RISK ASSESSMENT · CLEANING AND DISINFECTION

Cleaning and Disinfection Risk Assessment: How to Justify Your Frequency and Method to an Auditor

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 13 min read

A cleaning and disinfection risk assessment scores every cleanable unit on your site, then sets the frequency, method and chemical that the score justifies. BRCGS Global Standard Food Safety Issue 9, published 1 August 2022, makes housekeeping and hygiene at clause 4.11 one of twelve fundamental requirements, so an auditor will ask why you clean that surface at that interval, and habit is not an answer.

Why a certification body asks you to justify cleaning by risk

Certification bodies stopped accepting cleaning schedules on their own because a schedule records what you do, not why. BRCGS Global Standard Food Safety Issue 9 places housekeeping and hygiene at clause 4.11 and lists it among the twelve fundamental requirements, where a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. A schedule is a habit until something explains the interval, and the assessment is that explanation.

Issue 9 was published on 1 August 2022 and has nine sections and twelve fundamental requirements: 1.1, 2, 3.4, 3.5.1, 3.7, 3.9, 4.3, 4.11, 5.3, 6.1, 6.2 and 7.1. Cleaning sits in that list alongside senior management commitment and the HACCP study, which tells you how the scheme views it. A finding against a normal clause costs you a corrective action. a major non-conformity against the statement of intent of 4.11 is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified.

IFS Food and SQF do not use the same numbering, and I am not going to quote clause text I have not put in front of you. What both require, in substance, is that cleaning and sanitation are documented, that the frequency and method are appropriate to the risk of the area and the equipment, that the chemicals are approved for food use and applied as specified, and that the effectiveness is checked and recorded. Read the clause reference off the current issue of the standard you are certified to, and write that reference into your own procedure rather than copying one from a template. The Cleaning and Disinfection Risk Assessment Template (RA03), R690, carries a mapping column for exactly this reason.

If you sit under FSSC 22000, the cleaning requirement reaches you through the sector prerequisite programme standard rather than through ISO 22000 itself. The ISO 22002 series was restructured in July 2025, with ISO 22002-100:2025 published on 29 July 2025 as a new common baseline and ISO 22002-1:2025 covering food manufacturing. Codex CXC 1-1969, General Principles of Food Hygiene, revised 2022 in the 2023 edition, treats cleaning as a general principle rather than a numbered instruction, which is why the scheme standards push the justification back onto you.

South African law comes at it from a different angle. R638 of 2018, the Regulations Governing General Hygiene Requirements for Food Premises, the Transport of Food and Related Matters, published under Government Notice R.638 in Government Gazette 41730 on 22 June 2018, is the hygiene baseline enforced by your local authority, and regulation 3(1) prohibits handling food on premises without a valid Certificate of Acceptability. An environmental health practitioner arriving to assess your premises is looking at hygiene condition. Your certification auditor is looking at whether you can defend the system that produced that condition. You need both to hold.

A cleaning schedule tells an auditor what you intend to do. A cleaning risk assessment tells them why that is the right thing to do.

What a cleaning and disinfection risk assessment covers

A cleaning and disinfection risk assessment is the document BRCGS Issue 9 clause 4.11 expects to sit behind your schedule. It covers every cleanable unit on the site, the hazards each one presents, the score those hazards produce, and the cleaning decision that follows: frequency, method, chemical, concentration, contact time, tools, the person responsible, and how the clean is checked. It also records what was validated, when, and what would force a review.

The scope is wider than most sites expect. It is not a list of machines. It runs from the ceiling void above an open filling line down to the drain in the raw preparation room, and it includes the things nobody owns: cable trays, compressed air lines, the wash bay itself, the cleaning equipment store and the hoses left coiled on the floor.

It also has to be honest about hazards other than microbiological ones. A clean that removes bacteria may leave allergenic protein behind. A disinfectant applied without a final rinse where a rinse is required leaves chemical residue. A worn scouring pad sheds fibres onto open product, which is a physical hazard created by the cleaning itself. An assessment that thinks only about micro leaves allergen, chemical and physical residue unexplained. Sites that need to go deeper on the biological side usually pair this pack with the Microbiological Contamination Risk Assessment Template (RA14), R690.

How to break a site into cleanable units

A cleanable unit is the smallest thing you can hand to a person with a written instruction and expect them to clean the same way every time, and the register of those units is what the cleaning and sanitising requirements of ISO 22002-1:2025 are audited against. Break the site into six families: areas, surfaces, product contact equipment, services, drains and overheads. Every unit gets a row, a score and a frequency. A line is not a unit. A filler nozzle assembly is.

The test I use on site is simple. If two people could reasonably clean it two different ways, split it further. A depositor is not one unit. It is a hopper, a piston assembly, a nozzle set, a drip tray, an external frame and a set of guards, and four of those come off for cleaning out of place while two stay on the machine. Written as one row, the schedule cannot tell you whether the pistons came out last night.

1. AreasRooms and defined spaces: high care, low risk, raw intake, dispatch, wash bay, chemical store, staff changing rooms and the cleaning equipment store itself.
2. SurfacesFloors, walls, doors, door furniture, coving, drain covers, dado rails, hand contact points and the underside of tables where hands actually go.
3. Product contact equipmentEverything that touches open product, split into the parts that come off and the parts that stay on. Include blade guards, seals, gaskets and dead legs.
4. ServicesCompressed air lines and filters, water outlets, steam lances, extraction hoods and ducting, air handling units, filter housings and condensate trays.
5. DrainsEvery gully, channel, grid and trap, with the direction of flow recorded, because a drain that flows from raw towards a high care boundary is a different risk from one that does not.
6. OverheadsPipework, cable trays, light fittings, structural steel, ceiling panels and anything above open product where dust or condensate can form and fall.

Overheads and services are where most registers stop, and they are exactly where auditors start. On a site I audited, the cleaning register had 214 rows and not one of them was above shoulder height. The technical manager said the overheads were cleaned during the annual shutdown. When I asked to see the record, the record existed, signed and filed, but there was no risk assessment anywhere that said annual was the right interval for a chilled pipe run directly above an open depositor. The finding was not that the site was dirty. The finding was that the interval had never been decided by anyone.

The factors that drive a cleaning risk score

Eight factors decide how hard and how often a unit has to be cleaned, and the ASC register at R690 scores every one of them: product risk, open product exposure, soil type, surface material and condition, accessibility, allergen presence, hygiene zone, and history. Score each one from 1 to 5, add them, and you have a defensible number between 8 and 40 that an auditor can follow back to the evidence.

The scale matters less than the consistency. What an auditor tests is whether two assessors scoring the same unit would land in the same band, and whether the reasons written in the comment column match the number in the score column. A register full of fives with an empty justification column is worse than a register full of threes with a sentence behind each one.

History is the factor sites leave blank, and it is the one that carries the most weight in an audit. If the same slicer failed a protein swab three times in a quarter and the score never moved, your assessment is not being used. Pull the last twelve months of swab results, complaints, internal audit findings and environmental monitoring positives before you score anything. If you do not have an environmental programme to draw that history from, the Environmental Monitoring Risk Assessment Template (RA19), R690, is the pack that builds it.

Surface condition is the factor that quietly converts a maintenance problem into a cleaning problem. A pitted work surface cannot be cleaned to the same standard as a sound one, no matter what chemical you put on it, and increasing the frequency does not fix it. Score it honestly, then raise a maintenance action rather than a cleaning action. That decision trail is what the Equipment Suitability and Maintenance Risk Assessment Template (RA10), R690, is built to carry.

How to set frequency and method from the score

Convert the total score into a band and let the band drive the decision, because neither BRCGS Issue 9 clause 4.11 nor ISO 22002-1:2025 prints a cleaning frequency for you. Scores of 32 to 40 are critical and earn a full strip clean at every changeover and every shift end. Scores of 22 to 31 are high, 14 to 21 medium, and 8 to 13 low. The band sets the minimum, and anything you clean less often than the band needs a written explanation.

Worked example. Four cleanable units from a chilled ready to eat site, scored on the eight factors above, with the frequency and method the score justifies. The numbers are illustrative and are there to show the reasoning, not to be copied into your own register.

The drain in that table scores 22 with almost no product risk, because soil type and history carry it, and that is correct: drains are the reservoir, not the exposure point. The overheads score 28 mostly on accessibility and position. An annual clean is hard to defend at that score, and a scheduled stop with a visual trigger is easy to defend.

Cleaning in place versus cleaning out of place

Cleaning in place cleans a closed system without dismantling it, by circulating detergent and disinfectant through the pipework, tanks and heat exchangers at a controlled temperature, flow and time, and the choice between the two routes is a BRCGS Issue 9 clause 4.11 decision. Cleaning out of place means the parts come off and are cleaned in a wash bay or cabinet washer. The risk assessment decides which route a unit takes, and each route is validated differently.

The variables are the same in both cases, and they trade off against each other: chemical concentration, temperature, mechanical action and contact time. Reduce one and you must increase another. That trade off is why a site that quietly drops the CIP wash temperature to save energy has invalidated its cleaning programme even though nothing in the written schedule changed.

Take your flow, temperature and concentration figures from the equipment supplier’s design specification and your chemical supplier’s technical data sheet, and reference those documents in the assessment. Do not publish a number you cannot trace to a document, because the auditor’s next question is where the number came from.

How to validate a clean, and how to verify it afterwards

Validation is the evidence, gathered before the method goes into routine use, that the written procedure removes the soil to the level BRCGS Issue 9 clause 4.11 makes you define. Verification is the routine check that the validated procedure was followed and worked on that occasion. Validation happens once and again whenever something changes. Verification happens every clean, or at the frequency the risk assessment sets.

Confusing the two is the most common technical error I see in cleaning files. A site shows me a folder of ATP results and calls it validation. ATP results are verification. They tell you that this clean, on this day, left less organic residue than your action level. They tell you nothing about whether the procedure itself is capable, because a good result from a badly written procedure followed by a diligent operator proves only that the operator was diligent.

To validate, run the procedure exactly as written, on a worst case soil load, and sample the hardest to clean feature on the unit, on consecutive occasions and ideally with different operators. Then write the conclusion as a statement: this procedure, with this chemical at this concentration, at this temperature, for this contact time, removes this soil from this unit to this level, evidenced by these results on these dates. That paragraph is usually the one that is missing.

How to validate an allergen changeover clean

An allergen clean has to be validated by an allergen specific method, an ELISA test or a lateral flow test validated for that allergen in that matrix, because the allergens at regulation 43 of R146 of 2010 are what your label has to be right about. Once the method is validated, the changeover is verified in production using the same allergen specific test at the points the assessment identifies. ATP and protein swabs support the clean. Neither of them proves the allergen has gone.

ATP reports organic residue and a total protein swab cannot separate milk protein from meat protein, so neither answers the question the label makes you answer. The worst case changeover, the limit of detection to record, the sampling points, the consecutive run that turns a result into a validation and the labelling consequence are all worked through in our guide to allergen risk assessment and cross contact control.

What evidence an auditor asks for

An auditor working to BRCGS Issue 9 clause 4.11 asks for the chain: the risk assessment that set the frequency, the schedule that implements it, the procedure that describes the method, the chemical data that supports the concentration and contact time, the training record for the person who did it, the completed record, and the verification result that released the equipment. Any broken link in that chain is the finding.

• The cleaning and disinfection risk assessment itself, dated, signed, with the scoring rationale visible in a comment column
• A cleaning schedule that lists every unit in the register, with nothing in the schedule that is absent from the assessment
• Cleaning instructions or cleaning cards at the point of use, in the language the cleaning team actually reads
• Technical data sheets and safety data sheets for every chemical, with the approved use, dilution, temperature and contact time
• Evidence that concentration is checked in practice: titration results, dosing unit calibration or verification records
• Validation reports with raw data, dates and a written conclusion, including the allergen validation where allergens are handled
• Verification records showing visual, ATP, protein or microbiological results and the release decision taken on them
• Training records with evidence of competence assessment, not only an induction signature
• Corrective actions raised when a verification result failed, and evidence the action closed
• Records of review after a change to product, equipment, chemical, layout or cleaning contractor

Colour coding is tested physically rather than on paper. An auditor walks to the cleaning equipment store and looks at whether the high care tools are actually on the high care rack. Bring the storage arrangement into the assessment as a cleanable unit in its own right, with its own frequency.

The cleaning findings that come up again and again

Five failures account for most cleaning findings I raise against BRCGS Issue 9 clause 4.11, one of the twelve fundamental requirements: a schedule with no validation behind it, chemical concentrations that are never checked, cleaning staff trained once at induction and never again, drain equipment stored with everything else, and cleaning records signed before the work finished. None of them are about effort. All of them are about control.

Chemical concentration is the quiet one. A written procedure says 2 percent, the dosing unit was set correctly at installation three years ago, and nobody has checked it since. On one site the team was hand diluting into a bucket by capful because the dosing unit had failed months earlier, and the shift supervisor had decided that a stronger mix was safer than a weaker one. The disinfectant was being applied at several times its approved concentration onto product contact surfaces with an inconsistent final rinse. The micro results were excellent. The chemical residue risk was entirely uncontrolled, and nothing in the file showed it.

Training once at induction fails on two fronts. It fails the standard, and it fails regulation 10(1) of R638 of 2018, which requires the person in charge to be suitably qualified or otherwise adequately trained, with routine assessments of the impact of training and records kept and available to an inspector. Assessing impact means watching someone clean and recording what you saw, not reissuing the same slide deck. Cleaning teams also turn over faster than production teams, which means the induction record in your file may belong to somebody who left last year.

Drains are cleaned last on most sites, which is correct, and then the tools go back on the same rack as the food contact tools, which undoes the whole point. Drain equipment needs its own colour, its own store and its own line in the register. The same applies to the person: if the drain cleaner walks straight back into high care, the sequence you designed has been defeated by the route they took.

How to keep the cleaning risk assessment alive

A cleaning risk assessment is reviewed on a fixed annual cycle and on every trigger, because clause 4.11 is a BRCGS Issue 9 fundamental and a stale register fails it. The triggers are a new product, new allergen, new equipment, a change of chemical or supplier, a layout or zoning change, a new cleaning contractor, a failed verification result, an environmental positive, a customer complaint or an audit finding. The review is recorded with a date, an author and a note of what changed.

Give the register a role in daily decisions and it stays current on its own. A failed verification swab should force the corrective action form to state whether the score changes. An engineering handover should not close until the new unit has a row in the register. A cleaning contractor’s scope should be written from the register rather than from a quote.

The version of this I see most often is a register dated three years ago, signed by a technical manager who has since left, sitting next to a production area that has been relaid twice. The document is not wrong in any single row. It is simply describing a factory that no longer exists, and an auditor works that out in about four minutes by walking the line with the register in hand and pointing at the third machine.

For related reading on how cleaning findings behave inside a full audit, see our guides on BRCGS Issue 9 implementation, the Issue 9 audit preparation countdown, the most common FSSC 22000 non conformances and food hygiene audits. Sites moving to the new scheme version should also read our FSSC 22000 Version 7 guide, and the training site carries a deep guide on prerequisite programmes and GMP in South African food manufacturing.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.