The Helm and the Lens · English
Pronto per la pubblicazione / Ready for publication
the Helm and the Lens – Vol. 6a
ISO 22000 and Trust at the Table Volume 6a — The Helm
How hotel owners and general managers can make food safety a system they govern, from buffet to banquet to beach club, with ISO 22000:2018 as the frame and HACCP as the engine. Thirty cases from hotel kitchens around the world, from San Sebastián onward.
584
Pagine
The Helm and the Lens · Volume 6a
ISO 22000 and Trust at the Table
Food Safety Management for Hotels, Resorts and Their Kitchens
A guest who sits down to breakfast, orders room service at midnight or eats at a wedding banquet does not see the kitchen. They see the plate and trust it. This volume is about what has to be true behind that trust, and about who in a hotel is answerable for it.
Most hotels already have a HACCP plan. Far fewer have a system: one that knows where its food actually goes and who carries an allergy from the check-in desk to the waiter. It also has to decide what happens on the night the blast chiller fails or the banquet doubles in size. ISO 22000:2018 provides that system. This book reads it from the ownership and management side of the hotel. It covers every outlet where food reaches a guest: the main kitchen, the breakfast buffet, the pool bar, the minibar, the staff canteen and the beach club run by a concessionaire under the hotel’s name.
The volume is organised in two chapters of fifteen subchapters each. The Vision of Ownership covers what the standard asks of those who hold the helm: scope, leadership, policy, risk and the management review. The Operational Perspective follows the standard into daily work: prerequisite programmes, hazard analysis, the last metre between kitchen and table, allergens, traceability, emergencies and verification. HACCP rests on the Codex Alimentarius principles, so the method holds wherever the hotel stands.
Every subchapter opens with a case set in a real city, built as a composite and clearly declared as fictional. A frame story in San Sebastián runs through the volume. Each subchapter also carries a Verification Pact. It checks common market claims against what the standard actually requires and keeps three things apart: binding requirement, explanatory note and the author’s recommendation. Economic figures are presented as model estimates, not as sector data.
The author is a Lead Auditor and has spent over twenty years in international luxury hospitality. He writes as an author and publisher, for the people who run hotels and for those who will run them next.
Each subchapter ends with a concept card. Worksheets, checklists and the cards in high resolution are available on the online platform. The companion volume, 6b · ISO 22000 and the Proof on the Plate, takes up the same standard through the eyes of the internal auditor and the certification body.
EDIZIONI · FORMATI
Formati disponibili
Le edizioni fisiche e digitali associate a questa scheda.
NEL LIBRO
Contenuto / Contents
La struttura del volume così come presentata nell’edizione pubblicata.
Table of Contents
- Preface.
- 1.1 The HACCP Illusion.
- 1.2 The Context of a Kitchen.
- 1.3 Who Else Is at the Table.
- 1.4 Where the System Ends.
- 1.5 Commitment You Can Invoice.
- 1.6 A Policy That Can Refuse a Dish.
- 1.7 The Team Leader Is Not the Chef.
- 1.8 Risk to the Business, Hazard to the Guest.
- 1.9 Objectives That Reach the Pass.
- 1.10 The New Menu Is a Change.
- 1.11 Infrastructure Is a Capital Decision.
- 1.12 Sovereignty over the Supply Chain.
- 1.13 Competence, Awareness and the Culture Nobody Required.
- 1.14 The Review at the Owner’s Table.
- 1.15 Food Safety on the Balance Sheet.
- CHAPTER 2.
- 2.1 What the Hotel Actually Serves.
- 2.2 Prerequisite Programmes.
- 2.3 Hazard Analysis at Four Hundred Covers.
- 2.4 CCP or OPRP: The Choice That Decides Everything.
- 2.5 Validation Before the First Plate.
- 2.6 Allergens: From the Store to the Guest’s Word.
- 2.7 The Last Metre: Buffet, Room Service, Banquet.
- 2.8 Traceability and the Recall That Reaches the Kitchen.
- 2.9 When the Power Fails at Dinner.
- 2.10 The Cold Room That Lies.
- 2.11 The Handover and the Record at the Point of Use.
- 2.12 Food Defence and Food Fraud: What the Standard Does Not Ask.
- 2.13 The Tray at Eleven at Night.
- 2.14 Verification: Proving the Plan Works.
- 2.15 Updating the System, and the Helm and the Lens.
- Afterword.
- Sources and Research Methodology.
- Glossary.
- About the Author.
- Contact.
- The Series.
- The Online Platform...
- Acknowledgements.
- Analytical Index.
PRIMA DELL’ACQUISTO
Estratti / Extracts
Passaggi selezionati dal libro disponibili per la consultazione.
01 Preface Apri / Open
Why a hotel that already has HACCP needs to read this book
Almost every hotel that serves food already has a HACCP plan. Most of those plans are competent, many are good, and some are excellent. Yet the food safety failures that reach the press, the insurer and the courts are very rarely failures of the plan. They are failures of the organisation around it: a terrace opened for weddings that the plan never heard about, an outlet left outside the scope because it was run by a concessionaire, a policy that nobody has ever used to refuse a dish, a chef who is at once the person who cooks and the person who decides whether what was cooked is safe to serve. A plan can see only the steps it has been shown. Somebody has to decide what it is shown next.
This book is about that somebody. ISO 22000 is the international standard for food safety management systems, and its central idea is simple: the controls that make food safe (hygiene, temperature, segregation, the principles of hazard analysis) must be held inside a management system that decides what they cover, who governs them, what resources they receive, how they are checked and how they change. The standard does not replace the kitchen’s knowledge. It surrounds it with the decisions that the kitchen cannot take for itself.
The first subchapter opens with a wedding on a rooftop terrace in San Sebastián, on an afternoon of warm south wind, and with a hotel whose kitchen the inspectors described as well run. Thirty-one guests fell ill. The plan was correct. It described a hotel that had stopped existing three years before, and nobody in the building had been given the job of noticing. Every subchapter that follows is, in one way or another, about the same question the owner asked at the end of that week: who was supposed to know?
What this volume is
The Helm and the Lens treats each management system standard in two companion volumes. The first, The Helm, takes the side of the people who own and run the property: the decisions that build the system and keep it true. The second, The Lens, takes the side of the auditor, internal and external, who tests whether those decisions were taken and whether they hold. This is the first of the two volumes on ISO 22000. Its companion follows it.
The book is built in two chapters of fifteen subchapters each. Chapter 1, The Vision of Ownership, follows the decisions that belong to owners and top management: the context in which the kitchen works, the interested parties whose requirements the hotel has already signed, the scope, leadership as it appears in the budget, the policy, the food safety team leader, risk and hazard, objectives, the planning of change, infrastructure, suppliers, people and culture, the management review and, at the end, what an owner can honestly claim and prove. Chapter 2, The Operational Perspective, goes into the house as it is run every day: the description of what the hotel actually serves, prerequisite programmes, hazard analysis at scale, the choice between critical control points and operational prerequisite programmes, validation, allergens, the last metre between the pass and the guest, traceability and recall, emergencies, instruments, handovers and documents, food fraud and food defence, the food that leaves control, verification, and the updating that keeps the system describing the hotel that exists.
Chapter 2 is not a technical chapter. Its subject is the management that makes the operation work (the food and beverage director, the executive chef, the food safety team leader, the duty manager at eleven at night), and the technical matter appears inside the cases as the ground on which those people decide. A reader looking for cooking temperatures will find some, stated as the choices of the hotels in the cases and never as values required by the standard, because the standard contains none.
What ISO 22000 adds to HACCP
A hotel that knows HACCP already knows a great deal of what ISO 22000 asks. The principles of hazard analysis, the idea of controlling a hazard at the step where control is possible, monitoring, corrective action, verification and records are all there. What the standard adds is everything around them. It asks for interactive communication along the food chain and inside the organisation, for a management system with leadership, policy, objectives, resources and review, for prerequisite programmes that keep the conditions of hygiene under control, and for the principles of hazard analysis applied within that frame. Two cycles of Plan-Do-Check-Act run through the standard: one for the management system as a whole, and one inside the operation, where the hazard control plan is designed, applied, verified and updated. Most hotels run the second and have never been asked to run the first.
The difference matters more in a hotel than almost anywhere else in the food chain. A food factory produces a limited range of products on fixed lines, in a building designed for the purpose. A hotel produces hundreds of dishes a day, in several kitchens, for restaurants, bars, banquets, room service, breakfast buffets, pool terraces, staff canteens and outlets run by other companies under its roof. Its menu changes with the seasons and with the ambitions of its chef. Its staff change with the seasons too. Its last metre, the distance between the pass and the guest, can be a corridor, a service lift, a lawn or a beach. And its guests tell it, in words and often in a hurry, what they must not eat. A HACCP plan designed for one kitchen cannot see most of this. A management system can be made to.
How each subchapter is built
Every subchapter follows the same order, so that a reader who has learned it once can find anything in any of them. It opens with a guiding question and a case: a real kind of hotel, in a real city, on a particular day when something went wrong or nearly did. The Problem names the structural and cultural errors behind the case. The Principle states, in one or two sentences, what the subchapter holds to be true. What the Standard Says renders the relevant requirements in the book’s own words, with their clause numbers. The Verification Pact tests the most common claims about the subject against the text of the standard and says which of them are binding and which are not. What This Means in a Hotel translates the requirements into the property’s own terms, and What No Single Manual Will Tell You adds what experience teaches and guidance rarely writes down. Practical Application follows the hotel through what it did next. Economic Implications builds a model of what the failure cost and what the correction cost. Common Mistakes and Operative Synthesis reduce the subchapter to checks and questions that management can use. The Closing returns to the case, some months later, and passes the reader to the next city. Tables are numbered within each subchapter, so a reference to Table 5 always means the fifth table of the subchapter in which it appears.
The Verification Pact is the discipline that carries this series. Every statement in these pages about what the standard requires has been checked against the standard itself, and every claim that attributes to it an obligation it does not contain has been refused. A book that inflates obligations is as useless as one that minimises them; a hotel that believes it must do what the standard does not ask will spend its attention in the wrong places, and one that believes it need not do what the standard does ask will find out at the worst moment.
The cities
Thirty cases are set in twenty-eight cities, with San Sebastián opening the volume, closing the first chapter and closing the book. In a volume about kitchens the city is not scenery. It brings a climate, a produce, a supply chain and a way of eating, and several cases turn on exactly that: a coast where the power fails at dinner, an island where almost everything the kitchen uses arrives from another continent, a terrace where the south wind lifts the temperature by fifteen degrees in an hour, a resort where raw fish is a feast and not a risk to be designed away. None of the hotels is real. Each is a composite of patterns that recur across four decades of the author’s working life in hospitality, and in none of them does anyone act in bad faith. Every failure described in this book is produced by competent people doing the job in front of them on criteria that were legitimate at the time. That is not a courtesy to the industry. It is the argument. …
02 1.14 The Review at the Owner’s Table Apri / Open
Where information is supposed to become decisions: Melbourne
| Guiding Question
In the minutes of your last management review, how many lines begin with a verb, and how many with a number? |
Opening
On the Monday of Cup week the City of Melbourne’s environmental health officers arrived at the Collins Arcade Hotel at ten in the morning, following a complaint from a guest who had seen a cockroach crossing a canapé tray at a function the previous Friday. By one in the afternoon they had issued an order closing the banqueting kitchen until the infestation had been treated and the kitchen had been cleaned and inspected again. It stayed closed for three days. In those three days the hotel had eleven functions booked, including two race-day lunches for six hundred guests each, the most profitable events of its year. Four were moved to the restaurant kitchen at reduced capacity, three to other venues at the hotel’s expense, and four were cancelled.
The Collins Arcade is a three-hundred-and-eighty-room hotel in Melbourne’s central business district, owned by an Australian superannuation fund and run by an international operator under a management agreement. Its banqueting business is one of the largest in the city, and the spring racing season is its peak. The fund’s asset manager for the hotel, Rebecca Chen, received the news by telephone from the general manager, James O’Connor, on the Monday afternoon. On the Tuesday she asked for a copy of the most recent management review of the hotel’s food safety management system, which had been held in August.
The review pack ran to sixty-two pages, and it was excellent. The quality manager, Aisha Rahman, who also served as food safety team leader, had assembled every input the standard asks for: the status of previous actions, changes in context, results of monitoring, verification, internal and external audits, inspections, supplier performance, complaints, objectives, resources, incidents and opportunities. On page thirty-one there was a table of pest control findings by area, quarter by quarter. In the banqueting kitchen the findings had risen for three consecutive quarters: two activity reports in the first quarter, five in the second, eleven in the third. The pest control contractor’s reports, attached as an annex, recommended in each of the last two quarters that the gaps around the service penetrations behind the banqueting dishwasher be sealed, and noted that the work had not been done.
The minutes of the review were two pages long. They recorded that the meeting had been attended by the general manager, the quality manager, the executive chef and the director of engineering; that the inputs had been presented; that the food safety management system was considered suitable, adequate and effective; and that no changes were required. There were no actions. The pest control table was not mentioned.
Rebecca Chen read the pack and the minutes side by side on the Tuesday evening and flew to Melbourne on the Wednesday. She met the general manager, the quality manager and the director of engineering, Tom Walsh, in the hotel’s boardroom. The director of engineering confirmed that the sealing work had been on his list since the second quarter and had been deferred behind guest-room maintenance during a busy winter. The quality manager confirmed that she had put the trend in the pack. The general manager confirmed that he had read it.
“Everything we needed to know was in the pack,” she said. “Nothing we needed to decide was in the minutes. I want to understand what the meeting was for.”
The answer, when it came, was uncomfortable for everyone. The meeting had been held because the standard required it and because the surveillance audit was in September. The quality manager had prepared it conscientiously and presented it in full. The general manager had chaired it, and had approved the minutes that the quality manager drafted, as he approved most documents she drafted, because she was good at her job. Nobody had thought of it as the meeting at which the hotel decided what to do about its food safety. It had been the meeting at which the hotel showed that it had a food safety system.
The Problem
The management review is the one point in a food safety management system where everything the system has learned is supposed to arrive in front of the people who can change it. The monitoring results, the audit findings, the complaints, the supplier problems, the trends: all of it comes to one table, at which sit the people who decide about money, people and priorities. If the system works anywhere as a system rather than as a collection of procedures, it works there. And in many hotels, the management review is the place where the system is most thoroughly described and least often used.
The structural error is to organise the review around its inputs rather than its outputs. A review built around inputs is a presentation: someone assembles the information, presents it, and the meeting receives it. The more complete the pack, the longer the presentation, and the less time remains for the only thing the meeting exists to do, which is to decide. At the Collins Arcade the pack was complete to the last annex, and the meeting had spent its ninety minutes going through it page by page. By the time the last input had been presented, the meeting had run out of time for outputs, and it closed with the conclusion that everything was in order, because that is the conclusion a meeting reaches when it has not stopped to disagree.
The cultural error is to treat the review as an audit requirement rather than as a management meeting. Because the standard requires it and auditors ask to see its records, it is often scheduled once a year, shortly before the surveillance audit, and conducted in a way designed to produce records that satisfy the auditor. Its minutes are written to show that every input was covered. Nobody in the room expects it to change anything, and so nobody brings to it the questions that would change things: why has this trend been rising for three quarters, who owns it, and what will we spend to stop it?
There is a third element that is particular to hotels run under management agreements. The owner, who controls the capital and ultimately bears the loss, is usually not in the room. The operator’s management team conducts the review, and the owner sees, at most, a line in a quarterly report. Yet many of the decisions a review should produce (capital for repairs, resources for staff, changes to priorities between guest rooms and kitchens) are decisions the operator cannot take alone. A review without the owner cannot produce the outputs that matter most, and so it tends to produce none.
None of the people involved was careless. Each of the items in the pack was known to someone: the pest findings to the quality manager and the contractor, the rinse temperature to the internal auditor and the chief steward, the allergen complaints to guest relations and the chef, the late fish to purchasing. Each person had raised the matter in their own channel and had seen it dealt with, or not, in that channel. The review was the one place where all the channels met and where someone with authority over all of them could see which problems were connected, which were growing and which had been left behind. It met, and it did not look.
Table 1: Sixty-two pages in, two pages out
| What the review pack contained | What the minutes decided |
| Pest findings in the banqueting kitchen rising for three quarters: 2, 5, 11 | Nothing |
| Contractor recommendation to seal service penetrations, repeated twice, not done | Nothing |
| Internal audit: dishwasher final rinse below set temperature, third repeat finding | Nothing |
| Two allergen complaints in the Japanese restaurant, same root cause | Nothing |
| Late deliveries from the fish supplier in 14 of 52 weeks | Nothing |
| Objectives: four of six met | Nothing |
| Conclusion | “System suitable, adequate and effective; no changes required” |
The Principle
The principle of this subchapter is that a management review is measured by its decisions, and a review that produces none has not taken place. The purpose of bringing information to top management is to have top management act on it. Where the information shows that the system is working, the decision may be to change nothing, but that decision must be reached by looking at the evidence, not by running out of time.
Three practical consequences follow. The first concerns what is presented. Top management does not need every figure the system produces; it needs the figures that call for a decision, presented so that they can be read against the objectives and against previous periods. A trend over four quarters is information that calls for decision. A single quarter’s figure in a sixty-page pack is information that calls for nothing. The second concerns who is present. The review must include the people who can take the decisions the inputs require. In a hotel under a management agreement, that often means the owner’s representative, at least for the part of the review that concerns capital and resources. The third concerns what is recorded. The minutes of a review should be a list of decisions, each with an owner, a date and, where needed, a resource. Everything else (the inputs, the discussion) belongs in the pack, which is already written.
The principle also implies a discipline about the previous review. The first item on any review’s agenda should be the decisions of the last one: which have been carried out, which have not, and why. A review that does not look back at its own decisions teaches everyone in the room that its decisions do not matter, and they soon stop making any.
Finally, the principle says something about frequency. A review held once a year, before the audit, cannot respond to a trend that develops over three quarters. The standard leaves the frequency to the organisation. A hotel with a large banqueting operation and a seasonal peak has good reason to review more often, and to hold at least one review before its peak season rather than after it.
A review that decides is also a review that disagrees. If the general manager, the chef, the director of engineering and the owner’s representative all leave the meeting having agreed with everything, the meeting has probably not reached the questions that matter, because those questions involve trade-offs (between guest rooms and kitchens, between this year’s budget and next year’s risk) on which reasonable people differ. The review is the place where those differences are meant to be aired and resolved, with the evidence in front of everyone. A review without disagreement is often a review without decisions.
Table 2: The trend that was in the pack
| Quarter | Pest activity reports, banqueting kitchen | Contractor recommendation | Action taken |
| Q1 | 2 | Routine treatment | Treatment carried out |
| Q2 | 5 | Seal gaps around service penetrations behind dishwasher | Added to engineering list; deferred |
| Q3 | 11 | Seal gaps; urgent before spring events | Deferred behind guest-room maintenance |
| August review | Not applicable | Not applicable | Not discussed |
| Cup week | Infestation; kitchen closed three days | Not applicable | Emergency sealing and treatment |
What the Standard Says
Clause 9.3 of ISO 22000:2018 requires top management to review the organisation’s food safety management system at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. The subject of the sentence is top management. The review is not something the team leader does and reports upward; it is something top management does, with whatever support it needs.
The inputs are listed in clause 9.3.2 in detail. The review must consider the status of actions from previous reviews; changes in external and internal issues, including changes in the organisation and its context; and information on the performance and effectiveness of the system, including trends in the results of system updating, monitoring and measurement, the analysis of verification results, nonconformities and corrective actions, audit results, inspections, the performance of external providers, the review of risks and opportunities, and the extent to which objectives have been met. It must also consider the adequacy of resources, any emergency, incident or withdrawal that has occurred, relevant information from internal and external communication including complaints, and opportunities for continual improvement. The word trends is in the text. So is a requirement that deserves more attention than it usually receives: the data must be presented in a manner that enables top management to relate the information to the stated objectives of the system. …
MATERIALI DI LAVORO
Materiali e download
Checklist, modelli, supplementi e file di lavoro collegati al volume.
35 materiali in 3 gruppi
Capitolo 117 materiali
FILES
1 · Worksheet 1.1: The HACCP Illusion
Subchapter 1.1
If your food safety plan were perfect, who in this hotel would notice the day the hotel began producing food that the plan does not describe?
FILES
2 · Worksheet 1.2: The Context of a Kitchen
Subchapter 1.2
If your kitchen were moved, unchanged, to a city with ten degrees more heat and half the reliability of power and water, which of your controls would still hold, and who in your organisation has asked?
FILES
3 · Worksheet 1.3: Who Else Is at the Table
Subchapter 1.3
How many food safety commitments has your hotel accepted this year in contracts that nobody in your kitchen has read?
FILES
4 · Worksheet 1.4: Where the System Ends
Subchapter 1.4
If a guest fell ill tonight after eating somewhere on your property, would your food safety system cover the place where they ate, and who decided whether it would?
FILES
5 · Worksheet 1.5: Commitment You Can Invoice
Subchapter 1.5
If an auditor were shown only your last three budgets and none of your signed documents, what would they conclude about your commitment to food safety?
FILES
6 · Worksheet 1.6: A Policy That Can Refuse a Dish
Subchapter 1.6
When did your food safety policy last stop anyone in your hotel from doing something they wanted to do?
FILES
7 · Worksheet 1.7: The Team Leader Is Not the Chef
Subchapter 1.7
If the person responsible for your food safety system had to stop a service tonight, whose evening would they be ruining, and would it be their own?
FILES
8 · Worksheet 1.8: Risk to the Business, Hazard to the Guest
Subchapter 1.8
Is there a spreadsheet in your company where salmonella and falling bookings are scored on the same scale, and has anyone ever taken a decision about food because of it?
FILES
9 · Worksheet 1.9: Objectives That Reach the Pass
Subchapter 1.9
Could your kitchen meet every one of this year’s food safety objectives without changing a single thing it does with food?
FILES
10 · Worksheet 1.10: The New Menu Is a Change
Subchapter 1.10
Who in your hotel looked at the last new menu for its hazards before it was printed, and at what point would they have been able to stop it?
FILES
11 · Worksheet 1.11: Infrastructure Is a Capital Decision
Subchapter 1.11
When your kitchen was last designed or rebuilt, at which meeting did anyone speak for food safety, and was the person who would cook in it in the room?
FILES
12 · Worksheet 1.12: Sovereignty over the Supply Chain
Subchapter 1.12
If your main supplier replaced a product with a different one tomorrow morning, how would your kitchen find out, before or after the guest?
FILES
13 · Worksheet 1.13: Competence, Awareness and the Culture Nobody Required
Subchapter 1.13
If one of your cooks woke up tomorrow with vomiting and diarrhoea, what would it cost them to stay at home, and who in your hotel has ever asked?
FILES
14 · Worksheet 1.14: The Review at the Owner’s Table
Subchapter 1.14
In the minutes of your last management review, how many lines begin with a verb, and how many with a number?
FILES
15 · Worksheet 1.15: Food Safety on the Balance Sheet
Subchapter 1.15
If a lender, an insurer or a buyer asked you tomorrow to prove that your hotel controls its food safety, what would you put on the table, and how much of it would be a certificate?
XLSX
31 · Practical application: all thirty subchapters
Subchapters 1.1–2.15
178 steps from the book, with a summary by subchapter
FILES
35 · The thirty concept cards
Subchapters 1.1–2.15
Title, city, image and text of every card
Capitolo 215 materiali
FILES
16 · Worksheet 2.1: What the Hotel Actually Serves
Subchapter 2.1
If you walked your kitchen at six in the morning with your flow diagram in your hand, how many of the things you saw would be on it?
FILES
17 · Worksheet 2.2: Prerequisite Programmes
Subchapter 2.2
Who in your hotel cleans the inside of the ice machine in the bar, and does the person who wrote your cleaning programme know their name?
FILES
18 · Worksheet 2.3: Hazard Analysis at Four Hundred Covers
Subchapter 2.3
Your hazard analysis was written for a kitchen producing a certain number of covers. What is that number, and how many did you serve at your largest event last year?
FILES
19 · Worksheet 2.4: CCP or OPRP: The Choice That Decides Everything
Subchapter 2.4
How many critical control points does your kitchen have, and could the cook responsible for each one tell you, without looking, what to do with the food if the limit is missed?
FILES
20 · Worksheet 2.5: Validation Before the First Plate
Subchapter 2.5
For each critical limit and shelf life in your kitchen, who decided the number, and on what evidence other than habit?
FILES
21 · Worksheet 2.6: Allergens: From the Store to the Guest’s Word
Subchapter 2.6
A guest tells your receptionist at check-in that she is allergic to sesame. Through how many people, systems and pieces of paper must that sentence pass before it reaches the cook, and how much of it arrives?
FILES
22 · Worksheet 2.7: The Last Metre: Buffet, Room Service, Banquet
Subchapter 2.7
From the moment a plate leaves your pass to the moment the guest eats it, how many minutes pass, and whose job is it to know?
FILES
23 · Worksheet 2.8: Traceability and the Recall That Reaches the Kitchen
Subchapter 2.8
If a supplier telephoned at six this evening to recall a lot of something you bought last week, how long would it take you to say which dishes it went into and which guests ate them?
FILES
24 · Worksheet 2.9: When the Power Fails at Dinner
Subchapter 2.9
If the lights went out in your kitchen at eight o’clock on your busiest night, who would decide what happens to the food, and have they ever been told?
FILES
25 · Worksheet 2.10: The Cold Room That Lies
Subchapter 2.10
Every temperature in your food safety records was produced by an instrument. When was each instrument last checked against something that could prove it wrong?
FILES
26 · Worksheet 2.11: The Handover and the Record at the Point of Use
Subchapter 2.11
When your evening team hands over to the night team, what exactly is said about the food that is still cooling, holding or waiting, and where is it written?
FILES
27 · Worksheet 2.12: Food Defence and Food Fraud: What the Standard Does Not Ask
Subchapter 2.12
Which of the most expensive products on your menu could be replaced by something cheaper without anyone in your kitchen noticing, and who could reach your guests’ food who should not?
FILES
28 · Worksheet 2.13: The Tray at Eleven at Night
Subchapter 2.13
When food in your kitchen misses a limit at eleven at night, who decides what happens to it, and on what evidence, other than who answers the telephone?
FILES
29 · Worksheet 2.14: Verification: Proving the Plan Works
Subchapter 2.14
If every log in your kitchen is complete, signed and within limits, what do you actually know, and who, other than the person who wrote it, has checked that the plan is working?
FILES
30 · Worksheet 2.15: Updating the System, and the Helm and the Lens
Subchapter 2.15
Your food safety plan was correct on the day it was approved. How would you know, today, which parts of it no longer describe the hotel you are running?
Altri materiali3 materiali
XLSX
32 · Verification Pact
Verification Pact, all subchapters
186 common claims tested against ISO 22000:2018, each marked binding or not
XLSX
33 · Common mistakes: a self-check
Common Mistakes, all subchapters
182 mistakes described in the book, with columns for the property
XLSX
34 · The thirty guiding questions
Guiding questions, all subchapters
One question per subchapter, with room for the answer
Immagini e tavole HD
Apri e proietta le foto direttamente dal sito, a schermo intero, oppure scarica gli originali.
Concept Card 1.1 — The HACCP Illusion
Subchapter 1.1 · San Sebastián, Spain
Setting: San Sebastián, Spain
A small pantry beside a rooftop terrace, in the light of a warm afternoon. The owner stands at the centre with a thick bound plan open in her hands; the general manager and the executive chef flank her, each with a hand to his chin. On the steel counter, covered trays of a seafood starter wait. Through the open door, wedding tables in white linen.
The composition turns on what is missing. On the bare wall to the right, two sockets mark the place where a refrigerator should stand and does not. The plan in her hands is complete; the room it should describe is not in it. Everything the eye can see was well made, and the danger is in the empty space.
The four plaques read as one sentence. The plan was excellent, and the terrace was not in it: a plan sees only what it has been shown. Who decides the next step is the question the owner asked that week, and a plan is not a system is the answer this volume spends thirty subchapters unfolding.
The plate does not accuse the chef, who followed the plan, or the manager, who approved a terrace that sold well. Nobody in the picture was careless. What the image shows is a building that changed while the document stayed still, and three competent people discovering, together, that nobody had been given the job of noticing.
Concept Card 1.2 — The Context of a Kitchen
Subchapter 1.2 · Mombasa, Kenya
Setting: Mombasa, Kenya
The kitchen of a beach resort in the heat of the afternoon. The executive chef holds open the heavy door of the fish cold room with one hand and wipes his forehead with the other; cold vapour spills out over fish laid on ice. Beside him the owner’s asset manager looks closely at a round dial on the door.
The needle rests in the red segment, and on the shelf below it sits a thick binder of group standards, closed. The contrast is the argument: controls written for a cooler place meet a kitchen that reaches thirty-six degrees by early afternoon. The standards are sound; the assumptions inside them were never made visible.
Written for a cooler place names the portfolio standard. The heat is the context says that context is not a backdrop but the condition every control must survive. Assumptions made visible is the work of determining context, and decide, do not describe is the difference between a paragraph about climate and a cold room built for it.
The plate does not blame the chef, who knew the coast’s fish better than anyone in the group, nor the group, whose standards were thorough. It shows two people looking at the same needle and realising that a document can describe a place without ever having changed what happens in it.
Concept Card 1.3 — Who Else Is at the Table
Subchapter 1.3 · Istanbul, Türkiye
Setting: Istanbul, Türkiye
The general manager’s office in a historic city hotel, dark wood and lamplight. At the centre the general manager holds up two pages drawn from the back of a thick contract. On his left the director of sales looks away, a hand over his mouth; on his right the food safety team leader points at the pages. A crew cap lies on the desk.
The two pages are the annex, and the cap tells us whose. An airline’s requirements had been signed with the rest of the agreement and never read by the people who would have to meet them. The composition sets the thin pages against the thick contract: the obligation was small, specific and already accepted.
Signed and never read describes the annex. Law, contract, expectation names the three ways a requirement reaches a hotel. The annex is an obligation reminds the reader that agreeing to something makes it part of the system whether or not anyone knew, and know what you agreed is the whole of the remedy.
The plate does not condemn the director of sales, whose job is to win contracts, nor the general manager, who inherited them. It shows the moment a hotel discovers who else is sitting at its table, and three people deciding, for the first time, to read what they have signed.
Concept Card 1.4 — Where the System Ends
Subchapter 1.4 · Phuket, Thailand
Setting: Phuket, Thailand
A resort lawn at dusk under strings of warm bulbs. On the left runs the resort’s own buffet in white linen and polished chafing dishes; on the right, a row of wooden street-food carts. Between them a low rope on short posts divides the grass. The general manager and the food safety team leader stand on the rope line; a vendor at her grill looks back at them.
The rope is the scope. On one side, food the certificate covers; on the other, food served on the same lawn, to the same guests, on the same evening, that no system has looked at. The guests cross the line without seeing it. The composition makes the boundary physical so that the reader cannot miss what the guests did.
The certificate had a border, and the guests did not see it: every scope ends somewhere, and nobody at dinner knows where. Every outlet is a decision turns the boundary from an inheritance into a choice. Scope is ownership says whose choice it is.
The plate does not accuse the vendor, who cooks as she has always cooked, nor the manager, whose street-food night delighted his guests. It shows two people standing, for the first time, exactly on the line their system draws, and looking honestly at what lies beyond it.
Concept Card 1.5 — Commitment You Can Invoice
Subchapter 1.5 · Kraków, Poland
Setting: Kraków, Poland
An office in a city hotel, lamplit shelves of plain binders behind. The general manager sits at the desk with a pen in his hand; the company’s chief executive leans over the desk beside him, one hand on an open document. They look at each other rather than at the papers.
Two documents lie side by side. On the left, a single sheet with a gold seal: the policy that promised resources for food safety. On the right, the capital plan, open at rows that should have held them. The pen rests between the two. The image asks the only question that matters: which of the two decides?
The policy promised resources, and the budget took them away, in the same afternoon. Read them side by side is the chief executive’s method and the reader’s tool. Commitment has a price names what leadership means in a management system: not what is signed, but what is funded.
The plate does not portray a cynical manager. He signed both documents in good faith, an hour apart, without reading one against the other. It shows the moment someone did, and a chief executive who asked not who had failed, but which sentence the hotel had actually meant.
Concept Card 1.6 — A Policy That Can Refuse a Dish
Subchapter 1.6 · Lima, Peru
Setting: Lima, Peru
A hotel terrace set for a large wedding in bright afternoon light. The food safety team leader holds an event order, unsigned, a pen in her other hand. Facing her, the sales director spreads his hands. Between them the executive chef holds a lime and a small knife, listening. In front of them stretches a long counter of crushed ice, empty.
The empty ice is the dish that has not yet been served: a ceviche station open for hours in summer heat. The unsigned order is the policy at work. The composition places the one person with the authority to refuse between the one who sold the dish and the one who would cook it.
A policy that never says no has never been used: the first two plaques are the diagnosis. Name the dish it refuses is the test of a policy worth signing, and then offer the safe one is what keeps the refusal from becoming an obstacle to the business.
The plate does not stage a quarrel. The sales director wants what the couple asked for; the chef knows the dish better than anyone; the team leader is not against either of them. It shows a policy doing, for once, the job it was written for, and three professionals finding the version of the dish that can be served.
Concept Card 1.7 — The Team Leader Is Not the Chef
Subchapter 1.7 · Budapest, Hungary
Setting: Budapest, Hungary
A grand hotel’s banqueting kitchen on New Year’s Eve, full of cooks plating under the pass lights. In the foreground a young sous-chef holds up a probe thermometer and looks urgently at the executive chef. He has turned towards her while one hand still reaches into the open cold room beside them. Behind, a cook waits at the pass with a plate.
The chef is caught between two jobs. As executive chef, his evening depends on four hundred and fifty covers leaving the pass on time; as food safety team leader, he is the person who must decide whether the food in the warm cold room can be served. The composition puts both demands on him at once, and shows why they should never have been one person’s.
The judge was also the cook, and his evening depended on it. Authority to say no is what the role requires, and someone outside the line is where that authority is safest: with a person whose success does not depend on the service going ahead.
The plate does not question the chef’s integrity or skill. It shows an honest man placed by the organisation in a position no one could hold well, and a young colleague doing exactly what the system told her to do, reporting to the person least able to hear it that night.
Concept Card 1.8 — Risk to the Business, Hazard to the Guest
Subchapter 1.8 · Valletta, Malta
Setting: Valletta, Malta
A stone-walled office in an old palace hotel, warm light on vaulted arches. The group risk officer sits at a laptop showing a grid of green, yellow and red cells. The food safety team leader leans across the desk to set down a steel tray of fresh brown eggs; beside it stands a closed carton. They look at each other across the desk.
The spreadsheet had scored salmonella in eggs as a medium risk, controlled by supplier certificates, and let the saving through. The eggs are the hazard the spreadsheet could not see: raw egg in an afternoon mayonnaise on a summer terrace. The composition places the two kinds of risk on the same desk, a hand’s breadth apart, in two different languages.
A saving scored as low, a hazard never analysed: the upper plaques name the gap. Two registers, one bridge describes the correction, keeping business risk and food hazard in their own places with a route between them. The team leader decides says who stands on that bridge.
The plate does not mock the risk register, which did its own job well, nor the risk officer, who scored what she was shown. It shows the moment the person who understands the hazard is brought to the table where the saving is decided, which is all the standard asks.
Concept Card 1.9 — Objectives That Reach the Pass
Subchapter 1.9 · Chengdu, China
Setting: Chengdu, China
A busy hotpot restaurant in the evening, red lanterns and rising steam. The owner’s representative holds open an annual report at a page of four large gold tick marks. Beside her, the food safety team leader points down at a trolley of thinly sliced raw beef and lamb, standing in the water of ice that melted long ago.
The four ticks are the four objectives, all achieved. The trolley is where the risk actually lived, untouched by any of them. The composition sets the report and the food at the same height, so that the reader’s eye travels from success on paper to the plate in a single movement.
Four targets, four successes, and none of them touched the food. Measure what the plate needs is the discipline of an objective worth setting, one that cannot be met through the records alone, and change the process is what such an objective forces.
The plate does not accuse the hotel of dishonesty. Every number in the report was an accurate count. It shows what happens when objectives are chosen because they are easy to measure, and a team leader who looked past them to the trolley, where the guest would have looked if only the guest could see.
Concept Card 1.10 — The New Menu Is a Change
Subchapter 1.10 · Quebec City, Canada
Setting: Quebec City, Canada
The pass of a restaurant in an old stone hotel under copper lamps. The food safety team leader holds a single change form in one hand and rests the other flat on a stack of newly printed menus tied with string. Beside her, the executive chef presents a trolley of farm cheeses and preserves; behind, the purchasing manager carries a crate of vegetables.
The menus are ready, the suppliers found, the dishes perfected. The only thing holding them back is her hand. The composition shows the change gate as a gesture rather than a procedure: nothing reaches the plate until the page is complete. It is a quiet image, and the gate should be quiet.
New dishes, new suppliers, new hazards: the upper plaques unpack what a menu change contains. The gate before the plate names the point of control, and then print the menu reverses the order in which most hotels work, placing the food safety decision before the commercial one.
The plate does not set the team leader against the chef. His menu is his best work, and the gate exists so that it can be served safely, not so that it can be delayed. It shows a hotel that has learned, after a recall, to let the system see a change before the guests do.
Concept Card 1.11 — Infrastructure Is a Capital Decision
Subchapter 1.11 · Athens, Greece
Setting: Athens, Greece
A basement hotel kitchen with a low ceiling and no windows. The executive chef reaches up to touch the edge of an extraction hood that almost meets the ceiling. The owner and the architect lean over a drawing unrolled across a steel counter and follow his hand upwards. Behind them a steel service door is closed.
The drawing shows only lines; the room shows what the lines decided. Heat, flow and extraction were fixed at the drawing board, without the cook, and the kitchen will be cooked in for twenty years. The composition pairs the flat plan with the low ceiling so that the reader sees the decision and its consequence at once.
Designed without the cook, cooked in for twenty years: the upper plaques set out the cost of the omission. Food safety at the drawing board says where the voice belongs, and before the concrete sets says when, at the moment it is cheapest and least likely to be heard.
The plate does not blame the architect, who designed an elegant building, nor the owner, who approved it. It shows three people who now understand what the drawing meant, and the chef who was hired after the concrete had already set.
Concept Card 1.12 — Sovereignty over the Supply Chain
Subchapter 1.12 · Mahé, Seychelles
Setting: Mahé, Seychelles
Behind the breakfast counter of a tropical resort, croissants piled under glass domes. The pastry chef holds two plain cardboard cases side by side, identical in shape and colour, and compares them with a frown. The purchasing manager holds a specification sheet; the restaurant manager watches from the end of the counter.
The two cases look the same and are not. One comes from the approved manufacturer; the other is the substitute an importer sent when the first was out of stock, made on a line that also handled nuts. The composition asks the reader to spot the difference and shows that nobody can, from the outside.
The supplier changed the product, and nobody told the kitchen. Requirements in writing is the remedy: a supplier can only meet the requirements it has been given, and silence is also an instruction. Responsibility stays here says what outsourcing never transfers.
The plate does not accuse the importer, who meant to keep the resort supplied, nor the pastry chef, who ordered by the usual code. It shows the moment a resort takes back the part of its supply chain that no contract can carry for it.
Concept Card 1.13 — Competence, Awareness and the Culture Nobody Required
Subchapter 1.13 · Hội An, Vietnam
Setting: Hội An, Vietnam
The staff entrance of a riverside resort in the early morning. A young seasonal cook, pale and tired, holds his motorbike helmet in both hands and hesitates at the door. The kitchen supervisor rests a hand on his shoulder and speaks to him. Behind them, the garden kitchen with its clay stoves and hanging lanterns.
He is ill, and the rule says he must not work. Under the old contract, staying at home would have cost him a day’s pay he could not afford. Under the new one, she is sending him home without loss. The composition holds the threshold between the two: the door he nearly walked through and the hand that stops him.
He knew the rule; the contract taught him otherwise. Report without losing is what the hotel changed, and culture is what it costs says where food safety culture is really made: not in training, but in what the right behaviour costs the person who has to choose it.
The plate does not judge the cook, who had heard the rule at every induction and came to work because he needed to. It shows an organisation that finally made the safe choice the affordable one, and a supervisor able, at last, to say what the rule always meant.
Concept Card 1.14 — The Review at the Owner’s Table
Subchapter 1.14 · Melbourne, Australia
Setting: Melbourne, Australia
A boardroom in a city hotel, timber panels and lamplight. On the table lies a thick review pack, open. The owner’s asset manager has pulled out a single page and holds it up: one line, rising steadily. The general manager and the quality manager look at it, understanding.
The page had been in the pack all along, on page thirty-one of sixty-two, and no one had turned to it. The rising line was the trend that led to a closure order. The composition sets one sheet against the whole binder: everything the system knew reached the table, and nothing left it.
Everything was in the pack, and nothing came out of it. Organise around decisions is the reform: a review built around the outputs the owner must produce, not the inputs the standard lists. The owner acts names the only measure of a management review.
The plate does not criticise the quality manager, whose pack was excellent and complete. It shows what happens when information reaches a meeting that has no time to decide, and an owner who chose to read the one page that mattered before the next season did it for her.
Concept Card 1.15 — Food Safety on the Balance Sheet
Subchapter 1.15 · San Sebastián, Spain
Setting: San Sebastián, Spain
A meeting room in a bank, marble table and lamplight. The owner of the hotel sits with her hand on an open folder of neat tables. Across from her, a credit analyst leans in to read. On the table, a framed certificate lies face down, pushed aside.
The certificate says the system was audited; the folder shows who decided what and what it cost. Two years after the wedding on the terrace, the owner has learned which of the two a lender reads. The composition turns the certificate over so that the evidence can be seen.
A certificate is noted; decisions are credited. The lower plaques name what the folder contains, evidence of who decided, and what it becomes in the hands of a lender, an insurer or a buyer: food safety as an asset, proved rather than claimed.
The plate does not dismiss certification, which the hotel earned and keeps. It shows an owner who no longer relies on it to speak for her, and a young analyst who, for once, is given something he can actually verify.
Concept Card 2.1 — What the Hotel Actually Serves
Subchapter 2.1 · Oaxaca, Mexico
Setting: Oaxaca, Mexico
The service door of a hotel in an old convent in early morning light. An older woman in an embroidered blouse and apron carries two large baskets of tamales wrapped in cloth through the door. The breakfast cook steps forward to take one. The director of food and beverage watches, a closed folder under her arm and a paper cup in her hand.
In the folder is the flow diagram for breakfast, drawn in an office. It begins at the receiving bench. The tamales have come in by a door the diagram does not know, from a kitchen four streets away, and will go straight to the buffet. The composition keeps the folder closed: the diagram has nothing to say about what is happening.
The diagram began at receiving; the kitchen began at the door. Walk it at six is the method, confirming the description at the hours the work is done, and describe before you analyse is the principle that makes every later control possible.
The plate does not treat the tamales as a threat. They are part of what makes the hotel what it is, made by the same hands for eleven years. It shows a director who came to look for herself, and a system about to describe, at last, what the hotel actually serves.
Concept Card 2.2 — Prerequisite Programmes
Subchapter 2.2 · Marseille, France
Setting: Marseille, France
A hotel rooftop bar in the evening, bottles lined along dark wooden shelves. The ice machine behind the counter stands open. A food safety inspector in a dark jacket holds up one gloved finger with a dark film on its tip; in her other hand, a clipboard. The young bartender looks on, embarrassed; the food and beverage manager leans in.
The prerequisite programme manual, a hundred and forty pages, was on a shelf in the kitchen. The ice machine was at the bar, with no programme, no owner and no record. The composition places the evidence at eye level: a single fingertip shows what the manual could not.
The manual was in the kitchen; the ice was at the bar. One page, one owner is the reform: a programme each department can use, with a name beside it. Where the work is done says where that page belongs.
The plate does not shame the bartender, who had never been told that ice is food. It shows a hotel whose hygiene lived in one department and whose risk had moved to another, and an inspector who found the gap in the place no one had thought to look.
Concept Card 2.3 — Hazard Analysis at Four Hundred Covers
Subchapter 2.3 · Macau, China
Setting: Macau, China
A large banqueting kitchen before a wedding. In the foreground the Chinese culinary director tosses a small portion of fried rice in a single wok over a blue flame. Beside him the food safety team leader looks from his wok towards the racks behind, where dozens of wide trays of cooked rice cool at room temperature, row after row.
The recipe in the wok and the rice on the racks are the same. The process is not. Forty portions cool quickly and are fried at once; four hundred sit on racks for hours. The composition sets one wok against a forest of trays so that the change of scale becomes a change the eye can measure.
The same recipe, four hundred times over: the upper plaques name the illusion. Volume changes the process is the principle, and analyse the banquet is the instruction, treating the large service as a process of its own rather than as the restaurant dish multiplied.
The plate does not question the culinary director, whose fried rice is among the best in the city. It shows the difference between cooking and producing, and a team leader looking at the one place the hazard analysis had never gone: the racks.
Concept Card 2.4 — CCP or OPRP: The Choice That Decides Everything
Subchapter 2.4 · Parma, Italy
Setting: Parma, Italy
A hotel kitchen under the vaulted ceilings of an old palace. On the left, a steel shelf buried under a tower of clipboards. In the centre the food safety team leader holds one clipboard and looks at the cook beside her. On the right, a clear sous-vide bath with meat sealed in bags, the immersion heater standing in the water.
Twenty-three critical control points meant twenty-three monitoring sheets, and the attention of the kitchen spread across all of them. One mattered: the sous-vide bath, where a missed limit would reach the guest unseen. The composition sets the tower against the bath, quantity against consequence.
Twenty-three control points, one of them mattered. Attention where it counts is the principle behind the choice between a critical control point and an operational prerequisite programme, and choose the right control is the decision the standard leaves to the team.
The plate does not ridicule the old plan, which was written with care by people who wanted to control everything. It shows a team leader who knows that controlling everything is a way of controlling nothing, and a cook who will now be asked to watch one thing well.
Concept Card 2.5 — Validation Before the First Plate
Subchapter 2.5 · Montreal, Canada
Setting: Montreal, Canada
The central production kitchen of a large city hotel, in front of a cold room stacked with vacuum-packed bags. An inspector in a dark parka over a white coat holds one bag and turns it over, asking. The executive chef, hand to his chin, has no answer. The food safety team leader stands beside him with a clipboard.
Every bag was cooked, chilled and labelled, and every step was recorded. The inspector’s question is where the numbers came from: a shelf life brought from another hotel, a cooking time from a manufacturer’s book. The composition centres the bag, sealed and perfect, because it proves nothing about the limit printed on it.
Every batch was recorded, and no limit was proven. Evidence before use says what validation is, and validation, not habit names what it replaces: the numbers a kitchen inherits and trusts because they have always seemed to work.
The plate does not accuse the chef of carelessness. His monitoring was rigorous. It shows the moment a good kitchen discovers the difference between showing that it did something and showing that what it did works.
Concept Card 2.6 — Allergens: From the Store to the Guest’s Word
Subchapter 2.6 · Dublin, Ireland
Setting: Dublin, Ireland
A hotel restaurant in the evening, green walls and table lamps. A guest in glasses explains her allergy with both hands to a waiter who types on a handheld device. At the same moment, from the side, a young runner sets down a small plate of bread and a bowl of dark purée scattered with sesame seeds. Neither of the others has noticed it.
The guest has declared her allergy three times. The ticket will carry one word of it to the kitchen. The plate that could harm her never passes through a ticket at all. The composition puts the declaration and the danger in the same frame, a few inches apart, and lets the reader see what the people in it cannot.
Declared three times, and the word changed on the way: the upper plaques trace how the guest’s words shrink. Carry the guest’s words, to the person who plates: the lower plaques describe the whole chain that allergen control in a hotel must build.
The plate does not blame the runner, who was serving what every table receives, nor the waiter, who recorded what the screen allowed. It shows a chain with a gap in it, and a guest doing everything right while the system around her did not yet know how to listen.
Concept Card 2.7 — The Last Metre: Buffet, Room Service, Banquet
Subchapter 2.7 · Santorini, Greece
Setting: Santorini, Greece
A private plunge pool on a cliff-side terrace in strong morning sun, white walls and a blue door behind. A room-service attendant kneels and sets a wooden tray floating on the water: a silver cloche, smoked salmon, pastries, orange juice. A young couple in white robes photograph it with their phones from the sun loungers.
It is the most beautiful breakfast in the hotel and the most exposed. The kitchen prepared it perfectly; the last metre put it in the sun for as long as the photographs took. The composition is bright on purpose. The hazard in this subchapter looks like a holiday.
The kitchen was perfect; the tray sat in the sun. Design the service is the lesson, treating every format as a process with its own exposure of time and temperature, and time is the hazard names what the pass cannot control once the food has left it.
The plate does not criticise the guests, who ordered the hotel’s signature service, nor the attendant, who delivered it beautifully. It shows a hotel that followed its food to the pass and stopped there, and the metre beyond, where the guest actually eats.
Concept Card 2.8 — Traceability and the Recall That Reaches the Kitchen
Subchapter 2.8 · Valparaíso, Chile
Setting: Valparaíso, Chile
The cold room of a hotel restaurant an hour before dinner. The executive chef holds a telephone to his ear and a crate of clams with a plain tag in his other arm. Beside him a sous-chef searches a wall of identical plastic tubs of shellfish, each with a blank sticker, trying to match one to the crate.
The call is a recall. The supplier knows the lot; the kitchen knows what it bought. What nobody can say is which tubs came from that lot, which dishes used them and which guests ate them. The composition sets one tagged crate against a wall of untraceable tubs.
We know what we bought, not where it went: the upper plaques are the invoice and its limit. From lot to dish to guest is the chain traceability must build in a hotel kitchen, and in hours, not days is the measure of whether it has.
The plate does not fault the sous-chef, who decanted the shellfish into dated tubs exactly as she was taught. It shows a practice that was hygienic and untraceable at the same time, and a kitchen learning, in the first hour of a recall, what its labels could not tell it.
Concept Card 2.9 — When the Power Fails at Dinner
Subchapter 2.9 · Accra, Ghana
Setting: Accra, Ghana
A hotel banqueting kitchen in darkness, lit by torches. The executive chef plates jollof rice and grilled fish under the beam held by the banqueting manager. At the back, the chief engineer watches with a head torch. To the right, the doors of the cold rooms are shut and sealed with red and white tape.
The gala is still being served. The cold rooms have been sealed to keep the cold in, which is the right decision. The harder decision, what to do with everything inside when the lights come back, has not been written anywhere. The composition leaves the taped doors in the shadow, where that decision waits.
The lights came back at midnight; the decision waited for breakfast. Decide before the dark is the principle of emergency preparedness: the choices an emergency forces must be taken in advance. Keep the doors closed is the first line of the card this kitchen will write.
The plate does not blame the engineer, who spent the night fighting a generator, nor the chef, who kept three hundred and fifty guests fed by torchlight. It shows competent people improvising well in the dark, and a hotel that had never given them the decisions they would need at dawn.
Concept Card 2.10 — The Cold Room That Lies
Subchapter 2.10 · Abu Dhabi, United Arab Emirates
Setting: Abu Dhabi, United Arab Emirates
Inside a hotel cold room, frost on the evaporator. An auditor in a white coat pushes a slim reference probe into a piece of cooked chicken. On the counter a glass of iced water holds three handheld probes standing upright. The executive chef leans in behind her; the director of engineering watches with a hand to his chin.
Every instrument in the kitchen agreed with every other, and all of them were wrong. The glass of ice is the simplest test in the book, a reference that cannot lie. The composition puts the kitchen’s thermometers on trial in front of the people who trusted them.
Every instrument agreed; all of them were wrong. Check against a reference is the discipline of calibration and verification, and doubt is a method is the habit it leaves behind: every reading treated as a claim until something independent has confirmed it.
The plate does not accuse the engineers, who installed a modern system, nor the cooks, who read what it showed. It shows a hotel discovering that its numbers were only as good as their weakest instrument, and learning to ask the question an auditor from outside had to ask for it.
Concept Card 2.11 — The Handover and the Record at the Point of Use
Subchapter 2.11 · Tokyo, Japan
Setting: Tokyo, Japan
A hotel banqueting kitchen at night. At the door of a blast chiller, the evening sous-chef unties his apron to leave and speaks over his shoulder to the night cook arriving for his shift. Through the glass, trays of stock are cooling. Beside the door hangs a small card with ruled lines, empty.
The handover lasts six words. The stock needs probing at the end of its cycle, and the night cook does not know it. The card that could have carried the rest is blank. The composition catches the two men as they pass each other, with the information that matters hanging between them, unwritten.
Six words at the door; the rest stayed behind. Information travels with the food is the principle, and at the station, now says where it must be found, not in the office binder but at the point of use, at the moment of acting.
The plate does not blame either cook. Each did his job well and each told the truth. It shows how a system can fail in the space between two conscientious people, and why the card beside the chiller matters more than the manual in the office.
Concept Card 2.12 — Food Defence and Food Fraud: What the Standard Does Not Ask
Subchapter 2.12 · Geneva, Switzerland
Setting: Geneva, Switzerland
The cold section of a luxury hotel kitchen. The executive chef holds two round caviar tins side by side, one closed, one open. The security director stands on his left with a hand to his chin; the food and beverage director leans in on his right. Behind them, cooks plate at a separate station.
The tins are identical on the outside. The difference, a cheaper species repackaged in an unlicensed workshop, can be found only by opening them and asking where they came from. Behind, the separate station prepares food for a protected table. The composition holds both halves of the subchapter: fraud in the chef’s hands, defence in the background.
The standard stops here; the market does not. The upper plaques mark the boundary of ISO 22000:2018, which does not require food fraud or food defence plans. Decide beyond the boundary says what a hotel must do instead, and protect the table names what it is deciding for.
The plate does not accuse the chef, who tasted the caviar many times and found it excellent. It shows a hotel learning where its certificate ends, and three people deciding, deliberately, what they will do in the territory beyond it.
Concept Card 2.13 — The Tray at Eleven at Night
Subchapter 2.13 · Honolulu, United States
Setting: Honolulu, United States
A resort banqueting kitchen at eleven at night, almost empty. The night sous-chef pushes a probe thermometer into a large pan of salmon left on the bench, her other hand on its edge. Beside her, her mobile phone lies face up, its screen lit.
The first time, she telephoned two managers and received two opposite answers. Now there is a rule, written in the afternoon, that tells her who decides, on what evidence, and with what options. The phone is lit but she does not reach for it. The composition shows a decision taken by the right person, alone, calmly.
The limit was missed, and two phone calls gave two answers. The rule was written first is the remedy: the decision column of the hazard control plan. She decides is what the rule makes possible, and it is the whole point of the subchapter.
The plate does not portray a lonely figure. It shows a young professional trusted with a rule and the authority to apply it, which is the most respectful thing a system can give the person on duty at night.
Concept Card 2.14 — Verification: Proving the Plan Works
Subchapter 2.14 · Kuala Lumpur, Malaysia
Setting: Kuala Lumpur, Malaysia
The breakfast kitchen of a large city hotel late at night. The food safety team leader lowers a small data logger on a cable into a pot of cooked rice. Beside her, the hygiene officer in a white coat holds open a cooling log with neat ruled rows. Behind them a blast chiller stands full of banquet trays.
For eleven months the log said the rice had cooled in time, every night, in the same numbers. The logger will say what the rice actually did. The composition sets the ruled pages and the instrument side by side: one a record of what should have happened, the other a measurement of what did.
Every line was the same, and the rice had not cooled. Results, not signatures says what verification looks at, and checked by someone else says who looks: a person who does not monitor the activity being verified.
The plate does not accuse the sous-chef who wrote the log, and who was never able to see the cooling he recorded. It shows a system that had praised perfect paperwork, and two people doing the unglamorous work of finding out whether the plan works.
Concept Card 2.15 — Updating the System, and the Helm and the Lens
Subchapter 2.15 · San Sebastián, Spain
Setting: San Sebastián, Spain
A stone-walled cellar under a hotel restaurant. The food safety team leader holds the food safety plan open in both hands and looks at the executive chef, who reaches towards a wooden shelf of glass jars: dark liquids, pale grains, pickled vegetables. By the stairs, on the floor, stands a courier’s insulated delivery bag.
The jars are the chef’s fermentations, which began as an experiment and became three components of the tasting menu. The delivery bag is the bar’s new service. Neither is in the plan she holds. The composition places the document and the changed hotel in the same small room, three years after the wedding on the terrace.
The plan did not age; the hotel did. The upper plaques close the circle that began in the first subchapter. The gate and the sweep names the two ways a system stays true, and keep the plan true is the duty that holds everything else in this volume together.
The plate does not stage a conflict. The chef is proud of his work, and the team leader is not there to stop it. It shows the annual walk that finds what nobody announced, and two people making the plan describe, once again, the hotel that exists.
L’AUTORE
