Hi,
ideally, in the very first step you have designed a process without measures. Doing you very first risk assessment you will see a lot of risk and measures to be taken to reduce the risk.
In the practical work after many years of applying HACCP and FMEA you will not start from the scratch. In any case you have to demontrate minimization of risks - you can do this by showing the situation before and after taking a measure. So you are able to make lateron changes (and you will havearguments for change back to the original if necessary/possible) which are in line with the history, especially if you modify a line/a plant. HACCP is part of the log (history)- documentation where each change and each associated assessment is listed.
Nevertheless: At the end of the day you have to provide a most recent assessment of the running process.
Rgds
moskito