Mystery Shopping for Restaurants: How to Run It Well

Owners and managers see their restaurant on their best behaviour. Staff know when the boss is in, and the service changes. Restaurant mystery shopping is a way to see an ordinary shift through a guest’s eyes: an anonymous diner books or walks in, eats, pays, and then scores the visit against a list of standards you have set.

This guide explains when it helps, how to design the scorecard, whether to do it yourself or use an agency, and how to handle the results so they improve service rather than damage trust. It is general information, not legal advice. For PDPA questions, read PDPC’s guidance or speak to an adviser.

What mystery shopping is, and what it is not

A mystery shopper is a paid or reimbursed guest who follows a brief. They behave like a normal customer, notice specific things, and fill in a scorecard straight after the visit. The value comes from consistency: the same questions, asked across many visits, show patterns that one complaint or one review cannot.

It is not a replacement for your own management. It does not tell you why something happened, only that it did. It is also not the same as online reviews. Reviews tell you what guests chose to comment on; a mystery shop tells you whether your standards were met. To check the back of house too, pair it with a monthly internal audit. Our guides to collecting customer feedback and handling negative reviews cover those channels.

When mystery shopping helps

• After training. You have rolled out new steps of service or a new upselling script and want to know if it sticks.
• Multiple outlets. An owner cannot be in five places. Mystery shopping gives each outlet the same test.
• Falling sales or repeat visits. Your reports show fewer covers or lower spend per head, and you want to know whether service is a cause.
• Before and after a change. A new manager, a new menu or a switch to QR ordering. Shop before and after to see what changed.
• Specific concerns. Complaints about waiting times, unclean toilets or bills that do not match. A targeted visit can check.

It helps less if you have no written standards yet. Write the standards and train them first; our SOP template and staff training checklist are good starting points. Otherwise you are scoring staff against rules nobody told them.

Designing the scorecard

A good scorecard is short enough to fill in accurately from memory and specific enough that two shoppers would score the same visit the same way. Follow the guest journey and group questions into sections.

• Arrival and seating. Greeted within a set time, table offered, menu explained.
• Ordering and service. Taken within your target time, specials mentioned, allergy question asked, order repeated back. Use your steps of service as the list.
• Food and drink. Temperature, presentation matching the standard, portion, time from order to food. Keep taste questions simple and pair them with observable ones.
• Cleanliness. Table, cutlery, floor, toilets and the visible parts of the kitchen. Our cleaning schedule guide lists what should be done and when, and the SFA inspection guide covers what inspectors look for.
• Payment and cash handling. Bill presented promptly and itemised correctly, service charge and GST shown as stated, correct change, receipt given. Our guide to cash control and theft prevention explains why receipts matter.
• Farewell. Thanked, invited back.

Write each question so the answer is observable. “Was the guest greeted within one minute of entering?” is better than “Was the greeting friendly?” Add a small number of rating questions and a comments box for things the scorecard missed.

Sample scorecard

The questions and weights below are an example to adapt, not an industry standard.

Section	Example question	Answer type	Example weight
Arrival	Greeted within one minute of entering?	Yes / No	10%
Arrival	Seated or given a queue time within three minutes?	Yes / No	5%
Ordering	Asked about allergies or dietary needs?	Yes / No	10%
Ordering	Order repeated back or confirmed?	Yes / No	5%
Ordering	A drink, side or dessert suggested?	Yes / No	5%
Food	Mains arrived within your target time? (record time)	Yes / No + time	10%
Food	Hot dishes hot, cold dishes cold?	Yes / No	10%
Food	Dish matched menu description and photo?	Yes / No	5%
Cleanliness	Table, cutlery and glassware clean?	Yes / No	10%
Cleanliness	Toilet clean and stocked?	Yes / No	5%
Payment	Bill itemised correctly with charges as stated on the menu?	Yes / No	10%
Payment	Receipt given and change correct?	Yes / No	10%
Farewell	Thanked and invited back?	Yes / No	5%

Weight the questions that matter most to your guests and your risks. A missed allergy question is more serious than a missed dessert suggestion. Our allergen guide explains why.

DIY or agency

You can run mystery shopping yourself or pay a specialist agency. Both work; the choice comes down to scale, independence and time.

	DIY	Agency
Shoppers	Friends of friends, regulars you trust, or staff from another outlet who are not known at the one being shopped	A panel of trained shoppers matched to your guest profile
Cost	Meal reimbursement and a small fee or voucher	Agency fee per visit plus the meal. Get written quotes
Independence	Risk that shoppers are recognised or biased	More independent and consistent
Reporting	Spreadsheet or form you build	Usually an online report and trend analysis
Best for	One or two outlets, occasional checks	Chains, regular programmes, franchise audits

If you use an agency, ask how they recruit and train shoppers, how they check that visits really happened, how they store staff names, photos and recordings, and who owns the data. Put those answers in the contract.

Briefing shoppers and reimbursing meals

A shopper can only score what they were told to look for. Give each one a written brief:

• Visit details. Outlet, date window, meal period and party size. Spread visits across days and shifts so no one shift is always tested.
• Scenario. What to order, what to ask, and any test to run: ask about an allergen, request a substitution, pay by cash to check change.
• What to note. Times on arrival, order, food and bill, using a phone clock discreetly. Names from name badges only if you need them.
• What not to do. No confrontations, no recording guests at other tables, no posting about the visit online, no complaints staged purely to trap staff.
• Deadline. Complete the scorecard within a few hours while the visit is fresh.

Reimburse the meal against the original receipt and set a spending cap in the brief. The receipt is also your link to POS data. Record the reimbursement as a business expense and ask your accountant how to treat shopper fees and meal costs.

PDPA: staff photos, recordings and names

A mystery shop often collects personal data about staff: names from badges, descriptions, and sometimes photos or audio. PDPC’s PDPA overview describes personal data as data about an individual who can be identified from that data, or from that data and other information the organisation has or is likely to have access to. A photo of a named server clearly counts.

PDPC’s Advisory Guidelines on the PDPA for Selected Topics (revised 23 May 2024) explain the employment exceptions:

• Collecting, using and disclosing employee data that is reasonable for “entering into, managing or terminating” the employment relationship does not require consent, but employers are required to notify employees of the purposes. PDPC’s list of such purposes includes “conducting checks on conduct/discipline” and “performance management”.
• PDPC says the form of notice is not prescribed; employment contracts, employee handbooks or intranet notices are examples. A general notice is enough; you do not need to warn staff before each visit.
• A separate “evaluative purpose” exception covers data needed to decide on suitability for employment, promotion or continuance in employment.
• PDPC adds that even where an exception applies, organisations should still act as a reasonable person would consider appropriate.

In practice: tell staff in the handbook or employment contract that the business uses mystery shopping, CCTV and similar checks to manage service standards, and what happens to the results. PDPC’s guidance on CCTV in workplaces also says staff should be told the purpose of cameras, and our PDPA guide for F&B covers CCTV notices for guests. Limit who can see photos and recordings, keep them only as long as you need them, and do not post them anywhere. Our guide to CCTV and the PDPA sets out the rules for cameras. Tell shoppers not to film or photograph other guests. If an agency collects the data for you, set out in the contract how it is protected and deleted.

Sharing results fairly with staff

How you use the results decides whether mystery shopping improves service or just creates fear.

• Tell the team the programme exists. Surprise visits work; a surprise programme does not. Explain the scorecard so staff know what good looks like.
• Coach, don’t punish. Treat a low score as a training need first. One visit is a snapshot, not a verdict on a person.
• Praise in public, correct in private. Share good results at the team briefing. Discuss weak ones one to one, with the scorecard in front of you.
• Look for patterns. If every shift misses the allergy question, the problem is training or the process, not one server.
• Let staff respond. The shopper may have missed something: a kitchen delay, a short-staffed shift. Listen before you decide.
• Reward consistently. If you tie incentives to scores, set clear rules in advance and apply them the same way to everyone.

Our customer service tips and POS staff training guide have ideas for turning results into short, practical training.

Linking visits to POS data

The shopper’s receipt lets you find the same bill in your POS. That gives you a second, objective view of the visit: when the order was keyed, what was ordered, and how the bill was settled. Compare it with the scorecard:

• Timings. Does the shopper’s time from order to food match what the kitchen recorded? ChaChaCha’s kitchen display system includes prep timers, which help show whether a delay was in the kitchen or at the pass.
• Bill accuracy. Were items, service charge and GST correct, and did the receipt match the payment?
• Discounts and voids. A void or discount the shopper did not ask for is worth a question. Staff permissions in ChaChaCha let you limit who can apply them.
• Trends. Put mystery shop scores alongside POS reports on covers and spend per head to see whether better service shows up in the numbers.

Which check-level details you can see, such as the time each item was keyed or who applied a discount, varies by system. Ask us to confirm which fields ChaChaCha’s reports show for your setup, and get it in writing from each vendor, including us. Our restaurant KPIs guide explains which measures to track alongside mystery shop scores.

Turning results into an action plan

1. Collect enough visits. Wait for several visits per outlet before drawing conclusions.
2. Pick the top three gaps. Rank by guest impact and risk, with safety items such as allergies first.
3. Assign an owner and a deadline. For example, the floor manager retrains the allergy question at every briefing for two weeks.
4. Fix the process, not just the person. If toilets are often unclean, change the cleaning schedule and sign-off, not only the reminder.
5. Shop again. Test the same points in the next round to see whether the change held.
6. Share progress. Show the team how scores moved. It makes the next round feel like a goal rather than a trap.

Mystery shopping works best as one input among several: your own observation, guest feedback, online reviews and POS data. If you want to see how ChaChaCha’s reports, KDS timers and staff permissions could support your service checks, get in touch or read about our restaurant POS.