what matters when a wholesale audit, a regulatory visit, or a customer complaint requires you to prove it. This post is the working guide.

HACCP vs Preventive Controls: what applies to you

Two overlapping food-safety frameworks govern most US chocolate production:

For most craft chocolate makers, the practical framing is:

• PCHF is the legal requirement. You need a written food safety plan, a PCQI on staff, documented hazard analysis, preventive controls, monitoring records, and a recall plan. The plan can follow a HACCP-style structure, which most do.
• HACCP is the commercial expectation. Specialty wholesale buyers (Whole Foods, natural grocer chains, co-ops) increasingly ask for HACCP- style documentation as a vendor-onboarding prerequisite. Your PCHF plan, structured as HACCP, satisfies both.
• FSMA 204 adds a traceability layer for FTL-eligible products — covered in our FSMA 204 guide. Plain chocolate is not on the FTL, but chocolate with certain inclusions is.

So in practice: build a HACCP-structured food safety plan, ensure it satisfies PCHF, layer FSMA 204 on top if your inclusions require it.

The seven HACCP principles

HACCP is structured around seven principles. Every craft chocolate food safety plan walks through them in sequence.

1. Conduct a hazard analysis. Identify the biological, chemical, and physical hazards that could affect your product at each production step.
2. Identify Critical Control Points (CCPs). The steps where a hazard can be prevented, eliminated, or reduced to an acceptable level.
3. Establish critical limits. Measurable parameters (temperature, time, pH, moisture) at each CCP.
4. Establish monitoring procedures. How you'll verify critical limits are being met — who checks, how often, with what tools.
5. Establish corrective actions. What happens when a critical limit is missed.
6. Establish verification procedures. Periodic audits confirming the plan is actually being followed as written.
7. Establish documentation and record-keeping. Written records of all of the above, retained for 2+ years.

Chocolate-specific hazards

Every food category has its own hazard profile. Chocolate's hazards cluster into three categories:

Biological hazards

• Salmonella. The most significant biological hazard in chocolate. Historically present in cacao beans from field contamination; multiple major chocolate recalls over the past decade have been Salmonella-related. Roasting at proper temperatures inactivates Salmonella — which makes roast time and temperature a critical control point.
• Mold. Visible on improperly-fermented or wet-stored cacao. See our cut test guide for the inspection protocol. Mold is both a food-safety concern (mycotoxins) and a flavor defect.
• Listeria (milk chocolate or dairy-inclusion bars only). Dairy ingredients must be pasteurized; contaminated dairy is the main vector. Low-risk for plain dark; meaningful for milk chocolate.

Chemical hazards

• Heavy metals (lead, cadmium). Prop 65 exposure, California enforcement. Covered in depth in our Prop 65 guide. A CCP at the incoming-material inspection stage.
• Mycotoxins (ochratoxin A, aflatoxins). Produced by molds in poorly-stored cacao. EU regulatory thresholds are strict; US less so but still matters. Controlled via supplier cut-test documentation and receiving inspection.
• Pesticide residues. Particularly relevant for non-organic cacao. Most specialty cacao is organic or low-residue; verify via supplier CoA.
• Allergen cross-contact. Shared-equipment exposure to nuts, dairy, soy, or wheat from inclusion bars can contaminate “plain” dark bars made on the same line. Allergen-control protocols (dedicated equipment, cleaning validation, labeling) are preventive controls.

Physical hazards

• Stones, twigs, foreign objects from cacao harvest. Primary control: hand-sorting at intake (step 1 of our 7 stages of production guide).
• Metal fragments from equipment wear (especially melanger stones, roaster drums). Metal detector at finished-goods stage controls this at scale; visual inspection at craft scale.
• Glass or plastic from packaging or environment. Controlled via facility-design standards and incoming-material inspection.

Critical Control Points for a craft chocolate operation

A typical craft bean-to-bar operation has 3–5 Critical Control Points. The usual candidates:

Roasting is the CCP that matters most in terms of biological safety. Every batch should have documented roast-curve data showing bean temperature reached and held at Salmonella-kill temperatures. Our roast profile design guide covers the profile side of roasting; HACCP adds the monitoring and documentation discipline.

Writing your food safety plan

A compliant food safety plan for a small craft chocolate operation is typically 15–40 pages and contains the following sections:

1. Facility description. Address, square footage, equipment inventory, product categories made, typical production volume.
2. Product description per SKU. Each SKU identified by ingredients, intended use, packaging, shelf life, consumer population.
3. Flow diagram. Block diagram showing each production step from receiving to shipping, with inputs and outputs at each step.
4. Hazard analysis. A table listing biological, chemical, and physical hazards at each production step, with probability and severity assessments.
5. CCP determination. Which steps are CCPs, with justification.
6. Critical limits and monitoring. For each CCP: what measurement, what value, what frequency, who monitors, with what instrument.
7. Corrective actions. For each CCP: what happens if the critical limit is missed.
8. Verification and validation. How and how often you'll verify the plan works.
9. Recordkeeping procedures. What forms you use, where records are stored, how long they're retained.
10. Recall plan. How you would execute a recall, who has authority, notification procedures.
11. Supply chain program. Approved supplier list, CoA requirements, verification protocol.
12. Sanitation and allergen control. Cleaning protocols, changeover procedures, allergen validation.

FDA publishes templates for food safety plans; most craft makers build their plan from a template and customize. Don't write from scratch — the templates encode regulatory language that auditors expect to see.

Daily implementation

A written plan is only as good as the daily records that prove you're following it. The minimum daily/per-batch records a craft operation maintains:

• Receiving log. Every incoming raw material with date, supplier, quantity, lot/CoA reference, inspection result.
• Batch record per production run. Start time, ingredient lots used, roast temperature/ time data, conche time, temper parameters, output quantity, operator signature.
• Monitoring log.Documented CCP monitoring — each batch's roast-curve data, allergen-changeover cleaning validation, visual inspection results.
• Deviations log. Any critical limit miss, with corrective action taken and product disposition (released, reprocessed, destroyed).
• Sanitation log. Daily cleaning records, with operator initials and time.
• Training records. PCQI certification, ServSafe certification, team food-safety training completion.

The recordkeeping burden is real but manageable. Integrated production platforms (see our production calendar guide) can automate most of it — roast temperatures captured automatically, batch records populated from production data, allergen flags triggered when SKUs change. What a spreadsheet does with effort, a purpose-built platform does with less friction.

PCQI and training requirements

Under PCHF (21 CFR 117), every food facility needs a trained Preventive Controls Qualified Individual (PCQI) overseeing the food safety plan. For a small craft maker, that person is usually the owner. Requirements:

• Completed FSPCA-approved PCQI training (20-hour course, ~$500–$900 — see our starting-a-business guide);
• Or equivalent through job experience sufficient to develop and apply a food safety system;
• Certification is not time-limited but annual refresher training is recommended.

PCQI is not optional for commercial facilities. It's the foundational training requirement underlying your entire food safety plan; a plan authored by an uncertified individual is not compliant.

Common mistakes

• Writing a plan and never following it. The plan-vs-practice gap is the single most common audit finding. A three-year-old plan with no batch records showing execution is worse than no plan at all — it proves you know what you should do and don't do it.
• Generic copy-paste templates. A template without facility-specific customization sends obvious signals to auditors. Customize every section to your actual equipment, actual SKUs, and actual processes.
• Under-counting CCPs. Makers who declare only one CCP (usually roasting) and miss allergen control, incoming material review, or sealing are under-scoping. Under-scoping is often an audit failure even when the food itself is safe.
• No recall plan.PCHF requires a written recall plan. Makers who treat this as hypothetical discover during a real recall that they can't identify which customers got which batch — and then face regulatory penalties on top of the recall costs.
• Missing roast-temperature data. The most common craft chocolate CCP failure. Roasting is a CCP; if you don't have a data log showing bean temperature reached safe values for the required time, you don't have a complete plan.
• Expired PCQI or unclear authority. If your PCQI leaves and no one else is certified, the facility is non-compliant the day after they leave. Plan for succession; ideally have two certified people on a small team.

Common questions

Do I need HACCP if I'm cottage-food?

Technically no — cottage food operations are exempt from the Preventive Controls rule in most states. Practically: cottage food caps out at modest annual revenue thresholds, and the moment you graduate to a commercial facility you need a plan. Makers who build HACCP-style discipline from day one transition much more easily.

Do I need a consultant to write the plan?

Not strictly required — a PCQI-certified owner can write their own plan. But a food-safety consultant familiar with chocolate (2–4 hours of consulting, $600–$1,500 typically) catches oversights most first-time authors miss. A one-time consultant engagement at plan-writing time is cheaper than an audit failure.

How often should I review my plan?

PCHF requires reanalysis every 3 years minimum, and immediately whenever something material changes — new equipment, new SKU, new supplier, new facility. Most small makers do a light annual review plus the formal triennial reanalysis.

What happens during an audit?

For a regulatory audit (FDA or state inspector): they review your plan, walk your facility, observe operations, and request records showing plan execution. For a wholesale audit (Whole Foods, distributor): same process, generally less confrontational, but same documents. In both cases, the documents and the facility have to match — your plan says X, your records show X, your operation does X. Mismatches are findings.

The cheat sheet

HACCP and Preventive Controls sound bureaucratic and often feel like paperwork. Their real function is operational: they translate “we care about food safety” into specific documented actions that catch problems before they become recalls, illnesses, or enforcement events. Makers who internalize the framework end up with tighter operations; makers who treat it as box-checking end up with incidents — and incidents in food are disproportionately expensive.

Pair this post with our Prop 65 compliance guide (heavy-metal monitoring is a HACCP chemical hazard), our FSMA 204 guide (traceability layer on top of HACCP), and our starting-a-business guide (PCQI training fits into the broader pre-launch certification roadmap).