What Is a Food Safety Program?

A food safety program (FSP) is a written, hazard-based system that identifies the food safety hazards in your business, sets out how you control and monitor them, and records that the controls worked. Under the Food Standards Code, a full documented FSP is generally mandatory only for certain higher-risk businesses, but many other businesses must meet the related food safety management tools in Standard 3.2.2A. Requirements vary by state and territory, so always confirm yours. Key takeaways: A food safety program is a written, hazard-based plan that identifies your food safety hazards and sets out how you control, monitor, correct and record them.. A full documented FSP is generally mandatory only for higher-risk businesses (for example those serving vulnerable people, or handling bivalve molluscs and certain meats) under Standard 3.2.1.. Most retail and food service businesses must instead meet the food safety management tools in Standard 3.2.2A — a food safety supervisor, trained food handlers and evidence their controls work.. The hazard-based (HACCP) approach underpins both: think through what could go wrong, control it at critical points, and keep proof.. Requirements and terminology differ by state and territory, so confirm exactly what applies with your local council and state food regulator.. Types of food safety hazard: Hazard type, Examples. Biological — Bacteria such as Salmonella and Listeria, plus viruses and parasites. Chemical — Cleaning agents, allergens and naturally occurring toxins. Physical — Foreign objects such as glass, metal or plastic. What a food safety program actually is A food safety program is a documented, systematic approach to managing the safety of the food your business handles. Rather than relying on staff to remember good practice, it writes down the specific hazards that could make your food unsafe, the steps you take to control each one, how you check the controls are working, what you do when something goes wrong, and the records that prove it. In the Australia New Zealand Food Standards Code, the formal version of this is set out in Standard 3.2.1 — Food Safety Programs. A well-written FSP is a working document, not a folder that sits on a shelf: it should reflect how your kitchen genuinely operates and be updated when your menu, equipment or processes change. Identifies the food safety hazards relevant to your specific activities. States how each hazard is controlled and who is responsible. Sets out monitoring, corrective action and record-keeping. Is systematically reviewed to make sure it stays effective. Why it is 'hazard-based': the HACCP foundation The core idea behind a food safety program is HACCP — Hazard Analysis and Critical Control Points, an internationally recognised method that Australian regulators build on. Instead of inspecting the final product and hoping, you work forwards through your process — receiving, storing, preparing, cooking, cooling, holding, serving — and ask at each step what could make the food unsafe. Hazards fall into three broad groups: biological (bacteria such as Salmonella and Listeria, plus viruses and parasites), chemical (cleaning chemicals, allergens, naturally occurring toxins), and physical (glass, metal, plastic). You then decide which steps are critical control points where a failure would genuinely make food unsafe, set limits for them (for example cooking to 75°C), and monitor those limits. This hazard-based thinking is what separates a real food safety system from a generic checklist. Biological hazards — food-poisoning bacteria, viruses and parasites. Chemical hazards — cleaning agents, allergens and toxins. Physical hazards — foreign objects such as glass, metal or plastic. Critical control points — the steps where control is essential to keep food safe. When a full food safety program is generally required A full documented FSP under Standard 3.2.1 is generally required only for defined higher-risk activities, not for every food business. Nationally, the categories most commonly required to hold one include businesses that process or serve potentially hazardous food to vulnerable people (linked to Standard 3.3.1 — Food Safety Programs for Food Service to Vulnerable Persons, covering settings such as hospitals, aged care and childcare), producers and processors of bivalve molluscs such as oysters, and businesses producing manufactured or fermented meats. Importantly, states and territories can require food safety programs more broadly under their own food legislation, so the national list is a floor, not a ceiling. If a full FSP applies to you, it will usually need to be documented and, in higher-risk cases, independently audited on a set frequency. Confirm the specifics with your regulator. Food service to vulnerable people (hospitals, aged care, childcare, delivered meals). Primary production and processing of bivalve molluscs. Manufactured and fermented meat production. Any additional categories your state or territory prescribes. Food safety programs vs food safety management tools (3.2.2A) Most cafes, restaurants, takeaways and caterers are not required to hold a full Standard 3.2.1 program. Instead, since it became enforceable on 8 December 2023, many are captured by Standard 3.2.2A — Food Safety Management Tools, which introduced a more practical set of obligations. Depending on the risk category a business falls into, these can include appointing a certified food safety supervisor, ensuring food handlers have completed training or have equivalent skills and knowledge before handling unpackaged potentially hazardous food, and (for category one businesses that make ready-to-eat potentially hazardous food) being able to substantiate that key controls work, often through simple records or a prescribed template. It is easy to confuse the two: a 3.2.2A obligation is generally not the same as a full documented FSP, though it draws on the same hazard-based principles. Some businesses will fall under 3.2.1, some under 3.2.2A, and the details depend heavily on jurisdiction. Food safety supervisor — a trained, certified person overseeing food handling. Food handler training — completed before handling high-risk food. Substantiation — evidence, often records, that key controls are working. Confirm which category applies to you, as obligations scale with risk. Who needs one — a state and territory snapshot Because states and territories administer food law, the same business type can face different requirements depending on where it trades, and even on the local council. The points below are a general orientation only and change over time — always verify with your regulator before relying on them. Note too that allergen and labelling duties under Standard 1.2.3 apply alongside your program: managing allergens is part of controlling chemical hazards, and correct declarations are a legal obligation in their own right. Victoria — businesses are classified (Class 1 to 4) under the Food Act 1984; Class 1 (predominantly serving potentially hazardous food to vulnerable people) generally needs an independently audited FSP, while many Class 2 businesses can use a standard FSP template or minimum-records option. New South Wales — certain higher-risk sectors regulated under food safety schemes must hold food safety programs, and hospitality/retail businesses must meet food safety supervisor and handler-training rules; check the NSW Food Authority. Queensland — under the Food Act 2006, an accredited food safety program is generally required only for higher-risk licensees, chiefly off-site and on-site caterers, private hospitals and businesses producing potentially hazardous food for vulnerable people; many other licensed businesses instead meet Standard 3.2.2A tools. South Australia, Western Australia, Tasmania, ACT and NT — apply Standard 3.2.2A tools broadly, with full 3.2.1 programs targeted at higher-risk activities; requirements and audit frequency vary. In every jurisdiction, your local council's environmental health team is usually the first point of contact for what applies to your premises. What goes into a food safety program A compliant program is more than a hazard list. Standard 3.2.1 expects a program to work through your food handling operations, identify hazards, and specify controls, monitoring, corrective action and records, plus provisions for review. In practice a usable FSP is built around the everyday controls an inspector will look for, tied to your actual menu and layout. The point is traceability: if a control fails, you can show what you did about it. Hazard analysis mapped to each step of your process. Critical limits (for example cook to 75°C, cold storage at 5°C or below, hot holding at 60°C or above). Monitoring — who checks what, how often, and how it is recorded. Corrective actions — what happens when a limit is breached. Supporting programs — cleaning and sanitising, pest control, staff hygiene, supplier approval, allergen management, calibration. Record-keeping and a scheduled review of the whole program. Auditing, records and keeping it current A food safety program only protects you if it is kept alive. Higher-risk programs under Standard 3.2.1 are often subject to external audits at a frequency set by the regulator, where an auditor checks that the documented system matches reality and that records are complete. Even where formal audits are not required, records are your evidence: temperature logs, cleaning schedules, staff training records, supplier details and corrective-action notes all demonstrate due diligence and are frequently among the first things an environmental health officer asks to see. Review your program whenever you change your menu, equipment, suppliers or processes, and at least annually as a matter of routine. Digital record-keeping can make monitoring and audit preparation considerably easier, but the underlying obligation is the same on paper. Keep temperature, cleaning, training and corrective-action records up to date. Expect external audits for higher-risk 3.2.1 programs at a set frequency. Review the program after any significant change, and at least yearly. Records are your primary evidence of due diligence if a problem arises. Worked examples: A café checking which rules apply: A suburban café cooks and serves unpackaged, ready-to-eat meals. Rather than a full Standard 3.2.1 program, it is generally captured by Standard 3.2.2A, so it appoints a food safety supervisor, ensures food handlers are trained, and keeps simple records substantiating temperature and other controls. It confirms its exact category with the local council. An aged-care kitchen: A kitchen preparing meals for aged-care residents serves potentially hazardous food to vulnerable people. This is one of the higher-risk activities that generally requires a full documented food safety program under Standard 3.2.1, often with external audits at a set frequency. The kitchen maps its process, sets critical limits and keeps monitoring records. Checklist: Confirmed with council and state regulator whether you need a 3.2.1 program, 3.2.2A tools, or both. Process mapped from receiving through to service, based on your real menu. Hazards identified and critical control points defined for each step. Measurable critical limits set (for example 75°C cooking, 5°C cold storage, 60°C hot holding). Monitoring assigned — who checks what, how often, and how it is recorded. Corrective actions documented for each critical limit. Supporting programs in place — cleaning, pest control, hygiene, allergens, supplier approval, calibration. Food safety supervisor appointed and food handlers trained where required. Records being kept and stored so they can be produced on request. Review date scheduled and program updated after any significant change. Common mistakes: Assuming every food business needs a full documented FSP — many are covered by the Standard 3.2.2A tools instead. Downloading a generic template and never tailoring it to your actual menu, equipment and process. Confusing a food safety supervisor certificate or handler training with having a complete food safety program. Writing the program once and never reviewing it when the menu, suppliers or equipment change. Keeping no records, so there is no evidence the controls actually worked when an inspector asks. Treating allergen management and labelling under Standard 1.2.3 as separate from food safety rather than part of hazard control. Relying on the national requirements only and missing broader state, territory or council obligations. State and territory notes: VIC: Businesses are classified Class 1 to 4 under the Food Act 1984; Class 1 generally needs an independently audited food safety program, while many Class 2 businesses can use a standard FSP template or minimum-records option. Confirm with your council. NSW: Certain higher-risk sectors regulated under food safety schemes must hold food safety programs, and hospitality and retail businesses must meet food safety supervisor and handler-training rules. Confirm the detail with the NSW Food Authority. QLD: Under the Food Act 2006 an accredited food safety program is generally required only for higher-risk licensees, such as caterers, private hospitals and businesses producing potentially hazardous food for vulnerable people; many others meet Standard 3.2.2A tools instead. SA, WA, TAS, ACT & NT: These jurisdictions generally apply Standard 3.2.2A tools broadly, with full Standard 3.2.1 programs targeted at higher-risk activities; requirements and audit frequency vary, so confirm with your regulator.