RISK ASSESSMENT · HACCP

Risk Assessment or Hazard Analysis? What an Auditor Means When They Ask for a Risk Assessment

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 13 min read

A hazard analysis is principle 1 of the Codex HACCP system in CXC 1-1969, revised 2022: it identifies significant hazards at each process step and selects control measures. A risk assessment is a separate standing document that justifies one decision, a cleaning frequency, a zone boundary, a supplier rule. Certification schemes ask for both, and findings follow when a site offers one in place of the other.

What is the difference between a hazard analysis and a risk assessment?

A hazard analysis identifies the biological, chemical, physical and allergen hazards reasonably likely to occur at each step of a verified process flow, judges each one on the likelihood of occurrence and the severity of the adverse health effect, and selects control measures. A risk assessment takes one topic, such as cleaning, zoning, suppliers or pest control, and records why the site decided what it decided. Codex CXC 1-1969, revised 2022, names the first of those as principle 1.

The two documents answer different questions. A hazard analysis answers what can go wrong here, and what stops it. A risk assessment answers why we set it at that level, that frequency, that boundary, that acceptance limit, and what would make us change our mind. The first is organised by process step. The second is organised by topic and stands independently of the flow diagram.

The practical test is whether the document survives being read backwards. Pick any number in your system, a four hourly sieve check, a swab count of thirty per month, a two metre buffer at the high care boundary, and ask which document explains where the number came from. If the answer is the hazard analysis, the number is almost certainly unjustified, because a hazard analysis line has nowhere to put that reasoning.

Both documents are living records rather than files produced for the audit. The hazard analysis is reviewed when the process changes. The risk assessment is reviewed when the assumptions inside it change, which is more often than most sites plan for. Our guide to what a HACCP plan contains covers the first document in detail, so this article concentrates on the second.

Where each document sits in a food safety management system

The hazard analysis sits inside the HACCP study and produces the plan that controls significant hazards. Risk assessments sit underneath it in the prerequisite layer and beside it in the management layer. Under ISO 22000:2018 the control measures selected as critical control points and operational PRPs are recorded in the hazard control plan, while the general conditions remain in the prerequisite programme documents where they belong.

Think of the system in four layers. Everything above rests on everything below, and an auditor who finds a weak layer will test the layers above it harder.

Risk assessments appear at every layer. Context and interested parties assessments live at layer 1. Cleaning, zoning, pest, utilities, supplier and building fabric assessments live at layer 2. Foreign body, allergen and microbiological contamination assessments feed layer 3 directly, because the hazard analysis draws on them when it judges likelihood. Environmental monitoring and traceability assessments support layer 4. This is why sites that own only a HACCP file feel constantly under pressure at audit: the file is one layer of a four layer structure.

What Codex actually requires, and what the schemes add on top

Codex CXC 1-1969, General Principles of Food Hygiene, revised 2022, has two chapters: good hygiene practices, and the HACCP system with its seven principles applied in twelve steps. Principle 1 is to conduct a hazard analysis and identify control measures. Codex does not prescribe a library of topic risk assessments. The certification schemes and ISO 22000 based systems are what ask for those, and that gap is where sites lose marks.

The 2022 revision made one point that matters here more than any other, and it is worth stating plainly.

The schemes take that sentence and make it auditable. BRCGS Global Standard Food Safety Issue 9, published 1 August 2022, has nine sections and twelve fundamental requirements, and the food safety plan based on HACCP at section 2 is one of them. Section 4.3 covers layout, product flow and segregation. Section 4.11 covers housekeeping and hygiene. Neither is satisfied by a hazard analysis line, because both are asking about decisions rather than about hazards at process steps.

FSSC 22000 Version 7, published in May 2026, is ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series plus the FSSC additional requirements. That structure puts the same demand on a site from three directions at once: ISO 22000 wants the hazard analysis and the hazard control plan, the ISO 22002 part wants the prerequisite programmes established and verified, and the additional requirements want specific topics addressed on their own terms. Our complete guide to FSSC 22000 Version 7 in South Africa sets out the transition dates in full.

Four things a risk assessment does that a hazard analysis does not

A hazard analysis under principle 1 of Codex CXC 1-1969, revised 2022, identifies and classifies hazards at process steps. A risk assessment justifies, quantifies, bounds and reviews. Those four verbs describe work that a hazard analysis table has no column for, and they are exactly the four things an auditor asks about when a number in your system looks arbitrary. This is the argument for keeping the documents separate rather than trying to widen the HACCP table.

1. It sets the numberHow often the sieve is checked, how many swabs are taken and where, how long between full strip cleans, how far the buffer extends, what titration reading is acceptable. A hazard analysis says cleaning controls the hazard. Only the risk assessment says why every four hours rather than every shift.
2. It justifies decisions that are not tied to a process stepSupplier approval, hygienic zoning, pest programme design, chemical selection, waste routing and building fabric are site level decisions. They do not belong to a step on the flow diagram, so the hazard analysis cannot hold their reasoning.
3. It records residual risk and the review triggerAfter the controls are applied, what risk remains, is it tolerable, and what event would force a re-assessment. A hazard analysis records the control measure. It does not record what would change the answer.
4. It covers threats that are not food safety hazardsFood fraud vulnerability, food defence, emergency preparedness, organisational context and interested parties are all assessed risks that never appear in a hazard analysis, because they are not hazards at process steps.

A hazard analysis tells you what can hurt someone. A risk assessment tells you why you chose to control it the way you did.

This is the section I would ask a technical manager to read twice. A hazard analysis alone does not justify a cleaning frequency, a zoning boundary, a supplier approval rule or a pest programme design. Those four decisions carry most of the risk on a food site and almost all of the audit exposure, and the schemes ask for them separately for that reason. Sites that understand this stop trying to make the HACCP file carry weight it was never designed to carry.

PRP, operational PRP and CCP: which document decides which?

Prerequisite programmes are the conditions the site maintains at all times. Operational PRPs and critical control points are control measures selected through the hazard analysis to control a significant hazard. The hazard analysis is the document that decides which is which. ISO 22000:2018 records operational PRPs and CCPs in the hazard control plan, and leaves the prerequisite programmes themselves in their own documents.

Getting this hierarchy the wrong way round is the most common structural error I see in a documented system. A site classifies metal detection as a prerequisite programme because it runs all the time, or classifies handwashing as an operational PRP because it feels important. The classification is not a matter of taste. It comes out of the hazard analysis, and it changes what evidence the site then has to produce.

Two consequences follow. First, a control measure cannot be an operational PRP unless the hazard analysis identified a significant hazard for it to control, so a hazard analysis that finds no significant hazards but a hazard control plan full of operational PRPs is internally inconsistent, and an experienced auditor will spot it in minutes. Second, prerequisite programmes still need verification even though they are not in the hazard control plan, which is the requirement most sites miss.

What is a PRP verification plan, and why do auditors ask for it?

A PRP verification plan states, for every prerequisite programme written to ISO 22002-1:2025 or SANS 10049, what evidence proves that programme is working, by what method, at what frequency, who performs it, what the acceptance criterion is, what happens when it fails, and who reviews the results. Auditors ask for it because verifying prerequisite programmes is a separate requirement from having them, and most sites hold only the programmes.

The confusion is understandable. A site has a cleaning schedule, a pest contract, a glass and brittle plastic register, a maintenance system and a training matrix, and each of them generates records. Records are not verification. Verification asks a different question: taken together, is this programme achieving what it was put in place to achieve, judged against a criterion set in advance by someone who is not the person doing the work.

• Each prerequisite programme listed by name, with an owner
• The verification method for each: inspection, swab, audit, review of records, trend analysis, third party result
• The frequency, with the risk assessment that justifies the frequency referenced by document number
• The acceptance criterion, written before the result is generated rather than after
• The escalation route when the criterion is not met, including who decides on product
• Where the results are consolidated for management review
• The review date and the trigger events that force an earlier review

The July 2025 restructure of the ISO 22002 series sharpened this. Most parts moved from Technical Specification to full International Standard, with ISO 22002-100:2025 published on 29 July 2025 as a new common baseline and ISO 22002-1:2025 covering food manufacturing, while ISO/TS 22002-3:2011 for farming stayed a Technical Specification after review in 2025. Sites transitioning need to show which prerequisite requirements apply to them and how each one is verified, which is a table, not a paragraph.

The documents a site needs before its hazard analysis will hold up

A hazard analysis assumes the conditions of the premises are already established, documented and working to a named standard such as ISO 22002-1:2025 or SANS 10049, because control measure selection depends on them. If the zoning, cleaning, supplier and pest decisions are undocumented, the hazard analysis rests on assumptions the site cannot evidence. That is why auditors so often start in the HACCP file and finish in the prerequisite programmes.

• Product descriptions and intended use, including the vulnerable groups the product may reach
• Flow diagrams verified on site, on the shift and the line they describe, signed and dated
• Prerequisite programmes written to a named standard, not a folder of forms
• A PRP verification plan covering every programme
• Topic risk assessments for cleaning, zoning, suppliers, pest, foreign bodies, allergens and utilities
• Validation evidence for each control measure the hazard analysis selects
• Calibration and maintenance records for anything the plan relies on to measure
• Competence records for the multidisciplinary team that performed the analysis
• A change control route so that a new line or new supplier triggers a review of both documents

Sites often ask which of these to build first when the audit date is close. The honest answer is that the prerequisite layer takes longest and carries the most findings, so it is the layer to start on. A prepared site can point at a decision, name the document that justifies it and produce the verification result in the same minute. That is the pattern behind our guide to food hygiene audits, and behind the twenty five most common FSSC 22000 non-conformances.

Worked example: a metal fragment as a hazard analysis entry and as a risk assessment

Take a dry blending line producing a powdered savoury mix, with an in line sieve before filling and a metal detector after filling, and run one metal fragment from a fatigued sieve wire through both documents: the hazard analysis under principle 1 of Codex CXC 1-1969, and the risk assessment that sets the sieve check interval. This is a worked example built to illustrate the structure, not a client case, and the figures are illustrative.

Read the two columns against each other and the division of labour is obvious. The hazard analysis column cannot tell you why the interval is four hours rather than eight, and the risk assessment column cannot tell you whether metal detection is a CCP. A site that owns only the left hand column will be asked for the right hand one. A site that owns only the right hand one has no HACCP plan.

Note the quarantine rule in the risk assessment column, because it is the part sites forget. If the sieve is checked every four hours, then a broken wire found at a check puts up to four hours of production at risk, and the assessment has to say so. Setting the frequency and setting the recall exposure are the same decision, taken once.

The findings that come from confusing the two

Findings raised on this topic follow a small number of shapes, whether the audit is against BRCGS Issue 9, FSSC 22000 Version 7 or ISO 22000:2018, and whatever wording the certification body prefers. Each one is the same underlying gap: a decision was made, it was reasonable, and nothing in the system records the basis for it. The correction is usually quick. The corrective action is the part that takes time.

That last one deserves a comment, because it is the trap in buying documents of any kind, including ours. A template is a structure and a starting position. It becomes a site document when the site scores its own conditions into it, names its own owner, dates it, signs it and sets its own review trigger. An unedited template is worse than no document, because it tells an auditor that the thinking never happened. The completion guide in every ASC pack exists to force that adoption step.

The other pattern worth naming is the site that answers a prerequisite finding by adding a line to the HACCP file. It never satisfies the auditor, because the requirement was about the condition and its verification, not about the hazard. Our guide to implementing BRCGS Issue 9 works through where those requirements sit, and the training site guide to prerequisite programmes and GMP in South African food manufacturing covers the programme layer in more depth.

What to build first if you have neither

Build in the order the system depends on, not in the order the audit checklist is printed. Prerequisite programmes written to ISO 22002-1:2025 or SANS 10049 first, then the verification plan that proves they work, then the topic risk assessments for decisions already taken, then the hazard analysis, then the hazard control plan that comes out of it. Working the other way round produces a HACCP file resting on nothing.

1. Write the prerequisite programmes to a named standardISO 22002-1:2025 for food manufacturing, or SANS 10049 in the South African route. Name the standard in the document so the scope of each programme is auditable.
2. Build the PRP verification planOne table covering every programme, its verification method, frequency, acceptance criterion, owner and escalation route. This is the PRP Verification Plan Risk Assessment at R690.
3. Assess the decisions you have already madeCleaning frequency, zoning boundaries, supplier approval, pest programme design, foreign body control. You are not inventing new controls, you are recording why the existing ones are set where they are.
4. Run the hazard analysis on a verified flow diagramTwelve steps, seven principles, with hazard analysis as principle 1. Verify the diagram on the floor before you analyse anything against it.
5. Produce the hazard control planCCPs and operational PRPs with their limits, monitoring, corrections and verification, cross referenced back to the risk assessments that support them.
6. Set the review cycleDates, triggers and owners on every document, and one management review that reads the verification results together rather than one programme at a time.

Sites take one of two routes through that list. Some build it themselves from templates, which is the cheaper route and works well where there is a competent technical person with time. Others have ASC build it with the team on site or remotely, which is scoped and quoted as one figure rather than billed by the hour, with consultation available from R480 an hour where only advice is needed. Both routes end in the same place, and ASC is willing to audit sites it has supplied documents to.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.