How do you justify your risk assessment?

I'm currently working on our company's HACCP hazard analysis.  I've looked through this forum and gotten various samples but hadn't seen anything that answered my question, which is:  How do you justify your risk assessment?

I've seen the 5x5 matrix, the table for likelihood/severity/risk...  Is it just based on our own judgment? 

Like for a certain hazard, E. Coli has Severity 3 (1low-2medium-3high), Probability 1 because our supplier does pathogen test. 

Insights are appreciated...

Severity would certainly be high for E. coli, because it is a severe occurrence. When you say "Probably 1 because our supplier does pathogen test" do you mean likelihood?

If you are looking at a micro hazard, you can set the likelihood / probability by looking at recalls of your product.   Sometimes it's really high for E. Coli, because it's like every where & likes to thrive in your product.  Maybe your product is salt and nothing grows in it, so the probability is pretty low.

It's okay to have something with a high severity and a high likelihood on your analysis.  That tells you that you really have to control for that hazard.   So your control for the micro hazard of a raw material with pathogens is to make sure each lot of that material is tested for the pathogen.  The document with the test results is called a Certificate of Analysis, or a COA.   Hooray!  If you follow your HACCP plan, you've controlled that hazard.  Normally, this is part of a PRP program.  Sometimes the processing has a kill step, and that an additional control for pathogens.  But your team has to decide what is right for your business.  So you go down the decision tree to determine if this is a PRP, a CP, or a CCP. 

If you're worried about proving you are adequately controlling the risk - good.  Proving that the risk is controlled is called validation.  Validation for a control like requiring a COA is easy - send a sample to a 3rd party, ask for the same method analysis, and see if you get the same results.  If you do - Hooray!  That supplier will probably provide you with accurate COAs.  Sometimes validation is referencing literature or standard. 

I think Magenta really summed it up for you mate - sound advice.

Thank you for the detailed response Magenta, but I was more asking about how to justify our risk assessment during the hazard analysis.  So we're not strictly dealing with CCP's. 

Another example:  Biological hazard from temperature during shipping. 

I can put Likelihood-1, and Severity 3.  We've never had an issue with this or know of any incidence relating to our product or situation, and there are previous steps to eliminate/minimize pathogen presence.  Will that be a satisfactory justification?

We're going to have/already have control procedures and all that other fun stuff so not concerned about that (at least for now). 

Dear deLeon,

A few comments -

(1) the answer may depend on yr product/process

(2) Generic E.coli is not a pathogen.

(3) the interpretations of individual entries in "likelihood/Severity" risk matrices are inevitably subjective, ie the opinion of Mr.A may not (justifiably) agree with Mr.B. Regardless there are a few entries where most people will usually agree, eg LL, HH  but 25-50%(?) is undoubtedly a greyish area, and hotly debated in some places. From an auditorial POV, if ever challenged (which hasn't happened yet) i (would) say my matrix is based on a "published" one (there are sooo many 5x5s and other variations).

(3) A few detailed, published, relative risk levels of pathogens exist, mostly from memory  ex-USA. 1-2 are mentioned, linked on this forum (somewhere). But I suspect the vast majority of users simple allocate severity 5/ maximum to all listed pathogens. Never had that challenged so far. The truth is that in respect to absolute potency the risk may clearly vary but I doubt that auditors expect such knowledge to be displayed to them. :smile:

The "malleable" parameter as far as the risk calculation is concerned is, IMO, the Likelihood, interpretations for this can radically change the result, eg referenced to where ? - eg the specific step or the consumer ? Both opinions can be found in published hazard analyses.

(4) Regarding yr specific queries, it may help to find published examples of (a) yr choice of approach to hazard analysis (there are a legion), (b) yr specific hazard (this may take some effort). Or as per yr post, label it as a prerequisite and avoid the decision altogether.

Rgds / Charles.C

Thanks, Charles!  Perhaps I was making it more complicated than it needed to be. 

For the E. Coli, we actually refer to a specific strain, E-coli O157:H7, in the analysis. 

Also, may I ask what "LL, HH  but 25-50%(?) is undoubtedly a greyish area" mean?  I'm new at this and not quite caught up on the industry verbiage...

Thanks, Magenta!  I think that's exactly what I need. Others I've seen were not as descriptive. 

Thanks, Charles!  Perhaps I was making it more complicated than it needed to be. 

 

For the E. Coli, we actually refer to a specific strain, E-coli O157:H7, in the analysis. 

 

Also, may I ask what "LL, HH  but 25-50%(?) is undoubtedly a greyish area" mean?  I'm new at this and not quite caught up on the industry verbiage...

 

Thanks, Magenta!  I think that's exactly what I need. Others I've seen were not as descriptive. 

Dear deLeon,

Have a look at the matrix in this attachment taken from an excellent series of introductory HACCP publications -

haccp - hazard analysis.pdf   1.44MB   508 downloads

Rgds / Charles.C

PS- a grey area is a region, usually the middle matrix area, where the interpretations/opinions/decisions are most likely to be debated, the size increases with the matrix.

HI de Leon

I got a Hazard analysis record recently which has a place for justification on the back . I have started using it in all my clients hazrad analysis as it outlines why we came to the risk rating we did for each specific step. Useful in audits when all sense can leave your head in the second the auditor says " and why is this NOT a CCP?".

You might find it useful you may not, I'm just throwing it out there.....

Thanks everyone.  I really appreciate the attachments and samples.  Gives me a better handle (or at least a level of confidence) on the topic. 

We're doing an internal audit later this week.  The samples will come handy afterwards, when we go through everything again and make the necessary changes.  

Thanks again!