Hazard analysis and risk scoring

Step 6 is where a plan succeeds or fails. It has two stages: identify the potential hazards, then evaluate them to decide which are significant.

Start by listing all potential hazards at each step, including all inputs into that step. Use evidence. Codex points to surveys, sampling and testing, recalls, scientific literature and epidemiological data. Add your own complaints, supplier information and FSA and FSS food alerts.

Be specific. Codex says hazards should be specific, and the source or reason should be described, as in 'metal fragments from broken blades after chopping'. Specific statements matter because controls differ. Pathogenic spore-formers and other bacteria are both biological hazards, but cooking that kills one may not kill the other.

Then evaluate. Codex lists what should be considered wherever possible. These include hazards associated with the type of food, its ingredients and process steps; the likelihood of occurrence, taking prerequisites into account, in the absence of additional control; the likelihood and severity of adverse health effects in the absence of control; acceptable levels; the nature of the facility and equipment; survival or multiplication of pathogens; production or persistence of toxins, chemicals or physical agents; the intended use and the probability of mishandling by consumers; and the conditions leading to any of these.

Pay attention to the phrase 'in the absence of additional control'. Prerequisites count when you judge likelihood, because they are in place. The control you are assessing does not. Do not score Salmonella in raw mince as unlikely because you cook the mince. That is circular reasoning. Ask how likely the hazard is if that control were not there.

Many teams use a risk matrix. Codex does not require one, although it notes that businesses may use risk assessments and matrices from competent authorities or international experts. A common form scores likelihood from 1 to 5 and severity from 1 to 5, then multiplies them.

Write down what each score means, so that different people score alike. For severity, 1 might be no illness, 3 illness that needs medical care, and 5 death or lasting harm. For likelihood, 1 might mean not expected even without this control, and 5 might mean expected regularly without it. The team then sets a threshold. For example, a score of 12 or more might be treated as significant.

Here are some scores for the pies. Salmonella surviving in the mince without a cook step: likelihood 4, severity 4, score 16, significant. Undeclared milk because of a wrong label: likelihood 3, severity 5, score 15, significant. Clostridium perfringens growing because of slow cooling: likelihood 4, severity 3, score 12, significant. Glass from a light fitting, where lights are covered and a glass policy applies: likelihood 1, severity 3, score 3, not significant.

A matrix is a tool, not an answer. It has real limits. The numbers are judgements, not measurements. Multiplying treats a rare but fatal hazard as equal to a common but trivial one, because 1 × 5 and 5 × 1 both make 5. Scores can also be bent to reach a result the team wants, such as fewer CCPs.

So treat high severity with care. Many teams add a rule that any hazard with the top severity score must be considered further, whatever its total. A low total on a severe hazard is a reason to ask more questions. It is not a reason to delete the hazard, and it does not automatically make it a CCP either. Check whether prerequisites control it, and record your reasoning.

Record the analysis in a worksheet, as in Annex III of the Codex text. Show the step, the hazard and its cause, the likelihood, the severity, whether it is significant, the control measures, and the reasons. Codex lists the scientific support for hazards included in or excluded from the plan as an example of documentation. A hazard you left out needs reasons just as much as one you kept in.

Codex also accepts that a simplified hazard analysis may be acceptable in some cases. This identifies groups of hazards, such as biological, physical and chemical, and controls their sources, without analysing each specific hazard. There are drawbacks, because controls can differ for hazards within a group, such as spore-formers and other pathogens. Generic HACCP-based tools from industry or the authorities are designed to help with this.