Risk Assessment and Management in ISO 22000

In short: Risk assessment in ISO 22000 means systematically identifying biological, chemical and physical food safety hazards, evaluating how likely and how severe each one is, and putting control measures in place to prevent, eliminate or reduce them to an acceptable level. Those controls are then monitored, verified and reviewed, using HACCP principles, prerequisite programmes and continual improvement.

ISO 22000, the international standard for food safety management systems, places significant emphasis on risk assessment and management. Identifying and mitigating food safety risks is crucial to ensuring the production of safe and quality food products. In this article, we will explore the risk assessment process in ISO 22000 and discuss effective strategies for managing and mitigating food safety risks.

1. Introduction to risk assessment in ISO 22000

Risk assessment is a fundamental component of ISO 22000 and forms the basis for developing a robust food safety management system. It involves systematically identifying, analysing, and evaluating potential food safety hazards and implementing appropriate control measures to manage and mitigate those risks. By effectively managing risks, organisations can prevent foodborne illnesses, protect consumers, and maintain their reputation.

The current edition, ISO 22000:2018, looks at risk on two levels. At the organisational level, the business must address risks and opportunities that could affect its food safety management system as a whole. At the operational level, it must carry out a hazard analysis based on HACCP principles for its products and processes. This article focuses mainly on the operational level. For the bigger picture, see our essential guide to implementing ISO 22000.

2. The risk assessment process

The risk assessment process in ISO 22000 consists of the following steps:

Hazard identification

The first step in the risk assessment process is to identify potential hazards that may pose a risk to food safety. Hazards can be biological, chemical, or physical in nature, and ISO 22000 makes clear that they include allergens and radiological substances. Examples include pathogens, allergens, chemical contaminants, foreign objects, and hazards arising from improper handling or storage practices. Through a comprehensive hazard identification process, organisations can identify the specific hazards relevant to their operations and products.

Risk analysis and evaluation

Once hazards are identified, a risk analysis and evaluation is conducted to determine the level of risk associated with each hazard. This involves assessing the likelihood of the hazard occurring and the severity of its potential impact on food safety. By assigning a risk score or rating to each hazard, organisations can prioritise their efforts and allocate resources accordingly.

Risk control measures

Based on the results of the risk analysis, organisations develop and implement control measures to manage and mitigate the identified risks. Control measures may include process controls, prerequisite programmes (PRPs), standard operating procedures, training and education, equipment maintenance, and sanitation practices. In ISO 22000, the significant hazards are managed through operational prerequisite programmes (OPRPs) or critical control points (CCPs), set out in a hazard control plan. The goal is to prevent, eliminate, or reduce the identified hazards to an acceptable level.

Monitoring and review

To ensure the effectiveness of the implemented control measures, regular monitoring and review are essential. Organisations establish monitoring procedures to verify that the control measures are functioning as intended. This may involve regular testing, sampling, inspections, and analysis of food products, equipment, and processes. Additionally, organisations conduct periodic reviews to assess the performance of the control measures and identify any necessary adjustments or improvements.

3. Effective risk management strategies

To effectively manage and mitigate food safety risks in accordance with ISO 22000, organisations can employ the following strategies:

• Proactive approach: Adopt a proactive approach to risk management by identifying and addressing potential hazards before they lead to food safety incidents. Regular hazard analysis and continuous monitoring are key components of a proactive risk management strategy.
• HACCP principles: Incorporate Hazard Analysis and Critical Control Points (HACCP) principles into the risk management process. HACCP provides a systematic approach to identify and control hazards at critical points in the production process.
• Employee involvement and training: Engage employees at all levels in the risk management process. Provide comprehensive training and education programmes to ensure that employees understand the importance of risk management and their roles in maintaining food safety.
• Continuous improvement: Establish a culture of continuous improvement by regularly reviewing and enhancing the risk management system. Encourage feedback from employees and stakeholders, conduct audits, and implement corrective actions to address identified weaknesses or areas for improvement.
• Documentation and record-keeping: Maintain accurate and up-to-date documentation of the risk assessment process, including hazard identification, risk analysis, control measures, and monitoring records. Proper documentation enables traceability and facilitates effective communication within the organisation. Our article on documentation and record keeping in ISO 22000 goes into more detail.

Food safety risk is only one of the risks a business carries. To see how it fits with the rest, read our guide to integrated risk assessment and risk profiling.

4. Conclusion

Risk assessment and management are integral components of ISO 22000’s approach to food safety. By following a systematic risk assessment process, organisations can identify and mitigate potential hazards, ensuring the production of safe and quality food products. Implementing effective risk management strategies, such as a proactive approach, employee involvement, continuous improvement, and proper documentation, strengthens the food safety management system and helps organisations maintain compliance with ISO 22000 requirements.

Frequently asked questions

What is the difference between a PRP, an OPRP and a CCP?

Prerequisite programmes (PRPs) are the basic hygiene conditions and activities needed across the operation, such as cleaning and pest control. Operational PRPs and critical control points (CCPs) are specific controls applied to significant hazards identified in the hazard analysis, with CCPs having measurable critical limits.

Is HACCP the same as ISO 22000?

No. HACCP is a method for hazard analysis and control, while ISO 22000 is a full management system standard that includes HACCP principles together with leadership, planning, prerequisite programmes, communication and continual improvement.

How often should the hazard analysis be reviewed?

Whenever something changes that could affect food safety, such as new products, ingredients, equipment, suppliers or processes, and as part of the regular verification and update of the food safety management system.