Integrating Risk Management with Process Improvement

A frozen meals producer discovers repeated Listeria positives in a drain near a post-cook area. Each positive triggers cleaning and retesting, recorded as separate events. No one connects the pattern to a cracked floor repair, a changed cleaning contractor, and a new product with longer shelf life launched in the same quarter. Risk management saw fragments. Process improvement, integrated with risk thinking, would have forced the fragments into one picture.

Integration here does not mean merging two standards. It means running risk assessment and improvement as one loop inside the FSMS: risks prioritise improvement, improvement changes risk, and both are reviewed with the same evidence.

One Loop: Assess, Act, Reassess

Start with the risk picture. Clause 6.1 organisational risks, Clause 8.5 hazard analysis results, verification trends under Clause 8.8, complaints, and audit findings together form the organisation’s current risk profile. Improvement priorities should be traceable to that profile. If the highest assessed risk is allergen cross-contact, improvement resources flowing mainly to cosmetic projects signal a disconnect you should audit.

Improvement actions then change controls: new equipment, revised cleaning, supplier change, redesigned monitoring. Every significant change re-enters risk assessment. Clause 8.5 requires validation of control measures and combinations before implementation, and Clause 8.6 and Clause 10.3 require updating of hazard analysis and the FSMS after changes. Clause 6.3 requires changes to be planned with integrity of the system preserved. Test that sequence on real changes: was risk reassessed before the change went live, or rationalised afterwards?

Finally, monitoring and verification reassess whether risk actually fell. A new control that produces data nobody trends leaves the loop open. Closing evidence includes updated risk assessments, revised limits or criteria where justified, and management review under Clause 9.3 considering the results.

Tools That Connect Risk and Improvement

Several practical tools support the loop when used with discipline.

• Risk registers linked to actions: each significant organisational risk carries an owner, planned actions under Clause 6.1, and an evaluation of effectiveness. A register with risks but no actions, or actions but no evaluation, is incomplete.
• Prioritisation by severity and likelihood: improvement backlogs ranked by risk, not by who requested loudest. Ask the team to show ranking logic for deferred items, especially any deferred item touching hazard control.
• Management of change reviews: a single change record that prompts hazard analysis review, PRP impact, training, document updates, and verification planning before approval.
• Trend dashboards with thresholds: verification and monitoring trends with pre-set triggers for escalation, so improvement starts on signal rather than after failure.

Tools do not create integration. Links do. Audit the links: pick one register entry and follow it to actions, change records, updated documents, training evidence, and verification results. Breaks in the chain are findings about system effectiveness.

Failure Modes When the Two Stay Separate

Separate risk and improvement functions produce recognisable patterns. Corrective actions under Clause 10.1 close quickly with retraining while the risk assessment never changes, so the next audit finds the same issue in a new area. Capital projects improve throughput while quietly raising hazard likelihood, because no hazard review was triggered. Risk assessments are reviewed annually on schedule while major mid-year changes bypass them entirely.

Another pattern is risk inflation without action. Assessments list many high risks, diluting attention and delaying controls for the few severe hazards. Proportionality matters: severity for hazards affecting vulnerable consumers or involving allergens should dominate prioritisation, and low risks should receive light, efficient controls so resources remain for serious ones.

Auditing Integration Without Consulting

Your task is to evaluate, not to design the auditee’s loop. Ask questions that reveal linkage: show me a risk that led to an improvement last year; show me an improvement that changed a risk assessment; show me a trend that escalated into a project. If the organisation can produce such trails with records, integration exists in practice. If each answer requires searching separate systems with no cross-references, integration is a claim, not a condition. Report the gap factually, citing the clauses where linkage is required, and leave solution design to the organisation.

Leadership Review as the Integration Point

Management review under Clause 9.3 is where integration should become visible to leaders. Required inputs already combine both worlds: status of previous actions, changes in internal and external issues, FSMS performance including nonconformities and corrective actions, monitoring and verification results, audit outcomes, and supplier performance. Outputs must include decisions on continual improvement opportunities and any need for updates to the FSMS and resources.

Read review minutes as an integration test. Minutes that list inputs without decisions, or that approve improvement projects without referencing risk and verification evidence, show a review performing a ritual. Minutes that defer a high-risk action should record reasoning and interim controls. That record is exactly what a later auditor, or an investigator after an incident, will need.

Resource decisions make integration tangible. When risk and improvement compete for the same budget, leaders must choose visibly and record why. An organisation that funds a severe allergen risk reduction before a lower-risk efficiency project, and can show the assessment behind that order, demonstrates integration in its most practical form. Conversely, repeated deferral of high-risk actions without interim controls, while discretionary spending proceeds, is evidence a lead auditor should carry into Clauses 5, 6, and 9.3. Follow the money and the calendar: both reveal true priorities more reliably than policy statements.

Key points

• Run risk assessment and improvement as one loop: risks set priorities, changes trigger reassessment, verification confirms whether risk fell.
• Significant changes must pass validation and updating under Clauses 8.5, 8.6, 6.3, and 10.3 before becoming standard practice.
• Audit linkage with end-to-end trails from risk entry to action, change record, training, and verification results.
• Watch for closure without reassessment, projects without hazard review, and high-risk backlogs without ranking logic.
• Management review under Clause 9.3 is the visible integration point; test its decisions against risk and verification evidence.