Food safety manual templates.

01Quick triage

Policy, manual, or both?

Most of the people who land on a page like this need one of two very different documents, and the wrong choice wastes a week. Before you scroll past the first download, work out which one you actually need.

If your insurance broker, your landlord, a new customer, or a follow-up inspector asked for a “food safety policy,” you almost certainly need a one-page signed statement — not a sixty-page binder. They want a single Word document with your facility name, a four-sentence commitment, your top-management signature, and a date. That document lives at the top of this page. It downloads without an email gate. Print it, sign it, send it.

If you said yes to a customer who wants you SQF, BRCGS, or FSSC certified, and you're now staring at the standard wondering what a “documented food safety management system” actually looks like — you need the full manual. That's the second download. Plan to spend one to four weeks customizing it to your facility before you sign anything.

If you just failed an inspection and the corrective action says “produce a food safety manual within sixty days,” you need the full manual too, but read the “auditor gotchas” section before you start writing. The seven failures that show up there are the ones an inspector will catch even on a re-inspection.

“

Not the content. The wrapper around the content.

”

What every auditor is actually looking for

The rest of this page walks through what each manual contains, which regulations require which sections, and the specific document-control pieces that turn a stack of Standard Operating Procedures (SOPs) into something an auditor will accept as a manual.

02The one-page policy

The Food Safety Policy Statement.

A Food Safety Policy Statement is one page, signed by the most senior person at your business, that says four things: you commit to producing safe food, you commit to following the law, you commit to continuous improvement, and you name a person who is responsible. That's it. The auditor or insurance broker is checking that someone at the top of the business has put their name to those commitments in writing.

Eight components belong on the page:

1. 01

   Header

   Business name, address, license or registration number, document version (start at v1.0), and effective date.

2. 02

   Commitment statement

   Two to four sentences confirming that the business produces safe food, complies with the applicable law (the Food Safety Modernization Act (FSMA), the Safe Food for Canadians Regulations (SFCR), or the FDA Food Code), and commits to continuous improvement.

3. 03

   Scope

   Which products, processes, and sites are covered.

4. 04

   Objectives

   Three to six measurable goals. Examples: zero Class I recalls, 95 percent first-pass on third-party audits, 100 percent annual training completion, all Critical Control Points (CCPs) monitored to spec.

5. 05

   Responsibility

   Names the Food Safety Team Leader by title.

6. 06

   Communication

   Confirms the policy is communicated to staff, contractors, and visitors, and is available to interested parties on request.

7. 07

   Review cadence

   Confirms the policy is reviewed at least annually at management review and updated whenever scope, process, or regulation changes.

8. 08

   Signature and date

   Top management signs by hand. Wet ink, not a typed name.

Here is the opening of the policy I signed for my own CFIA-licensed facility in Brantford. You can lift the structure and change the names:

That fits on one page when you add the header and signature block. Print it on facility letterhead. Sign it. Frame a copy in the production entrance so visitors see it before they pass the line. Hand a digital copy to anyone who asks.

02bThe master document

The Food Safety Manual.

The Food Safety Manual is the master document of your food safety management system. It is not the Hazard Analysis and Critical Control Points (HACCP) plan, it is not the SOP binder, it is not the employee handbook — it binds those documents together into one controlled system. Auditors open the manual to answer one question: does this facility have a coherent, documented, implemented food safety system, with clear ownership, scope, and references to all the supporting procedures?

Three layers of food safety documentation sit underneath that question:

1. 01

   Tier 1 — the Manual

   The policy, scope, organizational chart, document control rules, and references to every Tier 2 document. Roughly 30 to 80 pages depending on facility complexity.Top management owns this

2. 02

   Tier 2 — Programs and Plans

   The HACCP plan, Sanitation Standard Operating Procedures (SSOPs), recall plan, allergen plan, food defense plan, environmental monitoring program. Each is a stand-alone document referenced from the manual.Food Safety Team Leader owns this

3. 03

   Tier 3 — Records

   Daily logs, completed forms, signed checklists, training records. The evidence the Tier 2 programs were actually executed.Operators and supervisors own this

When an auditor finds a gap in Tier 3, they go up to Tier 2 to see if the procedure exists, then up to Tier 1 to see whether top management owns the system. The manual is the document that proves the answer to all three is yes.

This three-tier model is consistent across SQF, BRCGS, FSSC 22000, ISO 22000, the Food Safety Preventive Controls Alliance (FSPCA) guidance, and the Codex Alimentarius general principles. Different schemes name the layers slightly differently, but the structure is the same.

03Which schemes require it

When the manual is mandatory.

Whether you need a documented manual depends on which regulation and which certification you operate under. Most operators end up needing one even when no single regulation uses the word “manual,” because the auditor or inspector expects the documents to be organized somewhere.

1. 01

   SQF Edition 10

   Module 2 (System Elements) is the management core. Edition 10 (published March 2026) adds explicit requirements at the manual layer: a prescribed Record Requirements list, a Food Safety Culture assessment, Change Management, and Risk Assessment.¹Effective Jan 2, 2027

2. 02

   BRCGS Issue 9

   Eleven clauses requiring documented procedures “compiled in a food safety and quality manual.” Clause 3.1 requires the manual to be documented, current, and available to staff. Clauses 4.9 and 4.10 drive the Glass and Hard Plastic Policy.²Part 3 of the standard

3. 03

   FSSC 22000 V6

   ISO 22000:2018 plus the ISO/TS 22002-1 prerequisite programs plus FSSC additional requirements. V6 added mandatory topics at the manual layer: Food Defense, Food Fraud, Allergen Management, Environmental Monitoring, and Food Safety and Quality Culture.³

4. 04

   ISO 22000:2018

   Annex SL high-level structure. The standard requires “documented information” for the scope of the food safety management system, the policy, the objectives, procedures, and records. The standard doesn't mandate a manual by name, but the manual is the practical artifact that organizes everything else.

5. 05

   FSMA Preventive Controls

   A written Food Safety Plan is required under §117.126 covering hazard analysis, preventive controls, supply-chain program, recall plan, monitoring, corrective action, verification, and records. Most facilities wrap the Food Safety Plan inside a broader food safety manual that also covers Subpart B Good Manufacturing Practices (GMPs) and §117.4 training.⁴21 CFR Part 117

6. 06

   USDA-FSIS HACCP

   A written HACCP plan is required. The plant-level system (HACCP plus 9 CFR 416 Sanitation SOPs plus supporting programs) is typically organized into a plant food safety manual.9 CFR Part 417

7. 07

   SFCR

   Section 86 requires a written Preventive Control Plan (PCP), which is functionally a food safety manual covering hazards, controls, monitoring, verification, corrective action, traceability, recall, and competencies. Section 87 mandates monitoring and verification records.⁵SOR/2018-108 §86

8. 08

   FDA Food Code

   No written manual required by the Code itself. But California, New York, Toronto, and Vancouver increasingly ask for documented food safety policies during inspection follow-up.Restaurants and retail

If you operate under more than one of these — FSMA plus SQF, or SFCR plus BRCGS — build one manual that satisfies the stricter requirement and call out the cross-references in the scope section. Two parallel manuals are an audit liability waiting to happen.

04The 22 sections

What goes inside the manual.

A complete food safety manual follows a remarkably consistent skeleton across schemes. The variance is mostly in scheme-specific sections — Food Defense for FSSC V6, Food Safety Culture for SQF Edition 10, traceability for SFCR §89 — not in the overall shape. Twenty-two sections plus four appendices, totaling 30 to 80 pages depending on how complex your operation is:

1. 01

   0. Cover page

   Facility name, address, license number, manual version, effective date, signatures.

2. 02

   1. Table of contents

   All sections and appendices with page references.

3. 03

   2. Scope

   Product categories, processes, sites, exclusions, applicable schemes.

4. 04

   3. Food safety policy statement

   The one-pager from section 02 above, signed by top management.

5. 05

   4. Organizational chart and responsibilities

   Roles, food safety team composition, Food Safety Team Leader.

6. 06

   5. Management commitment and resources

   How top management ensures resources, training, time.

7. 07

   6. Document and record control

   How documents are created, approved, distributed, retained, archived. Includes the controlled document register.

8. 08

   7. Training program

   Competency requirements, training matrix, refresher cadence, records.

9. 09

   8. HACCP or Food Safety Plan overview

   References to the actual HACCP plan; summary of CCPs or preventive controls.

10. 10

    9. Prerequisite programs (PRPs)

    GMPs, sanitation, pest control, water, allergen control, glass policy. Each with a reference to its own document.

11. 11

    10. Operational procedures

    References to the Sanitation Standard Operating Procedures library.

12. 12

    11. Allergen management

    Cross-contact controls, label verification, supplier verification.

13. 13

    12. Supplier and supply-chain program

    Approved supplier program, Certificates of Analysis (COAs), Foreign Supplier Verification Program (FSVP) if you import.

14. 14

    13. Traceability and recall

    One step back, one step forward. FSMA 204 (if covered food). SFCR §89. Mock recall cadence.

15. 15

    14. Customer complaints

    Complaint handling procedure and records.

16. 16

    15. Internal audit

    Annual schedule, auditor competence, finding and corrective-action flow.

17. 17

    16. Management review

    Annual review, inputs and outputs, action items.

18. 18

    17. Food defense

    Vulnerability assessment, access control, mitigation strategies. FSSC V6 and the FDA Intentional Adulteration Rule.

19. 19

    18. Food fraud

    Vulnerability assessment and mitigation. FSSC V6 explicit.

20. 20

    19. Environmental monitoring

    Scope, swab plan, trending. Especially important for ready-to-eat operations.

21. 21

    20. Crisis management and product withdrawal

    Crisis team, communication plan, media template, regulator notification.

22. 22

    21. Food safety culture

    Plan plus measurement. SQF Edition 10 explicit requirement. FSSC V6 also.

23. 23

    22. Change management

    Procedure for changes to product, process, equipment, suppliers. SQF Edition 10 explicit.

Four appendices round it out: a facility map and process flow diagram (Appendix A), the controlled document register (Appendix B), a glossary (Appendix C), and the revision history (Appendix D).

A small bakery running one process line typically lands around thirty pages when the skeleton is filled in honestly. A mid-size manufacturer running SQF plus retailer-specific requirements lands at sixty to eighty pages. If your draft is much shorter than thirty pages, you've almost certainly skipped sections you needed. If it's much longer than eighty, you're probably duplicating content that belongs in the Tier 2 documents.

05Supporting policy manuals

The other manuals in this hub.

The master Food Safety Manual is one document. Most facilities also need a family of supporting policy manuals that the master document references but doesn't fully contain. Each one warrants its own template.

Allergen Control Manual.

The United States recognizes nine major allergens under the Food Allergen Labeling and Consumer Protection Act (FALCPA) plus the FASTER Act of 2021: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and sesame (added April 23, 2021, effective January 1, 2023).⁶ Canada recognizes eleven priority allergens under SFCR — the nine plus mustard and sulphites. If your products contain any of these or are made on shared equipment, you need an allergen control manual.

Required sections: receiving control (segregated storage), production scheduling (allergen to non-allergen sequencing), cleanup validation between changeovers using a swab method such as Enzyme-Linked Immunosorbent Assay (ELISA), label verification, supplier verification, cross-contact prevention with color-coded utensils, training, and rework controls.

Recall Manual.

The recall manual is the binder version of the recall plan. It includes the team roles, the mock recall cadence, the customer notification templates, the regulator notification process (the FDA Reportable Food Registry; CFIA notification under SFCR §83 and §84), distribution traceability, and the public communications plan. The manual cross-references the operational recall plan template but packages everything — including signed agreements with your distributors and a hard copy of your customer list — in one binder ready for a 2 a.m. event.

Crisis Communication Manual.

Often combined with the recall manual but worth having as its own document. The crisis communication manual contains the crisis team roster (CEO, Quality Assurance, Operations, Communications, Legal, Customer Service), pre-approved holding statements, the internal communications tree, the named media spokesperson plus a 24-hour media training record, social media monitoring instructions, regulator engagement protocol, the post-crisis review template, and a quarterly simulation schedule.

A customer reported a possible foreign object in one of my products in 2024. It turned out to be packaging — harmless, identified within 30 minutes — but during those 30 minutes I realized my crisis communication plan was three lines on a sticky note. The template here is the version I built the week after.

Employee Handbook (food-safety sections).

The food-safety portion of an employee handbook covers six topics. Illness reporting is the first: employees must report the “Big 6” symptoms and illnesses identified by the FDA Employee Health and Personal Hygiene Handbook — Norovirus, Hepatitis A, Shigella, Salmonella Typhi, Shiga toxin-producing E. coli (STEC), and non-typhoidal Salmonella.⁷ Then hand washing (twenty seconds with soap and warm water, at six trigger moments), dress code (clean uniforms, hair restraints, no jewelry, no bare-hand contact with ready-to-eat food), personal hygiene (no eating, drinking, or gum in production), visitor and contractor expectations (induction training before plant entry), and a discipline procedure for violations.

Visitor Policy.

Pre-arrival notification and approval; sign-in and sign-out log; induction covering GMP, allergen awareness, and the no-photo rule; Personal Protective Equipment (PPE) issue including smock, hair net, beard net, and shoe covers; a health declaration confirming no Big 6 symptoms in the prior 24 to 48 hours; escort requirement (no visitor walks unescorted in production); restricted areas; sample receipt acknowledgment if you provide samples.

Contractor Policy.

Everything in the visitor policy plus insurance verification, pre-arrival risk assessment, a tool list approval (no glass tools, no wooden handles, hot-work permits required for grinding or welding), after-hours authorization, sign-off confirming no tools or materials were left behind, and allergen and chemical declarations for anything the contractor brings into the facility.

Glass and Hard Plastic Policy.

Required under BRCGS Issue 9 clauses 4.9 and 4.10 and FSSC V6 prerequisite programs. The policy needs a documented register of every piece of glass and brittle plastic in the facility (windows, light fixtures, instrument lenses, plastic guards), an inspection cadence (weekly in production zones, monthly elsewhere), a breakage response procedure (isolate, contain, document, clean, inspect, release), a substitution program (replace glass with shatter-resistant alternatives where possible), a shatter-resistant bulb requirement in production, a personal items policy (no glass containers carried into production), and records retention.

Every audit, the auditor asks to see the glass register. Most operators have one. Then the auditor walks the production floor and counts the light fixtures the register missed. The template here ships with a “walk the floor with this register” checklist, not just the register.

Foreign Object Control Policy.

A broader policy covering all extraneous matter, not just glass. Metal (metal detector plus magnets), glass and hard plastic (the register above), wood (eliminated where possible), fibers, pests, personal effects (jewelry, fingernails, hair), and packaging. Each category gets a control strategy and a cross-reference to the relevant SOP.

06The wrapper

What auditors actually look for.

When I submitted my first preventive control plan for CFIA review, the inspector handed back seven items. I expected the content to be the problem. It wasn't. The content was solid. The seven items were almost entirely about the document-control wrapper:

1. 01

   Version number missing

   No version number in the header, so the auditor couldn't tell which version was current. Every page needs “v1.0” or “v2.3” in the footer with the effective date.

2. 02

   No effective date

   A manual dated only by the year is ambiguous. The auditor needs to see “Effective: January 5, 2026.”

3. 03

   No top-management signature

   A manual without a senior signature at the front fails management commitment evidence. Wet ink signature on the cover page, dated, with title.

4. 04

   No controlled document register

   If a staff member is using the wrong version of a procedure, how do you know? The controlled document register lists every document, its current version, who has a copy, and when it was last reviewed. Without it, the auditor cannot verify staff are using current versions.

5. 05

   Manual exists but staff have never seen it

   Failed communication requirement. BRCGS clause 3.1 and FSSC V6 are explicit: the manual must be accessible to staff. Ask three random employees where the manual is. If they don't know, you fail.

6. 06

   Manual references documents that don't exist

   The manual says “see SOP-014.” SOP-014 has not been written. This is the most common finding in operations that copy a template wholesale and forget to write the supporting SOPs.

7. 07

   Internal inconsistency

   The scope section says “ready-to-eat ambient products” but the HACCP plan covers frozen RTE. Either the scope is wrong or the HACCP plan is wrong. Auditors will find this in under two minutes.

Generic templates don't ship with the document-control wrappers that prevent these findings. The templates in this hub do.

07HACCP vs. plan vs. manual

The three things people confuse.

Three different documents get mixed up constantly. Knowing which is which saves a week of re-work:

The Food Safety Manual sits above both. It references the HACCP plan and the Food Safety Plan as supporting documents in Section 8. It binds them together with the policy, scope, organizational chart, document control, training program, and supporting policies. If the HACCP plan is the recipe for one product line, the Food Safety Manual is the cookbook plus the kitchen rules.

A new audit finding I've started seeing: BRCGS auditors flagging operations whose “manual” is just a stack of SOPs in a binder. The binder is missing the connective tissue — the policy statement, the org chart, the document control register, the scope statement — that turns a collection of procedures into a manual. The fix is the wrapper from section 06 above.

08Template vs. consultant

When the template is enough.

Honest framing. The templates here are free because the template part of writing a food safety manual is the part that shouldn't cost money. Every operator's scope, organizational structure, document control rules, and management review cadence look similar enough that one good skeleton serves a thousand facilities. That's the part the consultant shouldn't be charging you for.

What the consultant is worth paying for: the facility-specific hazard analysis (your novel process, your unusual ingredient, your high-risk RTE step), validation work (challenge studies, thermal death-time models, allergen swab method validation), post-Warning-Letter or post-Class-I-recall rebuilds where the regulator wants a third party in the loop, and audit-readiness coaching in the four weeks before a Stage 2 SQF or BRCGS audit. Those activities require expertise no template provides.

If your needs are entirely on the template side, this hub covers you. If your needs cross into the validation or post-enforcement side, hire someone — but pay them for the validation, not for re-typing the scope section of a template.

09Edge cases

Single-site, multi-site, food trucks.

A few situations don't fit the standard skeleton cleanly:

1. 01

   Multi-site manufacturer

   One master manual with a scope section that lists every site, plus a site-specific annex per facility (facility map, organizational chart, local PRP variations). Don't maintain three parallel manuals — one master plus annexes survives an audit; three manuals will diverge within a year.

2. 02

   Food truck or mobile vendor

   FDA Food Code doesn't require a written manual. But increasingly, commissary kitchens, special event organizers, and corporate clients ask for one. A ten-page mini-manual (policy, scope, hazard analysis, sanitation procedure, temperature logs, employee health declaration, recall plan) covers the practical need.

3. 03

   Cottage manufacturer / home-based business

   Provincial or state cottage food law usually doesn't require a manual. But if a retail customer requests one as part of supplier approval, the same ten-page mini-manual format works.

4. 04

   Co-packer relationship

   If you have your products made by a co-packer, you typically need a Supplier Quality Manual or Supplier Approval Agreement rather than a full Food Safety Manual. The co-packer's manual covers the production; yours covers brand, label compliance, and recall responsibility.

5. 05

   Importer (FSVP)

   Importers operate under the FDA Foreign Supplier Verification Program. The FSVP requires its own documented program; many importers combine it into a single “Importer Food Safety Manual” that satisfies both FSMA importer requirements and any retailer-driven supplier expectations.

10How to use

How to actually fill in the skeleton.

Eight steps from download to signed binder. Honest timeline: one to four weeks of focused work for a small operation. Two to three months if you're building from nothing and also writing the supporting SOPs.

1. 01

   Download and rename

   Save the skeleton with your facility name and date in the filename. Set the document version to v0.1 (draft) in the footer.

2. 02

   Write the scope first

   One paragraph: what products, what processes, what sites, what schemes apply. The scope drives every other section. If you don't know the scope, stop and figure it out before you write anything else.

3. 03

   Build the organizational chart

   Names, titles, reporting lines. Name the Food Safety Team Leader. If you're a small operation and one person wears multiple hats, say so — auditors accept it as long as it's documented.

4. 04

   Sign the policy statement

   Top management signs Section 3 by hand. Don't skip this. Without it, the rest of the manual has no owner.

5. 05

   Fill in the PRP sections

   Reference your existing GMP, sanitation, pest control, allergen, and glass policies. If a referenced document doesn't exist yet, write it before you ship the manual.

6. 06

   Run a management review

   Even before you go live, sit down with top management and walk through the manual. Document the review in Section 16. The signed review record is the evidence the manual is implemented, not just written.

7. 07

   Distribute to staff

   Print a controlled copy for each shift supervisor. Add a brief introduction to each shift huddle for two weeks. Ask three random employees a week later where the manual is. If they can answer, you've passed the communication test.

8. 08

   Schedule the annual review

   Calendar reminder, same week every year. Don't miss it. A signed annual review is the single piece of evidence that separates a living manual from a binder collecting dust.

11Supporting logs

The logs the manual references.

The Food Safety Manual references a long list of operational logs that live in the Records tier underneath it. Most of the downloadable templates on this site sit at that tier. The ones most commonly referenced from a master manual:

The full list of operational logs lives at the temperature-log and cleaning-log hubs. Reference them from Section 9 of your manual with the document title, version, and storage location.

12FAQ

Common questions.

A few of the questions that come up every time someone starts a manual from scratch:

1. 01

   Is the HACCP plan the same as the food safety manual?

   No. The HACCP plan is one supporting document. The food safety manual binds the HACCP plan together with policies, organizational structure, document control, training, and the rest. The HACCP plan typically sits in Section 8 of the manual, referenced rather than reproduced.

2. 02

   Will an auditor accept a template-based manual?

   Yes, if you customize the facility-specific sections (scope, organizational chart, PRP references, signature). Auditors look at content fit and document-control wrapper, not at whether the prose started as a template.

3. 03

   Do I need a separate Quality Manual?

   Depends on the scheme. FSSC V6 commonly uses one integrated Food Safety and Quality Management System (FSQMS) manual. ISO 9001 alone uses a Quality Manual. SQF and BRCGS focus on the Food Safety Manual. If you have both ISO 9001 and a food safety scheme, integrate.

4. 04

   How often does the manual need updating?

   Annually at minimum. Plus whenever scope changes (new product, new site), process changes (new equipment, new supplier), regulation changes (FSMA 204 effective date, SFCR amendments, SQF Edition change), or significant findings (audit non-conformance, recall, customer complaint pattern).

5. 05

   Does the same manual work in the US and Canada?

   The skeleton works in both. The regulatory references differ: U.S. operations cite FSMA 21 CFR Part 117, USDA-FSIS 9 CFR if applicable, and the FDA Food Code for retail. Canadian operations cite SFCR SOR/2018-108 §86, §87, §89. Operations on both sides of the border maintain one manual with both sets of citations in the relevant sections.

6. 06

   Should I get the policy AND the manual?

   Yes, eventually. Start with whichever is more urgent. The policy can be signed and distributed the same day. The manual takes longer. The policy you sign today becomes Section 3 of the manual you finish next month.

7. 07

   Do food trucks need a manual?

   Not by law in most jurisdictions. But commissary kitchens, special-event organizers, and corporate catering clients increasingly ask for one. A ten-page mini-manual format is enough.

13Start here

Pick your first document this week.

If you're here because someone asked for a food safety policy, sign the one-page policy statement above this week. Send it. Move on with your life.

If you're here because you said yes to certification and the audit is in twelve weeks, download the master manual skeleton this week. Spend week one on the scope and organizational chart. Spend weeks two and three on the PRP sections and the HACCP plan reference. Spend week four on the document control wrapper (version, signature, controlled document register, communication to staff). Schedule a management review at the end of week four and sign the policy. You'll be ready to start the Stage 1 documentation review by week six.

If you're here because you just failed an inspection and have sixty days, download the master manual skeleton today. Read the “auditor gotchas” section first. Build the wrapper before you write the content. Most thirty-day-CAPA failures are wrapper failures, not content failures.

The point of the manual isn't the binder. The point is that someone at the top of the business has signed a commitment to food safety, the system that delivers on that commitment is documented, and every person in the facility can find the document that tells them what they're responsible for. That's what an auditor is checking. The templates below get you there.

Footnotes

1.SQF Code Edition 10 — sqfi.com

2.BRCGS Global Standard Food Safety Issue 9 — brcgs.com

3.FSSC 22000 V6 Scheme Document — fssc.com

4.21 CFR Part 117 (FSMA Preventive Controls for Human Food) — ecfr.gov

5.SOR/2018-108 Safe Food for Canadians Regulations — laws-lois.justice.gc.ca

6.FDA Food Allergies (FALCPA + FASTER Act) — fda.gov

7.FDA Retail Food Protection: Employee Health and Personal Hygiene Handbook — fda.gov

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-04· 14 min read· Wikidata Q139112497