Risk assessment

What is a risk assessment?

A risk assessment is a structured process used to evaluate the likelihood of an event occurring and the severity of its impact if it does. It helps determine whether controls are needed to manage the risk.

Every risk assessment must have:

• Inputs – information that goes into it.
• Outputs – information that is determined from the risk assessment.

Inputs

It is essential that risk assessments are driven by facts and data to ensure objective outcomes. However, many assessments are written with a predetermined result in mind, leading to selective use of information that supports the expected conclusion.

Using selective information negates the purpose of doing the risk assessment, because you’re not using facts and data to drive the result.

The type of facts and data that should be used in risk assessment could be:

• Complaints information.
• Previous incidents.
• History of non-conforming product.
• Information from industry recalls.
• Information from textbooks.

Subjective evidence such as personal opinions and gut feelings, which are not based in fact, must not be included.

Outputs

A risk assessment must always have an output, and the output must always have a purpose.

As an auditor, it’s very common to see assessments where the output doesn’t mean anything. Where a hazard has been risk assessed, to determine that the significance of the hazard is high. But the result of ‘high’ then doesn’t trigger the next step in the process.

The purpose of the risk assessment is to create an output. This output is the significance of the hazard and that result will then trigger the next step – which is to define the type of controls for that hazard.

What is the output used for?

The output of the risk assessment is used to either:

• Determine what controls are needed, to manage the risk identified.
• Justify why controls are not needed.

The controls may be prerequisite controls, operational prerequisites, preventive controls or critical control points.

How do you make a risk assessment ‘robust’?

Many standards require that a risk assessment be “robust,” but this term can often be unclear. So, what does it actually mean?

At its core, a robust risk assessment is one that stands up to scrutiny—there should be no ambiguity or debate about its conclusions. This means the assessment must be well-supported with sufficient data and a clearly documented rationale behind the decisions made.

A robust assessment doesn’t rely on subjective agreement. It’s not the auditor’s role to decide whether they personally agree with the outcome. Instead, the auditor should be able to review the assessment independently—without additional explanation—and fully understand how and why the conclusions were reached.

In short, robustness comes from transparency, evidence, and logical consistency.

When is a risk assessment needed?

A risk assessment must be completed when you need to determine controls or justify why controls aren’t needed. However, a risk assessment is also needed whenever the standard states any of the following:

• … risk assessment must/shall be completed/carried out/documented.
• …. based on risk.
• …must/shall be risk-based.

Examples

Example risk assessment

First, we’ll look at a physical hazard in packaging and then at a microbial hazard – both specifically looking at whether hair nets are required in a packaging factory.

Hazard

Introduction hair contamination into food via food packaging, creating a physical hazard, due to staff not wearing hairnets, causing consumer upset.

Severity

The severity of hair contamination in food would not cause injury, but may cause consumer upset or disgust.

Severity = low.

Likelihood

The likelihood of hair adhering to the food contact packaging depends on the type of packaging material. Plastic materials are known to retain static charge, which increases the risk of hair clinging to the packaging. Other materials, such as paper or cardboard, are less likely to attract or retain hair.

If the hair adheres to the packaging, the likelihood of this contaminating the food is high for food contact packaging. The likelihood of the hair contaminating food if the packaging is not food contact, is low.

Static food contact packaging: high + high = high

Food contact packaging that doesn’t hold static: high + low = medium

Non-food contact packaging: low

Significance

Hazard

Introduction of staphylococcus aureus contaminated hair into food via food packaging, creating a microbial hazard, due to staff not wearing hairnets, causing consumer food poisoning.

Severity

The severity of food poisoning due to staphylococcus aureus would be high, as it can become life threatening without medical attention.

Severity = high

Likelihood

The likelihood of hair adhering to the food contact packaging depends on the type of packaging material. Plastic materials are known to retain static charge, which increases the risk of hair clinging to the packaging. Other materials, such as paper or cardboard, are less likely to attract or retain hair.

If the hair adheres to the packaging, the likelihood of this contaminating the food is high for food contact packaging. The likelihood of the hair contaminating food if the packaging is not food contact, is low.

Static food contact packaging: high + high = high

Food contact packaging that doesn’t hold static: high + low = medium

Non-food contact packaging: low

Significance

Likelihood – taking the type of food product into consideration

The type of food that is being packed into the packaging, and the process used by the customer who uses the packaging, is also significant:

A ready to eat food such as ice cream or a sandwiches, would allow Staphylococcus aureus to survive and but may not grow due to the chilled storage conditions.  Therefore, the likelihood of Staphylococcus aureus contamination from hair on this food, causing food poisoning would be medium.

A ready to eat food, out of a retorted can (for example, a tin of peaches) wouldn’t allow Staphylococcus aureus to survive, as the retort process would kill the microbes. Therefore, the likelihood would be low.

A loaf of bread would allow Staphylococcus aureus to survive and grow.  Therefore, the likelihood would be high.

Further likelihood considerations

It’s also important to consider where the packaging is open to the environment and therefore, the risk of contamination. For example, if the film that makes the bread bags (from the example above) is only open for a short period of time – hair nets would only be required at that point in the process, if it can be segregated.

Finally, make sure that you put into your likelihood analysis the amount of hair complaints that you’ve had from your customers.