Why Are There So Many Certificates and Regulations in the Food Industry?

The short answer is federalism plus layering. Food safety standards are written once, nationally, by Food Standards Australia New Zealand — but FSANZ is a standard-setter, not an enforcer. Each state and territory then applies the Code through its own Food Act, its own regulator and, in most cases, its own local councils. One national standard therefore produces several quite different implementations, and a business operating across a border meets all of them.

Understanding the layers is what makes the mess navigable, because each layer answers a different question.

Where the line actually falls: the Code stops short of enforcement

This is the mechanism behind everything else on the page, and it is worth getting exactly right rather than in outline.

FSANZ develops the standards under the Food Standards Australia New Zealand Act 1991 (Cth). Those standards are then adopted by reference into each state and territory's food Act — which is why the legislation that picks them up is technically called the application Act. Standards 3.2.2 and 3.2.2A apply "in Australia only", and on their own they have no legal force. They acquire force only through the application Act of the place you are standing in.

That single design decision produces the whole pattern, and the regulatory guidance states the boundary in one sentence:

Enforcement, penalties, business classification and any state-issued certificate are matters for the application Act, not for the Code.

Read that list again, because it is the answer to "why so many certificates". Four of the things a business actually cares about — who enforces, what the fine is, which bucket you are in, and what document you must hold — are all deliberately left out of the national standard. The Code decides what a business must have. It leaves how entirely to the states, on purpose.

The clause that lets New South Wales issue its own certificate

There is a second, smaller piece of drafting that explains the single biggest divergence in Australian food safety, and almost nobody cites it.

Standard 3.2.2A defines a food safety supervisor certificate as certification by either:

• (a) a registered training organisation; or
• (b) an organisation recognised by the relevant authority under the application Act.

Limb (b) is an open door, written into the national standard, inviting any state that wants one to build its own certificate scheme on top of the national units. New South Wales is the only state that has walked through it. Victoria, Queensland and Western Australia all rely on limb (a) alone, which is precisely why the artefact in those states is an RTO's Statement of Attainment and in New South Wales it is a separate state document.

So the NSW scheme is not a departure from the national standard. It is the national standard being used as designed, by one state out of eight. That is the most useful single fact on this page: the divergence is not a failure of harmonisation, it is a feature of it.

The four layers, and what each one decides

A single question like "do I need a food safety certificate?" touches all four, which is why it never has a one-line answer.

One standard, four different implementations

Standard 3.2.2A requires category one and category two food businesses to have a certified Food Safety Supervisor and trained food handlers. What actually triggers that duty is decided by the state.

So the same cafe can be classified by a council in Victoria, by the food it serves in New South Wales, and by whether it holds a licence in Queensland. None of those tests is wrong. They are simply different instruments doing the same job.

The last row is the sharpest illustration of the boundary principle above. Four jurisdictions, applying one national standard, attach four different consequences to breaking it — and one of them, Victoria, attaches no fine at all. A Victorian operator who reasons "the worst case is a penalty" has misread their own Act: the exposure is to the registration the business trades on, which is a larger risk than a fine, not a smaller one.

The other consequences are not cosmetic either. Queensland is broader than the standard — a licensed business that would not be category one or two still needs a supervisor there. New South Wales issues its own document, so the nationally recognised Statement of Attainment is a prerequisite rather than the artefact, and a business keeping only the Statement of Attainment has not satisfied s 106G.

Note the wording of the interstate row above: it is about food safety certificates. Liquor is a separate scheme with a different answer in the same state, which is the point of the comparison later on this page.

The two categories, since almost everyone gets them backwards

Before the state layer even engages, Standard 3.2.2A sorts businesses into two categories, and the sorting is activity-based, not audience-based. This is the single most misread thing in Australian food regulation.

Category one is a caterer or food service operation that processes unpackaged potentially hazardous food into food that is both potentially hazardous and ready to eat. Restaurants, cafes, pubs, fast food, bakeries, hospitals, aged care, childcare, school canteens, family day care, mobile vendors, market stalls, and the supermarkets, delis and service stations that actually make food all sit here. The working rule: the legal test is whether the business performs that prescribed processing activity; having a kitchen or cooking is only a practical clue.

Category two is the retail sale of potentially hazardous ready-to-eat food the business did not make. Slicing, weighing, repacking, reheating and hot-holding do not count as making it. Delis, butchers, seafood retailers and convenience stores sit here.

The categories also decide which clauses you answer to. A category one business must comply with 3.2.2A–10 (handler training), –11 (the supervisor) and –12 (the records). A category two business complies with –10 and –11 only. That is the entire difference in obligation between the two, and it is one clause.

So the third management tool — the substantiation records, kept for three months and accessible at the premises — falls on category one alone, covering receipt at correct temperature (5 °C or below, or 60 °C or above), storage under temperature control, process steps achieving pathogen reduction, minimising time at growth-permitting temperatures, cooling and reheating within specified timeframes, display and transport under temperature control, and the cleaning and sanitising of food-contact surfaces and equipment.

So the common claim that "category two covers most of hospitality" is exactly inverted. Most hospitality venues are category one. Fundraising events raising funds solely for community or charitable causes are exempt, as are businesses that never handle unpackaged potentially hazardous ready-to-eat food. See how long do I need to keep records for.

Then the sector adds another dimension

The unit of competency that satisfies the requirement depends on what kind of food business it is.

A person moving from a supermarket deli to a restaurant kitchen has not necessarily brought the right units with them. That is not bureaucratic duplication; the hazards genuinely differ. And an organisation running both a cafe and an aged care kitchen in Victoria or Queensland needs two different supervisors, not one.

Note which states appear in that third row, because it is commonly stated wrongly. Standard 3.2.2A itself names no sector units at all. The health and community services units are a state-level determination, published by Safe Food Victoria and by Queensland Health. New South Wales names no sector-specific units in its published supervisor requirements, and neither does Western Australia — WA instead publishes HLTSS00061 (which is the same three HLTFSE units bundled as a skill set) as an equivalent alternative rather than a sector mandate, and does not confine health or childcare businesses to it.

Western Australia adds its own wrinkle by naming the skill set by code — it cites SITSS00069 directly, where the others describe the outcome. It also publishes a list of accepted equivalents including the superseded SITSS00051 (SITXFSA001 plus SITXFSA002), which is how older certificates continue to be accepted there.

Then the renewal rules diverge again

The five-year window is common ground: FSS certification must have been issued within the immediately preceding five years for category one and two businesses. How you renew is not common ground.

Victoria and Queensland take opposite positions on the same question. A group operating in both cannot run one model. See how long does a Food Safety Supervisor certificate last in Victoria.

The New South Wales recertification route also carries conditions the other states have no equivalent of, because it is a state scheme rather than a training product. A recertification course is only available to someone who already holds or held a NSW certificate; not every approved RTO offers one, so the Food Authority's list marks which do; and the course must be completed through an approved RTO that offers recertification. The NSW Food Authority says some approved RTOs offer that pathway. Past 90 days, the full course is the only route.

And the food handler layer works differently from all of it

Worth separating, because it is the one place the system is less demanding than people assume. For food handlers, Standard 3.2.2A requires training covering four topics — safe handling of food, food contamination, cleaning and sanitising of premises and equipment, personal hygiene — or skills and knowledge commensurate with the activity. It does not require a nationally recognised unit, mandates no refresher period, and does not require the business to keep records of it.

So one of the four layers barely applies at handler level. The accredited unit is worth having for portability and proof; it is not what makes you lawful. See the food handling course.

The layer that predates all of it, and never went away

One more layer, and it is the oldest. People reading about Standard 3.2.2A often conclude that food safety training became compulsory in December 2023. It did not. Clause 3 of Standard 3.2.2 has applied to every Australian food business since 2000: the business must ensure that persons undertaking or supervising food handling operations have skills in food safety and food hygiene matters, and knowledge of them, commensurate with their work activities.

That duty is outcome-based. It names no course, no certificate, no unit code and no refresher period — it simply requires the competence to be there. Its only carve-out is narrow: it does not apply to persons handling food for fundraising events at which the only food sold is food that is not potentially hazardous, or is to be consumed immediately after thorough cooking.

Standard 3.2.2A did not change clause 3. It added a prescriptive layer on top of it, for category one and two businesses only. Everyone else still answers to clause 3, and category one and two businesses answer to both.

That is worth holding onto, because it is the cleanest available answer to "why does this keep accumulating". Regulation here did not replace itself in 2023; it stacked. A twenty-six-year-old outcome duty, a 2023 prescriptive duty, eight state application Acts, a training-package layer and a council layer are all live at the same time, and none of them repealed the one before.

The fifth layer nobody counts: the rules about the training itself

Here is why the certificate sprawl is larger than the food law alone would explain. Behind each unit of competency sits a second regulatory system — the one governing the provider, not the business. Australian RTOs operate under the Outcome Standards for RTOs, and those standards generate their own documentation.

Who may teach and assess it. Outcome Standard 3.2 requires training and assessment to be delivered by credentialled people with current skills and knowledge in training and assessment. The Credential Policy that accompanies the Standards then specifies which credentials satisfy it. To deliver training and assessment without direction, including making assessment judgements, a trainer must hold one of: TAE40122 Certificate IV in Training and Assessment or its successor, TAE40116, TAE40110, a diploma or higher in adult education or VET, or a secondary teaching qualification plus one of TAESS00011, TAESS00019 or TAESS00024. Assessment-only work adds TAESS00001 to the acceptable list. A person with relevant credentials may deliver training and collect evidence under direction, but may not make assessment judgements. At least one person validating assessment must hold one of the qualifying credentials.

On top of the paper, the standards require industry currency: everyone delivering or assessing must hold competencies, skills and knowledge relevant to and current in the training product, demonstrate current industry practice, and maintain engagement with industry, with the RTO ensuring continuing professional development. That is why a food safety trainer is expected to have been in a kitchen, not only in a classroom.

How the assessment must be built. Four Principles of Assessment apply: fairness (accommodating needs, reasonable adjustment, reassessment where necessary), flexibility (appropriate to the context and the student, assessing skills regardless of how or where they were acquired), validity (including a practical application component — the skill demonstrated in a practical setting) and reliability (evidence interpreted consistently, outcomes comparable irrespective of assessor).

What the evidence must be. Four Rules of Evidence: validity, sufficiency, authenticity (the original and genuine work of that student) and currency (documenting and demonstrating current skills and knowledge).

Put those together and the answer to "why is there a certificate for everything" becomes clearer. The certificate is the output of a system that has already decided who may teach, what must be demonstrated, how the evidence is judged, and how often the judgement is re-validated. See the difference between a good and a bad course provider.

Certificate, card, licence, skill set, qualification — five different things

A great deal of the confusion in this area is vocabulary. These words are not interchangeable.

And a sixth identifier that is easy to mistake for a fifth: in New South Wales an approved RTO is issued a NSW Food Authority approval number, which is a different number from its national RTO code. The Food Authority publishes and revises the approved list at least annually. So verifying a NSW food safety course means checking two registers and two numbers, not one.

Two practical consequences.

A Statement of Attainment has a required form. It must carry the issuing organisation's name, registration code and logo, the full title and national code of each unit, the Nationally Recognised Training logo used per its conditions of use, an authorised signature, and a seal, corporate identifier or unique watermark. A "Certificate of Completion" or "Certificate of Achievement" with no unit code and no RTO number is not nationally recognised, however accurate its content. Certification must issue within 30 calendar days of the completion of assessment, provided the student completed the product and paid all agreed fees. In New South Wales the state certificate runs on its own, shorter clock: an approved RTO must issue the NSW FSS certificate within 10 working days of successful completion.

But a Statement of Attainment is not always the document the regulator wants. This is the sharpest illustration on the page of why there are so many certificates, and it runs in both directions. In New South Wales a food business must keep the state FSS certificate on the premises, not the Statement of Attainment. In Victoria, Liquor Control Victoria puts it the other way round for liquor: an employer must keep the RSA Certificate of Completion on site, and LCV states plainly that you do not need to give them the Statement of Attainment the course provider issues. Same national training product, two regulators, two different documents of record.

No certificate at all without a USI. Under section 53 of the Student Identifiers Act 2014 an RTO may not issue a qualification or Statement of Attainment without a verified Unique Student Identifier — and the identifier must not be printed on the document. If you studied after 2015 you already have one; recover it rather than creating a second, because a duplicate splits your training history across two transcripts.

What "nationally recognised" actually buys you

Given how much of this is state-specific, it is fair to ask what the national layer is for. Three things.

Portability of the unit — as a record of competency, not as a permission. The unit travels even where the state wrapper does not. A NSW competency card confers nothing outside NSW, but the underlying SITHFAB021 Statement of Attainment is recognised nationally as evidence that you were assessed as competent. What does not automatically travel is the authorisation to work. Liquor Control Victoria is explicit about the difference: a course from a provider it has not approved produces only "an RSA Statement of Attainment", and that document "does not allow you to supply alcohol in Victorian licensed venues or locations". Competency and permission are two different things, and only one of them is national.

Credit. A unit completed at any RTO can be credited into a qualification at another under Standard 1.7 credit transfer, on production of AQF certification documentation or an authenticated VET transcript, with no reassessment. That is distinct from Standard 1.6 recognition of prior learning, which is a genuine assessment of prior skills, learning and experience — the same judgement from different evidence, not a waiver. Both are raised at the pre-training review, required under Standard 2.2 of the Outcome Standards for RTOs. (The National Code 2018 has its own, different Standard 2.2 about overseas students' course entry, so name the instrument when you cite the number.) We verify evidence of equivalent prior completion, check the training-product requirements and any licensing or regulatory restrictions, and document the decision before granting credit. See ASQA’s credit-transfer guidance.

A single place to check a provider. An RTO may only deliver and issue what is on its current scope of registration, published on training.gov.au. That gives you a two-step check on any provider: is it a genuine RTO, and is the unit you are paying for actually on its current scope? A published fee for something an RTO cannot legally deliver is a serious red flag, and in the states that also run their own approved-provider registers, the regulator's list is a second and separate check.

One caution on that last point, because it is the same trap as "OLGR-approved" in liquor: a published list is not automatically an approval scheme. Western Australia publishes a table of RTOs offering food safety supervision training, including providers based in other states, but it is a convenience listing of self-notified providers, not an approval register. WA's actual test is a Statement of Attainment from any nationally registered RTO for the named units within the past five years, and WA Health directs readers to the national register to verify one. A provider absent from WA's table is not thereby disqualified, and a provider claiming to be "WA-approved" is describing something that does not exist. New South Wales is the opposite case: there, the register genuinely is an approval scheme, under s 106H. See beware of RSA training course scams and why nationally recognised certificates are so important in the food industry.

Why the codes themselves keep multiplying

One more source of proliferation, and it is internal to the VET system rather than to food law: codes change, and the old ones do not vanish.

One RTO's scope makes the scale visible. We hold 17 current qualifications, 81 current skill sets and 579 current units, every component at the extent "deliver and assess". Those skill sets span seven different training packages — hospitality (SITSS), business and cyber (BSBSS), community services (CHCSS), health and infection control (HLTSS), retail (SIRSS), creative arts (CUASS) and horticulture (AHCSS). The same register also records 1,085 superseded and 76 deleted components against that one provider. Every one of those superseded codes is still printed on somebody's certificate.

Two mechanisms follow from that, and both are worth knowing.

End dates. A qualification can pass its end date while the code lives on. On our own scope, SIR30216 Certificate III in Retail carried an end date of 28 June 2024 and is past it; the other sixteen run to 30 June 2032. The retail food safety unit SIRRFSA001 carries the same 28 June 2024 end date, which is a neat illustration of the point — the unit is still named in Safe Food Victoria's published competency table, and is still printed on certificates people hold, while no longer being something an RTO can enrol you in today. A code on a register is not the same as a course you can enrol in today.

Equivalence. When a qualification is replaced, the register records whether the new code is equivalent to the old one, and the answer is often no. Of sixteen currently available qualifications on our scope, five are equivalent to their predecessor — SIT20322, SIT20421, SIT30821, SIT40521 and BSB40520 — and eleven are not. One, CHC43015 Certificate IV in Ageing Support, maps to two predecessors, CHC40108 and CHC40212. "Not equivalent" is why a transition brings teach-out obligations and gap assessment rather than an automatic swap, and it is a large part of why two people doing the same job can hold differently-coded certificates that are genuinely not the same credential.

And the rules about how long it takes

A final layer, because people who ask "why so many rules" often mean "why can I not just do a two-hour course". The Australian Qualifications Framework sets an expected volume of learning independent of delivery mode: Certificate II 0.5 to 1 year; Certificate III 1 to 2 years; Certificate IV 0.5 to 2 years (the range reflects short specialist qualifications building on prior knowledge); Diploma 1 to 2 years. The volume must be sufficient for graduates to achieve the learning outcomes, and the regulator names "accelerating or shortening training without allowing students sufficient time for skill development and knowledge application" as a compliance risk in its own right.

The same is true of how training is advertised. Among the marketing risks the regulator names are false or misleading marketing of a course or qualification; marketing unrealistically short courses that compromise the integrity of the product; promoting easier paths through inadequate RPL; using images that do not depict the facilities actually used; failing to clearly distinguish nationally recognised training from non-accredited training; and failing to comply with Australian Consumer Law. That last one is the most useful test a buyer can apply: if a provider will not tell you plainly whether what you are buying is accredited, that is the answer.

The same pattern, worse, in liquor

If food safety looks fragmented, liquor licensing is the same structure with eight implementations instead of four. Responsible Service of Alcohol is one national unit, SITHFAB021, under eight separate regimes:

Current regulator guidance: NSW, VIC, SA, QLD, WA, NT, ACT, TAS.

An RSA Statement of Attainment is a national training record, but permission to serve alcohol depends on the destination’s rules. NSW permits eligible temporary interstate workers; permanent movers and security or RSA marshal roles must meet NSW training and competency-card requirements, using bridging where eligible. Victoria offers bridging to eligible interstate holders. SA applies approved-provider rules to training from 1 November 2020, with earlier training not required to be repeated solely for that change. QLD and WA require suitable national RSA evidence. Tasmania distinguishes staff from licence holders; the ACT and NT have local currency and refresher requirements. Check the regulator before your first shift. See RSA recognition by jurisdiction, NSW’s rules and SA’s rules.

Five further details show how far the divergence goes.

Victoria has a second stage. The accredited unit produces a Statement of Attainment, but the RSA certificate itself only exists after the LCV Learning Hub pre-training survey, a module on recognising, preventing and responding to sexual harassment and assault, and a post-training survey.

That module is in the refresher too, not only in initial certification. LCV's position is that RSA training, including the RSA Refresher course, includes it. So the three-yearly refresher is a content obligation rather than a formality — and, as the table notes, it falls on every certificate holder rather than on licensees alone. Licensees carry a separate obligation of their own under the Liquor Control Reform Act 1998 s 108AA, and the two should not be conflated.

Victoria also approves providers by delivery mode, on two separate lists. LCV publishes an in-person provider list — those providers may deliver in person or online using a live meeting platform — and a separate online provider list for self-paced delivery. A provider approved for one is not thereby approved for the other, so "LCV-approved" is an incomplete answer until you know which list, and for which mode you intend to study.

Tasmania requires practical assessment of RSA skills for licence holders, plus Tasmanian-specific content, which no other jurisdiction does.

Queensland and Western Australia operate no approved-provider register for RSA at all, which means a claim that any provider is "OLGR-approved" or "DLGSC-approved" describes a scheme that does not exist.

One more contrast worth drawing, because it is the cleanest illustration of the whole page: in Victoria an under-18 may complete RSA training but must be 18 to serve alcohol. The training layer and the authorisation layer have different age rules for the same person. See RSA in Australia for the full matrix, and how much does an RSA course cost for where the hidden costs of all this sit.

Why it is not simply reducible

Regulations accumulate because each one answers a real failure. Allergen management, egg handling, cleaning and sanitising, temperature control — each has a history, and in some cases a specific outbreak behind it. New South Wales naming allergen management, cleaning and sanitising, safe egg handling and Food Act offences as its four mandatory key focus areas is not arbitrary; it reflects what went wrong in that state.

The multiplicity is the cost of a federal system that lets states respond to their own experience, layered over a national standard that keeps the baseline consistent. The alternative — one uniform national scheme — would mean states could not tighten rules after an incident without a national agreement first.

What this means practically is that the question is never am I food safety trained. It is which state, which sector, which class, and when was it issued.

How to navigate it without reading four Acts

1. Which state do you operate in? That fixes the application Act, the regulator and whether a state certificate exists.
2. What is your trigger in that state — premises class, the food, or a licence?
3. Which category are you under Standard 3.2.2A? Processing unpackaged potentially hazardous food into ready-to-eat food makes you category one, which adds clause 3.2.2A–12 and the records.
4. Which sector are you in? Health and community services has its own published units in Victoria and Queensland.
5. Handler or supervisor for each person? Only the supervisor level requires an accredited certificate.
6. When was the certificate issued, and does your state accept RPL to renew it?
7. Is the unit on the provider's current scope on training.gov.au, and is the provider on the state register where one exists — and for the right delivery mode, where the register distinguishes them? Check first whether that list is an approval scheme at all: NSW's is, WA's is not.
8. Which document must you hold on site, the Statement of Attainment or a state certificate? The answer differs by state and by scheme.
9. And remember clause 3 applies regardless. Even if none of the above catches you, the 2000 skills-and-knowledge duty does.
10. If you cross a border, re-run steps 1 to 9. Do not assume anything carries over except the underlying unit as a record of competency.

About us

We are Complete Hospitality Training, RTO 3722, CRICOS 04242E. Level 3, 28 Elizabeth Street, Melbourne VIC 3000, and 410 Elizabeth Street, Surry Hills NSW 2010. Contact melbourne@cht.edu.au or +61 3 9654 1554.

Our own record is a compact illustration of the layering described above: legal name Complete Hospitality Training (Vic) Pty Ltd, ABN 27 006 947 262, holder of RTO code 3722 since 1 June 1994, registered by the Victorian regulator until it transferred to the national regulator ASQA on 8 September 2017, with a current registration period running 1 July 2025 to 30 June 2032. Six trading names sit on the record, five current; the sixth, Complete Healthcare Training, ran from 24 October 2023 to 19 April 2025, so a certificate in that name is still an RTO 3722 credential. On the state-register layer: we appear on Liquor Control Victoria's approved RSA provider list, on the in-person list only, and are not on LCV's separate online provider list; and we are not on the NSW Food Authority's approved provider list, so we cannot issue the NSW Food Safety Supervisor certificate. On the sector layer, HLTFSE001 is on our scope but HLTFSE005 and HLTFSE007 are not, so we do not deliver the complete health and community services set that Victoria and Queensland publish for that sector. All three are good examples of why the provider question, the state question, the sector question and the delivery-mode question are four separate questions.

See also Standard 3.2.2A explained, what food safety certificate do I need, the benefits of food safety training, Food Safety Supervisor, RSA in Australia and all courses.

We link to the relevant course and regulatory sources in this guide. Check those sources for current requirements, and confirm course availability, delivery, fees and entry requirements with us before enrolling.

Source records and further guidance

We link the unit records and regulator guidance relevant to this page below. Check the current source before making an enrolment, licensing or employment decision.

• SITSS00069 Food Safety Supervision Skill Set
• SITXFSA005 Use hygienic practices for food safety
• HLTFSE001 Follow basic food safety practices
• SITHFAB021 Provide responsible service of alcohol
• BSB40520 Certificate IV in Leadership and Management
• Responsible Service of Alcohol training requirements (Victoria)
• Responsible Service of Alcohol training requirements (Queensland)
• Responsible Service of Alcohol training requirements (Western Australia)
• Responsible Service of Alcohol training requirements (South Australia)
• Responsible Service of Alcohol training requirements (Tasmania)
• Responsible Service of Alcohol training requirements (Northern Territory)
• Responsible Service of Alcohol training requirements (Australian Capital Territory)
• Food Safety Supervisor certificate requirements (New South Wales)
• Food Standards Code — Standards 3.2.2 and 3.2.2A (food safety practices and food safety management tools)
• National Code of Practice for Providers of Education and Training to Overseas Students 2018 — Standards 1 to 11
• Outcome Standards for Registered Training Organisations 2025 (full text)
• Unique Student Identifier (USI) requirements for RTOs