How Do You Assess Severity and Likelihood in HACCP?

The problem with severity × likelihood is that the calculation looks much simpler than the assessment behind it.

Ask somebody how they carry out a HACCP hazard analysis and the answer will often involve some variation of severity × likelihood = risk.

It sounds straightforward, but assessing severity and likelihood in HACCP involves far more than putting two numbers into a risk matrix. The real challenge is determining what those severity and likelihood ratings actually mean, applying them consistently and ensuring that the result of the assessment has a clear purpose.

What is the purpose of HACCP hazard analysis?

The purpose of hazard analysis isn’t simply to produce a risk score, it’s to determine the significance of a hazard so that the business can decide what level of control is required. That means the output of the assessment needs to lead somewhere.

A hazard analysis that labels something “high risk” without that result having a defined consequence hasn’t finished the job. The assessment should create a logical connection between the identified hazard and the control that will eventually be used to manage it.

First, you need to identify the right hazards

Hazard analysis relies heavily on the information produced during preparation:

• Legislation and standards may highlight hazards or limits.
• Material assessments may identify hazards arriving through the supply chain.
• Product information may reveal risks associated with the formulation, treatment, intended user or intended use.
• Facility plans can highlight cross-contamination risks.
• Process flows provide the structure for identifying hazards associated with individual process steps.

This is also why the multidisciplinary team is so important. Different people are able to interpret those information sources using their own areas of expertise.

A vague hazard is difficult to assess

Another common weakness is the way hazards are described. Terms such as “bacteria”, “foreign body” or “allergen contamination” may identify a general subject, but they don’t necessarily provide enough information for somebody to understand exactly what is being assessed.

A useful hazard description, needs sufficient context to understand where the problem originates, what the contaminant or hazard is, where it applies, how it could occur and what harm could result. The clearer the hazard, the easier it becomes for the team to discuss and assess the same thing consistently.

How are severity and likelihood assessed in HACCP?

Severity considers the level of harm that could result.
Likelihood considers whether the hazard could occur.

On the surface, combining the two sounds simple. In practice, however, terms such as low, medium and high can mean very different things to different people. What one team member considers a medium likelihood another may consider low.

Without a defined approach, scoring can become subjective. That becomes an even bigger issue when different teams, sites or auditors need to understand why a particular decision was made.

Does Codex define a HACCP severity and likelihood scoring method?

Codex identifies likelihood and severity, as important considerations within hazard analysis. However, it doesn’t prescribe a specific detailed method for rating them or combining the results to determine significance. This means businesses need to establish a clear and consistent approach, that enables the HACCP team to assess hazards and reach decisions that can be justified.

How does FSMA affect HACCP likelihood assessment?

The Food Safety Modernization Act approach also affects the way likelihood is considered. Under FSMA, the probability of a hazard is assessed in the absence of preventive controls – and this is a critical change to the way hazard analysis is conducted.

If a business has historically assessed likelihood, while assuming that its existing controls are working, removing those controls from the assessment can produce a very different view of risk. It also creates a challenge for businesses that need a product safety plan capable of working across different requirements.

This creates a clear need for a hazard-analysis methodology that provides more structure around how likelihood and severity are assessed, while still aligning with the principles established by Codex and the requirements of FSMA. The methodology also needs to work within the wider product safety plan, taking account of relevant certification standards and customer requirements rather than treating the hazard analysis as a standalone exercise.

Why consistency matters in HACCP hazard assessment

A good hazard analysis method should enable different competent team members, to look at the same evidence and reach a consistent, explainable conclusion. That requires more than a coloured matrix. The team needs to know what is being assessed, what the ratings mean, what evidence should inform the decision and what happens as a consequence of the result. It’s also important that the team can explain why the decisions were made.

A risk score may tell an auditor looking at the HACCP what the team decided. A clear justification explains why.

The matrix isn’t the hazard analysis

Matrices can provide useful structure, but the quality of a hazard analysis comes from the information behind the decision: the quality of hazard identification, the competence of the team, the evidence considered, the consistency of the assessment and the clarity of the outcome. If those elements aren’t strong, changing the colour or size of the matrix won’t solve the problem.

The objective isn’t to produce a score – it’s to make a defensible decision about risk that leads to the right level of product safety control.

Move beyond the risk matrix

A severity × likelihood matrix can provide a useful framework, but it doesn’t tell the HACCP team how to make consistent decisions about severity, likelihood and significance.

Our Level 3 HACCP for manufacturing course teaches a structured methodology for carrying out hazard analysis, helping learners understand what needs to be assessed, what information should be used and how the outcome should determine the level of product safety control required.

The approach is designed to overcome some of the gaps left by traditional HACCP guidance, while aligning the assessment with both Codex principles and FSMA requirements.

Most importantly, it gives the team a consistent method they can apply and justify, rather than relying on a simplified risk matrix.

Find out more about our Level 3 HACCP for manufacturing course and the practical methodology it provides for hazard analysis.