Risk assessment how-to

IFS Broker Risk Assessment for Traders: Building the Hazard Analysis of Broker Services and the Supplier Approval Behind It

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

An IFS Broker risk assessment is a HACCP based hazard analysis of the steps your company is responsible for as a broker, from contract and specification through supplier approval, release and logistics, scored for likelihood and severity, with a control measure, a limit, monitoring and a record for every significant hazard. It sits under KO requirement 2.3.1 and requirements 2.3.2 to 2.3.9, and it drives the risk based supplier approval in 4.4.3. This guide shows you how to build both without buying anything. If you want the finished workbook, it is in ASC’s IFS Broker Version 3.2 Document Templates Toolkit.

What does IFS Broker require from the risk assessment?

Requirement 2.3.1, KO n° 2, asks for product safety control built on a fully implemented, systematic and comprehensive risk management system. The requirements that follow describe how. The assessment covers every process the company is responsible for, allowing for different products and service levels (2.3.3). A multidisciplinary team does it (2.3.4), from complete descriptions and a flow chart (2.3.5). It analyses physical, chemical and biological hazards, allergens included, for likelihood and severity (2.3.6), chooses control measures by a logic you can demonstrate and validates limits (2.3.7), sets monitoring and corrective action (2.3.8), and is reviewed at least yearly and on change (2.3.9). Separately, 2.3.2 asks you to make sure suppliers run their own risk management, with Codex based HACCP at food manufacturers.

Food fraud (4.7) and product defence (chapter 6) have their own assessments, but they feed the same supplier decisions, and the Doctrine on 4.4.3 says the supplier risk assessment must include product defence.

Who should do the risk assessment?

Requirement 2.3.4 asks for a team with enough knowledge of the services, products and hazards. In a trading company, that is the Quality and Technical Manager leading, with the Commercial Manager who knows the customer requirements, the Procurement and Sourcing Manager who knows the suppliers, the Logistics Coordinator who knows the cold chain, and the Quality Controller who sees the product at the packhouse or packer. Where nobody on the team knows a hazard well, for example mycotoxins in nuts, bring in a competent outsider and record it. Appoint the team in writing with terms of reference, and keep each member’s competence evidence. The auditor will ask.

How do you describe the services and draw the flow diagram?

Start with a description of each product group: what it is, origin, destination markets, intended use and consumer, packaging, storage and transport conditions and shelf life. Then describe the service level, because a broker selling fruit free on board is responsible for fewer steps than one delivering to the destination port.

The flow diagram shows the broker steps, not the supplier’s factory steps. For a fresh fruit exporter it might run like this.

1. Customer enquiry and contractDestination, customer code of practice and residue requirements confirmed before acceptance.
2. Specification agreementSpecification signed by the customer, with the market list of permitted treatments.
3. Supplier and service provider approvalPackhouses, farms, cold stores, forwarder, shipping lines, laboratories.
4. Sourcing programme and purchase orderOrder names specification version, market and allowed production units.
5. Packing at the packhouse (outsourced)The supplier’s HACCP plan controls the step. The broker verifies it.
6. Pre-shipment consignment check and document checkInspection, residue results and documents checked, then release or hold.
7. Export inspection, cold store, port and sea freightExport certification, temperature instructions and records reviewed.
8. Customer receiptArrival reports, claims and complaints followed up.

A customer branded dried fruit and nut mix adds product development, label approval, ingredient supplier and contract packer approval, pre-despatch release and road haulage. Verify the diagram against reality, by document walk-through and by seeing outsourced steps on site, and sign the verification. A diagram nobody checked is the first thing an auditor tests under 2.3.5.

How do you score likelihood and severity?

The Standard leaves the method to you, but it must be defined and used consistently. A five by five matrix works well for brokers because likelihood can be tied to evidence you already hold: alerts, results and supplier history.

Score before the specific control in the row is applied, assuming the supplier’s general hygiene prerequisites are in place. In the TK18 workbook a hazard is significant at a score of 8 or more, an illustrative threshold the company confirms. A severity 5 hazard scored at likelihood 1 needs a written justification and is re-examined at every review. Keep the hazards below the threshold on the sheet too, so the reasoning is visible next year.

Where does the control sit when you never touch the product?

This is the part most broker risk assessments get wrong. For each significant hazard, ask four questions in order.

1. Is it controlled at a supplier step?For example the metal detection CCP at the contract packer. If yes, you verify that control and define the evidence you need at release.
2. Does the supplier control need a broker action to work?A specification, a market list of permitted treatments, an approval criterion. That action is your control measure.
3. Can you detect loss of control before the product leaves the supplier?A record check, a result, an inspection. That check is your monitoring and your release gate.
4. If none of these is possible, escalateThe supply is not approved until a control is in place.

A broker’s control measures live in contracts, approvals and release decisions. If your hazard analysis lists washing and metal detection as your own steps, it is describing someone else’s factory.

How do you set and validate limits a broker can check?

A limit must tell a person, without judgement, whether the step is in or out of control (2.3.7). For a broker, limits look like this: no contract accepted until every customer residue requirement is recorded, no fruit released for a market without a compliant residue result for each production unit, no mix lot despatched until the certificates of analysis for pathogens, mycotoxins and sulphites are on file and conform.

Take legal limits from the regulation of the destination market on the day you check, never from memory or last season’s list. For the EU that means Regulation (EC) No 396/2005 for pesticide residues and Commission Regulation (EU) 2023/915 for contaminants. In South Africa, R.246 of 1994 covers pesticide residues and R.1145 of 2004 covers mycotoxins. Validation is the evidence that the limit and control actually work: the regulation itself, the customer’s code of practice, laboratory accreditation scopes, and your own residue and test history over several seasons.

Then set the monitoring (who checks, how often, on what record) and the corrective action for a failure, including what happens to product already shipped (2.3.8). In TK18, every numeric frequency is an illustrative default the company confirms and records on IFSB017 Operating Parameter Schedule.

How does supplier approval connect to the risk assessment?

Requirement 4.4.3 asks for supplier approval and monitoring that is risk based, using defined criteria such as audit results, certificates of analysis, reliability, complaints including fraud, and required performance. The hazard analysis tells you how much harm a product can do. The supplier’s status tells you how much assurance you have. Together they set a risk class.

The frequencies above are illustrative defaults. An approval file then needs the questionnaire, the verified certificate, the risk rating signed off by the quality lead, the audit where the route requires one, the signed specification and quality agreement, product defence and food fraud evidence from the supplier (4.7.5, 6.1 and 6.2), and increased checks on the first consignments. Assess every supplier regularly (4.4.6), by default at least yearly, and straight away after a safety complaint, a certificate suspension or a failed check.

What should you check on a supplier certificate?

• Scope: the products and processes named cover what the supplier actually sends you, from the site that sends it.
• Validity: in date for the whole period of supply, with the next audit window known.
• Status: confirmed on the scheme owner’s database. A PDF alone is not proof, because suspended certificates keep circulating.
• Recognition: GFSI recognition applies to a specific programme, version and scope. Check the GFSI website at approval and record the date.
• Fruit: for fruit and vegetables, the GFS edition of GLOBALG.A.P. IFA version 6 is the one benchmarked by GFSI. The GGN identifies the producer, not each production unit, so check the registered units too, and confirm the packhouse is covered for handling.
• Social add-ons such as GRASP or a SIZA audit are customer requirements, not food safety certificates.

Where a product supplier has no recognised certificate, requirement 4.4.4 allows it only with the customer’s explicit acceptance, and the Doctrine requires that acceptance to be active and evidenced. Where supplier status is unknown, the Doctrine on 4.4.7 expects more frequent and wider testing, justified in writing.

When must the risk assessment be reviewed?

At least once a year and whenever the broker services change (2.3.9). The first annual review must be done before your first certification audit. Triggers worth writing into the procedure:

• A new product, origin, destination market or customer.
• A new supplier, contract packer or logistics provider.
• A change in the law or an MRL in a destination market.
• An incident, recall, complaint trend or border rejection.
• A new alert or emerging risk from horizon scanning.

Record what changed, which rows were rescored, and the knock-on changes to the control plan, testing plan and supplier classes. The sector hazards behind these rows are in our guide to food safety for fruit exporters and traders, and the KOs these assessments protect are in our guide to the IFS Broker KO requirements. For the place of the risk assessment in the full rollout, read IFS Broker certification in South Africa, and for the whole Standard, the requirements chapter by chapter. To learn the method with a trainer, ASC’s Implementation of IFS Broker Version 3.2 for Trading Companies course (R5,500) builds the assessment with you. If your own office or sample store needs a pest control contract, ASC Pest Control covers offices and warehouses.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.