The hazard analysis is based on the Codex Alimentarius, scientific documents (literature), legal texts and historical . The hazard analysis was drawn up per process step and per product (raw material, auxiliary material, end ). The analysis considered microbiological, chemical and physical hazards and hazards due to the presence or transfer of . All this was done according to the probability x severity principle.

The Codex Alimentarius includes a decision tree that leads to a classification in measures in the PRP or CCP category. See document Decision tree Codex Alimentarius.

In the ISO22000 (and FSSC22000) standard, there is also the possibility of using OPRPs in addition to PRP and CCP. To do this, a different decision tree must be used. Thus, the hazard assessment then ultimately leads to 3 types of measures. These measures differ from each other by the intensity of the required monitoring and the way deviations are to be dealt with. The hazard analysis also establishes the following:

  •   Severity and probability of an deviation
  •   Ability to detect and correct a deviation

Control measures are named. PRPs are controlled and monitored by the various procedures. Corrective measures have been named for each CCP (intervening on product and process). Critical standards are defined, validated and subject to verification.

All measurements are recorded and kept as prescribed.

Terminology of ISO22000 (definitions of measures)

PRP = Prerequisite programme: basic conditions and activities that are necessary within the organization and throughout the chain to maintain food .

OPRP = Operational prerequisite programme: control measure or combination of control measures applied to prevent or reduce a significant food safety hazard to an acceptable level and where action criteria and measurement or observation enable effective control of the process and/or product.

CCP = Critical control point: step in the process at which control measure(s) is (are) applied to prevent or reduce a significant food safety hazard to an acceptable level and defined critical limit(s) and measurement enables the application of corrections.

Step in the processStep in the process or not in the process
Single control measureControl measure or combination of CMs
Critical limitsAction criteria or control limits
MeasurementMeasurement or observation
Enable correctionEnable control of product or process


Hazards are classified into types:

  •   microbiological (mainly )
  •   physical (such as product foreign bodies like glass, hard plastic, )
  •   chemical (such as , drug residues, banned substances, toxins, radiation)
  •   allergens.

The following aspects were taken into account/included in the hazard analysis.

  • Change in product, process, production area and ;
  • Change in man, machine, method, measurement, environment and material;
  • Basic conditions program (HACCP);
  • Packaging material and impact on product;
  • Possible cross- with allergens;
  • Possible cross-contamination or mixing of species;
  • Compliance with claims;
  • Packaging of products;
  • Product development;
  • Contamination with product foreign ingredients, including food brought from home and property;
  • Hygiene;
  • Suitability of resources, including lubricants, R&D resources and conveyor belts (food grade);
  • Environment;
  • Building;
  • Cleaning and disinfection;
  • Need for metal detection;
  • Storage;
  • Fraud (substitution, forgery);
  • Intentional contamination ();
  • Analyses/investigations;
  • Recalls (from ourselves and others);
  • Blocking and release of products;
  • Legal requirements and limits;
  • Legal control of ;
  • Relevance of the raw material to or in the finished product.

All measurements, deviations, measures taken, improvements, etc. are recorded. All this serves partly as input for verification/validation and possible improvements for our food safety system.


In addition to the HACCP analysis, the following analyses were performed regarding deliberate contamination or sabotage:

  • regarding food defense threats.
  • VACCP with respect to vulnerabilities with respect to food fraud in the chain (, substitution, adulteration).

Hazard and risk analysis methodology QAssurance

The methodology is based on:

The risk level at each stage in the process is determined by the severity or effect of the hazard with respect to the probability with which the hazard may occur. In this way, it can be determined whether or not it is significant and whether a control measure is needed at this stage or at a subsequent stage:

P = probability = the probability of the hazard occurring at a given stage in the process (raw material, (finished) product, etc.), taking into account correctly applied preventive (GHPs) and control measures during the previous stages of the process

S = severity = effect or severity of human health hazard.


Risk can be defined as the number of expected incidents (probability) relative to the expected harm (severity) per incident.


1 = very low/low

  •   Theoretical probability – the hazard has never occurred.
  •   The control measure or hazard is of such a nature that if the control measure is inadequate, no production is possible or no more usable products are produced (e.g. excessive concentration of added dyes).
  •   The contamination is very limited and/or localized.
  •   Control measures for the hazard are general in nature (GHPs) and well implemented.

2 = medium/high

  •   Inadequacy or lack of the (specific) control measure does not lead to the systematic presence of the hazard at this stage, but the hazard may occur in a certain percentage of the product in the corresponding batch.
  •   Inadequacy or lack of the (specific) control measure leads to a systematic error. It is very likely that the hazard is present at this stage.


0 = limited

  •   There is no food safety concern for consumers (nature of hazard, e.g., paper, soft plastic, large foreign ).
  •   The hazard may never reach a dangerous concentration (e.g., dyes, Staphylococcus aureus in frozen foods where increase by multiplication is very unlikely or impossible due to storage conditions and preparation).

1 = moderate

  •   No serious injuries and/or symptoms or only when exposed to an extremely high concentration over a long period of time.
  •   A temporary but marked effect on health (e.g. small pieces).

2 = severe or very severe

  •   A marked effect on health with symptoms occurring in the short or long term and rarely fatal (e.g., gastroenteritis, microbiological hazards such as Campylobacter or Bacillus cereus).
  •   The hazard has a long-term effect; the maximum dose is not known (e.g. pesticide residues, etc.).
  •   The consumer group belongs to a hazard category and the hazard can be fatal.
  •   The hazard results in severe symptoms that may cause death, including long-term effects (e.g., Salmonella, monocytogenes, dioxins, aflatoxins, etc.);
  •   Permanent injuries.

Decision tree

The decision tree in the document Decision Tree QAssurance is used to determine whether hazards should be controlled according to a PRP, OPRP or CCP. Hazards that are controlled through the basic conditions program are included in the document Control Measures (GHP, PRP).

The hazard analysis indicates per process step or raw material which control measures from the prerequisite program (PRP or GHP = good hygiene practices) are applicable to control the risk. If a process step is marked “No specific hazard”, it means that only hazards that have been considered in the PRP measures are applicable. If there is a specific hazard and the answer to the first question in the decision tree is “No,” then the PRP also complies. In other cases, it becomes an OPRP or CCP. In addition, the following is also still applicable in the final determination of measures.


In the case of severe and diverse effects, it may be useful to also assess the probability of the deviation as well as the possibility of timely detection and correction of the deviation. According to , when the probability of the deviation is high, but monitoring results in a high possibility of detecting the deviation (immediate detection and prompt corrective action), this is a typical critical control point (CCP).

In the case where it is difficult to feasibly establish critical limits, conduct surveillance to detect all deviations and apply corrective action, basic operating conditions programs (OPRP) are designated or the process must be modified.

When the severity x probability of deviation is high, while the ability to detect and correct the deviation is low, this poses a challenge to control measures. Measures should then be taken to improve the ability to detect and correct deviations or to reduce the probability and/or severity of deviations.

Precautionary allergen labeling (preparation instructions, allergen control) should be used only when it is not possible to effectively implement a preventive strategy and the product may pose a risk to consumers. In other cases where the probability of the deviation is high and the possibility of detection is low, we should be very careful and check the robustness of the whole FSMS.

Severity and probability of an deviation
Ability to detect and correct deviation LowMediumHigh
LowGHP /PRPOPRPReview process or oPRP if possible

Related files

TwitterFacebookLinkedInPin It

Related articles to ISO methodology hazards and risk analysis

Many customers and visitors to this page 'ISO methodology hazards and risk analysis' also viewed the articles and manuals listed below:

We are a Food Tech firm in Food Safety Compliance. Experts in setting up and maintaining Food Safety Systems for companies in the Food Supply Chain. We are dedicated to breaking down the barriers for Transparency and Trust in the Global Food Supply Chain.
In our Partnership Program we would like to work together with (Non)Governmental Organizations, Universities, Multinationals and Food companies.

iMIS Food is a fully equipped Food Safety Compliance platform. Unique is the installation of an iMIS Food server at the Food company, for online and offline availability. The online (no travel costs) iMIS Food implementation process includes 6 to 10 days of support and has a lead time of 3 months.

Monthly iMIS Food Update

Would you also like to receive the monthly iMIS Food Update and be invited to our events? Then please fill in this form.

Food Safety news 2-2024

Deming circle and Certification management

The next page discusses how to apply the, plan, do , check, act circle or the Deming circle to food certification management.

3th training with Profound GMP / HACCP in Uganda

On August 2nd, we collaborated with Profound by doing a training. The content was about HACCP and GMP. The participants were from SME food companies in Uganda.

iMIS E-Training Platform

With our iMIS E-Training platform, you will gain the tools to train yourself and your employees and improve the food safety culture.