To what extent is Risk Analysis required by HACCP?

Title says it all...

Hi MoM,

You may be surprised with my response, but strictly speaking HACCP does not require Risk Analysis to any extent!

Let me explain. It is often the case in food safety that different terms with specific meaning are used interchangeably to describe something e.g. verification and validation. Risk analysis is another.

The term 'Risk Analysis' is used to describe a broader framework of actions or principles relating to Risk. The risk analysis framework is as follows:

• Risk Assessment
• Risk Communication
• Risk Management

Conducting risk analysis should follow these steps in sequence and they have been defined by the CAC (the people who brought us the Principles of HACCP).

Risk assessment provides a formal and validated estimate of the level of risk which can then be communicated to stakeholders, interest groups, policy makers, politicians and food businesses. From this communication of risk data, risk management decisions are made such as product and process criteria, standards, market restrictions and so on. This all applies at a government and intergovernmental level.

So where does all this fit in with HACCP? Well, HACCP is a local risk management tool. The CAC have defined 7 principles for conducting a HACCP study. Principle 1 is 'Conduct a Hazard Analysis' (Not a Risk Analysis). It is not always clear what this means but it speaks about the likelihood of the occurrence and severity of impact of the hazard.

In the BRC Issue 6 Clause 2.7.2 there are detailed requirements under Principle 1 requiring estimate of likely occurrence, impact, vulnerability of consumers, survival of microorganisms etc. In short this is what the CAC have defined in other standards as Risk Assessment (The first step of Risk Analysis). All very confusing, I agree.

In short HACCP calls for a 'Hazard Analysis' which contains elements of what is accepted as risk assessment. The CAC and other interested groups could benefit from addressing what IMO is the inherent confusion with the use of these various terms.

George

We use the term "Hazard Risk Analysis" which we feel is more appropriate. But it does not really matter what term is used since the 7 principles cover the entire risk concept of assessment, communication and management.

Thanks for the responses so far.

I'd like to reform my question. to "What is an 'acceptable' risk level under HACCP?"

Is it safe to say that the CAC requirement refers to product and to process?