RISK ASSESSMENT · MICROBIOLOGY AND EMP

Microbiological Risk Assessment and Environmental Monitoring: Designing a Programme That Finds Things

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

Auditors have started asking to see the positives first. A year of clean results is the answer that invites the next question. BRCGS Global Standard Food Safety Issue 9 requires a documented sampling procedure and defined action limits at clause 4.11.8, and customers now want the same evidence and the action that followed each positive.

What a microbiological risk assessment covers, and how it differs from a hazard analysis entry

BRCGS Issue 9 and FSSC 22000 Version 7 judge a hazard analysis on the reasoning behind it. The microbiological risk assessment is the standing document that decides which organisms are credible in your product and your factory, why they are credible, and what you will do about them. The hazard analysis in your HACCP plan records the decision. The risk assessment records the reasoning, in enough detail that a new technical manager could rebuild the logic without you in the room.

The difference is not academic. Open most HACCP plans and you find a row reading Listeria monocytogenes, likelihood 2, severity 4, controlled by cooking and cleaning. That row is a conclusion. It does not say what the finished water activity is, whether the organism can grow across the declared shelf life, or which data supported the score. When an auditor asks where the score came from, the finding lands on the hazard analysis, not on your swab results.

A complete assessment works through six inputs for every product family: the intrinsic factors of the product, meaning water activity, pH, preservatives, competing flora and packaging atmosphere; the process, meaning where the lethality step sits and what it delivers; the exposure after lethality, meaning every point where product is open to the room, to hands, to equipment or to air; shelf life and storage, including realistic abuse; the intended consumer, including whether vulnerable groups are a foreseeable market; and the history, meaning your own results, complaints and supplier data. That last input is where this document and your environmental monitoring plan meet, and our guide to what a HACCP plan is and what it must contain sets out the study they sit under.

Which organisms matter, by product type and process

The organisms that matter are the ones your product and your process cannot exclude, as South Africa’s 1,060 case listeriosis outbreak of 2017 and 2018 demonstrated. A cooked, chilled, ready to eat product with a long shelf life owns Listeria monocytogenes. A low moisture powder owns Salmonella, and Cronobacter sakazakii where infant use is foreseeable. A low acid canned product owns Clostridium botulinum and post process recontamination. Naming the organism is the first honest step.

The common error is to list every pathogen in the textbook and score them all as low. That produces a document nobody uses. For chilled ready to eat foods with post lethality exposure, Listeria monocytogenes is the organism the system is built around, because it grows at refrigeration temperature, it settles into wet niches in the factory, and it reaches product by contact rather than through an ingredient.

South Africa has direct experience of what that means. The National Institute for Communicable Diseases recorded a listeriosis outbreak in which 1,060 laboratory confirmed cases were reported between 1 January 2017 and 17 July 2018, with 216 deaths among the 806 cases whose outcome was known. The outbreak was declared on 5 December 2017, the implicated source was ready to eat processed meat, and a recall followed on 4 March 2018. The practical lesson is narrow: the organism was living in a processing environment, and the route to product was the environment rather than the raw material.

How water activity, pH, temperature and process step drive the assessment

Water activity, pH and temperature set the outer limits of what can grow. Published growth limit tables, such as Appendix 4, Table A-1 of the FDA Fish and Fishery Products Hazards and Controls Guidance, put the minimum for Listeria monocytogenes at about pH 4.4, water activity 0.92 and minus 0.4 degrees Celsius. Those are general limits for screening, not specifications for your product.

Water activity is the water available to microorganisms rather than the water present. The same table gives about 0.94 for Salmonella, about 0.935 for proteolytic Clostridium botulinum and about 0.83 for growth of Staphylococcus aureus, which is why S. aureus is the organism to think about in salted and cured products. Below roughly 0.60 nothing grows, which is the basis of dry product stability, although survival is a separate question and Salmonella persists for months in dry material it cannot multiply in.

pH works from the other direction: about 4.4 for Listeria monocytogenes, 3.7 for Salmonella, 4.0 for Staphylococcus aureus and 4.6 for proteolytic Clostridium botulinum, the classical line between acid and low acid products. Yeasts and moulds tolerate far lower pH than bacteria, so an acidified sauce still needs a spoilage strategy once every pathogen has been excluded.

Temperature decides whether a limit on paper matters in practice. Listeria monocytogenes grows from about minus 0.4 to 45 degrees Celsius, so a chilled chain does not stop it, it slows it. Non proteolytic Clostridium botulinum grows from about 3.3 degrees. Vacuum packed chilled products with long shelf lives need specific attention on that account, while proteolytic strains need about 10 degrees, so chill is a genuine control for them.

The fourth driver is the process step, and most assessments handle it badly. What matters is not whether there is a kill step but what happens after it. Identify the last step that delivers a lethality, then map every point downstream where product is open: cooling, slicing, weighing, hand packing, rework addition, filling, sealing. Every point in that section is a contact route between your factory and food that will not be cooked again.

The study behind that limit is a discipline of its own, and most sites have never designed one. The Overview of Conducting a Shelf-Life Study course is R799 and covers how to set the test points, the storage conditions and the organisms to follow, so the result can carry the limit you write into the register. ASC does not charge VAT on training, so the price shown is the price paid.

Which product and process characteristics justify which monitoring approach

The monitoring approach should follow from the product and the process, not from what the laboratory happens to offer: a water activity below 0.85 and a pH at or below 4.6 point at different organisms and at different sampling. The table below maps common product and process characteristics to the organisms a microbiological risk assessment should justify, and the monitoring approach that follows. It is a starting point for your own assessment, not a specification.

What an environmental monitoring programme is for, and why a clean result set is a warning sign

An environmental monitoring programme exists to find contamination in your factory before your product finds it for you. FSSC 22000 Version 7 keeps it as a named additional requirement in Part 2, Section 2.5. It is a search, not a scorecard. If your results are always negative, the likely explanation has nothing to do with a sterile factory. You are sampling dry, accessible, recently sanitised surfaces at the safest possible moment, and reporting the answer as control.

A programme designed to pass is worthless. The only environmental monitoring data an auditor can use is data that has found something.

A site presents twelve months of results, every one negative, on the same twenty sites, taken every Friday after the deep clean. The plan has not changed. No positive has been investigated, so no corrective action exists to review, and no trend has prompted a change to cleaning, equipment or layout. That file evidences a plan built to avoid finding anything, whether or not anyone intended that, and it says nothing about whether the environment is controlled.

Auditors and customers have moved firmly on this point. A competent auditor asks three questions in sequence: show me your positives, show me the investigations that followed, show me what changed as a result. A programme with no positives answers none of them. Our review of the most common FSSC 22000 non conformances and our complete guide to food hygiene audits cover how that evidence is examined.

Three choices decide whether a programme searches or performs. Where you sample: harbourage lives in wet, cracked, inaccessible places, not on the polished table top. When you sample: three hours into a run tells you what the line is doing to product, while a sample taken straight after sanitiser tells you the sanitiser was applied. What you sample for: an indicator that appears often gives you something to work with.

Zone 1 to Zone 4 monitoring zones, which are not hygiene zones

Monitoring zones describe how close a surface is to open product. Zone 1 is product contact, Zone 2 is non product contact surfaces adjacent to Zone 1, Zone 3 is more remote surfaces inside the processing area, and Zone 4 is everything outside processing. These are not the production risk zones BRCGS Issue 9 uses to separate high care and high risk areas, which are set in a layout, process flow and hygienic zoning risk assessment. The four zone model is an industry convention, not South African law.

The point of zoning is not the labels, it is the consequence. Each zone carries a different sampling frequency, a different organism list where that makes sense, and a different response protocol. A Listeria species positive on a Zone 3 floor drain is expected, informative and managed through investigation. The same organism on a Zone 1 filler nozzle in a post lethality area is a different event, and your procedure must say so before it happens.

Zoning also has to be drawn, not described. A map a new starter can read is worth more than a paragraph of text: the boundary of each zone, personnel and material flow across those boundaries, hand washing and footbath positions, drains and their fall, and the sampling sites plotted on the same drawing. If your zone map and your process flow diagram disagree, one of them is wrong.

• The zone boundary lines are drawn on a scale layout, not sketched over a photograph
• Personnel flow, material flow, waste flow and air movement are shown crossing those boundaries
• Every drain is plotted, with the direction of fall, because drains connect zones you thought were separate
• Condensate points, ceiling voids and overhead services above open product are identified as monitoring targets
• Every monitoring site is numbered on the map and appears with the same number in the sampling plan
• Changes to layout, equipment or flow trigger a review of the map and the plan together

Indicator organisms or pathogens: choosing what to test for

BRCGS Issue 9 clause 4.11.8 requires a documented sampling procedure and defined action limits, but it names no organism, so most zoned programmes use indicators for routine sampling and pathogens where the result has to be definitive. Testing for Listeria species rather than Listeria monocytogenes alone produces more hits, sooner, and those hits point at the same wet harbourage. Enterobacteriaceae serves as a general hygiene and post process indicator. The choice belongs in your risk assessment, with the reason recorded.

The argument for indicators is practical. If the organism you are hunting sits in one site out of two hundred, a pathogen specific test finds it rarely and late. A genus level test finds the conditions that support the pathogen far more often, and those conditions are what you are trying to remove. A wet niche that grows Listeria innocua will grow Listeria monocytogenes just as happily.

The argument against relying on indicators alone is equally practical. An absent indicator does not prove an absent pathogen, Enterobacteriaceae is not a reliable surrogate for Salmonella in every dry environment, and total viable count says almost nothing about pathogens. So use indicators for breadth and pathogens for depth: routine indicator sampling across many sites, lower frequency pathogen testing at defined Zone 1 and Zone 2 points, and pathogen testing on every investigation an indicator hit triggers.

Decide the commercial dimension deliberately. Some customers require pathogen testing on product contact surfaces and expect notification of any positive. Others prefer indicator led programmes precisely because a Zone 1 pathogen positive forces an immediate product decision. Neither position is wrong, but the choice belongs in the procedure and in the specification you both signed.

How many sites, where, and how often

There is no correct number of sites and no standard publishes one. The count follows your zoned map, the number of lines, the number of points where open product is exposed after the last kill step, and your own history. Name every site, give it a number, a zone, an organism, a frequency and an owner. That named list is what clause 4.11.8 means by a documented sampling procedure.

Site selection improves sharply when you split the plan into three purposes. Sentinel sites are fixed, sampled every time, and give you a comparable trend over years. Rotating sites come from a much larger pool on a cycle, and cover far more of the factory than a fixed list ever could. Investigative sites are chosen on the day, in response to standing water, a new leak, a maintenance job that opened a machine, or a belt that has started to fray.

1. Walk the line during productionNot during a shutdown. Note every wet point, every crack, every place where product contacts a surface, and every place where a person or a trolley crosses a zone boundary.
2. List candidate sites by zoneAim for a pool several times larger than the number you will sample in any one round, so the rotation covers real ground.
3. Weight by risk, not by convenienceProximity to open product, wetness, cleanability, condition, accessibility to cleaning, history of positives and whether the point sits after the last kill step.
4. Set frequency by zone and risk bandHigher frequency for Zone 1 and Zone 2 in post lethality areas, lower for Zone 4, with the reasoning recorded against the band rather than against each site.
5. Fix the timing and write it downState whether the sample is taken during production or after cleaning, and why. Mixing the two without recording which is which makes the trend meaningless.
6. Define the techniqueSample a large surface area, use sponge samplers with an appropriate neutralising broth for sanitised surfaces, use vacuum sampling in dry environments, and state your compositing rule and how a composite is deconstructed if it is positive.
7. Name the owner and the deputySampling is a skill. The same person taking samples the same way is a large part of whether your trend means anything.

One comment on frequency. Sites raise it easily and lower it almost never, which produces bloated plans that get skipped in a busy week, and a skipped sample is worse than a lower planned frequency because it leaves a hole in the record. If the assessment supports monthly for a Zone 3 site, write monthly and do it every month.

Seek and destroy: how to find harbourage before it finds your product

Seek and destroy is a deliberate hunt for harbourage, run as a scheduled event outside the routine sampling plan, because the organism behind the 2017 and 2018 South African listeriosis outbreak was living in a processing environment rather than in a raw material. The team takes equipment apart and samples the places routine swabbing cannot reach: hollow rollers, belt splices, worn conveyor edges, motor housings, cracked welds, insulation, hollow frames, castors, drain interiors, floor to wall joints and the underside of everything.

The method matters. Run the event during production or immediately before cleaning, because a niche sampled after sanitiser has been applied to the outside of a machine tells you nothing about what lives inside it. Bring maintenance and engineering, because most sites worth sampling need tools to reach. Photograph each machine as it opens, since physical condition is often more informative than the laboratory result. Sample generously: the point is discovery, not a defensible pass rate.

Accept before you start that you will find things, and decide in advance what you will do about them. A hollow roller harbouring Listeria is an equipment replacement decision, not a cleaning one. A cracked weld under a hopper is a fabrication job. Worn belting is a purchase with a lead time. Sites that run these events without a budget line for the outcome stop after the second one, which is the worst of both worlds: documented knowledge of a harbourage site and no record of removing it.

Run them on a defined cycle, and after construction or maintenance in a production area, a roof or drain repair, repeat positives in one area, a complaint with a microbiological cause, or a recall anywhere in your group. Record each event as its own report: sites opened, results, physical findings, photographs, actions and closure evidence. That report is persuasive to an auditor precisely because it contains positives.

When a result comes back positive, including the product decision

A positive result is the programme working, and the product decision that follows it sits under section 61 of the Consumer Protection Act 68 of 2008. The response has to be written down before it happens, because the pressure in the room on the day is always towards a fast negative. Confirm, contain, clean, investigate the cause, decide on product, verify closure and record. The product decision is driven by the zone, the product type and whether the site sits after the last kill step.

Before you decide which products this programme has to cover, apply the revised Codex reasonably foreseeable consumption test.

1. Confirm and identifyConfirm the result with the laboratory, and confirm to species where the routine test was at genus level and the consequence depends on the species.
2. Contain by vector samplingOn the same day, sample outwards from the positive site: surrounding surfaces, the equipment above and below it, the nearest drain, and the same point on the parallel line. One positive tells you little. A pattern tells you where the niche is.
3. Clean, disinfect and re-sampleIntensive clean of the site and its surroundings, then re-sample. This is a containment action, not the corrective action, and it is not the end of the event.
4. Investigate the root causeAsk why the organism was there, not only how to remove it. Water, condensate, a niche, a traffic route, a maintenance job, a failed sanitiser contact time, a design fault. A corrective action reading cleaned and re-swabbed, with nothing about cause, is a finding waiting to happen.
5. Make the product decisionEstablish what ran on or near that surface, over what period, and where it is now. For a pathogen positive on a product contact surface in a post lethality ready to eat area, holding is the sensible default while you work that out.
6. Verify closureMany sites use consecutive negatives at the site and the vector sites over a defined period as their closure rule. Whatever rule you use, write it in the procedure in advance rather than deciding it after the event.
7. Record and feed it backThe event report goes into the trend, into the review of the monitoring plan, and into the history input of the microbiological risk assessment.

Trending, and what the trend should change

Trending is the mechanism that changes the plan, and the chart in the management review pack is only the evidence that it happened. If twelve months of data have not moved a sampling site, a frequency, a cleaning method, a piece of equipment or a traffic route, the trend is being reported rather than used, and BRCGS Issue 9 clause 4.11.8 expects results to be reviewed against defined action limits and acted on.

Useful trending looks at percentage of positives by zone over time rather than counts, because the number of samples changes. It looks at repeat sites, the strongest signal you will get that a niche exists, at repeat organisms, at time to closure, at seasonality, and at the relationship between positives and events such as wet cleaning, maintenance and construction. A rise in Zone 3 positives with Zone 1 still clean is not comfort, it is early warning.

What the trend should change, in rough order: the sampling sites, since a site that never gives a positive belongs in the rotating pool rather than the sentinel list; the frequency, up where a pattern appears and down only with a written justification; the cleaning method, frequency and chemical, which feeds straight into your Cleaning and Disinfection Risk Assessment (RA03), R690; the utilities, because condensate, compressed air, water and drainage sit behind many persistent positives, which is what the Utilities Risk Assessment (RA09), R690, is for; the equipment, where replacement beats cleaning; and the zoning and traffic flow, where the route is the cause.

How to verify that the monitoring programme itself works

The programme is a control, so it needs its own verification. The first test is whether it finds anything at all. After that, check the chain that produces each result: how the sample is taken, how it is transported, how quickly it reaches the laboratory, whether the laboratory holds SANAS accreditation to ISO/IEC 17025 for that specific method, and what that method can actually detect.

Five checks cover most of it. Watch someone take a sample against the written procedure, unannounced, at least twice a year, because technique drift is invisible in the data. Check transport temperature and time to laboratory against the method, since a sample arriving warm the next morning has tested your courier. Confirm the neutraliser in the sponge suits the sanitiser in use. Keep the laboratory’s stated limit of detection and proficiency testing performance on file. And send a duplicate set to an independent laboratory occasionally.

The sixth check is the one nobody schedules: read the plan once a year and ask what has changed in it. A plan identical to last year’s, in a factory that has added a line, replaced a filler, changed a sanitiser and had two roof repairs, has not been reviewed. Record the review with a date, an author and what changed. That record is what an FSSC 22000 Version 7 audit in South Africa or a BRCGS Issue 9 implementation will test.

Who should interpret the results

A named, competent person who does not carry the production output target. Competence here means understanding what the organism needs to grow, what the method can and cannot detect, and what a single positive does and does not prove, which is a R1,195 course rather than a job title. The procedure should name that person, name a deputy, set the notification time and state who may release product on hold. Independence is what makes the interpretation usable.

In most South African plants this sits with the technical or QA manager, supported by the HACCP team, which works while three conditions hold: the person has genuine microbiology training rather than familiarity with a report format, the escalation path reaches a director without passing through the person whose line is affected, and that person is not also accountable for despatching the order that day.

Building that competence is cheaper than most people assume. Introduction to Food Microbiology, R1,195, gives supervisors and QA officers the organism knowledge to take meaningful samples and read a report. Intermediate Food Microbiology, R1,450, takes the person who signs results off into method limitations and interpretation. Both are self paced with lifetime access, and ASC does not charge VAT on training.

Where interpretation exceeds what the site holds, buy an external opinion for the events that matter rather than for the routine: a pathogen positive in a post lethality area, a niche that resists three rounds of intervention, or a product decision with a customer notification attached. ASC consultation starts from R480 an hour, and a full project is scoped and quoted as one figure rather than billed by the hour.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.