What a food safety program is, when it's generally required in Australia, how the hazard-based (HACCP) approach works, and who needs one by state under…
A food safety program (FSP) is a written, hazard-based system that identifies the food safety hazards in your business, sets out how you control and monitor them, and records that the controls worked. Under the Food Standards Code, a full documented FSP is generally mandatory only for certain higher-risk businesses, but many other businesses must meet the related food safety management tools in Standard 3.2.2A. Requirements vary by state and territory, so always confirm yours. Key takeaways: A food safety program is a written, hazard-based plan that identifies your food safety hazards and sets out how you control, monitor, correct and record them.. A full documented FSP is generally mandatory only for higher-risk businesses (for example those serving vulnerable people, or handling bivalve molluscs and certain meats) under Standard 3.2.1.. Most retail and food service businesses must instead meet the food safety management tools in Standard 3.2.2A — a food safety supervisor, trained food handlers and evidence their controls work.. The hazard-based (HACCP) approach underpins both: think through what could go wrong, control it at critical points, and keep proof.. Requirements and terminology differ by state and territory, so confirm exactly what applies with your local council and state food regulator.. What a food safety program actually is A food safety program is a documented, systematic approach to managing the safety of the food your business handles. Rather than relying on staff to remember good practice, it writes down the specific hazards that could make your food unsafe, the steps you take to control each one, how you check the controls are working, what you do when something goes wrong, and the records that prove it. In the Australia New Zealand Food Standards Code, the formal version of this is set out in Standard 3.2.1 — Food Safety Programs. A well-written FSP is a working document, not a folder that sits on a shelf: it should reflect how your kitchen genuinely operates and be updated when your menu, equipment or processes change. Identifies the food safety hazards relevant to your specific activities. States how each hazard is controlled and who is responsible. Sets out monitoring, corrective action and record-keeping. Is systematically reviewed to make sure it stays effective. Why it is 'hazard-based': the HACCP foundation The core idea behind a food safety program is HACCP — Hazard Analysis and Critical Control Points, an internationally recognised method that Australian regulators build on. Instead of inspecting the final product and hoping, you work forwards through your process — receiving, storing, preparing, cooking, cooling, holding, serving — and ask at each step what could make the food unsafe. Hazards fall into three broad groups: biological (bacteria such as Salmonella and Listeria, plus viruses and parasites), chemical (cleaning chemicals, allergens, naturally occurring toxins), and physical (glass, metal, plastic). You then decide which steps are critical control points where a failure would genuinely make food unsafe, set limits for them (for example cooking to 75°C), and monitor those limits. This hazard-based thinking is what separates a real food safety system from a generic checklist. Biological hazards — food-poisoning bacteria, viruses and parasites. Chemical hazards — cleaning agents, allergens and toxins. Physical hazards — foreign objects such as glass, metal or plastic. Critical control points — the steps where control is essential to keep food safe. When a full food safety program is generally required A full documented FSP under Standard 3.2.1 is generally required only for defined higher-risk activities, not for every food business. Nationally, the categories most commonly required to hold one include businesses that process or serve potentially hazardous food to vulnerable people (linked to Standard 3.3.1 — Food Safety Programs for Food Service to Vulnerable Persons, covering settings such as hospitals, aged care and childcare), producers and processors of bivalve molluscs such as oysters, and businesses producing manufactured or fermented meats. Importantly, states and territories can require food safety programs more broadly under their own food legislation, so the national list is a floor, not a ceiling. If a full FSP applies to you, it will usually need to be documented and, in higher-risk cases, independently audited on a set frequency. Confirm the specifics with your regulator. Food service to vulnerable people (hospitals, aged care, childcare, delivered meals). Primary production and processing of bivalve molluscs. Manufactured and fermented meat production. Any additional categories your state or territory prescribes. Food safety programs vs food safety management tools (3.2.2A) Most cafes, restaurants, takeaways and caterers are not required to hold a full Standard 3.2.1 program. Instead, since it became enforceable on 8 December 2023, many are captured by Standard 3.2.2A — Food Safety Management Tools, which introduced a more practical set of obligations. Depending on the risk category a business falls into, these can include appointing a certified food safety supervisor, ensuring food handlers have completed training or have equivalent skills and knowledge before handling unpackaged potentially hazardous food, and (for category one businesses that make ready-to-eat potentially hazardous food) being able to substantiate that key controls work, often through simple records or a prescribed template. It is easy to confuse the two: a 3.2.2A obligation is generally not the same as a full documented FSP, though it draws on the same hazard-based principles. Some businesses will fall under 3.2.1, some under 3.2.2A, and the details depend heavily on jurisdiction. Food safety supervisor — a trained, certified person overseeing food handling. Food handler training — completed before handling high-risk food. Substantiation — evidence, often records,
How to develop a food safety program
Check with your local council and state or territory food regulator whether you require a full Standard 3.2.1 program, must meet Standard 3.2.2A tools, or both. This determines everything that follows.
Write down every step from receiving and storing through to preparing, cooking, cooling, holding and serving. Use your actual menu — the map should reflect how your kitchen really works.
For every step, list the biological, chemical and physical hazards that could make food unsafe, then decide which steps are critical control points where control is essential.
Define the control and measurable limit for each critical point (for example cook to 75°C), then state who monitors it, how often, and how it is recorded.
Decide in advance what staff must do when a limit is breached — for example reheat, discard or recalibrate — so the response is consistent and documented.
Document cleaning and sanitising, pest control, personal hygiene, allergen management, supplier approval and thermometer calibration, which underpin the whole system.
Make sure food handlers understand their responsibilities, appoint a food safety supervisor if required, and keep monitoring, training and corrective-action records.
Revisit the program after any change to menu, equipment, suppliers or process, and review it at least annually so it stays accurate and effective.
Frequently asked questions
Does every food business in Australia need a food safety program?
No. A full documented food safety program under Standard 3.2.1 is generally required only for higher-risk businesses, such as those serving vulnerable people or handling bivalve molluscs and certain meats. Most cafes, restaurants and takeaways instead need to meet the food safety management tools in Standard 3.2.2A. Requirements vary by state, territory and council, so confirm what applies to your business.
What is the difference between Standard 3.2.1 and Standard 3.2.2A?
Standard 3.2.1 sets out full, documented, hazard-based food safety programs, generally required for defined higher-risk activities. Standard 3.2.2A, enforceable from December 2023, introduced food safety management tools — a food safety supervisor, trained food handlers, and evidence that controls work — for many retail and food service businesses. Both are built on the same hazard-based principles, but they are not the same obligation.
What does 'hazard-based' mean in a food safety program?
Hazard-based means the program is built around the specific things that could make your food unsafe, following the HACCP method. You work through each step of your process and identify biological, chemical and physical hazards, then control them at the points where control is critical — for example cooking to a safe temperature. It is a preventive approach, focused on stopping problems rather than just checking the finished product.
Who is responsible for writing the food safety program?
The food business is responsible for having a compliant program. Many businesses develop it in-house using regulator templates and guidance, while others engage a food safety consultant, especially for higher-risk operations requiring external audits. Whoever drafts it, the program must reflect how your business actually operates, and your food safety supervisor and staff need to understand and follow it. Check your regulator's requirements before finalising.
How often does a food safety program need to be reviewed or audited?
Review your program whenever you change your menu, equipment, suppliers or processes, and at least once a year as routine. Higher-risk programs under Standard 3.2.1 are often subject to external audits at a frequency set by the regulator. Even where audits are not required, keeping current records is essential evidence. Your council or state food authority can tell you the specific audit frequency that applies to you.
Is a food safety supervisor the same as a food safety program?
No. A food safety supervisor is a trained, certified person who oversees food handling and can recognise and prevent food safety hazards — an obligation under Standard 3.2.2A for many businesses. A food safety program is the broader documented system of hazards, controls, monitoring and records. A business may need a supervisor, a program, or both, depending on its risk category and jurisdiction, so confirm your requirements with your regulator.