Risk analysis

HACCP: mapping risks pays off

Hazard Analysis & Critical Control Points is an established risk analysis method based on the 12 steps set out by the Codex Alimentarius. A HACCP study assesses all possible food safety risks within the context of the company's processes and the raw materials used. It weighs how serious a risk is during a given process against the likelihood of the hazard occurring. This results in a risk level, to which the appropriate control measures are then linked.

Control your production process with HACCP

The main outcome of a HACCP risk analysis is the final set of control measures. These must be closely monitored every day to prevent food safety problems. Critical hazards that are difficult to control will result in one or more CCPs (Critical Control Points). A CCP is a point in a process where a parameter shows that a limit value is essential to keep a hazard under control.

When do you need a full HACCP plan?

HACCP is a systematic method for identifying hazards in your production process and for determining and monitoring critical control points (CCPs). The aim is simple: detect potential food safety risks before they become a problem, rather than reacting after the event. A thorough risk analysis forms the basis for this.

Not every company needs an equally extensive HACCP plan. The scope and complexity of the plan depend on the size of your company and the risks inherent to your product and process. Smaller companies or low-risk activities can often rely on a sector guide to self-checking approved by the FASFC. These guides already translate the HACCP principles into concrete, practical measures for your sector, so you do not have to build your own plan from scratch.

A complete HACCP plan is based on seven principles: hazard analysis, determining CCPs, setting critical limits, organising monitoring, providing for corrective actions, building in verification and documenting everything. You must be able to demonstrate each principle during an audit or an FASFC inspection.

Start with a thorough process analysis: map every step of your production process and determine where the risks lie. Our Normanists help food companies every day to set up, review or optimise their HACCP plan, from the initial risk analysis to an audit-ready system.

HACCP in your organisation?

HACCP is a legal requirement if you are active in the food or animal feed sector. These provisions are laid down in Regulation (EC) No 852/2004.

FSMA - PCQI

On 4 January 2011, former President Obama signed the Food Safety Modernization Act (FSMA) into law. Its aim is to better protect the safety of food in the US by shifting the focus from responding to incidents to a preventive, risk-based approach, one that has in fact long been applied in Europe. The FSMA and its related guidance apply both to US companies and to companies exporting food to the US. If your company exports to the US or plans to do so, you will also have to demonstrate that you meet these requirements.

Food safety plan - Preventive controls

The FSMA requires a risk-based Food Safety Plan from which preventive controls are derived. There are four types of ‘Preventive Controls’:

• Process preventive controls
• Sanitation preventive controls
• Allergen preventive controls
• Supply-chain preventive controls

Our Normanists help your company submit a compliant ‘Food Safety Plan’ to the FDA and your customers.

PCQI

Another important requirement is that every company must have a Preventive Controls Qualified Individual, or PCQI. This is the person responsible for setting up and maintaining the food safety system.

AMNorman can train your in-house PCQI or temporarily act as your PCQI.

Food defence plan: precautions against deliberate contamination

These preventive measures protect the production facility against deliberate contamination. Think of the mercury-contaminated oranges in 1978 or the needles found in in-flight meals in 2012. These measures are included in the criteria of the GFSI standards BRCGS, IFS and FSSC. As a result, there is extra focus on securing the production site and training staff.

Our Normanists support you in setting up a Food Defence Plan and train your staff on the subject. We can also carry out intrusion tests, in which we measure how alert and assertive employees are, to safeguard the security of your company.

Food fraud

Unfortunately, this happens regularly: fipronil in eggs, horse meat sold as beef, and so on. Preventing food fraud is a priority for authorities and standard owners. All GFSI standards require a risk analysis to minimise the likelihood of fraud and to put the right detection methods in place.

Our Normanists map the risks for you and integrate the necessary precautions into your quality system.

Stakeholder and context analysis

In a stakeholder analysis, we list the relevant stakeholders and their requirements for both the organisation and the quality management system.

The context analysis focuses on analysing and managing the risks in your environment.

Carrying out and following up both analyses is a requirement of all ISO standards.

Business continuity

A crisis can disrupt day-to-day operations to the point where business continuity is at risk: a fire on site, an occupational accident, an environmental disaster, a food defence incident or a cyberattack. Nobody wants it to happen, but unfortunately these things do happen. In a Business Continuity Plan, we set out how to respond adequately to such crises. The plan is preceded by a thorough ‘Business Impact Analysis’, which examines the impact of a crisis situation.

For now, only the BRCGS standards require a business continuity plan to be implemented.

Frequently asked questions about risk analysis

What is the difference between a HACCP plan and a risk analysis?

A risk analysis is the first step: you identify all possible biological, chemical and physical hazards and assess their likelihood and impact. A HACCP plan (Hazard Analysis and Critical Control Points) builds on this: it sets out which of those hazards must be monitored as a critical control point (CCP), with which critical limits, checks and corrective actions. In short: no HACCP plan without a prior risk analysis.

How often should you review or update a risk analysis?

At least once a year, and additionally whenever there is a relevant change: a new product or process, a different raw material or supplier, a refurbishment of the production area, new legislation, or an incident such as a complaint or recall. Most certification schemes (BRCGS, IFS, FSSC 22000) expect you to be able to demonstrate these reviews during an audit.

Who should be on the HACCP team?

A multidisciplinary team with knowledge of your product, process and equipment: typically someone from production, quality, maintenance/engineering and purchasing, supplemented by an internal or external HACCP-trained person who safeguards the methodology. A single person drawing up the plan “on paper” is a common mistake that auditors quickly spot.

Is a risk analysis mandatory for every food business?

Yes. The European Hygiene Regulation (EC) No 852/2004 requires every food business, regardless of size, to have a system based on HACCP principles. Smaller businesses can often meet this in a simplified way through a sector-specific guide for self-checking, but the underlying risk analysis remains mandatory.

Further reading in our knowledge centre

• GMOs and the new NGT Regulation: what does it mean for your business?
• Traceability in the food industry: why it is crucial and how to approach it
• New PAL rules in the Netherlands 2026: what this means for allergen management