Every food business in the UK, whatever its size, needs a food safety management system. It is easy to hear that phrase and picture a thick binder gathering dust in a back office, but a good food safety management system is something quite different: a live, working set of procedures that keeps food safe every single day and gives us evidence to show it.
At FoodSure, we build and audit food safety management systems for businesses across the UK, from independent cafes to multi-site manufacturers, and this guide walks through what one actually needs to contain.
A food safety management system, often shortened to FSMS, is the overall framework a business uses to control food safety hazards from the moment ingredients arrive to the moment food reaches the customer. It is broader than HACCP alone.
Think of HACCP as the technical hazard-analysis core sitting inside a wider system that also includes prerequisite programmes such as cleaning schedules, pest control, staff training, supplier approval, allergen management and traceability.
The legal basis for this sits in Regulation (EC) No 852/2004, retained in UK law following Brexit, which requires food business operators to put in place, implement and maintain procedures based on HACCP principles, supported by good hygiene practice throughout the operation.
For a single-site cafe, takeaway or small restaurant, the Food Standards Agency's Safer Food, Better Business (SFBB) pack usually provides a ready-made framework that satisfies the legal requirement. It bundles prerequisite programmes and a simplified HACCP approach into a diary format that most Environmental Health Officers recognise on sight.
Once a business grows beyond a single straightforward kitchen, whether through multiple sites, a more complex menu, or wholesale supply, SFBB alone often stops being enough. At this stage we typically build a bespoke FSMS with detailed HACCP plans for each product category, formal supplier approval processes, and more rigorous documentation and internal audit schedules.
Larger manufacturers and businesses supplying supermarkets or food service contracts are usually expected to hold a full seven-principle HACCP system supported by a comprehensive FSMS, and are commonly required by customers to achieve third-party certification such as BRCGS or SALSA.
This is one of the most common points of confusion we come across. HACCP is the specific, structured method for identifying and controlling hazards at defined critical control points. A food safety management system is the wider umbrella that HACCP sits within, alongside prerequisite programmes, training, documentation and management review. Put simply, a business cannot have a genuine FSMS without a HACCP-based approach at its core, but HACCP alone, without the prerequisites and management structure around it, is not the same as a complete FSMS.
Any one of these gaps can be enough to affect a Food Hygiene Rating or, in a supply chain context, put a customer contract or certification at risk. The good news is that most of these issues are straightforward to close once they have been properly identified.
A well-organised FSMS tends to hold together as a set of clearly linked documents rather than one enormous file. At a minimum, we would expect to see a process flow diagram, a hazard analysis, a schedule of critical control points with their limits and monitoring arrangements, prerequisite programme records such as cleaning and pest control logs, a supplier list with approval evidence, an allergen matrix, staff training records, and a log of internal reviews. Businesses working towards BRCGS or SALSA certification will need this documentation structured in a way that maps onto the specific standard's clause numbering, which is one of the more time-consuming parts of preparing for a first audit.
Verification is often the weakest link in an FSMS, not because businesses do not care, but because day-to-day pressure crowds out the time needed to step back and check the system as a whole. A short, regular internal audit, even a simple monthly walk-through against a checklist, is usually enough to catch drift before it becomes a serious issue: a cleaning schedule that has quietly stopped being signed, a supplier whose approval paperwork has lapsed, or a training record that has fallen behind current staff. Larger businesses typically formalise this into a management review meeting, where food safety performance, complaints, audit results and any incidents are discussed on a set schedule, with actions tracked to completion.
Beyond day-to-day compliance, a properly documented FSMS is central to a business's due diligence defence under UK food law. If something does go wrong, whether a customer complaint, a foodborne illness claim, or an EHO investigation, the strength of that defence usually rests on being able to show that reasonable precautions were in place and reasonable diligence was exercised. Patchy or inconsistent records make that defence far harder to mount, however good the underlying food safety practice actually was. This is one of the reasons we encourage clients to think of their FSMS as protection for the business, not just a compliance exercise.
At FoodSure we help businesses build a food safety management system that fits the way they actually operate, rather than forcing an oversized or undersized template onto the business. Our team reviews existing systems, identifies gaps against Regulation 852/2004 and, where relevant, BRCGS or SALSA standards, and works alongside staff to put practical, workable procedures in place. Whether the goal is passing the next EHO visit with confidence, achieving certification for a new supply contract, or simply knowing the system will hold up under scrutiny, we would be glad to talk through where the business stands today.
