Retail & grocery

Food safety and compliance for retail and grocery operations

Retail food is judged store by store, department by department, against whichever food code your local authority has adopted. We build the programs, the records and the inspection readiness that hold up in every one of them.

Talk to a Compliance ExpertSee what we do
Regulated by
State and local health departments
Framework
FDA Food Code, as adopted locally
Scope
Single store to multi-state operator

Who this is for

Retail food, in every format it comes in

A supermarket is a dozen different food businesses under one roof, and a convenience store has quietly become a foodservice operation with a forecourt attached. We work with all of them, and we assess each department on its own hazards rather than against a single store checklist.

The regulatory landscape

What retail food operations actually get inspected on

Retail food establishments in the United States are regulated primarily by state and local health departments. The FDA publishes the Food Code as a model — a recommended set of provisions that states, counties and cities then adopt, in different editions and with their own amendments. That is why a practice that passes without comment in one county draws a violation in the next one, and why the honest first step in any retail engagement is confirming which code your regulatory authority has actually adopted.

What that adopted code focuses on is consistent, though. Inspections are built around the risk factors most often associated with foodborne illness, and the same handful of subjects account for the majority of findings in most jurisdictions. The table below is the practical version of that list: what an inspector looks at, and what the requirement behind it is.

General guidance only. The provisions below reflect commonly adopted Food Code subject matter; the edition in force, the amendments and the inspection scoring are set by your state or local regulatory authority and must be confirmed there.

FDA Food Code (model code)
Published by FDA as a model. It is not federal law and it does not apply to your store until your state or local authority adopts it. Editions in force vary widely, and many jurisdictions amend the text they adopt, so requirements have to be confirmed with the authority that inspects you.
TCS foods: cooking, holding and reheating
Time/temperature control for safety foods carry cooking, hot holding, cold holding and reheating parameters in adopted codes. Where time is used instead of temperature as the public health control, written procedures and disciplined marking and discard are generally required.
Cooling
Cooked and prepared foods generally have to move through the temperature danger zone within a defined time in two stages. Cooling is one of the most commonly failed controls in retail, and the binding constraint is usually equipment capacity and container depth rather than staff effort.
Date marking
Ready-to-eat TCS food held more than 24 hours generally requires date marking with a defined maximum holding period. Multi-department stores tend to fail this in the corners: prep coolers, back stock and reduced-price racks.
Employee health and hygiene
Adopted codes require reporting of specified illnesses and symptoms, exclusion and restriction decisions, handwashing provision and, in many jurisdictions, a written employee health agreement. It is a frequent finding and a genuine outbreak control rather than a paperwork exercise.
Cross-contamination controls
Separation of raw animal foods from ready-to-eat food in storage, preparation and display, plus equipment and utensil separation. In a store where one back room serves a deli, a meat counter and a produce prep area, this is a layout and sequencing question as much as a training one.
Cleaning and sanitizing
Equipment cleaning frequency, sanitizer concentration and contact time, test kits, and the disassembly cleaning that slicers, grinders and dispensing equipment require. Verification records are what turn a schedule into evidence.
Allergen awareness
Adopted codes generally require the person in charge to ensure employees are properly trained in food allergen awareness. Packaged foods carry separate labeling obligations under federal law, and several states add their own disclosure or training requirements for prepared food.
Specialized processes: HACCP plan and variance
Reduced oxygen packaging, sushi rice acidification, curing, smoking as a method of preservation, sprouting and similar processes generally require a written HACCP plan and, in most jurisdictions, a variance from the regulatory authority before the process may run. Whether a variance is granted rests solely with that authority, and some do not grant them for particular processes at all.
Person in charge and CFPM
Most jurisdictions require a person in charge able to demonstrate food safety knowledge, commonly satisfied by an accredited Certified Food Protection Manager credential. How many certificate holders are required, which programs are accepted, and whether coverage is required at all operating hours vary locally.

SURU Compliance is an independent consulting practice. We are not a health department, a government agency, a certification body or a law firm, and we do not issue permits, variances or approvals of any kind.

What we do

Retail compliance services

Four bodies of work. Most retail engagements start in one of them and grow into a second once the first assessment is on the table.

  • Retail food safety programs

    The written system a store runs on, built around the equipment, staffing and volume you actually have rather than a generic template.

    • Retail food safety programs
    • SOP development
    • Food code compliance support
    • Quality systems
    • Corrective action programs
    • Allergen programs
    • Date marking and cooling programs

  • Inspection and health department readiness

    Independent assessment against the code your jurisdiction has adopted, so the findings surface on our visit rather than on the inspector's.

    • Health department compliance support
    • Inspection readiness
    • Store audits
    • Operational assessments
    • Mock inspections
    • Violation root-cause analysis
    • Re-inspection preparation support

  • Multi-location and vendor compliance

    One standard, applied consistently, with results that are comparable across stores, banners and jurisdictions.

    • Multi-location compliance programs
    • Vendor and supplier compliance
    • Standardized programs across sites
    • Supplier approval
    • Specification review
    • Brand-standard audits
    • Franchise and commissary alignment

  • Specialized retail processes

    The processes that move a store beyond routine retail practice and generally require a HACCP plan, and often a variance, depending on your jurisdiction.

    • Sushi rice acidification HACCP
    • Reduced oxygen packaging
    • Smoking and curing as a preservation step
    • Juice HACCP
    • Prepared foods and hot bars
    • In-store bakery and deli
    • Variance and HACCP plan support

Common situations

Four conversations we have most weeks

Retail operators rarely call to buy a service. They call with a date, a department or a report. These are the four that come up most, and what we do about each.

  • Challenge
    We failed our health inspection and the re-inspection is in two weeks.
    What is required
    Violations have to be corrected, and at re-inspection the establishment generally has to show that the conditions behind them have changed rather than that the item was tidied on the day. Repeat findings against the same risk factor are treated more seriously than a first one in most jurisdictions.
    How SURU helps
    We read the report with you and trace each violation back to the practice or system that produced it, not to whoever was standing there. We correct the immediate condition, revise the procedure behind it, retrain the people who run it, and rehearse the walkthrough the way an inspector runs it. We prepare you for the re-inspection. We do not represent you to the health department and we do not control the outcome.
    What you receive
    A finding-by-finding corrective action record with root cause, named owner and verification date, revised SOPs for the practices that failed, retraining records, and a pre-inspection walkthrough checklist you keep using afterwards.
  • Challenge
    Every one of our stores does food safety differently.
    What is required
    Each store answers to its own regulatory authority, and adopted code editions and local amendments differ between them. The baseline is set locally and head office cannot override it. What can be common is the internal standard you hold every store to and the evidence that it is being met.
    How SURU helps
    We document what each jurisdiction actually requires, then write one program that meets the strictest applicable requirement with jurisdiction-specific annexes where codes genuinely diverge. A single calibrated audit instrument makes the results comparable, so a score in one market means the same thing as the same score in another.
    What you receive
    A multi-location standard operating manual, a jurisdiction requirements matrix, a calibrated internal audit instrument with severity definitions, and a reporting format a district manager can act on.
  • Challenge
    We want to add a sushi program and we have been told we need an approved HACCP plan or a variance.
    What is required
    Acidifying sushi rice so it can be held without time or temperature control is treated as a specialized process in most jurisdictions. That generally requires a written HACCP plan and, depending on your jurisdiction, a variance from the regulatory authority before the process may operate. Whether a variance is granted, and on what conditions, rests entirely with that authority.
    How SURU helps
    We confirm what your jurisdiction requires in writing before anything is built or ordered. Then we develop the HACCP plan — process description, hazard analysis, critical limits with the scientific basis behind them, monitoring, corrective action, verification and records — and prepare the variance request so it can be judged on its merits. We also pressure-test whether the pH measurement discipline the plan depends on is something your team can sustain on a Saturday.
    What you receive
    A sushi rice acidification HACCP plan, the variance request package where one is required, calibrated pH monitoring procedures and record forms, and training for the staff who will actually run the program.
  • Challenge
    Our prepared foods department has grown and there is nothing written down.
    What is required
    Adopted food codes expect documented control of cooking, cooling, hot and cold holding, date marking, allergen handling and employee health. Separately, once a department packages food for sale beyond its own retail customers, federal manufacturing requirements may come into scope. That is a question to be assessed for your specific model, not assumed either way.
    How SURU helps
    We walk the department as it genuinely runs, map every process from receiving through service, and assess honestly where the operation sits relative to the retail food establishment exemption. Then we write the program around your equipment capacity, staffing and volume, because a procedure the department cannot physically follow is not a control.
    What you receive
    A department gap assessment, written SOPs for each process, cooling and date marking procedures, an allergen program, monitoring record forms, and a written assessment of where the operation sits relative to the retail exemption.

How the work runs

Assess, then build what the store can actually run

The same six steps whether it is one store or two hundred. The difference at scale is standardization, not method.

  1. Assess

    We walk the store department by department during trading hours and confirm which code edition and local amendments your authority has adopted.

  2. Identify gaps

    Findings written against that adopted code and against your own inspection history, ranked by risk rather than by how easy they are to fix.

  3. Build

    SOPs, monitoring records, HACCP plans and department programs written for the equipment, staffing and volume the store actually has.

  4. Train

    Role-specific training for managers, department leads and crew, tied to your real findings rather than to generic content.

  5. Implement

    The program put into daily use on the floor, with named owners, realistic frequencies and a shift routine that survives a busy weekend.

  6. Verify

    Independent follow-up audits and record review to confirm the controls are running, and corrective action tracked through to closure.

What you receive

The documents you keep

Consulting that leaves nothing behind is not much use at the next inspection. These are the artefacts a retail engagement produces, scoped to what your operation actually runs.

  • Store-level gap assessment report
  • Retail food safety program
  • Written standard operating procedures
  • Sushi rice acidification HACCP plan
  • Allergen program
  • Date marking and cooling procedures
  • Cleaning and sanitation schedule
  • Employee health policy
  • Corrective action plan
  • Multi-location standard operating manual
  • Training materials and records
  • Inspection readiness checklist
  • Vendor approval program
  • Internal audit program

Questions

Retail compliance, answered plainly

Does the FDA inspect our grocery store?

Generally, no. Retail food establishments — grocery stores, supermarkets, convenience stores, delis and restaurants — are regulated and inspected by state and local health departments. FDA's role is to publish the Food Code as a model and to support the jurisdictions that adopt it. FDA does regulate food manufacturing directly, so a store that also manufactures, processes, packs or holds food for distribution beyond its own retail customers can fall within federal scope. That is worth assessing for your specific operation rather than assuming either way.

Can SURU guarantee that we pass our next health inspection?

No, and you should be wary of anyone who says otherwise. Inspection results are determinations made by a regulatory authority on the day, against its own adopted code and its own inspector's judgement. What we can do is assess your operation against that same code before the inspector arrives, close the gaps at root cause, document the corrections, and rehearse the walkthrough so nothing about the visit is a surprise. That changes what an inspector finds. It does not change who decides.

Which edition of the Food Code applies to us?

Whichever edition your state or local regulatory authority has adopted, together with any amendments it made when adopting it. Adoption is not automatic and it is not uniform: jurisdictions run on different editions, some lag by several revision cycles, and local amendments can be stricter than the model text. For a multi-state operator this is the first thing we document, because it determines what a finding in one market means in another.

Do we need a variance and a HACCP plan for sushi rice?

It depends on your jurisdiction and on how you intend to hold the rice. Acidifying sushi rice so it can be held without time or temperature control is treated as a specialized process in most jurisdictions, which generally means a written HACCP plan and often a variance from the regulatory authority before the process may run. Some jurisdictions handle it differently, and some will not grant a variance for a given process at all. We confirm the requirement with your authority in writing before you build anything, and we prepare the plan and the request — but the decision is theirs alone.

Do we need a Certified Food Protection Manager on site?

Most jurisdictions require a person in charge who can demonstrate food safety knowledge, and that is commonly satisfied by an accredited Certified Food Protection Manager credential. The details vary considerably: how many certificate holders a site needs, which accredited programs are accepted, how quickly a new operator has to comply, and whether credentialed coverage is required at every hour the establishment operates. For convenience and extended-hours formats, that last point is usually the hard one, and it is a staffing model question as much as a training one.

At what point does our prepared foods operation stop being retail?

The line is generally about who you are selling to. A retail food establishment sells food directly to consumers, and restaurants and retail establishments are generally excluded from FDA food facility registration. Once a department or commissary is manufacturing, processing, packing or holding food for distribution beyond its own retail customers — supplying other stores, wholesaling, or packaging for another business — federal requirements including registration and preventive controls may come into scope. We assess where your specific model sits and give you that assessment in writing, because it changes the whole shape of the program you need.

Start right

Tell us about the store, the department or the date.

A re-inspection on the calendar, a sushi case on order, a prepared foods department that outgrew its procedures, or a chain where no two stores work the same way. Tell us which one it is and we will tell you what applies, what does not, and what it takes to be ready.

Talk to a Compliance ExpertExplore training

Direct contact

SURU Compliance is a regulatory consulting practice. We are not a government agency, a certification body, or a law firm, and we do not provide legal advice or guarantee regulatory outcomes.