Hazard analysis is often misunderstood as a simple brainstorming exercise, but it is actually the most critical scientific judgement in your entire food safety plan. If you fail to correctly identify a "reasonably likely" hazard here, the rest of your HACCP plan — no matter how well executed — will not protect your customer.
Here is your comprehensive guide to performing a hazard analysis correctly, covering the two distinct phases: Hazard Identification and Hazard Evaluation.
Part 1: The two-phase approach to hazard analysis
The correct approach is a methodical, two-step process that moves from broad identification to specific risk assessment.
| Phase | Objective | Key Question | Outcome |
|---|---|---|---|
| 1. Hazard Identification | List all potential hazards | What could possibly go wrong? | Comprehensive list of biological, chemical, and physical agents |
| 2. Hazard Evaluation | Assess significance of hazards | Is this hazard reasonably likely to occur? | Determination of "Significant" vs. "Not Significant" hazards requiring control |
Part 2: Phase 1 — how to identify hazards correctly
This phase is qualitative. You are brainstorming based on science and experience, not yet judging probability.
- Map your inputs and steps: review your process flow diagram and assess every ingredient and step from receiving to distribution. A common mistake is overlooking hazards introduced by packaging materials or during maintenance and sanitation
- Think across three categories: systematically consider all three hazard classes for every step:
- Biological: pathogens like Salmonella, Listeria monocytogenes, and E. coli; parasites; viruses (Hepatitis A, Norovirus); and spoilage organisms
- Chemical: allergens, cleaning and sanitising residues, pesticides, mycotoxins (from mould), heavy metals, and unapproved food additives
- Physical: hard foreign objects causing injury — metal, glass, stones, bone, hard plastic, wood splinters
- Use multiple information sources: do not rely on guesswork. To ensure you do not miss emerging risks, consult published scientific texts, industry recalls, epidemiological outbreak data, and your own customer complaint records
Part 3: Phase 2 — how to evaluate hazards correctly
Once you have a list of potential hazards, you must filter them to find the "significant" ones. This is where many plans fail — either by ignoring real threats or by trying to make every minor issue a Critical Control Point (CCP).
The global standard is to use a risk assessment matrix based on two criteria:
- Severity: if this hazard occurred, how serious would the health consequences be? (e.g., death, hospitalisation, minor injury)
- Likelihood: in the absence of specific controls, what is the probability this will occur in your specific operation?
How to use the matrix
A hazard is considered "Reasonably Likely to Occur" if it has both high severity and at least moderate probability.
- Example (Significant): Listeria monocytogenes growth in a ready-to-eat deli salad. Severity: high (lethal in vulnerable populations). Likelihood: moderate to high if temperature abuse occurs during distribution. Conclusion: significant hazard requiring preventive controls.
- Example (Not Significant): Salmonella in a raw chicken breast intended to be fully cooked by the consumer. Severity: high if not cooked. Likelihood: the hazard is present, but the intended use (cooking by the consumer) mitigates the severity. Conclusion: often handled by labelling and safe handling instructions rather than a CCP at the plant.
Justification is mandatory
For every hazard you deem "Not Significant," you must write a scientific justification in the "Reason for Decision" column of your hazard analysis worksheet. Auditors will scrutinise this closely. For example: "The hazard is not significant because the subsequent validated kill step (bake at 190°C for 20 minutes) achieves a 5-log reduction of Salmonella spp."
Part 4: From hazard to control
Once a hazard is deemed significant, the analysis dictates the required response.
- Control measures: actions to prevent, eliminate, or reduce the hazard
- CCP (Critical Control Point): a specific point in the process where control is applied to eliminate or reduce the hazard to an acceptable level — for example, metal detection or pasteurisation
- PRP (Prerequisite Programme): general operational conditions maintaining a safe environment — for example, pest control, sanitation, and good manufacturing practices. You cannot make "cleaning the floor" a CCP
Part 5: Common pitfalls and pro tips
"One and done" mentality
Hazard analysis is a living document. You must re-evaluate the plan when you change suppliers, change equipment, introduce a new product formulation, or learn of a new emerging pathogen.
Group think
Ensure the HACCP team includes diverse perspectives — maintenance, sanitation, quality, and production. A maintenance engineer knows about metal wear that a QA manager might miss.
Pro tip: justify the "no"
A thorough analysis explains why a hazard is not controlled by a CCP just as rigorously as why one is. Documenting the absence of risk — for example, "No physical hazard from glass because the facility uses shatterproof lighting and strictly prohibits glass containers" — protects you during audits.
By applying this structured, two-phase approach and documenting your scientific rationale, you ensure that your HACCP plan controls what truly matters: protecting the consumer and your brand.