There is a specific moment in an audit that catches businesses out. The auditor has already seen the contract and flipped through the service reports, and then asks for your pest control policy — and the room goes quiet, because everyone assumed the contractor’s paperwork was the policy. It isn’t. The contract describes what your supplier has agreed to do; the policy describes what your business does about pests, and it keeps applying between visits, on the days nobody is on site, and after you change contractor. This guide covers the nine sections a policy needs, what to actually write in each, the mistakes that get them failed, and how to keep the thing alive once it exists.

Policy or contract — what’s the difference?

The clearest way to hold them apart is to ask who each document commits.

The contract commits your contractor. Frequency, areas covered, response times, reporting, what a visit includes. We went through those clauses in detail in what to put in a commercial pest control contract.

The policy commits you. It tells your own staff what to do, and it covers the ninety-something percent of the year when no technician is in the building. Nobody outside your business can write that for you, because nobody outside your business can make your night shift report a sighting.

The practical test: if you sacked your contractor tomorrow, the contract would be void and the policy would still stand. That is why an auditor treats the policy as the more revealing of the two.

The sentence to keep in mind while drafting. A monthly visit is twelve days a year. Your policy governs the other three hundred and fifty-three.

Do you actually need one?

Sometimes genuinely not, and it is worth checking before you spend a morning on it.

You need a written policy if any of these apply: you hold a food premises licence, you are working toward or hold MeSTI, GMP, HACCP or halal certification, you supply a customer who audits you, or you operate a premises where a tenant, insurer or franchisor asks for documented procedures. In those cases pest management is a prerequisite programme and a written procedure is expected rather than optional.

You probably do not need one if you run a small office or retail unit with no food handling, no certification, no auditing customer and no licence condition attached. A single page naming who calls the contractor and what staff should report will do everything a full policy would.

The trigger is being audited by somebody. It has nothing to do with headcount.

The nine sections, and what goes in each

Two pages is the target. A policy nobody reads because it runs to fourteen pages fails in a different way from one that is too short.

Section 4 is the one worth spending real time on, because it is the only part that changes behaviour. Write it as rules a supervisor can enforce on a Tuesday: “all waste to the bin bay before close”, “no cartons stored overnight in the unit”, “external doors closed when not in active use”, “dry goods stored 150mm off the floor and clear of walls”. Not “maintain high standards of cleanliness”, which commits nobody to anything.

Who should be named as responsible?

A role, never a person. “Outlet Manager”, “Warehouse Supervisor”, “Facilities Executive”.

Naming an individual means the policy expires the day they resign, and in Malaysian F&B and logistics that can be a matter of months. It is the most common single reason a policy is out of date at audit — the document names someone who left in 2024, which tells the auditor rather more than it was meant to.

Keep the current holder’s name and number on a separate contact sheet pinned next to the file. That page can be reprinted in thirty seconds; the policy stays untouched.

Give the responsible role four specific duties: escort and brief the technician on each visit, file the service report before the technician leaves, close out corrective actions and record the closure, and raise anything unresolved to management. Vague accountability is the same as none.

What should staff have to report?

Be explicit, because “report anything unusual” produces nothing. The list:

• Any live or dead pest, anywhere, including insects on a window sill
• Droppings, smear marks or urine staining
• Gnaw damage to packaging, cable or building fabric
• A damaged door seal, sweep, screen or strip curtain
• Standing water or a blocked drain
• Any new hole or gap in the fabric — including one made deliberately for a new cable or pipe

Then say how and how fast. In writing, in a sighting log kept at a named location, within the same shift. A route that relies on someone remembering to mention it to the manager in passing is not a route, and it produces exactly the situation where three people had seen something for a month and nobody had written it down.

One line worth adding: reporting a sighting is never treated as blame. Say it in the policy. Kitchens and warehouses under-report because staff think a sighting reflects on their cleaning, and an under-reported problem is a bigger problem later.

“Its good to hear after all their inspection around the house and outside that they found my house to be at the top for being clean and hygienic.”

— Chef Wan (customer testimonial). A home, not a business, but it makes the point the reporting section depends on: an inspection record is evidence of how well a place is run, not an accusation. Staff who understand that report things early.

How do you write the corrective action section?

As a fixed sequence, so it cannot be improvised on the day:

1. Contain. Isolate affected product or the affected area. Where food is involved, product decisions sit with the responsible role, not the technician.
2. Record. Date, location, what was found, how many, a photograph.
3. Treat. By the contractor, within the rules for that area.
4. Investigate the cause. Not what was seen — why it was there.
5. Close the gap. The physical or procedural fix, with an owner and a date.
6. Verify. Confirm at the next visit that it has not recurred, and record that check.

Step 4 is the one auditors actually read. A corrective action log where every entry says “treated area” is a treatment record wearing a corrective action heading, and it will be graded as one. The equivalent detail for food manufacturers, including thresholds and trend analysis, is in our guide to managing pest risk in a food processing facility.

Which records, and for how long?

Name them in the policy, say where they live, and state a retention period:

• Dated service reports for every visit
• The current contract and the treatment schedule
• The numbered device map or site plan
• Trend data, where the site keeps monitoring counts
• The sighting log and the corrective action log
• Product information, with Safety Data Sheets available on request
• Staff training records

Two to three years is a sensible retention default and covers most licence renewal and audit cycles. Keep it all in one physical file at the premises. A folder in someone’s email is not a record system — that person will be on leave the week the officer arrives.

A central kitchen in Puchong asked us to help after a customer audit marked their pest programme down twice in a row. The service itself was fine — monthly, properly done, reports issued every time. What they had no version of was a policy: no sighting log, no named role, no corrective action sequence, and a folder of reports with no evidence anyone had ever acted on the recommendations in them. We gave them the device map and frequency justification for the technical sections, and their operations manager wrote the rest in an afternoon on two pages. Same contractor, same visits, same price. The next audit passed. Nothing about the pest control had changed — the business had simply started describing what it already did.

— Job notes, Nomobug field team

Why do policies fail an audit?

Rarely because they are missing. Usually because of one of these:

• It names a person who has left. The classic.
• It is undated and unversioned, so nobody can tell whether it reflects the current operation.
• It describes a frequency that does not match the reports. Policy says monthly, file holds seven visits.
• It was written by the contractor and reads like a service brochure, committing your staff to nothing.
• No sighting log exists, so the reporting section describes a process that has never once been used.
• Corrective actions have no closure dates. Open items from last year are worse than no log at all.
• Training is claimed but not recorded. If there is no signed list, it did not happen.
• It covers areas the contract does not. Or the reverse — the two documents should agree with each other.

Every one of those is fixable in an afternoon, which is the encouraging part. None of them require spending more on pest control.

How do you keep it alive?

Four habits, none of them onerous:

• File the service report before the technician leaves. Not later. Later is how a file ends up with four reports in it.
• Check the corrective action log monthly for anything still open. Five minutes.
• Brief new and temporary staff on two rules — what to report and where the log is. Everything else can wait; those two cannot, and this is exactly what collapses during a seasonal peak.
• Review annually, and immediately after a change of contractor, a change of premises or layout, a significant infestation, or a failed inspection. Bump the version number and the date even if nothing changed, because that itself is evidence somebody looked.

What does the service behind it cost?

The policy is free to write. What it references is not, so for completeness:

For reference, Nomobug’s commercial pricing sits consistently around 10% below that typical market range — Annual Total Protection at RM2,090 a year for a premises below 2,000 sq ft, 15 visits (12 monthly plus 3 free), roughly RM139 a visit, with the numbered device map, treatment schedule and dated reports your policy needs to point at. A single visit is RM290 and the 3-visit intensive is RM490. Fuller detail sits in our commercial pest control price guide.

One thing worth asking any contractor before you draft: will they supply the device map, the frequency justification and the product information as documents you can reference by name? Those are the three technical inputs a policy needs, and a contractor who cannot produce them is going to leave holes in sections 3, 6 and 7 that you will have to fill with vague language.