RISK ASSESSMENTS · GFSI AUDITS

The 24 Risk Assessments a GFSI Food Audit Expects

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

BRCGS Issue 9, FSSC 22000 Version 7 and IFS all require documented risk assessments, and a hazard analysis does not satisfy them. A certified site holds about 24, from allergen management under BRCGS clause 5.3 to context of the organisation under ISO 22000:2018 clause 4.1. ASC packs are R690 each. Toolkits run R699 for the Basic set to R8,720 for GLOBALG.A.P. IFA, certification level toolkits from R4,000, assessments already inside.

What is a food safety risk assessment?

A food safety risk assessment is a documented judgement about one subject, cleaning, pests, zoning, suppliers, allergens, fraud or utilities, required in writing by BRCGS Issue 9, FSSC 22000 Version 7 and ISO 22000:2018 clause 6.1. It differs from a hazard analysis in scope, because a hazard analysis works product by product through the process flow under ISO 22000:2018 clause 8.5 while a risk assessment works subject by subject. A GFSI recognised scheme wants both.

The confusion is expensive. It shows up as a non-conformity against a clause the site believed its HACCP study had already answered. A HACCP study is bounded by its scope and its flow diagram, so it can only reason about hazards that appear at a process step. It has nothing sensible to say about why your external bins sit where they sit, why the goods in bay is cleaned weekly rather than daily, or why a supplier in a new country of origin was approved on a certificate alone. Those questions live in prerequisite programmes and in management decisions, and the schemes ask you to justify them in writing.

The distinction matters at the audit table. When an auditor asks why a control is set where it is, a HACCP plan answers with a critical limit and its validation. A prerequisite programme answers with a procedure. Neither of those explains the choice. The risk assessment explains the choice, and it is the only document on site that carries the reasoning. If you want the HACCP side laid out in full, our guide on what a HACCP plan contains covers the twelve steps in order.

Why certification schemes ask for risk assessments by name

Because the schemes stopped prescribing controls and started demanding justification. BRCGS Global Standard Food Safety Issue 9, published 1 August 2022, runs to nine sections with twelve fundamental requirements, and several of those fundamentals are written in risk based language rather than as a fixed rule. FSSC 22000 Version 7, published May 2026, carries its own additional requirements in Part 2, section 2.5.

First, a correction that matters for anyone searching this topic. There is no such thing as GFSI certification. GFSI is hosted by The Consumer Goods Forum and benchmarks schemes; it does not certify anybody. A GFSI audit means an audit against a GFSI recognised scheme: BRCGS, FSSC 22000, IFS, SQF or GLOBALG.A.P. IFA v6 in the GFS edition. ISO 22000 on its own is not GFSI recognised, which is exactly why FSSC 22000 exists as ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements. If you are still choosing, the BRCGS, FSSC 22000 and IFS decision framework sets out the trade offs.

The twelve BRCGS Issue 9 fundamentals are clauses 1.1, 2, 3.4, 3.5.1, 3.7, 3.9, 4.3, 4.11, 5.3, 6.1, 6.2 and 7.1. A major non-conformity against its statement of intent is a fail. Certification is off the table, the auditor, the certification body and site management agree whether the audit ends there or carries on as a non-certification gap audit, and a further full audit is needed to certify. Look at that list against the risk assessment table below and the overlap is obvious: supplier approval, traceability, layout and segregation, housekeeping and hygiene, allergen management and control of operations all sit in it, and every one of them is assessed on the strength of your written reasoning.

IFS applies the same logic through its own checklist, with risk based wording running through the requirements rather than a separate risk assessment register. The practical effect is the same. An IFS auditor asks for the justification behind a frequency, a zone boundary or a supplier decision, and expects a document rather than a conversation.

An auditor tests something narrower than whether you have controls: whether you can show why those controls are the right ones for your site.

The full list of risk assessments a GFSI audit expects, and the clause that drives each

No standard prints a list of required risk assessments. Sites are left to work the list out for themselves. In practice a certified food manufacturing site holds about 24, and an auditor works through them by subject rather than by number. The table below gives every one, what it covers, and the clause that drives it in BRCGS Issue 9, FSSC 22000 Version 7 or ISO 22000:2018. Every pack is R690.

Two notes on how to read that table. Where a row cites a BRCGS clause, the same subject appears in FSSC 22000 through ISO 22000:2018 and the relevant part of the ISO 22002 series, which was restructured in July 2025 so that most parts became full International Standards, including ISO 22002-100:2025 as a new common baseline published on 29 July 2025. Where a row cites an ISO 22000 clause, BRCGS reaches the same subject through Section 1 and Section 3. The subject is what the auditor cares about, not the label on the document.

Second, RA22, RA23 and RA24 are the three that manufacturing sites most often skip, because they feel like paperwork for the boardroom. They are not optional in an ISO 22000 or FSSC 22000 audit. Clauses 4.1, 4.2 and 6.1 are auditable requirements, and an auditor who finds no evidence of them writes the finding against the management system, not against the factory floor.

What a defensible risk assessment actually contains

A defensible risk assessment carries ten things, and they are what an auditor tests against ISO 22000:2018 clause 6.1 and BRCGS Issue 9: scope, the hazards your site actually has, a stated basis for likelihood, a stated basis for severity, a scoring rule, the existing controls, a residual risk, actions with dates, a named owner, and a review date with an approval. Miss one and it shows in a minute.

1. Scope and boundaryWhich site, which lines, which products, which shifts, and what is deliberately excluded. An assessment with no boundary cannot be shown to be complete.
2. The hazards or issues, listed by youWritten from your own walk of the site, your complaint file and your micro data. This is the field that separates a real document from a downloaded one.
3. Basis for likelihoodWhat makes something likely here. Historical incidents, complaint rate, equipment age, staff turnover, supplier performance. Say which one you used.
4. Basis for severityConsequence to the consumer first, then to legality and to the brand. Severity for a pathogen in a ready to eat product is not the same as severity for a taint complaint.
5. The scoring ruleThe matrix, the bands and what each band means in words, printed on the document rather than held in the head of the person who wrote it.
6. Existing controlsOnly controls you can evidence on the day. A control listed here is a control the auditor will ask to see running.
7. Residual riskThe score after the existing controls, and the threshold above which action is compulsory.
8. Actions, with datesEach action with an owner and a target date, and a closure record when it is done. Open actions past their date are a finding on their own.
9. Named ownerA person, not a department. “QA” is not an owner.
10. Review date and approvalThe next review date and the signature of the person who approved the current version, with version control that matches your document control procedure.

Every ASC risk assessment pack is built on those ten fields, and each pack contains a register, a procedure, a completion guide and a read me, in editable Word and Excel, mapped to BRCGS, IFS and SQF clauses. The procedure is the part sites forget to buy elsewhere: without it you have a spreadsheet, and an auditor asks who is allowed to change it.

Which risk scoring methods survive an auditor’s challenge

Any method survives if its bands are defined in words and tied to your own data, because neither BRCGS Issue 9 nor FSSC 22000 Version 7 prescribes a scoring method. A three by three or five by five likelihood and severity matrix is accepted by every GFSI recognised scheme, and so is a plain high, medium and low classification. What fails is a score with no stated basis, and one that changes when the auditor asks why.

The single most common failure is subtler than any of those. It is the assessment where the matrix is correct, the bands are defined, and the hazards listed are still the template author’s hazards. The site has a glass policy, a metal detector and a wooden pallet problem, and none of the three appear. That document is not wrong, it is simply about somebody else’s factory, and a competent auditor spots it because the hazards do not match the walk they have just done with you.

How often must each risk assessment be reviewed?

The working rule is at least annually, and immediately on any change that affects the subject, because neither BRCGS Issue 9 nor FSSC 22000 Version 7 prints a universal review frequency. The frequency you choose becomes a commitment the auditor will hold you to. A review date of twelve months that has passed by three weeks is a finding, and it is one of the easiest findings in the book to write.

• A new product, recipe or claim, including any new allergen brought on site
• A new process step, new equipment, or a change of supplier or country of origin
• A layout change, building work, or a change to a zone boundary
• A complaint trend, an adverse micro result, a foreign body incident, a withdrawal or a recall
• Pest activity above your own action level, or a change of pest control contractor
• A scheme version change: FSSC 22000 Version 6 audits are permitted until 30 April 2027, the Version 7 upgrade audit window runs 1 May 2027 to 30 April 2028, and the certification body must complete the upgrade documentation in the FSSC platform by 30 June 2028
• A regulatory change affecting the subject
• A non conformance raised against the subject by an internal audit, a customer or your certification body
• A change of the named owner, or the loss of a key person who held the reasoning in their head

Record the out of cycle review on the same document, with the trigger written into the review row. An auditor who sees “reviewed 14 March 2026 following foreign body complaint C-2026-041, detection frequency increased” reads a system that is alive. An auditor who sees a review row with a date and nothing else reads a diary entry. Our BRCGS Issue 9 ninety day audit countdown sets out when to schedule the reviews before an audit rather than in the last fortnight.

The findings auditors write against risk assessments

Findings against risk assessments are rarely about the absence of a document. They are about a document that cannot be defended. In BRCGS Issue 9 that lands as a minor or major non conformity depending on the clause, and where the subject is a fundamental such as clause 5.3 on allergens or clause 4.11 on housekeeping and hygiene, the consequence escalates quickly.

When a finding does land, the response is what the certification body actually grades. Root cause analysis on a documentation finding is usually done badly, because the site fixes the document and calls that the cause. The guide on corrective action and root cause analysis for audit findings shows what a certification body accepts as a closed action, and the 25 most common FSSC 22000 non conformances shows how often these repeat across sites.

Should you write your own or start from a template?

Start from a template, then make it yours. An ASC pack at R690 arrives with its clause mapping to BRCGS, IFS and SQF already done, which leaves you the part only you can write. A certification body does not audit where the format came from; it audits whether the content is yours. Writing 24 risk assessments from a blank page takes a competent QA manager several weeks. A template gives you the structure, the hazard prompts and the clause mapping in an afternoon.

The honest limit of any template is this: it cannot know your site. Nobody can sell you your own hazards, your own complaint history, your own zone boundaries or your own supplier list. What you are buying is the scaffolding and the prompts, so that the thinking you have to do anyway lands in a defensible format. A site that buys a pack and enters nothing has bought a finding at R690, and I have seen it happen.

Where the packs earn their price is in the parts most sites do not think to write: the procedure that governs who may change the assessment, the completion guide that explains what each field is for, and the clause mapping that lets you answer “which clause does this satisfy” without hunting. That mapping is also why the FSSC 22000 toolkit index is clause mapped, so you can trace a clause to a document and back.

Is a R690 risk assessment pack or a R5,500 toolkit better value?

All 24 packs at R690 each come to R16,560. The HACCP and PRPs toolkit is R5,500 and the BRCGS Food Safety toolkit is R6,550, and both already contain the risk assessments plus the full management system and one hour of premium consultation. For a site heading for certification the toolkit is the better buy, and I would rather say so.

The break even against the R4,000 GFSI Intermediate toolkit sits at about six packs, and against the BRCGS Food Safety toolkit at about ten. Buy six and you have spent R4,140 for six documents; buy the BRCGS Food Safety toolkit for R6,550 and you have 220 or more documents including those six, an indexed structure, and an hour with one of our consultants to point at the parts that do not fit your scope. The packs are for a site that has a system and one gap. The toolkits are for a site that is building one.

One thing the arithmetic does not capture. The toolkits are cross referenced, so the allergen risk assessment agrees with the allergen procedure, which agrees with the labelling control and the cleaning validation. Twenty four packs bought one at a time over eight months will not agree with each other unless somebody spends a fortnight making them agree, and that fortnight is the real cost. If you want the full explanation of what sits inside one, read what a food safety toolkit contains.

How the packs, the toolkits and consulting fit together

Three routes, priced to be honest about each other. A pack at R690 fixes one named gap. A certification level toolkit from R4,000 to R8,720 builds the system and includes an hour of premium consultation with one of our consultants. Consulting from R480 an hour, or a project quoted as one figure, is for a site that wants the thinking done with them.

Sites usually arrive at the middle option after trying the first. They buy the allergen pack because that is where the finding landed, then find that the cleaning validation behind the allergen assessment is also thin, then that zoning is undocumented, and by the fourth purchase the toolkit would have been cheaper. There is no shame in that order, but if you already know you are three or four documents short of a system, skip to the toolkit.

On the consulting side, we implement, we audit, and we are willing to audit sites we have supplied documents to. If you want the capability in house instead, the training academy is the cheaper long term answer: HACCP for Supervisors and HACCP Teams at R2,730 puts the hazard analysis and the risk assessment logic into the same heads, and Food Fraud (VACCP) and Food Defence (TACCP) at R1,450 covers the two subjects that generate the most rewritten documents. No VAT is charged on training, so the price shown is the price paid.

Two further reads if you are early in the process. Implementing BRCGS Issue 9 works through the nine sections in build order, and the FSSC 22000 Version 7 guide for South Africa covers the Version 6 to Version 7 transition dates in full. If food defence is new to you, what food defence and TACCP actually require is the shortest way in.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.