Understanding Risk Management in FSMS

A spice importer tests every lot for Salmonella and still ships a contaminated batch, because sampling a few grams from tonnes of product cannot reliably detect uneven contamination. Testing managed one kind of uncertainty poorly. Risk management in a food safety system means choosing controls based on likelihood and severity before harm occurs, then proving those controls work.

ISO 22000 uses the word risk in two distinct senses, and confusing them produces confused audits. You need both meanings clear before you can judge either.

Two Meanings of Risk in ISO 22000

Food safety hazard risk sits inside Clause 8. A hazard is a biological, chemical, or physical agent in food with the potential to cause an adverse health effect. Hazard analysis assesses each hazard’s likelihood of occurrence and severity of harm, considering intended use and vulnerable consumers, to decide which hazards need control and how.

Organisational risk sits in Clause 6.1. Here risk means the effect of uncertainty on the FSMS achieving its intended results. Sources include supplier failure, loss of competent staff, regulatory change, equipment obsolescence, water supply interruption, and emerging hazards the current analysis does not yet cover. Organisations must determine such risks and opportunities and plan actions to address them, integrated into FSMS processes, with effectiveness evaluated.

Audit each meaning against its own clause. A detailed hazard analysis does not satisfy Clause 6.1 by itself, and a corporate risk register does not satisfy Clause 8.5 hazard analysis. Findings must name the right requirement.

Hazard Analysis as Risk Assessment

Clause 8.5 requires a structured sequence. First, collect and maintain preliminary information: raw material and product characteristics, intended use, flow diagrams verified on site, and descriptions of process steps and existing control measures. Second, identify hazards reasonably expected at each step, considering the chain before and after the organisation, process equipment, and the surrounding environment. Third, determine acceptable levels for each hazard, taking legal requirements and intended use into account. Fourth, assess hazards by likelihood and severity to select those needing control. Fifth, select and categorise control measures as OPRPs or CCPs using a systematic approach, assess feasibility of limits and timely monitoring, and validate that selected measures can achieve control.

Challenge assumptions during audits. Likelihood estimates copied from a template, severity scores that ignore vulnerable groups such as infants or people with allergies, and acceptable levels stated without legal or customer basis all weaken the analysis. Ask the food safety team to explain its reasoning for the highest-risk hazards and for any hazard it decided not to control. Reasoning quality is the evidence.

Allergen and Emerging Hazard Examples

Allergen risk shows why assessment must be site-specific. Cross-contact likelihood depends on scheduling, shared equipment, cleaning validation, label controls, and rework practice on this site, not on industry generalities. Emerging hazards, such as a new contaminant reported in a raw material from a particular origin, test updating: Clause 8.6 and Clause 10.3 require the team to evaluate new information and update the analysis and hazard control plan when needed. Sample how the last significant external alert was handled.

Uncertainty, Monitoring, and Verification

Risk is never reduced to zero. Monitoring and verification manage residual uncertainty. Monitoring at CCPs and OPRPs must be capable of detecting failure in time to isolate affected product. Ask whether monitoring frequency is justified by process variability: a continuous process with rapid drift needs different monitoring from a stable batch process.

Verification under Clause 8.8 confirms the system works as planned: PRPs implemented, hazard analysis inputs current, hazard levels within acceptable levels, and procedures followed. Analysis of verification results, feeding Clause 9.1 evaluation and Clause 9.3 management review, is where risk judgements get revised. A site that collects verification data but never analyses trends is accepting risk blindly. Trend a year of environmental monitoring, complaints, or supplier failures with the team and test what changed as a result.

Auditing Risk Proportionality

Risk-based auditing mirrors risk-based management. Spend audit time where severity and likelihood combine highest, where controls are weakest, and where change has occurred. Document your rationale. At the same time, avoid two errors: demanding controls disproportionate to assessed risk in low-risk areas, and accepting weak justification where risk is high because the auditee is confident. Confidence is not evidence. Severity for allergens and pathogens affecting vulnerable consumers demands conservative judgement and strong validation, even when incident history is clean.

Close risk trails with the handling of deviations. When monitoring shows loss of control, Clause 8.9 requires corrections, evaluation of affected product, and disposition based on safety. Retrospective risk acceptance after the fact, without documented evaluation by authorised competent people, is a serious finding.

Communication of risk decisions is part of control. Acceptable levels, limits, and action criteria must reach the people who monitor them in a form they can use under production pressure, and changes to those values must be communicated before they take effect, with obsolete values removed. Audit the last change to a limit or criterion: who was told, when, and how was understanding checked. Similarly, risk information owed to customers or the next organisation in the chain, such as allergen status or use instructions that affect safety, must be accurate and current. A sound internal assessment fails consumers if its outputs are communicated poorly.

Key points

• Clause 8 hazard risk and Clause 6.1 organisational risk are distinct requirements; audit each against its own clause.
• Hazard analysis must assess likelihood and severity, set acceptable levels, and select validated controls as OPRPs or CCPs.
• Challenge template-based scoring and test reasoning for high-risk hazards and for hazards not controlled.
• Monitoring must detect loss of control in time; verification results must be analysed and used to revise judgements.
• Apply proportionality: strong evidence and conservative judgement where severity is high, without inflating low-risk areas.