What should a food safety management system include?

This blog explores why your business needs a food safety management system and what it should include. 

If you run a business that sells food in the UK, whether it’s from your home kitchen or large commercial premises, food safety should be your top priority.  

After all, your brand relies on the quality of the products you make and sell. Yet just one incident that affects the safety of your food can give your reputation a hit that’s difficult to recover from.

That’s why your business needs a food safety management system (FSMS).

The Food Standards Agency estimates that around 2.4 million cases of food-related illness happen in the UK every year, costing the economy around £9bn. Implementing an effective FSMS is the best way of keeping your food business compliant and ensuring your products are safe to consume.

This blog explores why your business needs a food safety management system and what it should include.

What is a food safety management system, and why do you need one? 

An FSMS is a structured, documented framework for identifying, controlling and preventing food safety hazards across your food business’s operations.

Every food business operating in the UK, no matter how big or small, is legally required to have an FSMS based on ‘HACCP principles’, which we’ll come to in a moment. 

The specific law in question is Article 5 of Regulation (EC) 852/2004, which was retained in UK law after Brexit and consolidated by the Food Safety and Hygiene (England) Regulations 2013. Similar legislation covers Scotland, Wales, and Northern Ireland. 

The Food Safety Act 1990 goes a step further, making it an offence to sell or serve food that could harm someone’s health. It covers all aspects of food handling, including preparation, storage, transport and sale, and imposes strict duties to prevent harmful products from reaching consumers.

These laws apply to every food business operating in the UK, which is why having an effective, legally compliant FSMS in place is essential. Without one, you leave your food business open to enforcement, fines and negative publicity, and, in the most serious cases, prosecution and closure.

An FSMS is a documented set of policies, procedures, controls and records that work together to ensure your food products, whatever they may be, are consistently safe to eat. It should cover every stage of your operations, from ordering and receiving raw materials to the moment your food reaches your customers. 

Building your food safety management system

As we mentioned earlier, your food business needs an FSMS based on ‘HACCP principles’, which are designed to keep your food safe from potential hazards. HACCP stands for hazard analysis and critical control point. We’ll get onto the seven HACCP principles shortly, but before you can build your HACCP plan, you need the right foundations in place. These are known as prerequisite programmes (PRPs). They’re the baseline hygiene and operational controls that allow the rest of your FSMS to work effectively.

PRPs are the non-negotiable working practices that ensure safe food production. They don’t focus on a single hazard or step in your processes. Instead, they create the basic operational conditions that underpin the specific controls set out in your HACCP plan. Your FSMS should include PRPs covering the following areas:  

• Cleaning and sanitation

• Pest control

• Personal (and staff) hygiene, including PPE and sickness absence

• Equipment maintenance

• Waste management

• Water quality

• Premises design and layout 

You should maintain written policies and processes for all your PRPs, along with any associated records or schedules, and document them in your FSMS. It’s good practice to carry out routine spot checks or audits to confirm they’re being adhered to, and to review and update your documentation periodically to ensure it remains relevant to your operations as they evolve.   

The key takeaway here is that your PRPs need to be solid, as without them, the targeted controls in your HACCP plan won’t work as intended. 

The seven principles of HACCP 

As we mentioned earlier, every food business, from artisan bakers and takeaways to ingredient suppliers and large-scale food manufacturers, must have an FSMS based on HACCP principles to identify, control and prevent the risks that can compromise food safety. The seven principles are: 

Principle one: Identify and list potential hazards

Before you can control a hazard, you have to identify it. Principle one requires you to take a systematic look at every stage of your operations to identify anything with the potential to cause harm. Food safety hazards fall into the following four categories:

• Microbiological: Bacteria (such as Salmonella, E.coli, Listeria and Campylobacter), viruses and mould

  Chemical: Cleaning agents, pesticides and veterinary drug residues

• Physical: Glass, metal fragments, bone and packaging materials

• Allergens: The 14 legally specified allergens listed under UK food law (see below)

Once you’ve identified all your potential hazards, you’ll need to assess each one’s severity to determine how it should be controlled. This step forms the foundation of everything that follows. If you miss a potential hazard here, it won’t get picked up later in your plan. 

Principle 2: Identify Critical Control Points (CCPs)

This stage of the process is about determining whereabouts in your processes you can apply control measures to prevent, eliminate or reduce each potential hazard you’ve identified to an acceptable level. 

A CCP is a step where failure to control the hazard would result in an unacceptable risk to the consumer, and where control at that specific step is considered ‘critical’. Not every step in a process is a CCP. There may be some instances where control is important, but not critical. This principle is all about filtering the non-critical ones out.   

Principle 3: Establish critical limits

For each identified CCP, you must set a ‘critical limit’, which is the measurable boundary that separates safe food from unsafe food, such as: 

• Cooking poultry to a minimum internal temperature of 75°C 

• Chilling cooked food to below 8°C within 90 minutes

• A minimum or maximum pH level

• A maximum water activity level

You should base your critical limits on scientific evidence, legislation, industry guidance and validated supplier data, and record them in your FSMS along with any associated policies, processes or records.

Principle 4: Establish a monitoring system

Your monitoring system should specify what should be measured for each CCP, how it’s measured (and how often), who’s responsible, and how it’s recorded.

Keeping accurate, up-to-date records is crucial here, because food inspectors and auditors will want to see completed, dated records showing when the checks were carried out, who did them, and what the results were.

Principle 5: Establish corrective actions

Corrective actions determine what should happen if a CCP falls outside its critical limit. For each CCP, it should specify what to do with the affected product, who’s responsible, how to investigate and address the cause of the problem, and how it’s documented. This principle is all about preventing unsafe food from reaching consumers and ensuring a consistent response to any potential problems. 

Principle 6: Validation, verification and review

This principle is all about checking and verifying that your HCAPP plan is valid and your staff are following it. By law, you’re required to review your plan whenever there are changes to your business, such as launching new products, investing in new equipment, working with new suppliers,  changing your processes, or whenever something goes wrong. But it’s good practice to review your HACCP plan periodically to ensure it remains relevant to your operations as you grow. 

Principle 7: Documentation and record-keeping

Accurate, up-to-date documentation and record-keeping provide the evidence that your food safety controls are in place, effective and working as they should. Your FSMS should include a written version of all the policies and processes associated with your PRPs and HACCP plan, along with your ongoing monitoring logs, records of your corrective actions, staff training logs, a detailed supplier list and any other relevant paperwork, such as cleaning, maintenance and pest control records.

Other considerations

Food-based allergens present one of the biggest risks to food businesses in the UK and are a leading cause of food recalls. Any business producing prepacked for direct sale (PPDS) food is legally required to label it with the name of the food and a full ingredients list, with any allergenic ingredients emphasised within the list. 

The legislation, known as Natasha’s Law, was introduced in October 2021. It was named after 15-year-old Natasha Ednan-Laperouse, who died in 2016 following an allergic reaction to sesame seeds hidden in a prepacked baguette. It applies to all food prepared and packed on the same premises before being sold. Businesses are obliged to declare the following 14 allergens whenever they’re present as ingredients: 

• Celery

• Cereals containing gluten (including wheat, rye, barley and oats)

• Crustaceans

• Eggs 

• Fish

• Lupin

• Milk

• Molluscs

• Mustard

• Peanuts

• Sesame

• Soybeans

• Sulphur Dioxide and Sulphites (above 10ppm)

• Tree nuts (such as almonds, hazelnuts, walnuts, Brazil nuts, cashews, pecans, pistachios and macadamia) 

UK food law also requires food businesses to be able to evidence who supplies their raw materials and where their finished products go. That’s why the documentation you need to keep for your FSMS should include a supplier list with up-to-date contact details, evidence of your suppliers’ food safety standards, batch coding of your raw materials and finished products that are linked throughout your production process, goods in and out records, and a documented and tested product withdrawal and recall procedure.

How can Beacon compliance help? 

Implementing a food safety management system that’s effective and relevant to your business can feel overwhelming, especially if you’re starting out or have no internal technical support to lean on. 

At Beacon Compliance, our team has more than 80 years’ combined industry experience working with globally recognised food brands. We’re here to help you get to grips with your legal obligations to ensure your food products are compliant and safe. 

We provide on-site and off-site technical support to help you get all the necessary certifications in place, whether that’s SALSA, BRCGS  or something else, to help your business operate legally and efficiently. To find out more about our services and how we can help your food business thrive, get in touch to book a free, no-obligation consultation with our team.