Risk Assessment is an important activity in food safety and quality management. GFSI standards such as BRC Global Standards and the SQF code require the documentation of risk assessments as part of the certification process. One needs only to read the standards to see that the notion of risk assessment and mitigation form the basis of the Food Safety Management System (FSMS) or Quality Management System (QMS). For instance, the word “risk” is utilized over 50 times in SQF Food Manufacturing version 9.0.
When are risk assessments required in SQF 9?
A documented risk assessment is required to evaluate
- The development of an HACCP plan or food safety plan including validation of cleaning and sanitation procedures (biological and allergenic hazards);
- The development of a food fraud vulnerability and mitigation plan;
- The development of a food defence plan;
- The suitability of an internal audit schedule;
- The need for an environmental monitoring program;
- The request for an exemption to Module 11 requirements;
- The adequacy of clothing and hair policies within the site;
- The adequacy of the pest management and equipment maintenance programs;
- The presence of allergens in raw materials, ingredients, and processing aids, including food-grade lubricants;
- The suitability of the manufacturing environment (piping and sanitary waste, wastewater handling, temporary and overflow storage, ducting and overhead areas)
- The risk level of contract manufactured foods;
- The risk level of domestic and foreign suppliers of processed food, ingredients and raw materials.
Risk identification, analysis and mitigation in the food industry decreases the likelihood of negative outcomes while ensuring positive ones. For instance, examples of negative outcomes include the risk of a product recall, loss of revenue due to food fraud, and enforcement actions (stripping of manufacturing licenses by authorities, frequent government inspections, and product seizures). On the flip side, maintaining a food safety certification will ensure business sustainability by enhancing consumer trust and goodwill.
In the recent past, risk assessments have been conducted in a more formal manner using risk management tools. The latest update of the Codex HACCP standard (2020) encourages the use of such tools. Accredited food safety training courses delivered by certification bodies often highlight simple quadratic matrices to be used as part of a risk assessment for HACCP, food fraud mitigation and food defence. These matrices can therefore be used to assess intentional food safety contamination risks (food fraud, food defence) or unintentional risks (food safety). They are increasingly used to evaluate the adequacy of GMP programs or to assist with internal auditing functions. Matrices may be used to calculate or establish different risk outcomes. They should be designed for the purpose of establishing food safety or quality controls. Once selected, they must be used consistently throughout the assessment. The risk assessment must be documented.
What is a quadratic risk matrix?
A quadratic risk matrix is a visual tool that characterizes multiple levels of negative outcomes (ex: low risk, medium risk, high risk, very high risk) for a number of factors that control these specific risks. For example, Likelihood of Hazard and Severity of Hazard are two variables that are assessed in a HACCP risk analysis. Risks related to food safety hazards can be biological, chemical/radiological and physical in nature. For Food Fraud, we tend to use the likelihood that the fraud will occur, the Level of Detection of the Fraud and sometimes the Level of Profitability. For food defence, we consider the likelihood that the attacker will strike and the level of access to a given area, and the equipment of food within the site. The total risk is obtained by multiplying the risk levels for each of the factors if they are numbered, or by cross-referencing the risk outcomes which may be colour coded and labelled. The safety teams then decide what control measures are needed based on the total risk level.
Source: Introduction to Codex HACCP and Hazard Analysis for Risk-Based Measures Workshop retrieved from: https://safefoodservices.co.nz/wp-content/uploads/2018/07/Codex-HACCP-and-Hazard-Analysis-for-Risk-Based-Measures-White-Paper-11-July-2018.pdf
In the food safety matrix shown above, Potential Consequences (“Severity”) are classified into five increasing levels of significance (L6 to L2 which can be numbered from 1 to 5). Each one is attached to a risk level from Not Significant to Severe. The vertical axis addresses the probability of occurrence (“likelihood”) with five levels ranging from Rare to Almost Certain which can also be numbered from 1 to 5.
The corresponding Total Risk is found at the junction of each factor for the level considered. Consequently, the Total Risk level for a hazard which is Rare (Risk = 1) and presents Minor Consequences (Risk= 2) is 1 X 2 = 2 (Low Risk, pictured in Green). The maximum Total risk level for this matrix is 5 (Severe) X 5 (Almost Certain) = 25. The lowest risk level is 1: (Rare – Risk of 1) X (Not Significant – Risk of 1) = 1.
The HACCP team or the PCQI (Preventive Controls for Human Food – FSMA) must decide what constitutes a significant hazard for the purpose of determining CCPs and Preventive Controls. The risk boundary is documented in the plan. In our example, it could be hazards that are rated high and very high risk when considering Potential Consequences and Likelihood as variables.
Using the matrix in HACCP and GMP:
Problematic #1: Assess allergen cross-contact risks (chemical hazards) during manufacturing
Severity: Major, even Severe in the case of anaphylactic shock.
Likelihood: Likely to Almost Certain if allergenic and non-allergenic products are produced on the same line during a regular shift (scenario 1). Rare or Unlikely if a dedicated area or line is used for the manufacturing of the allergenic product (scenario 2).
Estimation of Total Risk: Very High Risk (scenario 1), Low to High (scenario 2).
The total risk level may be discussed and fine-tuned with the food safety team/PCQIs. The handling of peanut allergens may increase the risk for a product intended for the general public (zero tolerance). A processing line with dedicated employees located 30 feet away from an allergen handling or storage area may result in a lower risk.
Outcome: Allergen Cleaning between production batches is required and must be highly controlled. This activity is a CCP or an Allergen Preventive Control (Scenario 1). When the risk is lower, the allergen control program can be relied upon and may be supplemented with additional controls (such as engineering controls to avoid the spread of allergens from one area to another or the controlled flow of materials and personnel). The team can then use the site GMP inspection program and internal audit program to gauge the adequacy of the controls.
Problematic #2: Are hairnets required to be worn by all staff in the plant? Can we ask SQFI for an exemption for employees who are shaven bald? Can we update our hair-covering policy for employees working in warehousing?
Severity: Moderate to Major if we consider the spread of communicable diseases in exposed food zones. Food handlers may also touch ears or scalp which is difficult to monitor.
Likelihood: Possible or Likely
Estimation of Total Risk: Medium to High
Outcome: Hair coverings support health and hygiene practices and are a regulatory requirement for food handlers. You may decide to relax the hairnet policy in areas where a product is not exposed (storage warehouse) but ensure that staff conducting product sampling and inspections in these areas wear appropriate PPEs.
Food Fraud Vulnerability Assessments and Mitigation Plans
Let’s now discuss Food Fraud Vulnerability Assessments. The following matrix is often used to conduct such evaluations. Green risk level is considered low while red is high. You can number each risk level for Likelihood of Occurrence and Detection to establish a total risk level from 1 to 25 as we did earlier with the Food Safety/HACCP risk matrix. You then establish the risk boundary. Ingredients and materials presenting food fraud risks in amber and red should be addressed as part of quality and food safety plans.
Source: Understanding Food Fraud and Mitigation Strategies. Retrieved from: https://www.ifsqn.com/fsf/Understanding%20Food%20Fraud.pdf
The use of paid search options such FoodChain ID, HorizonScan will facilitate the risk identification and analysis process. Free food fraud resources also exist such as Trello Food Fraud Advisors or resources from Dr. John Spink (MSU).
In order to satisfy the requirements of SQF 9, the fraud assessment must be conducted on materials, ingredients, processed products including functional packaging and labels that may be counterfeited, misrepresented (false claims), substituted, diluted or adulterated for economic gain. You may group foods and ingredients that share similar characteristics.
Problematic #1: Perform a food fraud risk assessment on black pepper.
Likelihood of occurrence: Unlikely to Fairly Likely if product is whole and imported, Likely to Very Likely if materials are ground and imported for certain markets associated with Food Fraud. For reference, FoodChain ID (Decernis) identifies 29 inference reports for ground black pepper and 2 adulteration incidents. For peppercorn, the database lists 4 substitution incidents and 9 inference reports of adulteration (2021 data). The sources of the fraudulent spices were reported to be primarily found in India and Vietnam.
Likelihood of detection: Fairly Likely to Certain for whole peppercorns and Fairly Likely to Likely if ground.
Total risk score: Medium Risk (Yellow) at most for imported spices. Analytical laboratories can easily detect fraud and confirm authenticity of black pepper using spectroscopic techniques. You can then request a Certificate Of Analysis (COA) for each delivery. Opting for a domestic and trusted food supplier will also decrease the risks.
Problematic # 2: Perform a risk assessment on functional food packaging.
Likelihood of occurrence: Likely if regulations around plastics or recycled materials increase the price of food packaging.
Likelihood of detection: Fairly Unlikely for functional packaging.
Total risk score: High Risk (Red). Controls must be robust and can include material inspections and analytical testing at receipt as well as monitoring the price fluctuations of packaging and components of packaging materials (ex: can liners). Understanding the supply chain for these materials is critical to verify that packaging vendors are trustworthy.
Sirocco Food + Wine Consulting offers SQF certification consulting services. We develop food safety and food fraud mitigation plans. We offer SQF 9 document templates for food manufacturing. Our team is SQF certified in consulting and training. Contact us to request a quote.
