RISK ASSESSMENT · UTILITIES

Utilities Risk Assessment: Water, Ice, Steam, Compressed Air and the Services Nobody Assesses

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 17 min read

Utilities are the risk assessment most food sites have never written. BRCGS Global Standard Food Safety Issue 9, published on 1 August 2022, gives utilities their own clause at 4.5, covering water, ice, air and other gases. R638 of 2018 defines water as potable water complying with SANS 241. The Utilities, Water, Air, Steam and Lighting Risk Assessment Template (RA09) is R690.

Which utilities need a risk assessment?

Every utility that touches product, packaging or a contact surface needs one: water, ice, steam, compressed air, the other process gases, ventilation air, lighting and drainage. BRCGS Issue 9 gives utilities a clause of their own at 4.5, and ISO 22002-1:2025, published in July 2025, places supplies of air, water and energy squarely inside the prerequisite programmes.

They are assessed less often than any other prerequisite programme because no single department owns them. Engineering owns the compressor, maintenance owns the boiler, the municipality owns the water, facilities owns the lights and quality owns the audit finding. I have walked sites with an immaculate cleaning file, a pest programme designed properly from a risk assessment and an allergen matrix that would survive any auditor. Then I have asked for the compressed air assessment and watched the room go quiet. Somebody eventually produces a compressor service report. It proves the machine was serviced. It says nothing about whether the air leaving the nozzle above the open filler is fit to touch food.

The same pattern repeats with water. A municipal water quality report is handed over as if it were the site’s evidence. It is the municipality’s evidence, and it stops at the connection point. Everything after the meter, the tanks, the pipework, the dead legs, the softener, the filters and the outlet at the line, is the site’s responsibility and nobody else’s.

Utilities are invisible until an auditor asks who assessed them. Then they are the only thing in the room.

A finding against clause 4.5 is not a finding against one machine. It is a finding against a whole class of service running through the entire factory, and closing it properly means schematics, sampling plans, filter specifications and monitoring records, all produced under audit pressure. Producing them in advance costs R690 and an afternoon. The same logic runs through the FSSC 22000 Version 7 guide for South Africa.

Which utilities can contaminate product, and how

Clause 4.5 of BRCGS Issue 9 covers utilities, and a utility becomes a hazard under it the moment it contacts product, packaging or a product contact surface, or the moment its failure changes a control. That gives four routes: direct addition, direct contact, indirect transfer through a surface or the air, and loss of a control that depended on the utility. Every utility on your site fits at least one.

Score each utility on those routes and the priorities sort themselves out. Compressed air blown into a bottle before filling ranks above compressed air driving a pneumatic gate in a warehouse. Both belong on the register, only one needs point of use testing.

The table below is the shape the register in the Utilities, Water, Air, Steam and Lighting Risk Assessment Template (RA09) takes, at R690. Use it as your walk sheet.

Why water is treated as a raw material

Water is the only raw material most factories buy without a specification, a supplier approval file or a certificate of analysis. It enters as an ingredient, a processing aid, a cleaning medium, a cooling medium and the feedstock for ice and steam. R638 of 2018, in its definitions, states that water means potable water that complies with the specifications set out in Water for domestic supplies: SANS 241.

Once you accept that water is a raw material, the controls write themselves, because you already apply them to everything else you buy. Water deserves the same four.

• A specification. What quality do you require at the point of use, and against which standard is that judged? Name it, and hold the standard.
• A supplier approval. For municipal supply that is the local authority and its published quality data. For a borehole, you are the supplier, and the approval file is your own treatment and monitoring evidence.
• A distribution record. A current schematic showing every line, tank, softener, filter, dosing point, outlet and dead leg, with sample points marked and numbered.
• A verification programme. Sampling and testing at a frequency you can defend, with an action plan for a result outside specification.

Borehole and tanker supplied sites carry both roles at once, supplier and customer, so the treatment train, the disinfection control and the monitoring plan all have to be documented and verified by the site. If your treatment relies on dosing, the dosing control is a monitored parameter, not a maintenance task.

Potable and non potable water: separation, identification and backflow

Three grades of water usually run through a food factory, and they must be separated physically, identified visually and documented on one schematic. Potable water, meaning water meeting SANS 241 as R638 of 2018 defines it, may contact product. Recycled water may only be used where a validation study says so. Non potable water, in fire mains, cooling towers and effluent lines, must never reach product, packaging or a contact surface.

If you are recovering and reusing water, work from the 2026 Codex fit for purpose test for reused water before you write the specification.

Separation is a design control and identification is a human control, and you need both. Physical separation means dedicated pipework, air gaps where a potable line discharges into a vessel and tested backflow prevention devices where a cross connection cannot be designed out. Identification means a colour or labelling convention applied consistently, so a contractor working alone on a Saturday cannot pick the wrong line.

1. Walk the site with the drawingTake the existing schematic into the plant and correct it against reality. On most sites the drawing is older than the last two projects, and the corrections are the finding.
2. Mark every outletNumber every tap, hose point, standpipe and connection, and record its grade. An unnumbered outlet is an outlet nobody assessed.
3. Hunt the cross connectionsLook wherever a hose can reach two systems, at wash bays, at chemical dosing units, at cooling tower make up and at any temporary connection left in place after a breakdown.
4. Find the dead legsDecommissioned lines, capped spurs and lines feeding equipment that has been removed all hold stagnant water. Remove them, or bring them into a flushing regime with a record.
5. Fix the identificationApply the colour or label scheme, then write the convention into a document so the next contractor inherits it rather than inventing one.

Recycled water needs a separate decision. Reuse is legitimate and increasingly necessary, and it is also where a site most often walks into trouble by allowing a use the treatment does not support. Define the origin, the treatment applied, the validation evidence and the exact list of permitted uses. Anything not on that list is prohibited. Water reused for an initial vegetable wash is not automatically fit for a final rinse.

Water sampling, what to test and how to justify the frequency

A water sampling plan is judged on its reasoning, not its frequency. It must name the sample points, say why they were chosen, state which determinands are tested at each, set the frequency and explain the basis for it. SANS 241-1:2015 covers microbiological, physical, aesthetic and chemical determinands and SANS 241-2:2015 covers the application of SANS 241-1. Both remain the currently published edition.

Sample points come from the schematic, not from convenience. A useful plan covers the point of entry, the point of storage, the furthest point of the distribution system, and the points of use carrying the highest product risk, including the ice machine feed, the culinary steam feed and any final rinse. Rotate through the remaining outlets on a defined cycle so every outlet is sampled within a stated period.

On which determinands to test, take the answer from three places: the standard your specification names, the hazards your source actually presents, and your own historical results. A microbiological indicator suite belongs on almost every plan, with a wider chemical screen at a lower frequency for municipal supply. A borehole site needs a broader chemical profile, informed by local geology and land use.

Use a laboratory whose accreditation covers the methods you commission, and check the report names the method. Then close the loop. An out of specification result triggers an investigation, a containment decision on product made with that water, a corrective action and a resample. Water results that arrive by email and are never trended are a laboratory invoice with no control attached. Our ISO 22002 Prerequisite Programme Requirements course, R2,100, works through how utilities sit inside the prerequisite structure.

Ice as a product contact material

Ice is frozen water, so it starts under the same R638 of 2018 definition and the same SANS 241 limits, inherits every hazard its feed water carries and adds its own, because it is made in a machine, stored in a bin and handled by people. Treat it as both a utility and a product contact material: the feed water sits in the water sampling plan, the machine sits in the cleaning schedule and the ice itself is sampled and tested like a product.

Ice machines are among the least inspected pieces of equipment in a food factory, because they run continuously, sit in a corner and appear to be self contained. Inside, the evaporator plates, the water distribution manifold, the sump and the bin all need cleaning at a defined frequency, with the disassembly required to reach them written into the method.

• Feed water quality, verified as part of the water sampling plan, not assumed from the mains
• Machine internal cleaning frequency and method, with verification evidence, not a service contractor’s sticker
• Bin condition, lid discipline and whether anything other than ice is ever stored in it
• A dedicated scoop with a defined home, because a scoop buried in the ice is a routine finding
• Transfer containers cleaned and stored to the same standard as any other product contact container
• Ice sampled and tested at a frequency set by how the ice is used and how much product it touches

Where ice is bought in rather than made, it becomes a purchased material and moves into supplier approval, with a specification, a certificate of analysis and transport hygiene conditions. The Microbiological Contamination Risk Assessment Template (RA14), R690, carries the pathogen reasoning behind the sampling decision, and your HACCP plan should show where ice enters the process flow.

Steam, culinary steam and boiler treatment chemicals

Steam splits into two categories and the split decides the whole control set. Indirect steam heats through a barrier, in a jacket, a coil or a heat exchanger, and never touches product. Culinary steam contacts food or a product contact surface directly, in steam injection, blanching, peeling, surface pasteurisation or sanitising. It must be generated from water meeting the potable definition R638 of 2018 sets by reference to SANS 241, and any boiler treatment chemicals used must be food grade.

The documentation point is the one sites miss. It is not enough to believe the boiler chemicals are food grade because the supplier said so on a phone call. The site must hold the supplier’s approval documentation and specification sheets for every treatment chemical used on a boiler producing culinary steam, and those documents must match the products actually in the dosing pots. Internationally, boiler water additives permitted in food production are listed at 21 CFR 173.310 of the United States Code of Federal Regulations, and a credible supplier will state the basis on which its product qualifies.

Beyond the chemicals, the assessment covers feed water quality, whether a dedicated clean steam generator is used, the filtration fitted at the point of use, the pipework material and the condition of any flexible connections. Treatment chemicals can carry over with the steam, so filtration and separation design are the controls that keep them out of product.

For indirect steam the hazard is mostly mechanical. The failure mode is a pinhole in a heat exchanger plate or a jacket, letting steam, condensate and treatment chemicals into product wherever the service side is allowed to sit at a higher pressure than the product side. Correct design holds the product side above the heating medium across the whole plate pack or jacket, so a pinhole leaks outward, and the assessment records the required differential, where it is measured and what happens when it is lost. That puts exchanger integrity testing, pressure differential management and leak investigation into the utilities assessment, overlapping with the Equipment Suitability and Maintenance Risk Assessment Template (RA10), R690.

Compressed air and the other gases used in packaging

Compressed air is drawn from the environment, compressed, carried through a ring main and blown at food. ISO 8573-1:2010 exists to classify what is in it by the time it arrives. It can carry water, oil, particulates and micro organisms, and it arrives with none of the visual cues that would make anyone suspicious. Where air contacts product or packaging, the assessment must cover the intake, the compressor type, the filtration train, condensate management and testing at the point of use.

An oil free compressor removes the oil route at source and is the stronger control for product contact air. A lubricated compressor is not automatically unacceptable, but it shifts the burden onto filtration, condensate management, monitoring and evidence. The internationally used reference for compressed air purity is ISO 8573-1:2010, Compressed air, Part 1: Contaminants and purity classes, which defines contaminant categories and a class system. Name the class you require in your own specification only if you hold the standard and can state which class you have chosen and why.

Build permanent sample points into the ring main at the outlets that matter, so a test can be repeated in the same place and a trend can be read. Record filter specifications, differential pressure where it is measured, and change frequency with the reasoning behind it. Blow guns used for cleaning deserve their own line in the register, because they are the most common route by which a non contact air system becomes a contact air system.

The other gases follow the same logic with the supplier chain added. Nitrogen and carbon dioxide used for modified atmosphere packaging, blanketing or carbonation are purchased materials that end up inside the pack. They need a food grade specification, a supplier approval file, certificates of analysis linked to deliveries, controlled cylinder handling and in line filtration where the gas contacts product. Where the gas mix supports the shelf life claim, gas analyser calibration becomes a food safety record.

Lighting, shatter protection and the glass and brittle plastic link

Lighting appears in two places at once and the two entries have to agree. R638 of 2018 requires artificial illumination permitting an illumination strength of at least 200 lux, at regulation 5(3)(b)(ii)(bb). Every fitting above or near open product is also an item of glass or brittle plastic, so it belongs on the glass register with its protection status recorded. BRCGS Issue 9 deals with contamination control of that kind at clause 4.9.

Two things belong in the utilities assessment itself: whether the light level supports the inspection and cleaning verification tasks that depend on it, and whether every fitting above or near open product is shatter protected or fully enclosed, with the protection status recorded rather than assumed. Everything else that follows from a fitting being glass, the register format, the breakage procedure, the exclusion zone and the product decision afterwards, belongs to a different assessment, so work through our foreign body risk assessment guide and the Physical Contamination and Foreign Bodies Risk Assessment Template (RA15) at R690 for that side of it.

Ventilation, air handling and pressure differentials in high care

Ventilation is a utility that moves. R638 of 2018 requires effective ventilation at regulation 5(3)(b), including removal of gas, vapours, steam and warm air arising during food handling. Beyond that legal minimum, air handling does three jobs: it removes heat and moisture, it filters what comes in, and in high care and high risk areas it controls the direction air travels between zones.

Assess the intake first, because filtration cannot fix a badly placed intake. Then assess the filtration grade against what the area needs, the accessibility for filter changes, the monitoring that tells you a filter is loaded, and the record that says it was changed. Condensation is where most of the real findings sit. Warm moist air meeting a cold surface produces condensate, condensate above open product is a direct contamination route, and the surfaces that produce it are usually ducting, ceiling panels and chilled pipework nobody has looked up at in months.

In high care and high risk areas, positive pressure relative to lower care areas is the design intent, so air leaks outwards rather than inwards through doors, hatches and service penetrations. That intent only counts if the differential is specified, measured, logged and acted on. Ask what differential is required, where it is measured, and what happens when the reading falls outside the range. A pressure gauge with no reading behind it proves the differential existed at some point, and nothing more. Zoning design is covered by the Layout and Hygienic Zoning Risk Assessment Template (RA08), R690.

Drainage as a utility and as a hazard

Drainage is the utility that runs in the opposite direction, and it carries the highest microbiological load on the site. Drains are a known harbourage site for environmental pathogens, and drain aerosols travel far further than most teams assume. R638 of 2018 requires a waste water disposal system approved by the local authority at regulation 5(3)(c)(iv) and places a duty on the person in charge at regulation 10(7).

The design questions matter more than the cleaning schedule. Drainage should flow from high care towards low care, never the reverse, and never from a raw area into a ready to eat area. Capacity has to match the peak flow of a full cleaning shift, not the average, because an overwhelmed drain floods and flooding is how drain contents reach the floor and then the wheels, the boots and the pallet bases.

• A drainage plan showing every drain, gully, channel and interceptor, with flow direction between zones marked
• Capacity assessed against peak cleaning flow, with a record of any area that has flooded and what was done about it
• Trap presence and water seal verified, and a check for dried out traps in seasonal or low use areas
• Backflow protection at the connection to the municipal system, with testing where a device is fitted
• A drain cleaning method that specifies dedicated tools, a colour code and a technique that does not create aerosols over open product
• Drains included in environmental monitoring, with results trended by drain rather than pooled

Cleaning drains is a task most sites hand to whoever is nearest, with the same brush that cleaned a floor and the same hose that was used on a wall. Dedicated tools, a distinct colour code, a written technique and separate storage are the minimum. Where a drain is cleaned with high pressure water over an open line, the technique itself is the hazard.

Load shedding, water interruptions and the risk of a restart

South African food manufacturers operate with an electricity supply that is not guaranteed and, in a growing number of municipalities, a water supply that is not guaranteed either. R638 of 2018 grants no relief for either, and the hygiene requirements apply exactly as they did before the outage. Loss of supply is a hazard in its own right, and the restart afterwards is where product is most often put at risk.

A utilities risk assessment written for a European site will not carry those scenarios, and yours has to. The wider legal picture sits in our guide to South African food legislation. Assess loss of power on what it takes away rather than on the outage itself. Refrigeration stops and temperatures climb at a rate your own data can tell you. Metal detectors, X ray units, checkweighers and interlocks lose power and may need re-verification on restart. Compressed air pressure falls and pneumatic controls drift or fail open. Air handling stops, so pressure differentials in high care collapse. Lighting drops to emergency levels, so visual checks stop being reliable.

Generators need their own entries: fuel holding calculated against a realistic worst case, fuel condition and rotation, load testing frequency, changeover time and what happens during that gap, and whether the generator actually carries the refrigeration and the detection equipment or only the lights and the office.

Water interruption brings a different set. Storage tanks buy time and create risk at once, because stored water stagnates, loses any disinfectant residual and warms up. Assess tank capacity against turnover, cleaning and inspection frequency, covers and vent screening, and the quality of the water at the tank outlet rather than the inlet. When mains pressure falls, backflow protection is the control that stops a cross connection becoming a contamination event.

1. Define the triggerState what constitutes an interruption serious enough to invoke the procedure, so the decision is not left to whoever is on shift.
2. Protect product in processDecide in advance what happens to product in a cooker, a chiller, a filler or a holding vessel when the supply stops, and who authorises the decision.
3. Control the restartFlush lines that stood full of warm stagnant water, re-verify detection equipment, restore pressure differentials, confirm refrigeration recovery and check air quality at the point of use before running product.
4. Decide on affected productApply hold, assess and release criteria that were written before the event, and record the decision with the data behind it.
5. Review the eventEvery interruption is free test data on your own contingency. Record what failed, what took longer than planned and what you changed.

That scenario planning belongs in the Emergency Preparedness and Response Risk Assessment Template (RA21), R690, which sits alongside the utilities pack and takes the same events through to the response plan, the communication and the review. Buy the two together and the assessment and the plan point at each other, which is what an auditor is looking for.

What an auditor checks, and the utilities findings that recur

An auditor approaching clause 4.5 works from the product backwards. They identify every utility that touches product, packaging or a contact surface, then ask to see the assessment for each one, the monitoring behind it and the reaction when monitoring failed. BRCGS Issue 9 has nine sections and twelve fundamental requirements. Utilities is not among the fundamentals, but the findings it generates are rarely small, as our BRCGS Issue 9 implementation guide sets out.

These are the checks I make on site, in the order I make them. Run them on yourself before someone else does.

• A current water schematic that matches the plant, with sample points marked and dead legs identified
• A sampling plan with written reasoning for the points, the determinands and the frequency
• Laboratory reports naming the method, with evidence that out of specification results were investigated and closed
• Cross connection survey evidence and backflow device testing records
• Ice machine cleaning records and ice sample results, plus a look inside the machine and the bin
• Boiler treatment chemical approval documentation matched to the boiler that feeds culinary steam
• Compressed air test reports naming the sample point, with filter specifications and change records
• Certificates of analysis for packaging gases, tied to deliveries
• The glass and brittle plastic register cross checked against the light fittings actually present
• Pressure differential logs for high care, with the specified range and the action taken on excursions
• Drainage plan with flow direction, drain cleaning records and environmental results by drain
• A contingency plan for loss of power and water with evidence it has been tested or reviewed after a real event

The findings that recur are consistent across sites and sectors. Compressed air with no assessment and no point of use testing. Water sampling done faithfully at the same two convenient taps for years, with no rationale and no rotation. Boiler chemical approvals that cover a different boiler. Ice machines cleaned by nobody in particular. Light fittings above open product that are unprotected and absent from the glass register. Pressure gauges in high care that nobody logs. The compressed air one is the finding I raise most, and it is closed with a single point of use test report.

If your last report was a run of small findings across different services rather than one big failure, the root cause is almost always that no single document ever considered utilities as a set. Our guide to the 25 most common FSSC 22000 non conformances shows how often prerequisite gaps sit behind findings that look like isolated events, and the complete guide to food hygiene audits covers how the visit is structured.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.