What the standard requires
FSANZ explains that Category 1 businesses carrying out prescribed activities must substantiate critical food-safety controls. Where records are used, those records must be kept for at least three months.
Prescribed activities cover key controls around receiving, storage, processing, display, transport, cleaning and sanitising when handling unpackaged potentially hazardous food that is ready to eat.
Records are not the only possible form of substantiation
The standard allows flexibility. A business may be able to demonstrate to the reasonable satisfaction of an authorised officer that the relevant controls are being managed in another acceptable way — for example through physical demonstration or validated operating procedures and staff knowledge.
The practical implication is that operators should not confuse “digital records” with “compliance by software”. The system should support the controls your business actually uses and make the evidence easy to retrieve.