Change Country
-or-
In this article, Denis Kiely explains why risk assessments often look complete on paper but still fail to reduce inherent risk. You will learn:
By Denis Kiely
Walk into almost any food business and you will find risk assessments. They are in HACCP files, audit folders and spreadsheets across the site. That sounds reassuring, but in my experience the real issue is not whether organisations are doing risk assessments, it is whether those risk assessments are actually helping them reduce risk in a meaningful way. Too often, they are not.
I do not say that to criticise people. Most teams are doing the best they can with the tools, training and expectations they have been given. The problem is that many businesses still confuse hazard with risk, treat the exercise as something to complete rather than something to understand and rely on tools that produce numbers without producing clarity. When that happens, the business may believe it is managing food safety well while still leaving itself exposed.
One of the most common misunderstandings I see is the idea that hazard and risk are interchangeable. They are not. In fact, I often describe them as being like oil and water. They do not mix. Hazard identification and risk assessment are two different activities and if you confuse them, your decision making starts to weaken very quickly.
Hazard identification asks a straightforward question: what could cause harm? Risk assessment asks a different question: how likely is that harm to occur and how severe would the impact be? In food safety terms, the hazard may be biological, chemical, physical or allergen. Risk is something more complex. It involves thinking about probability, severity, inherent risk, residual risk and whether the outcome is acceptable or unacceptable. Can a hazard like salmonella which has a significant severity ever pose an acceptable Risk? Yes, it can.
That distinction matters because the purpose of risk assessment is to support better decisions. If you identify a hazard but do not properly assess probability and severity, you cannot logically decide whether your controls are good enough. That is where confused thinking can begin and weak decisions follow.
This is not just a technical issue for QA. Weak risk assessment has consequences across the business. I have seen sites go into audits with risk assessments that look complete on paper, only to struggle when asked to explain why a decision was made, what changed after a control was applied or why the residual risk is still being described as unacceptable. Audits do not create those problems. They reveal them.
It also affects commercial confidence. If a supplier tells me the risk is still unacceptable even after the controls are in place, the question is obvious: why would I buy that product? That is not just a technical gap. It is a credibility issue. It affects how customers, auditors and senior leaders view the strength of your food safety thinking.
Another pattern I see is businesses going through the motions. The matrix gets completed, the form gets saved and everyone can say the risk assessment has been done. But when you look at the outcome, the business is not actually learning anything useful from it. The exercise becomes a task rather than a decision making tool to protect the business and consumer.
A better question is not “Have you completed the risk assessment?” It is “What has the risk assessment told you about your business?” If the answer is vague, if the team cannot explain the logic or if the controls do not clearly reduce risk to an acceptable level, then the exercise has not been worthwhile. A strong risk assessment should tell you where your business is exposed, where your controls are working and where there may still be unacceptable risk.
A lot of organisations assume that once they have a risk matrix, they have a risk assessment. I do not agree with that. A matrix is only a tool and some tools are flawed from the start. I have seen scales that run from 1 to 432 and others where 1 represents the highest risk and 25 the lowest. That is counterintuitive and not helpful. If the tool is not logical, the outcome will not be logical either.
If one of those is weak, the whole exercise becomes difficult to defend. Poor tools lead to poor decisions and poor decisions eventually become audit findings, customer concerns or internal confusion.
So what does best practice look like? In my view, three things are essential. First, risk assessment should be done by a team, not by one person sitting alone with a spreadsheet. If engineering is not in the room, if operations is not in the room or if the people who understand raw materials, equipment and the factory environment are missing, the assessment process is flawed.
Second, the team must focus on reasonably foreseeable hazards, not every imaginable what-if scenario. If somebody constantly asks “what if the sky falls?” the process loses focus. The focus must be on what is reasonable not conceivable. The focus must be on what is reasonably foreseeable based on evidence and experience.
Third, every hazard must be assessed on probability and severity. That is the core of the whole exercise. If you are not doing that clearly and consistently, you are not really assessing risk.
A particularly important point for food manufacturers is that too much attention is often placed on process steps and not enough on prerequisites and the factory environment. In ready-to-eat production, many hazards that end up in product are not caused by direct process failure. They come from environmental management failures. That is an important mindset shift for the industry.
If a site is very focused on process controls but weak on environmental controls, sanitation discipline or prerequisite risk assessment, it may believe it is covered when it is not. This is exactly where stronger risk assessment can stop problems earlier and reduce disruption later.
One of the strongest points I would make is that risk assessment is not just a technical exercise. It is a leadership capability. Teams need direction. They need to be comfortable with the tools before the session starts. They need enough confidence to challenge outcomes that do not make sense. If people see an illogical output and accept it because “the matrix says so”, that is not good enough.
This is where many organisations can improve quickly. Train people on the tools in advance. Build confidence. Give them permission to question the outcome. Make sure leaders can explain not just what decision was made but why it stands up to challenge. That is the difference between paperwork and capability.
If I were to leave readers with one message, it would be this: risk assessment should reduce uncertainty, not create paperwork. If your organisation is still confusing hazard with risk, relying on tools that do not make sense or treating the exercise as a tick-box for audit purposes, then you are missing the real value of the process.
A good risk assessment helps you think clearly, communicate clearly and make better food safety decisions before something goes wrong. That is what makes it valuable. It is also what allows businesses to protect their product, defend decisions and build confidence across quality, operations and leadership.
At SQT, we help food industry teams build the practical skills behind stronger risk-based decision making. That means moving beyond forms and matrices and helping people understand the logic of hazard identification, probability, severity, inherent risk, residual risk and defensible decision making in the real world. If your team needs more confidence, more consistency and a more practical approach to risk assessment, that is exactly where focused training and facilitated team development can help
Categories
ArchiveSign up to receive the latest industry and company news direct to your inbox.
2026