Food Protection Manager Study Guide 2026

The food protection manager certificate

The FDA Food Code is a model set of food safety rules for restaurants, stores and other retail food businesses. FDA published the newest edition, the 2026 Food Code, in September 2026. Many places still use the 2022 edition or an older one, because each state, county or city adopts the code on its own schedule and can change it.

In the FDA model code, section 2-102.12 says the person in charge must be a certified food protection manager (CFPM). That person shows what they know by passing a test that is part of an accredited program. Many states use older wording that requires at least one employee with supervisory and management responsibility, and the authority to direct food preparation and service, to be certified. The 2026 summary of changes lists no change to 2-102.12.

• The regulatory authority may exempt establishments that pose a minimal risk, based on the type of operation and how much food is prepared.
• Your state or local health department decides whether the rule applies to you, which businesses are exempt and which exams it accepts.
• Some places add their own rules, such as how soon a business must replace a certified manager who leaves.

How the exam system works

Exams come from certification organizations that are accredited by the ANSI National Accreditation Board (ANAB) under the Conference for Food Protection (CFP) standard. ANAB checks the organizations. It does not give exams or certificates itself.

The person in charge: knowledge and duties

A person in charge (PIC) must be present during all hours of operation. Under section 2-102.11, the PIC must show the inspector that they know how to prevent foodborne illness. There are three ways to do this:

1. Have no priority violations during the current inspection.
2. Be a certified food protection manager.
3. Correctly answer the inspector's questions about the operation.

Knowledge areas

The knowledge list includes personal hygiene, the duty to stop sick workers from spreading illness, symptoms of foodborne disease, cooking, holding, cooling and reheating temperatures, cross-contamination, major food allergens and their symptoms, cleaning and sanitizing, water supply and backflow protection, safe use of toxic chemicals, critical control points, following a HACCP plan, and the reporting, exclusion and restriction rules. The 2026 edition added food defense.

Daily duties

• Keep people who are not needed out of food preparation, storage and dishwashing areas.
• Make sure delivery, maintenance and pest control workers follow the code when they enter food areas.
• Check that employees wash their hands and that deliveries come from approved sources at the right temperature, including deliveries made after hours.
• Oversee daily temperature checks for cooking, cooling and holding, using calibrated thermometers.
• Make sure customers get a consumer advisory for raw or undercooked animal foods and use clean plates when they return to a buffet.
• Make sure staff avoid bare-hand contact with ready-to-eat food unless the regulator approved another method.
• Train staff in food safety, including food allergy awareness, for their duties.
• Tell food and conditional employees in a verifiable way, such as a signed agreement, that they must report certain illnesses.
• Keep written procedures up to date, such as the vomit and diarrhea clean-up plan. The 2026 edition also adds food defense training for employees.

Risk factors and active managerial control

CDC identified five risk factors that cause most foodborne illness in restaurants and stores. A manager's food safety system should target them.

Active managerial control means management builds specific actions into daily work to control these risk factors. It is preventive: you set up procedures, train staff, monitor and correct problems before an inspector or a sick customer finds them. FDA says the operator holds final responsibility for the system.

Prerequisite programs support the system. Examples are supplier (vendor) certification, staff training, allergen management, buyer specifications, recipe instructions, first-in, first-out (FIFO) stock rotation, pest control and safe chemical storage.

HACCP and the process approach

HACCP stands for Hazard Analysis and Critical Control Point. It is a system for finding and controlling hazards at the steps where they matter most. There are seven principles, in this order:

1. Conduct a hazard analysis. Find the hazards likely to occur and how to control them.
2. Identify critical control points (CCPs). A CCP is a step where control is essential to prevent, remove or reduce a hazard to a safe level.
3. Set critical limits. These are measurable limits, such as cooking pork chops to 145°F for 15 seconds.
4. Monitor. Measure or observe each CCP, for example by taking and recording temperatures.
5. Take corrective actions. Decide in advance what to do when a limit is missed, such as cooking longer or rejecting a delivery.
6. Verify. Check that the system works, for example by reviewing logs and calibrating thermometers. Ideally someone other than the person who did the monitoring does this.
7. Keep records. Logs, invoices and shellfish tags show the system is working.

The three food preparation processes

FDA groups menu items by how many times they pass through the danger zone of 41°F to 135°F.

Some activities need a HACCP plan by law. Examples include making juice on site for a highly susceptible population and serving certain raw or undercooked foods under a variance from the regulatory authority.

Cooking, cooling and reheating

Managers must know the Food Code times and temperatures well enough to check staff and correct problems.

• A whole-muscle, intact beef steak may be served undercooked only outside highly susceptible settings, if it is labeled as intact and its surface reaches 145°F with a color change.
• An undercooked ground meat item, such as a rare burger, must not be offered from a children's menu.
• Microwave reheating: reach 165°F, stir or rotate, then let the food stand covered for 2 minutes.
• Fish served raw must be frozen to kill parasites: -4°F for 7 days, or -31°F until solid and then -31°F for 15 hours or -4°F for 24 hours. Some tuna species, molluscan shellfish and certain farm-raised fish are exempt.

Cooling

Cooked food must cool from 135°F to 70°F within 2 hours, and to 41°F or lower within 6 hours in total. Food made from room-temperature ingredients, such as canned tuna, must reach 41°F within 4 hours. TCS food that the law allows to arrive above 41°F, such as milk, must also be cooled to 41°F within 4 hours.

Holding, time control and date marking

Hold cold TCS food at 41°F or colder and hot TCS food at 135°F or hotter.

Time as a public health control

• You need written procedures prepared in advance, kept on site and given to the regulator on request.
• Food must start at 41°F or colder, or 135°F or hotter, and be marked with a time 4 hours after it leaves temperature control.
• Within 4 hours, cook and serve it, serve it if ready to eat, or discard it. Unmarked or expired food is discarded.
• Facilities serving a highly susceptible population may not use time control for raw eggs.

Date marking

• Ready-to-eat TCS food kept more than 24 hours must be date marked.
• It may be kept for up to 7 days at 41°F or colder. The day of preparation, or the day a commercial package is opened, is day 1.
• A mixed food keeps the date of its earliest-prepared ingredient.
• Your date cannot go past a manufacturer's food-safety use-by date.
• Some opened commercial products are exempt, such as hard cheeses like parmesan, cultured dairy such as yogurt, and shelf-stable cured meats.

Receiving

Cold TCS food arrives at 41°F or below, hot TCS food at 135°F or above, and frozen food frozen. Reject food that shows signs of temperature abuse, and reject raw shellfish that arrives without its tags.

Employee health and the Big Six

Food employees must report certain symptoms, diagnoses and exposures to the person in charge. Symptoms to report are vomiting, diarrhea, jaundice, sore throat with fever, and infected cuts or boils on the hands, wrists or arms.

The Big Six pathogens are norovirus, hepatitis A, Salmonella Typhi, nontyphoidal Salmonella, Shigella and Shiga toxin-producing E. coli. They spread easily because a few germs can cause illness and infected people shed large numbers. A diagnosis of typhoid fever within the past 3 months must be reported unless it was treated with antibiotics.

A conditional employee is a job applicant who has been offered a job. If they report a listed symptom or illness, they cannot start as a food employee until they meet the return criteria. The 2026 Food Code calls for a written employee illness policy and clean-up procedures for vomiting and diarrheal events.

Vulnerable customers, consumer advisories and allergens

A highly susceptible population includes people in nursing homes, hospitals, child and adult day care and similar care facilities. Extra rules apply there:

• No raw or partly cooked animal foods, such as raw oysters, rare meat or soft-cooked eggs made from raw eggs, and no raw seed sprouts.
• Use pasteurized eggs in foods like hollandaise, Caesar dressing, mayonnaise and meringue.
• Juice made on site needs a HACCP plan. Packaged juice that carries the warning label for untreated juice cannot be served.

Consumer advisory

When animal foods such as beef, eggs, fish, lamb, pork, poultry or shellfish are served raw or undercooked, the menu needs a disclosure (a description, or an asterisk linked to a footnote) and a reminder about the risk of eating them.

Allergens

There are nine major food allergens in the United States. Sesame became the ninth on January 1, 2023. Managers must know the allergens and the symptoms of a reaction, and must make sure staff get allergy awareness training for their jobs.

Sanitizing, pests and food defense

Test sanitizer strength with a test kit and follow the product label. The 2026 Food Code also added a new part on disinfecting equipment and utensils, and test kits for checking disinfectant strength.

Pest control is a prerequisite program. Keep pests out, and make sure pest control workers follow the code in food areas. Food defense means protecting food from deliberate contamination, such as limiting who can enter food areas.