What HACCP requires for pest control documentation

If your food business is HACCP certified or working toward it, your pest control program needs to meet specific documentation requirements. Auditors don't just want to know that you have a pest controller. They want to see the paperwork — and it's one of the most common places Melbourne food businesses lose marks.

Why pest control is a HACCP prerequisite

Under HACCP, pest control sits as a Prerequisite Program (PRP) — one of the foundational conditions that has to be in place before the rest of your food safety system can work. That status carries obligations: the program has to be written down, implemented consistently, monitored regularly, and reviewed whenever pest activity is found.

A verbal arrangement with a pest controller, or a one-off annual treatment, won't satisfy an auditor. What they're checking is that pest control at your site is a system, not a phone number you call when something scurries past.

Where the rules actually come from

Two separate frameworks apply, and it helps to know which one your auditor is quoting.

The first is law. Food Standards Code Standard 3.2.2 requires every Australian food business to take all practicable measures to prevent pests entering the premises, and to eradicate and prevent harbourage of any pests found. That obligation applies whether or not you're HACCP certified — it's what your council Environmental Health Officer inspects against.

The second is your certification scheme. HACCP (and the GFSI schemes built on it — SQF, BRCGS, FSSC 22000) treats pest management as a prerequisite program and adds the documentation burden: written plans, service records, trend review, corrective action logs. Certification auditors check the paperwork; EHOs check the premises. A compliant program satisfies both with the same file.

One more detail auditors increasingly check: every product used on your site must be registered with the Australian Pesticides and Veterinary Medicines Authority (APVMA), and used per its label. Your pest file should show registration numbers for every chemical on the premises.

The written pest management plan

The centrepiece of a compliant program is a written Pest Management Plan (PMP) specific to your facility. At minimum, an auditor will expect it to cover:

• A facility diagram showing the location of every monitoring and bait station
• The pest species the program targets at your site
• Approved treatment methods, with product names and APVMA registration details
• The scheduled service frequency, and what happens at each visit
• Emergency callout procedures for activity found between visits
• Chemical safety documentation (SDS) for every product used on site
• Your pest controller's licence details and insurance certificates

Service reports after every visit

Every service visit needs a written report added to your pest file. A compliant service report records:

• Date and time of service
• Areas inspected and treated
• Products used — names, registration numbers, concentrations, and quantities
• Pest activity observed, and where
• Corrective actions recommended (proofing gaps, sanitation issues, storage practices)
• The attending technician's name and licence number

If your current provider leaves without handing over a report — or emails one that never makes it into your file — that visit effectively didn't happen as far as your audit trail is concerned.

Monitoring station records

Internal monitoring stations and glue boards need their own inspection records, tracked over time. The point isn't just "checked, all clear" — it's the trend. Rising activity at stations near a loading dock tells you something a single visit note can't, and auditors increasingly want to see that trend data reviewed and acted on.

Trend review is also where early warnings live. Three consecutive visits with activity at the same external station is a proofing problem announcing itself — the kind of signal we cover in our guide to spotting the signs of a rodent problem before it becomes an infestation.

Your responsibilities vs your contractor's

A common audit failure is each party assuming the other holds the paperwork. The split is actually clean.

Your pest controller is responsible for supplying the site-specific plan and station map, producing a written report after every visit, providing SDS and APVMA registration details for every product used, holding a current licence and insurance, and flagging corrective actions — the proofing gaps, sanitation issues and storage practices that invite pests in.

Your business is responsible for keeping the pest file on site and current, actioning the corrective actions (your contractor can recommend sealing a dock gap; they can't make you do it), logging any sightings between visits and reporting them, and briefing staff on what to do when they see activity. Auditors mark down sites where recommendations sit unactioned across multiple reports — it demonstrates the system exists on paper only.

What auditors commonly find missing

From sites we've taken over across Melbourne, the same gaps come up again and again:

• No written PMP at all — just a stack of invoices
• Service reports that were never collected or filed
• Chemical registers missing SDS documents or out of date
• No facility diagram, or one that doesn't match the stations actually on the floor
• No record of the pest controller's licence being verified
• No documented emergency procedure for sightings between visits

How long to keep pest control records

Certification schemes generally expect a minimum of two years of pest records on file, and many QA managers keep longer to show multi-year trends. The practical rule: keep every service report, station log, corrective action record and chemical register at least for the life of your current certification cycle plus the previous one, so an auditor can always compare this year against last.

Digital files are fine — most schemes accept scanned or emailed reports — but they have to be retrievable during the audit, not sitting in a former manager's inbox. A shared drive folder per year, mirrored in a physical binder for sites where auditors ask to walk the floor with it, is the setup that never causes problems.

If you're switching providers, treat the handover as part of record-keeping: get the outgoing contractor's station map, remaining reports and chemical register before they leave site, and have the incoming provider formally adopt or replace the plan. A documentation gap between providers reads to an auditor exactly like a period with no pest control at all.

Getting it right in Melbourne

None of this is difficult — it just has to be systematic. Before your next audit, ask your pest controller two questions: does every visit produce a written report, and is there a current site-specific plan document with a station map? If either answer is no, fix it before the auditor asks.

A1 Pest & Weed Control builds HACCP-compliant pest management plans for food businesses across Melbourne — documentation included, audit-ready from day one, with cockroach and rodent programs built to the standards above. Call 0411 859 516 or get a free quote.

Frequently asked questions

Is pest control mandatory for HACCP certification?

Yes — pest control is a Prerequisite Program, meaning certification can't be achieved or held without a documented, implemented program. Separately, Food Standards Code Standard 3.2.2 makes pest prevention and eradication a legal obligation for every Australian food business, certified or not.

How often should a food business have pest control service visits?

Most Melbourne food premises run monthly scheduled visits, moving to fortnightly for high-risk sites or during active treatment. The frequency should be risk-based and written into your pest management plan — an auditor will check that you're actually following whatever schedule the plan states.

Who keeps the pest control records — the business or the contractor?

The business. Your contractor produces the reports, but the audit obligation to hold and produce them sits with your site. Keep a dedicated pest file — physical or digital — and check after every visit that the report actually made it in.

What happens if an auditor finds pest activity?

Activity alone isn't an automatic fail — auditors know pests exist. What they assess is your response: was it detected by your monitoring, logged, reported to your pest controller, and closed out with a documented corrective action? An infestation with no paper trail is what fails audits.

Do I need a separate pest management plan for each site?

Yes. A compliant plan is site-specific: it includes that facility's diagram, station locations, target species and risk areas. A head-office template shared across sites won't match what an auditor sees on the floor.