A food safety program is a written document that identifies your food safety hazards and sets out how you control them, in the six parts clause 5 of Standard 3.2.1 requires, and most Australian cafes and restaurants do not need one.
Skai Solutions answers the phone for Australian and New Zealand venues, so we read a lot of compliance advice written for an operator who does not have time to read it. This is the short version, taken from the standard's own clauses and from the regulators, read on 25 October 2026. Where the answer depends on your state, it says so instead of guessing.
Six things, and they are set out in clause 5 of Standard 3.2.1 rather than left to interpretation. A program has to systematically identify the potential hazards that may reasonably be expected to occur across all your food handling, identify where in the operation each of those hazards can be controlled and how, provide for systematic monitoring of those controls, provide for corrective action when a hazard is not under control, provide for regular review by the business, and provide for appropriate records to be made and kept.
Clause 3 adds the duties around it. You examine your operations to find the hazards, develop and implement the program, set it out in a written document and keep that document at the premises, follow it, and review it at least annually. The annual review is a legal duty, not a suggestion, and it is the clause most often ignored by a venue whose program was written by a consultant three years ago and has not been opened since.
No, and this is where most of what you will read on the subject is wrong. Standard 3.2.1 is not a national obligation on its own. Food Standards Australia New Zealand puts it plainly on its own food safety standards page, last updated 6 August 2025: the standard enables states and territories to require food businesses to implement a food safety program. It applies where a jurisdiction chooses to require it.
The businesses that need a program under the national code itself are narrower than a cafe owner expects. FSANZ's Standard 3.2.1 page lists them: businesses serving or processing potentially hazardous food for vulnerable people under Standard 3.3.1, such as hospitals, aged care, child care and delivered meal organisations; seafood businesses handling bivalve molluscs; manufactured and fermented meat producers; and cell-culturing food businesses.
A suburban restaurant, a cafe, a takeaway or a bar is not on that list. If you are being told you must have a program, the reason is either your state's law or your own customer base, not the national standard.
Victoria is the clearest published example of a jurisdiction that does require programs, and it shows how the obligation actually lands. On the Victorian Department of Health's food safety audits page, class 1 premises need a program and so do certain class 2 premises, specifically those carrying out one of the eight designated high-risk activities or manufacturing low-risk food with an allergen-free claim. Class 3 and class 4 premises do not need one at all.
Class 1 premises are not forced into an independently written program. They may use a department-registered standard template instead. If they choose an independent program, it has to be audited annually. Class 1 and class 2 premises are audited once a year, and a class 2 premises using a registered standard program gets a council assessment rather than an audit.
The detail worth carrying away: the auditor has to be a department-approved food safety auditor certified for that type of premises, and an auditor cannot audit a premises if they wrote or helped prepare its food safety program. If the consultant who wrote your program offers to audit it, that is not allowed in Victoria, and it is a reasonable question to ask anywhere.
Every other state and territory sets its own position, and the national standard is explicit that you check with your council or your state health department. If you are opening, that check belongs in the same conversation as food business registration.
You have Standard 3.2.2A, the food safety management tools, which has applied to food service and retail businesses handling potentially hazardous food since 8 December 2023. It is a lighter obligation than a full program and it is the one most venues are actually subject to. Three tools: a certified food safety supervisor, food handler training, and showing that your key processes are managed.
Those are not the same thing as a documented hazard analysis. The third tool can be satisfied by records or by demonstrated practice, records are kept for three months rather than years, and category two businesses are exempt from the third tool entirely. The supervisor rule is the one with teeth and the one with state variations, and it has its own page here: food safety supervisor requirements. The underlying handling rules, including the temperature control that a program would monitor, sit in Standard 3.2.2 and in practice come down to things like the two hour four hour rule.
The standard is specific in one place and silent in two. Clause 4(c) of Standard 3.2.1 requires a business to retain copies of all written reports of the results of all audits within the last four years, and to produce them on request to an auditor or authorised officer. Four years of audit reports is the hard number and it is the one almost nobody publishes.
The written program itself has to be retained at the food premises under clause 3(c), with no period stated, which in practice means for as long as you trade. The internal records required by clause 5(f) also carry no stated retention period in the standard, so your state's requirement or your auditor's expectation fills the gap. We have set out the rest of the paperwork clocks in how long to keep food safety records, and what happens when the paperwork is not there in failing a food safety inspection.
No. The Australian food safety standards in Chapter 3 apply to Australian food businesses only, which FSANZ states on the standards page itself. A New Zealand venue works under the Food Act 2014 and operates a food control plan, which is a different instrument with its own registration, verification and fee structure. If you run venues on both sides of the Tasman, the two obligations are not interchangeable and the paperwork does not transfer. The New Zealand side is covered in food control plan costs.
A food safety program is a monitoring document. Its whole logic is that you decide in advance what you will check, you check it, and you write down what you found. The reason venues fail that test is almost never ignorance of the rule. It is that the person who is supposed to be checking the cool room at 3pm is on the phone taking a booking, and the check gets done from memory at close, or not at all.
Skai Solutions answers the phone so the person holding the thermometer can keep holding it. The calls still get answered, the bookings still get taken, and the hour before service stops being the hour when everything competes for the same pair of hands.
What is a food safety program?
A written document that identifies the food safety hazards in a business's food handling activities and describes how the business will monitor and control them. Standard 3.2.1 sets out six things it has to contain, requires it to be kept at the premises, and requires it to be reviewed at least annually.
What is the purpose of a food safety program?
To move food safety from memory to method. Clause 5 of Standard 3.2.1 requires a business to systematically identify its hazards, say where each one can be controlled, monitor those controls, take corrective action when one is out of control, review the program and keep records of what was done.
Does my cafe or restaurant need a food safety program in Australia?
Probably not under the national code. Food Standards Australia New Zealand states that Standard 3.2.1 enables states and territories to require a program rather than requiring one nationally. Under the code itself, programs are required for food served to vulnerable people, bivalve molluscs, manufactured and fermented meat, and cell-cultured food. Your state may still require one, so check with your council or state health department.
Which Victorian premises need a food safety program?
Class 1 premises, and class 2 premises that carry out one of the eight designated high-risk activities or manufacture low-risk food with an allergen-free claim. Class 3 and class 4 premises do not need one. Class 1 and class 2 premises are audited once a year.
Can the person who wrote my food safety program also audit it?
Not in Victoria. The Department of Health states that an auditor cannot audit a premises if they wrote or helped prepare its food safety program, and that the auditor must be department-approved and certified to audit that type of premises.
How long do you keep food safety program records?
Clause 4(c) of Standard 3.2.1 requires audit reports from the last four years to be kept and produced on request. The written program is kept at the premises with no period stated, and the standard sets no retention period for the internal records required by clause 5(f).
Is a food safety program the same as HACCP?
It is built on the same logic of identifying hazards, controlling them at set points, monitoring and correcting, but Standard 3.2.1 is the Australian legal instrument and sets its own six required elements in clause 5. Meeting a commercial certification scheme does not by itself discharge a state law obligation.
Do New Zealand venues need a food safety program?
No. The Australian food safety standards apply to Australian food businesses. A New Zealand venue operates a food control plan under the Food Act 2014 instead, with its own registration and verification requirements.