Food safety law and inspections

Every rule in a commercial kitchen, from the temperature of the walk-in to the sign over the hand sink, traces back to a law. Knowing where the rules come from helps a cook understand why they exist, helps a manager know which ones are flexible and which are not, and helps everyone stay calm when the health inspector walks through the back door at 11:40 on a Friday. This lesson explains who writes the rules, who enforces them, what the restaurant must have in place, and what happens during and after an inspection.

Layers of food safety law

In the United States, food safety is shared among federal agencies, the states and local health departments. The federal government regulates food manufacturing, imports and interstate commerce and writes a model code for restaurants. The states turn that model into law. Counties and cities hire the environmental health specialists, often called inspectors or sanitarians, who issue permits and inspect.

The federal level

The Food and Drug Administration (FDA) writes the Food Code, a model set of rules for restaurants, grocery stores and institutions. The current edition is the 2022 Food Code, published in January 2023. The Food Code is not federal law on its own; it becomes law when a state or local government adopts it, and almost every state has adopted some edition, often with changes. The FDA also enforces federal law for food manufacturers under the Food Safety Modernization Act, and the USDA's Food Safety and Inspection Service (FSIS) inspects meat, poultry and egg product plants. The CDC tracks illnesses and helps investigate outbreaks. A restaurant depends on all of them every time it receives a delivery, and it must act on recalls.

The state level

In Georgia, the Department of Public Health's Rules and Regulations for Food Service, Chapter 511-6-1, set the rules for restaurants. They are based on the FDA Food Code, with some Georgia-specific additions such as the letter grading system. An inspector will expect the person in charge to know them.

• A permit from the county health authority is required to operate, it is issued after plan review and a pre-opening inspection, it is not transferable, and it must be posted.
• Each establishment must employ at least one certified food safety manager (CFSM) with supervisory authority over food preparation, and the manager must hold a current certificate from an accredited exam, with the original posted in public view. If the certified manager leaves, the restaurant must tell the health authority within 30 days and has 60 days to replace them.
• A person in charge must be present during all hours of operation and must be able to show knowledge of food safety. The person in charge makes sure employees are trained in food safety, including food allergy awareness, as it relates to their duties.
• Time/temperature control for safety (TCS) foods must be held at 41 °F or colder or at 135 °F or hotter, cooked to set temperatures and cooled within set times.
• Food employees must report certain symptoms and diagnoses to the person in charge, who must exclude or restrict them as the rules require and notify the health authority of certain diagnoses.
• Hand sinks must be accessible, used only for hand washing and stocked with soap and single-use towels or an approved dryer.
• Inspections are scored and graded, and the most recent grade is shown to the public, as described later in this lesson.

Other states use the same framework with their own details. Some adopt the newest Food Code quickly and others still use older editions; some require every food worker to hold a food handler card while Georgia relies on the certified manager to train staff; and many cities and counties add their own requirements. A restaurant group with locations in several states must follow each one's rules.

The county health department and its inspectors

Savannah is in Chatham County, where environmental health specialists of the county health department review plans, issue permits, inspect food service establishments, investigate complaints and work with the state on outbreaks. Under Georgia's rules they can enter during operating hours, examine food and records, take samples and photographs, and suspend a permit when there is an imminent health hazard such as a sewage backup, no hot water or an outbreak. Inspection results are public, and the grade is shown to guests.

What inspectors look for

Inspectors do not try to look at everything equally. Modern inspections are risk-based: they spend most of their time on the practices most likely to make someone sick, the five risk factors from Lesson 1, and less time on things like a chipped floor tile or a burned-out light, which still matter but rarely cause outbreaks. A good inspector will want to see food being cooked and probed, check the temperatures in the coolers and on the hot line, ask staff how they cool soups, watch whether people wash their hands, and ask what the restaurant does when someone is sick.

The Food Code divides violations into priority items, which directly reduce a hazard (such as cooking temperatures, cold holding, hand washing and sick workers), priority foundation items, which support a priority item (such as having a thermometer, sanitizer test strips or soap at the hand sink), and core items, which concern general sanitation, maintenance and facilities. Georgia's scoring follows a similar logic: risk factor violations in subcategory 1 cost 9 points each, those in subcategory 2 cost 4 points each, and good retail practice violations cost 1 to 3 points each. Repeat violations cost extra.

Scoring an inspection

The program below scores an invented Georgia inspection of Juniper Street. Each violation has a category, and the program subtracts the points from 100, adds the extra deduction for a repeat, and assigns the letter grade.

# Score an invented inspection (Georgia-style deductions and grades).
violations = [
    # (description, points, repeat?)
    ("Cooked rice held at 120 F on the line", 9, False),
    ("Hand sink at dish pit blocked by a rack", 4, False),
    ("No thermometer in the reach-in cooler", 4, True),
    ("Torn gasket on walk-in cooler door", 1, False),
    ("Grease buildup under the fryers", 2, False),
]

REPEAT_EXTRA = 1   # simplified: one extra point for each repeat in this example
score = 100
for desc, pts, repeat in violations:
    lost = pts + (REPEAT_EXTRA if repeat else 0)
    score -= lost
    print(f"-{lost:>2}  {desc}{'  (repeat)' if repeat else ''}")

def grade(s):
    return "A" if s >= 90 else "B" if s >= 80 else "C" if s >= 70 else "U"

print(f"Score: {score}  Grade: {grade(score)}")

- 9  Cooked rice held at 120 F on the line
- 4  Hand sink at dish pit blocked by a rack
- 5  No thermometer in the reach-in cooler  (repeat)
- 1  Torn gasket on walk-in cooler door
- 2  Grease buildup under the fryers
Score: 79  Grade: C

One priority violation and two priority foundation violations cost Juniper 18 points before the small items were even counted, and the score of 79 is a C, which means a follow-up inspection. Cold holding alone cost as much as nine maintenance problems would. That is the point of risk-based scoring: it pushes managers to spend their attention on the practices most likely to make someone sick. The deductions in this example are simplified; the real form lists each item and its points.

Grades, follow-ups and enforcement

Georgia's grades are A for 90 to 100, B for 80 to 89, C for 70 to 79 and U for 69 or less. A routine inspection with a C or U brings a full follow-up inspection, and after a U the follow-up must come within 10 days. A restaurant that cannot reach at least a C within 10 days of a U, or that gets a U on two routine inspections in a row, may be asked to close voluntarily, and the health authority can suspend the permit when there is an imminent health hazard. Grades are shown to the public, and local media in many cities report the lowest scores every week, so a bad inspection can follow a restaurant for a long time.

Recalls: when the problem starts upstream

Sometimes the restaurant does nothing wrong and still has unsafe food in its walk-in. When a manufacturer, the FDA or the USDA finds contamination, such as Listeria in a brand of cheese, E. coli in a lot of flour or undeclared peanuts in a sauce, the product is recalled, the recall is classified by risk (Class I being the most serious), and the notice is published on the agencies' recall websites. Suppliers usually call their restaurant customers directly, but Juniper does not rely on that: Aisha subscribes to FDA and USDA recall alerts by email and checks each one against the invoices.

• Find it: check the brand, product, lot code and best-before or use-by date on the notice against what is in storage and on the line, and against recent invoices.
• Separate it: move any recalled product to a marked spot in the walk-in, labeled DO NOT USE, so it cannot be used by mistake.
• Follow the instructions: return it to the supplier for credit or destroy it as the notice says, and record what was done.
• Look back: if recalled food was already served, consider which dishes used it and whether guests at higher risk may have eaten it, and ask the health authority for advice.

Keeping invoices and lot codes for a few months is what makes this possible, and it also protects the business. When a guest sues after an illness, the restaurant's records of training, temperature logs filled in at the time, supplier invoices and a documented response to recalls are often the best evidence that it acted with reasonable care. Records that were never kept, or that were filled in afterwards, help the other side.

The restaurant's side of the inspection

An inspection goes best when the restaurant treats the inspector as a partner and when the people on duty know what to show. Juniper's managers keep a single binder in the office with everything an inspector usually asks for, and every supervisor knows where it is.

• The posted operating permit, the most recent inspection report and the certified food safety manager's original certificate.
• Records of staff food safety and allergy awareness training.
• The written food safety procedures, with the current temperature, cooling, date-marking and cleaning logs.
• Supplier invoices and shellstock tags, kept for 90 days.
• The pest control contract and the contractor's service reports.
• The employee health policy, including the reporting agreement each food employee signs.

During the visit, the manager or person in charge walks with the inspector, answers questions honestly, and fixes what can be fixed at once: discarding food that has been out of temperature too long, moving raw chicken to the bottom shelf, clearing the hand sink. Arguing rarely helps; asking questions often does. Inspectors know a great deal about food safety and are usually glad to explain a requirement or suggest a simpler way to meet it. After the visit, the manager reviews the report with the staff who were on duty, assigns each item to someone, and checks that it was done.

For supervisors: being ready every day

• Run your own inspection. Once a week, walk the kitchen with the inspection form in hand and score yourself honestly. Lesson 12 shows how Juniper does it.
• Train the person on duty, not just the chef. Inspectors arrive without warning and often on the busiest shift, and whoever is in charge that day must be able to show the logs and answer questions.
• Keep records as you go. A cooling log filled in afterwards from memory is worse than none, and inspectors can usually tell.
• Fix the cheap things first. A thermometer in every cooler, test strips at every sanitizer bucket and soap at every hand sink cost little and remove whole categories of findings.