RISK ASSESSMENT · FOREIGN BODIES

Foreign Body Risk Assessment: Proving Your Detection Is Set Where the Risk Actually Is

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 17 min read

A foreign body risk assessment maps every source of physical contamination on site, then applies control in order: eliminate, prevent, control, detect. BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, covers chemical and physical product contamination control at clause 4.9 and foreign body detection and removal equipment at clause 4.10. The Physical Contamination and Foreign Bodies Risk Assessment Template (RA15) is R690.

Why is a metal detector not a foreign body programme?

Because detection is the last of four steps, and BRCGS Issue 9 keeps the two apart: chemical and physical product contamination control at clause 4.9, foreign body detection and removal equipment at clause 4.10. The order is eliminate, prevent, control, detect. A metal detector sees metal that is detectable in your product at your settings, and nothing else. It does not see the glass thermometer above the mixer, the brittle plastic guard on the filler or the wooden splinter from a pallet at intake.

I see the same conversation on site visits every month. A site has a foreign body complaint, the response is a capital request for a second detector, and six months later the complaint repeats because the source was a cracked polycarbonate sight glass that nobody had on a register. The detector was never the problem. It was doing exactly what it was bought to do, which is catch metal, and the hazard was not metal.

This is why BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, treats the two things separately. Clause 4.9 is chemical and physical product contamination control, which is the work of removing and preventing sources. Clause 4.10 is foreign body detection and removal equipment, which is what you install once you know what is left. A site that can only talk about 4.10 has answered the second question without answering the first.

The hierarchy also decides where your money goes. Eliminating a source is a once off cost with a permanent effect. Detection is a permanent operating cost with an ongoing failure mode: it needs power, air, calibration, test pieces, trained operators, reject verification and a discipline that holds at three in the morning on a night shift. Every source you eliminate is one your detection programme never has to catch, and one your auditor never has to interrogate.

Detection tells you the control failed. It is not the control.

The prerequisite standards say the same thing in different words. FSSC 22000 Version 7, published in May 2026, is ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements, and physical contamination control sits in that prerequisite layer. The ISO 22002 series was restructured in July 2025, with most parts moving from Technical Specification to full International Standard, including ISO 22002-1:2025 for food manufacturing and the new common baseline ISO 22002-100:2025 published on 29 July 2025. Codex CXC 1-1969, General Principles of Food Hygiene, revised 2022 in the 2023 edition, sets the same prevention first logic across its seven principles and twelve steps.

What does a foreign body risk assessment have to cover?

ISO 22002-1:2025 puts physical contamination control in the prerequisite layer, and the assessment behind it covers every credible source of hard, sharp or otherwise physical contamination that could reach product, the route it would take, the control chosen against it, the reasoning for that choice, and the evidence that the control works. If a physical hazard can reach open product anywhere between intake and despatch, the assessment should name it and say what stops it.

• Scope and boundary: intake to despatch, every process step, every open product point, and what is excluded and why
• The source map: every category of foreign body source present on your site, walked and recorded, not copied from a template
• Product characteristics: whether the product is dry, wet, frozen, conductive, foil packed, high salt or high moisture, because all of that affects what detection can achieve
• Consumer exposure: who eats it, whether it is cooked or sieved before consumption, and whether children or vulnerable groups are in the population
• Scoring: likelihood, severity and detectability, with the scale defined so two assessors reach the same answer
• The hierarchy decision for each source: eliminate, prevent, control or detect, and why the higher step was not possible
• Detection equipment: what type, at what point in the flow, at what sensitivity, and the validation behind it
• Reject and failsafe design: what happens on power loss, air loss, bin full, belt stop and a reject that does not confirm
• Testing and verification: frequency, method, who does it, what a pass looks like and what a failure triggers
• The registers: glass and brittle plastic, knives and blades, small tools, and any item that is counted in and out
• Interfaces: maintenance, equipment suitability, building fabric, zoning, pest control, packaging and raw materials
• Review triggers: any change to line, product, packaging, layout, supplier or equipment

The Physical Contamination and Foreign Bodies Risk Assessment Template (RA15) at R690 is built to that structure. Every pack in the range contains a register, a procedure, a completion guide and a read me, in editable Word and Excel, mapped to BRCGS, IFS and SQF clauses, so a completed assessment drops into an existing document index without renumbering anything around it.

Which source categories must be mapped?

Codex CXC 1-1969 puts prevention ahead of detection, and prevention starts with a map of sources. Nine categories cover almost everything I find on a South African food site: glass and brittle plastic, metal, wood, personal effects, packaging, maintenance, pests, raw materials, and the building itself. Walk each one physically, in production hours, with a plan in your hand. A source category that is not on your map is a hazard your controls were never designed for.

Two of those categories are worth extra attention because sites consistently underweight them. Raw materials arrive as somebody else’s foreign body problem and your detection is usually the first place they will ever be seen, which is an argument for intake inspection and supplier specification rather than a heavier reliance on the detector. Maintenance is the category most often missing altogether, because the work happens outside production hours and is documented in a different system by a different department.

Building fabric and equipment condition sit behind more foreign body findings than any other pair. That is why the Equipment Suitability and Maintenance Risk Assessment Template (RA10) at R690 and the Site and Building Fabric Risk Assessment Template (RA07) at R690 are usually bought at the same time as RA15.

Source to control: what removes it, and what the auditor will want to see

Each source needs a named control and a named piece of evidence, which is what BRCGS Issue 9 is asking for at clause 4.9, chemical and physical product contamination control. The table below sets out the pattern I use when completing an assessment on site. Notice how often the control that actually removes the hazard sits in another programme, and how rarely the answer is the detector at the end of the line.

Two rows in that table lead straight into other packs. Zoning decides where wood, outer packaging and personnel movement stop, which is the Layout and Hygienic Zoning Risk Assessment Template (RA08) at R690. Physical contamination almost never travels alone, so sites that write RA15 properly usually find they need the Chemical Contamination Risk Assessment Template (RA16) at R690 for the lubricants, inks, cleaning chemicals and coatings that live on the same equipment.

How do you score a foreign body source?

Score three things, not two, which is how the RA15 register at R690 is laid out: likelihood that the source reaches product, severity of harm if it does, and detectability by the controls already in place. Severity for physical hazards is driven by hardness, sharpness, size and who eats the product. Define the scale in the assessment itself so two assessors working separately land in the same band.

Likelihood is a judgement about the route, not about the material. A glass thermometer in a locked instrument cabinet three metres from the line and a glass thermometer suspended over an open mixing bowl are the same material with completely different likelihood scores. Score the route, and the score will drive the right control.

Severity for physical contamination is not the same conversation as microbiology. A soft fragment of film in a sauce is a quality complaint. A hard sharp fragment of similar size in the same product is a potential injury, and in a product eaten by children it is a more serious one again. Build the severity scale around hardness, sharpness, dimension and consumer group, and write those descriptors into the scale so nobody has to guess what a four means.

The purpose of the score is to force a decision, not to produce a number. A high score should compel a hierarchy decision that is recorded in words: this source was eliminated, or this source could not be eliminated for the following reason and is therefore prevented in the following way. Auditors read those sentences far more carefully than they read the arithmetic. Our guide on what a HACCP plan is covers how these prerequisite level assessments feed the hazard analysis itself.

Where does detection equipment belong, and how is sensitivity set?

Detection belongs at the last point in the process where a rejected unit can still be removed cleanly, and after the last point where contamination can enter, which is the judgement BRCGS Issue 9 expects behind clause 4.10. Placing a metal detector before the final packing step, when the packing machine itself has moving metal parts, leaves a gap the assessment must either close or explain.

Technology choice follows the source map. Metal detection sees ferrous, non ferrous and stainless steel, with stainless typically the hardest, and it is affected by product effect from moisture, salt, temperature and foil. X-ray sees by density, so it finds glass, stone, bone, dense plastic and metal, and it can inspect through foil, but it is poor on low density materials such as thin plastic film, hair and wood. Magnets remove ferrous material only, and their strength, position and cleaning frequency are all specification items. Sieves and filters remove by size and depend entirely on mesh integrity. Optical sorting works on colour and shape and is most useful in raw material streams.

Sensitivity is the part sites most often get wrong, usually by copying a number from a supplier’s brochure or a competitor’s manual. Sensitivity is established through validation trials on your actual product, in your actual packaging, on that specific machine, using the test piece types and sizes defined in your site specification, and confirmed against product effect. Publishing a millimetre figure as though it were a universal standard is exactly the mistake that gets a site into an argument it cannot win, because the achievable level depends on the product, the pack, the aperture and the machine.

What the risk assessment must record is the reasoning: the achievable sensitivity demonstrated during validation, why that level is appropriate for the credible contaminant sizes identified in the source map, what product effect was observed, and what would trigger revalidation. If the credible fragment from a source is smaller than what the machine can reliably detect in that product, the assessment has to say so and push the control back up the hierarchy, because detection has already been shown not to answer that source.

How do you test and verify detection, and what happens when a test fails?

Testing proves the detector still finds what it was validated to find and that the reject mechanism still removes it, which is what clause 4.10 of BRCGS Issue 9 expects you to be able to show. A test that only proves the detector alarmed is half a test. Frequency is a risk decision the site records, based on how much product would be at stake between two tests, the equipment history and the consequence of a failure.

A complete test passes a test piece through the unit in the running condition, in the least sensitive position within the aperture, and confirms three things: the unit detected it, the reject device operated, and the rejected unit physically arrived in the secure reject location. Test at start of run, at end of run, at the defined interval during the run, and additionally after any stoppage, product changeover, settings change or maintenance intervention on the unit itself.

1. Define the test methodWhich test pieces, presented where in the aperture, on which product, by whom, and what a pass looks like. Trained and named operators only.
2. Test the reject, not just the alarmConfirm the reject device fired and the unit landed in the locked reject bin. An alarm without a verified reject is not a pass.
3. Confirm the failsafe conditionsTest what happens on air loss, power loss, reject bin full, reject confirmation failure and belt stop. The line should stop or divert, not continue running unprotected.
4. Record the exact timeEvery test record carries a time, not just a date. Without a time you cannot define the quarantine window when the next test fails.
5. Control the reject areaLocked, access controlled, with a documented procedure for who opens it, who investigates the contents and how the finding is recorded.
6. Review the records for patternRepeated marginal passes, rising reject counts and repeated resets are a machine telling you something before it fails outright.

What to do about a failed test

This is the point that separates a real programme from a paper one. A failed test does not mean the detector failed at that instant. It means you cannot prove the detector was working at any point since the last recorded good test, so every unit made in that window is suspect and has to be treated as such.

• Stop the line immediately and prevent further despatch of affected product
• Identify the exact window from the last recorded good test to the failure, using the recorded times
• Quarantine all product made in that window, including anything already in the finished goods store, on a vehicle or at a distribution centre
• Record the quantity, batch codes and locations before anything is moved
• Investigate the cause of the failure rather than resetting and continuing
• Repair, adjust or revalidate as required, and record what was done and by whom
• Confirm the unit passes a full test, including reject verification, before restart
• Decide the disposition of quarantined product formally: re-inspection through a proven unit, rework, or disposal, recorded and signed
• Assess whether product has already left the site and whether the traceability, withdrawal and recall procedure needs to be invoked
• Open a root cause investigation if the failure is a repeat, or if any product reached a customer

Sites fail this in one specific way, and it is always the same way. The test log shows a failure, then a pass twenty minutes later, and nothing in between explains what happened to the product made during those twenty minutes or during the four hours before the failed test. An auditor who finds that gap has found a control failure with an unresolved product decision, which is a far more serious finding than a detector that broke. If your investigations habitually close with “reset and retested”, the Root Cause Analysis One-Day course at R1,250 is the shortest route to changing that, and our guidance on corrective action and root cause analysis for audit findings sets out the method.

What does a glass and brittle plastic register need, and what does the breakage procedure say?

This is clause 4.9 territory in BRCGS Issue 9. The register is a controlled list of every glass, brittle plastic and ceramic item in or over open product areas, with a unique reference, a location, a description, a condition and an inspection frequency. The breakage procedure is what happens the moment one of them breaks. Neither has value without the other, and an auditor will test both against the physical building.

Build the register by walking the area and looking up. Most sites capture the obvious light fittings and miss the instrument faces, the sight glasses, the level indicators, the guarding panels, the clock, the wall mounted screen, the ceramic hand basin near the entrance and the polycarbonate cover on the control panel. Then decide, item by item, whether it can be eliminated. Shatterproof lamps and sleeved tubes, polycarbonate replacing glass, protected instrument faces and enclosed gauges remove items from the register permanently, and every item removed is one fewer inspection to sustain forever.

1. Isolate immediatelyStop the line, define a containment area around the breakage and stop anyone walking through it. Nothing moves until the area is defined.
2. Segregate all product at riskEverything in the defined area, plus product upstream and downstream that could have been reached, quarantined and clearly identified.
3. Clean under supervisionDedicated equipment, a named responsible person, and a cleaning method that does not spread fragments further.
4. Reconcile the piecesAccount for the broken item as completely as the situation allows, and record what could not be accounted for.
5. Inspect and release the areaA second named person inspects and signs the area as clear before production restarts. Never the same person who did the cleaning.
6. Decide the product dispositionFormally recorded, signed, and never a verbal decision made at the line by whoever is available.
7. Change clothing and footwearAnyone in the containment area changes before returning, because fragments travel on soles and sleeves.
8. Record and investigateLog the breakage, update the register with the replacement item, and ask why it broke rather than only replacing it.

How are knives, blades and small tools controlled?

By count, by issue, by condition check and by physical control, all recorded: under clause 4.9 of BRCGS Issue 9 knives and blades are a contamination control question, not a stores question. Any item that can shed a fragment into product needs to be accounted for at the start of a shift and at the end of it, with an immediate response defined for a missing item or a damaged blade. The control is the reconciliation, not the cupboard.

• A numbered register of every knife, blade, scraper, snap off cutter and small hand tool used in production areas
• Issue and return recorded by shift, with a named person accountable for the reconciliation
• Condition inspection at issue and return, checking specifically for chips, cracks and missing blade tips
• Snap off blade knives prohibited in open product areas, or controlled under a specific documented justification
• A defined immediate response for a missing item or a missing blade fragment, including product quarantine
• Shadow boards for maintenance tools, so a missing tool is visible rather than discovered
• Metal detectable materials specified for pens, plasters, scoops, scrapers and cable ties used near product
• Blade disposal into a controlled sharps container, never into a general waste stream in a production area
• Staples and cutting tools controlled at debagging and decarding points, where most packaging metal enters

The same discipline applies to maintenance interventions. Tool control and the equipment programme belong in one document, written together. The Equipment Suitability and Maintenance Risk Assessment Template (RA10) at R690 covers the permit to work, the post work inspection and the temporary repair register that closes this loop properly.

What does an auditor ask for in a foreign body file?

An auditor reads clause 4.9 and clause 4.10 of BRCGS Issue 9 together, and asks whether the sources were identified, whether the higher steps of the hierarchy were applied before detection was chosen, whether the detection that exists is validated and verified, and what happened to product the last time a test failed. The file is read from the source map forward and from the last failure backward, and both readings have to meet in the middle.

Sites preparing for a scheme audit should read the foreign body file the way the auditor will. Our BRCGS Issue 9 implementation guide and the BRCGS Issue 9 audit preparation countdown set out the sequence, and the complete guide to food hygiene audits covers how the questioning works in the room.

The foreign body findings that keep recurring

BRCGS Global Standard Food Safety Issue 9 runs to nine sections and twelve fundamental requirements, and foreign body findings still cluster in the same short list across scheme, sector and site size. None of them is technically difficult, and every one of them is expensive to explain on the day, because the programme started at the detector rather than at the source map.

• A detection log with no risk assessment behind it. Months of clean test records and no document explaining why that machine is there, at that setting, at that point
• No quarantine decision after a failed test. A failure, a pass, and complete silence about the product made in between
• Test records with dates and no times, which makes a defensible quarantine window impossible to construct after the fact
• Reject verification never tested. The alarm is checked every shift, the reject device has not been challenged since commissioning
• Failsafe conditions never proven. Nobody has confirmed what happens on air loss, power loss or a full reject bin
• A reject bin left open or not secured in a production area, with no record of who opens it or what was found in it
• A glass register that fails the reverse test. Items on the wall that were never added to the list
• Wood still in open product areas, usually pallets that come one bay further in than the transfer point on the drawing
• Maintenance absent from the source map entirely, with job cards that have no tool count and no post work inspection field
• Sensitivity settings with no validation record, traced back to a commissioning engineer who left in 2021
• A risk assessment that predates the last line change, so the source map describes equipment that is no longer on the floor

Prerequisite ownership sits underneath most of those. Our analysis of the 25 most common FSSC 22000 non-conformances shows how often a finding written against one clause is really a prerequisite that was bought rather than designed.

How do you keep the assessment current after a line change?

Make the risk assessment a mandatory input to change control rather than an annual chore. The RA15 pack at R690 carries a review trigger list to make that practical. Any new equipment, new packaging format, new raw material, layout change, new utensil or building work triggers a review before the change goes live. An assessment reviewed once a year describes a factory that stopped existing the day someone installed a new filler.

The practical mechanism is a single field on the change request form asking which risk assessments this change affects, with a named person required to sign that the review was done. It costs a few minutes per change and it removes the most common finding in this whole area, which is an assessment that no longer describes the floor.

Set a formal review period as well, and record the trigger list inside the assessment so it is not dependent on somebody’s memory. Foreign body risk assessments age faster than almost any other prerequisite document, because factories change equipment far more often than they change buildings.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.