Building a hazard analysis that survives an audit

Before You Start

Form a food safety team. Include people who understand the actual production process, such as employees from production, engineering, hygiene, and quality. Each department can help identify different types of hazards.

Collect four important documents:

• Process flow diagrams verified at the actual site.

• Product descriptions.

• Raw material descriptions.

• Information about the processing environment.

The process flow diagram must accurately represent every stage of production. Verify it by walking through the process at the site. Include rework, sampling, waste disposal, and anything that enters the process, such as water, steam, compressed air, and packaging materials.

Step 1: Identify Hazards at Every Stage

At each stage of the process, identify the following four types of hazards:

• Biological hazards: Harmful microorganisms, spoilage organisms, and their growth or survival during processing.

• Chemical hazards: Cleaning chemical residues, lubricants, processing aids, mycotoxins, heavy metals, and veterinary drug residues.

• Physical hazards: Metal pieces, glass, hard plastic, stones, wood, and bones.

• Allergen hazards: Accidental allergen contamination from other products, rework, shared equipment, or the movement of personnel.

Consider hazards that may enter the process, increase during a particular stage, or survive the existing controls. Also assess what could happen if a process step fails or if unusual situations occur, such as starting or stopping production, equipment breakdowns, and product changeovers.

Step 2: Define Acceptable Hazard Levels

For every identified hazard, determine the acceptable level in the final product.

Use relevant legal requirements, customer expectations, the intended use of the product, and reliable scientific evidence to establish these limits.

This step is essential. Without a defined acceptable level, it becomes difficult to assess whether a hazard is significant or determine whether a control measure is effective.

Step 3: Assess the Significance of Each Hazard

Evaluate each hazard using clearly defined criteria based on two main factors:

• Likelihood: How likely is the hazard to occur?

• Severity: How serious could its effect on human health be?

Document the assessment method and apply it consistently to all relevant hazards. Auditors want to understand how decisions were made, not just see the final results.

Avoid classifying every hazard as significant. The purpose of this assessment is to identify which hazards need priority attention and ensure that control measures remain practical and effective.

Step 4: Select and Classify Control Measures

For every significant hazard, identify the control measure or combination of measures needed to prevent, eliminate, or reduce the hazard to an acceptable level.

Next, determine whether the control measure should be managed as a Critical Control Point (CCP) or through an Operational Prerequisite Programme (OPRP).

Consider whether the measure has a measurable critical limit, whether losing control requires immediate action on potentially affected products, and whether monitoring can detect the loss of control in time.

Document the reasons for your decision. Clear explanations are important because auditors may closely examine how and why each control measure was classified.

Step 5: Define the Control Requirements

Once the control measures have been classified, document how each one will be managed.

For each CCP, specify:

• Critical limits.

• Monitoring methods and frequency.

• The person responsible for monitoring.

• Corrections required when a deviation occurs.

• Corrective actions to prevent recurrence.

• Records that must be maintained.

For each OPRP, specify:

• The action criteria.

• Monitoring methods to confirm that the controls are implemented.

• Corrections required when the criteria are not met.

• Corrective actions.

• Records that must be maintained.

These details help ensure that employees understand their responsibilities and know what to do when a problem occurs.

Step 6: Validate the Control Measures

Before relying on a control measure, collect evidence that it can effectively control the identified hazard.

This evidence may come from published scientific studies, guidance from qualified process experts, or trials conducted by your organisation.

Document the validation results and explain the evidence used to support the decision. Without proper validation, an organisation may struggle to demonstrate that its food safety controls can achieve the intended results.

Step 7: Review and Update the Hazard Analysis

Hazard analysis should be reviewed whenever changes could affect food safety, including:

• Changes to products or ingredients.

• Changes in production methods or processes.

• New or modified equipment.

• Changes in raw materials or suppliers.

• New information about food safety hazards.

• Food safety incidents or other relevant problems.

Keep a record of every review, including the review date and its outcome. If no changes are required, document that conclusion as well.

Common Mistakes to Avoid

1. Not verifying the process flow diagram: The hazard analysis may not reflect what actually happens at the site.

2. Failing to define acceptable hazard levels: This makes it difficult to assess hazard significance and validate control measures.

3. Using unclear assessment criteria: Undocumented or inconsistent methods can lead to unreliable decisions.

4. Not explaining control measure classification: The reasons for identifying a CCP or OPRP should be clearly documented.

5. Ignoring unusual operating conditions: Startup, shutdown, equipment breakdowns, and product changeovers must also be considered.

6. Overlooking rework and allergen risks: Rework and shared equipment can introduce hazards that may otherwise go unnoticed.

7. Missing validation evidence: Control measures must be supported by evidence showing that they can achieve their intended purpose.

8. Not updating the analysis: An outdated hazard analysis may fail to reflect changes in products, processes, equipment, or suppliers.

Final Takeaway

An effective ISO 22000 hazard analysis is more than a checklist. It requires a clear understanding of the production process, a consistent method for assessing hazards, suitable control measures, and reliable supporting evidence.

The key is to identify the hazards, explain your decisions, validate your controls, and keep the analysis updated. This helps strengthen food safety management and prepares the organisation to demonstrate its approach during an audit.