What is a Food Safety Program?

A Food Safety Program (FSP) is a written system that identifies and controls food safety hazards in your business. Under FSANZ Standard 3.2.1, certain food businesses in NSW are legally required to have one. It's not a suggestion — if your business falls within scope and you don't have a current, maintained FSP, you're operating in breach of the Food Standards Code.

A Food Safety Program is built on HACCP principles: you identify hazards, determine which are critical control points, set monitoring procedures, and document corrective actions. Done properly, it becomes a living document your staff use daily — not a folder gathering dust before an inspection.

Who must have one? Under Standard 3.2.1, businesses required to have a Food Safety Program include: food service to vulnerable groups (hospitals, aged care, childcare), caterers, and businesses assessed by NSW Food Authority as higher-risk. Always confirm with your NSW Food Authority — requirements vary by operation type.

What a valid Food Safety Program must include

Standard 3.2.1 specifies the minimum content. Your FSP must document:

Many businesses produce documents that look like a Food Safety Program but fail NSW Food Authority audits because they're missing the verification or corrective action sections, or because the records don't match the written procedures. The program must reflect what you actually do — not what you intend to do.

Step-by-step: writing your Food Safety Program

Step 1
Describe your business and its food activities
Document what food you handle, how it moves through your operation from receiving to service/sale, and who you serve. Include a process flow diagram. This scopes the hazard analysis — if you skip this, your hazard analysis will be incomplete.
Step 2
Identify all food safety hazards
For each step in your process flow, identify potential biological (bacteria, viruses), chemical (cleaning agents, allergens, pesticides), and physical (glass, bone, metal) hazards. This is the hazard analysis stage of HACCP. Be exhaustive — undocumented hazards are the most dangerous ones.
Step 3
Determine Critical Control Points (CCPs)
Use the HACCP decision tree to determine which steps are Critical Control Points — the points where a control measure is essential to prevent or eliminate a food safety hazard. Cooking temperature is almost always a CCP. Cold storage usually is. Not every step is a CCP — over-designating CCPs makes the program unworkable.
Step 4
Set critical limits for each CCP
A critical limit is the measurable boundary that must not be exceeded. For cooking poultry, the critical limit is typically 75°C internal temperature. For cold storage, 5°C or below. Critical limits must be based on scientific evidence — not guesswork.
Step 5
Define monitoring procedures
Document how each CCP is monitored — what is measured, how often, by whom, and using what equipment. If you can't monitor it, it can't be a CCP. Your monitoring records become your evidence of compliance during a NSW Food Authority audit.
Step 6
Document corrective actions
For each CCP, document what happens when a critical limit is breached. Who is notified? What happens to the food? How is the issue corrected? Corrective actions must be specific — "discard affected product and retrain staff" is acceptable; "deal with it" is not.
Step 7
Establish verification and review procedures
Verification confirms the HACCP system is working as intended — calibration of thermometers, periodic temperature log audits, and internal audits. The FSP must also include a review procedure: when will the program be reviewed, who is responsible, and what triggers an out-of-cycle review (e.g. new menu items, change in suppliers, near-miss incident).

Records: the part most businesses get wrong

A Food Safety Program without records is worthless. NSW Food Authority inspectors specifically check whether your actual records match your documented procedures. Common failures include:

Records are your proof. If it's not documented, from a legal standpoint, it didn't happen.

Reviewing and updating your program

Standard 3.2.1 requires your Food Safety Program to be reviewed when activities change. If you introduce a new menu item, change a supplier, move premises, or change cooking methods, the FSP must be updated. Businesses are frequently issued improvement notices not because their original FSP was inadequate, but because it hadn't been updated to reflect operational changes made years ago.

Practical tip: Build a review date into your calendar — minimum annually. Every time you make a change to your operation, note whether it affects the hazard analysis. A 10-minute review is far cheaper than an improvement notice.

Common mistakes that fail NSW Food Authority audits

  1. Generic programs not tailored to the operation — Downloaded templates that reference processes you don't perform, or miss processes you do
  2. No completed records — The written program exists but daily monitoring records are blank or inconsistent
  3. CCPs with no measurable critical limits — e.g. "food is cooked thoroughly" rather than "internal temperature ≥75°C"
  4. Out-of-date programs — FSP written three years ago but the business has changed significantly
  5. Staff who haven't read it — The Food Safety Program exists but no staff member can explain the CCPs or what to do when a critical limit is breached

Need a Food Safety Program written for your business?

A properly scoped FSP from AMES Food Advisory is built around your specific operation — not a generic template. Start with a free scoping call.

Book free scoping call View packages

Related guides