How to Write a Food Safety Program (Step by Step)

A food safety program is a written, HACCP-based document that identifies the hazards in your business, sets out how you control them, and records that you did. To write one, map your process, list the biological, chemical and physical hazards at each step, define control measures and critical limits, decide how you will monitor and correct problems, and add supporting programs like cleaning and pest control. Then review it regularly. Key takeaways: A food safety program is a systematic, written plan built on HACCP principles: identify hazards, control them, monitor, and keep records.. Whether you legally need one depends on your business type and jurisdiction, so confirm with your state or territory regulator and local council.. The core is a hazard analysis at every process step, with control measures, critical limits, monitoring, and corrective actions.. Supporting programs (cleaning, pest control, supplier approval, calibration, staff training) underpin the plan and must be documented.. A program is only compliant if it is followed, recorded, and reviewed, not just written and filed away.. Common critical limits to build into your program: Control point, Established limit, Typical monitoring. Cold storage / display — 5°C or below — Probe or fridge thermometer check each shift. Hot holding — 60°C or above — Probe check during service. Cooking / reheating — 75°C core temperature — Probe the thickest part of the food. Time out of temperature control — 2-hour/4-hour rule — Track time for ready-to-eat PHF. Thermometer accuracy — Around ±1°C — Calibrate and record regularly. What a food safety program actually is A food safety program is a written document that systematically identifies the food safety hazards in your business and describes how you keep them under control. In Australia it is built on the internationally recognised HACCP (Hazard Analysis and Critical Control Points) approach, which is the framework the Food Standards Code refers to. It is not a generic policy statement; it is specific to your premises, your menu, your equipment and your process flow. A good program does four things: it recognises the hazards reasonably likely to occur, sets out the control measures for each, provides for monitoring so you know controls are working, and requires records so you can demonstrate compliance to an authorised officer. Hazard-based and specific to your business, not a copied template left unchanged. Built on HACCP principles referenced by the Australia New Zealand Food Standards Code. Includes both the process controls and the supporting programs around them. Must be usable by staff on the floor, not just readable by a regulator. Do you legally need one? Whether a written food safety program is mandatory depends on your business category and where you operate. Certain higher-risk sectors, such as some food service to vulnerable people, catering, and specific manufacturing and processing activities, are more commonly required to have and often to have audited a documented program. Lower-risk businesses may instead be expected to meet the general food safety requirements of the Food Standards Code without a full formal program. Requirements, categories, and audit frequency vary between states and territories and can be set by local council. Before deciding your obligations, confirm with your state or territory regulator and local council exactly what applies to your business type. Higher-risk sectors (e.g. catering, food for vulnerable groups, some manufacturing) more often need a documented, sometimes audited, program. Lower-risk businesses still must meet the Food Standards Code even without a formal program. Category definitions and audit rules differ by state, territory and council. Get your specific obligation confirmed in writing by your regulator or council. Step 1-2: Assemble the team and describe your food and process Start by bringing together the people who know the operation: the owner or manager, the food safety supervisor, and experienced kitchen or production staff. You do not need a large team, but you do need practical knowledge of how food actually moves through your premises. Next, describe your products and how they are used. Note the ingredients, whether food is served ready to eat, whether it is intended for a vulnerable group, and how customers will store or reheat it. Then draw a process flow diagram covering every step from receiving deliveries through storage, preparation, cooking, cooling, hot holding, display, packaging and service. Walk the floor and confirm the diagram matches reality, because your hazard analysis is only as good as this map. Include people who understand day-to-day practice, not just management. Describe each product, its ingredients and its intended consumer. Flag food intended for vulnerable groups, which needs extra care. Draw and physically verify a full process flow, receiving to service. Step 3: Identify hazards and set control measures For each step on your flow diagram, ask what could make the food unsafe. Hazards fall into three groups: biological (bacteria, viruses, parasites), chemical (cleaning chemicals, allergens, natural toxins), and physical (glass, metal, plastic, pests). Focus on hazards reasonably likely to occur in your operation, not every theoretical risk. For each significant hazard, define the control measure that prevents, eliminates or reduces it to a safe level. Common controls include temperature control, time limits, thorough cooking, separating raw and ready-to-eat food, and effective cleaning. Allergen management is a critical chemical control in Australia and should be handled deliberately through labelling, separation and staff awareness rather than treated as an afterthought. Biological: control with cooking, cold holding at 5°C or below, hot holding at 60°C or above. Chemical: control allergens, and store cleaning chemicals away from food. Physical: control with equipment checks, pest control and good handling. Match a specific, workable control measure to each significant hazard. Step 4: Set critical limits and monitoring A control measure only works if you define the boundary that separates safe from unsafe and then check it. These boundaries are your critical limits, and they should use established, measurable figures. Well-known examples in Australian practice include cold food kept at or below 5°C, hot food held at or above 60°C, and cooking or reheating to a core temperature of 75°C. The 2-hour/4-hour rule guides how long ready-to-eat potentially hazardous food can safely sit in the temperature danger zone. Monitoring is how you confirm limits are met: who checks, how (for example with a probe thermometer accurate to about ±1°C), how often, and where it is recorded. Keep monitoring simple enough that staff will actually do it every shift. Cold holding at or below 5°C; hot holding at or above 60°C. Cook or reheat to a core temperature of 75°C where applicable. Apply the 2-hour/4-hour rule for potentially hazardous ready-to-eat food. Use a calibrated probe thermometer and record checks on a simple log. Step 5: Corrective actions, verification and records Decide in advance what staff do when monitoring shows a limit has been breached, so no one has to improvise. A corrective action fixes the immediate problem (for example, reheating, extending cooking, discarding affected food, or repairing a fridge) and addresses the cause so it does not recur. Verification is the separate check that the whole system is working: reviewing records, calibrating thermometers, and periodically confirming controls remain effective. Records are the evidence that ties it all together, including temperature logs, cleaning schedules, corrective action reports, and training records. In an inspection or audit, records are usually the first thing an officer asks to see, so keep them current, legible and retained for the period your regulator requires. Write clear corrective actions for each likely failure, before it happens. Fix both the affected food and the underlying cause. Verify by reviewing records and calibrating equipment on a set schedule. Retain records for the period required by your state or territory regulator. Supporting programs and keeping it current Your process controls sit on top of a set of prerequisite or supporting programs that keep the whole environment safe. These typically cover cleaning and sanitising, pest control, supplier and incoming goods approval, waste management, staff skills and training, thermometer calibration, and premises and equipment maintenance. Document each one so it is repeatable and so a new staff member can follow it. Finally, a food safety program is a living document. Review it whenever your menu, equipment, suppliers or process changes, after any food safety incident, and at regular planned intervals. Confirm review frequency and any audit requirements with your regulator or council, and make sure the version staff use on the floor is the current one. Document cleaning, pest control, supplier approval and maintenance. Keep staff training and food safety supervisor requirements up to date. Calibrate thermometers and record it as part of verification. Review after any change or incident, and on a planned schedule. Checklist: Process flow diagram drawn and verified against the real premises. Hazard analysis completed for every step (biological, chemical, physical). A specific control measure assigned to each significant hazard. Critical limits set using established figures (5°C, 60°C, 75°C, 2/4-hour rule). Monitoring defined: who, how, how often, and where it is recorded. Corrective actions written for each likely failure. Verification and thermometer calibration scheduled. Supporting programs documented (cleaning, pest control, suppliers, training). Record templates in place and staff trained to use them. Review date set and obligations confirmed with regulator or council. Common mistakes: Downloading a generic template and using it unchanged, so it does not match your actual process. Listing hazards but never defining measurable critical limits or who monitors them. Writing the program then never recording monitoring, leaving no evidence at audit. Treating allergen management as informal rather than a documented chemical control. Never reviewing the program after menu, equipment or supplier changes. Assuming you are exempt without confirming your obligation with your regulator or council.