Risk
“We found Salmonella in the raw ingredient” — alarming. “We found Salmonella in a raw ingredient that gets a validated 7-log kill step” — a different story entirely. The hazard is the same; the risk isn’t. That distinction is the whole discipline of risk.
Definition
Risk combines the likelihood of exposure to a hazard with the severity of the resulting harm. Hazard is the agent; risk is the probability × consequence. Risk assessment is the structured process of estimating it; risk management is deciding what to do about it.
Key facts
- The Codex risk analysis framework has three parts: risk assessment (the science — hazard identification, characterization, exposure assessment, characterization), risk management (the decisions), and risk communication (telling people).
- Institutions built for this: EFSA in the EU, FDA/CFSAN and USDA in the US, the Joint FAO/WHO expert committees (JECFA for additives/contaminants, JEMRA for microbiological risk) globally.
- Risk assessment is what justifies proportionate controls: it separates the hazards needing CCPs from those handled by PRPs, and the products needing recalls from those needing monitoring.
- It’s inherently uncertain — exposure estimates, dose-response models, data gaps. Good assessments state their uncertainties openly instead of hiding them.
- Zero risk doesn’t exist in food. The goal is risk that’s as low as reasonably achievable and clearly communicated — not the pretense of absolute safety.
Why it matters
“Weak” food safety cultures treat every hazard as equal — everything’s critical, nothing’s prioritized, resources spread thin. Risk thinking is what focuses effort: the high-likelihood, high-severity hazards get the CCPs and the validation; the remote ones get proportionate controls. Hazard analyses transform when the team starts asking “how likely, how severe?” instead of just listing. It’s also the language regulators and trade bodies speak — Codex, WTO, EFSA all operate in risk terms. Learn it; it’s how the system reasons.
Sources: Codex Alimentarius; FDA; WHO.
Quick reference
| Component | Role |
| Risk assessment | The science: likelihood × severity |
| Risk management | The decisions: controls, limits, actions |
| Risk communication | Telling stakeholders honestly |
| Key bodies | EFSA, FDA, JECFA, JEMRA |
| Principle | Proportionate controls for assessed risk |