Hazard Analysis in Food Manufacturing: How to Do It and Defend It

Your hazard analysis is the first document an auditor or FDA investigator reads, because everything else in your food safety plan derives from it. If the analysis is weak, every control downstream of it inherits that weakness.

One clarification before anything else. If you searched for hazard analysis and landed here expecting Job Hazard Analysis, worker safety, or an OSHA process, this is a different discipline. This article covers food hazard analysis under FSMA and HACCP, where the thing being protected is the consumer.

Food hazard analysis vs. Job Hazard Analysis

The two share a name and almost nothing else. Both identify hazards and evaluate risk, and then they diverge completely.

If workplace safety is what you actually need, OSHA's hazard identification and assessment guidance is the right starting point. Everything below is about food.

What is a hazard analysis in food safety?

A hazard analysis is the systematic identification of biological, chemical, physical, and radiological hazards that are reasonably foreseeable in a food, followed by an evaluation of each one to decide whether it requires a preventive control or a critical control point.

That is two distinct activities, and conflating them is the most common mistake in the exercise. Identification asks what could go wrong. Evaluation asks whether it is likely enough and severe enough to require a control. A team that jumps straight to controls without documenting the evaluation ends up with a plan it cannot defend.

The requirement itself sits in 21 CFR 117.130, and the written hazard analysis is a required component of the food safety plan.

This article covers the analysis step in depth. For the wider framework it sits inside, see the seven HACCP principles, where hazard analysis is Principle 1, and HARPC vs. HACCP for how the FSMA and HACCP approaches relate.

The four hazard types, not three

Most training material still teaches the biological, chemical, physical triad. FSMA widened the scope, and a hazard analysis built on three categories will miss things an investigator expects to see addressed.

Allergens sit inside the chemical category and deserve the most attention of any single hazard, because undeclared allergens remain the leading cause of food recalls in the United States. Your allergen control program is where the controls live, but the hazard analysis is where the decision to control them is justified.

Economically motivated adulteration is the category most often missing entirely. It is assessed through a food fraud vulnerability assessment, which is a separate exercise that feeds the hazard analysis rather than replacing it.

For the biological side, our guide to the big 6 foodborne pathogens covers the organisms that appear most often in hazard analyses, and metal detection in food packaging covers one of the main physical hazard controls in more depth.

Where hazards come from

Work two axes. Every ingredient and raw material, then every step on the process flow diagram.

Verify the flow diagram on the floor before you start. A hazard analysis built on a diagram that no longer matches the line is wrong from the first row, and this is a routine audit finding. Walk it, confirm every step, and note any rework loops, holding steps, or bypasses added since the diagram was drawn.

Then classify what you find into three sources:

Hazards that arrive with the material. Pathogens on raw agricultural commodities, allergens in an ingredient, mycotoxins from field conditions, foreign material from a supplier's process.

Hazards the process introduces. Metal from equipment wear, lubricant contact, allergen cross-contact at changeover, chemical residue from sanitation, or contamination during an open-product step.

Hazards the process fails to remove. The category people forget. If your process includes a kill step, the analysis has to address what happens when it underperforms, not only what it removes when it works.

Product characteristics drive much of this. Ready-to-eat foods with no downstream kill step carry a different hazard profile from a product the consumer will cook, and TCS foods require time and temperature control because their composition supports pathogen growth.

Evaluating hazards: severity and likelihood

Identification is the easy half. Evaluation is where hazard analyses succeed or fail, because it requires documented judgment rather than a list.

Three questions structure the evaluation:

1. Is this hazard historically associated with this food or this ingredient?
2. If control were lost, would it be likely to cause illness or injury?
3. Is it reasonably likely to occur in the absence of any other control?

The third question is the one that trips people up. "Reasonably foreseeable" is not the same as "theoretically possible." A meteorite fragment is theoretically possible and is not reasonably foreseeable. A metal fragment from a sifter screen that has failed twice in five years is both.

The severity and likelihood matrix

High-severity hazards deserve care even at low likelihood. A pathogen capable of causing serious illness in a vulnerable population does not become insignificant because it has not happened to you yet.

There is a third outcome besides "requires a preventive control" and "not significant": the hazard is real and is already adequately controlled by a prerequisite program. Pest control, sanitation, and personnel hygiene handle a large number of hazards without needing a preventive control or CCP. Your HACCP prerequisite programs should be robust enough to carry that weight, and the analysis should say which program controls what.

Virginia Tech Extension publishes a useful set of resources for conducting a hazard analysis that works through the evaluation questions in detail, and FDA's hazard analysis and risk-based preventive controls guidance is the authoritative reference.

A worked hazard analysis example

Here is a partial analysis for a hypothetical ready-to-eat hummus product, showing the rows that matter most.

Note the two rows marked "No." Those are the rows an auditor reads most carefully, because dismissing a hazard requires more justification than controlling one. Both give a specific reason tied to a documented control, not an assertion.

The CCP rows feed into your HACCP plan, and our guide to critical control point examples covers how CCPs are determined once a hazard has been judged significant.

Once the analysis is complete it becomes a controlled document with an approval history. Allera's Document Control module handles that lifecycle, moving revisions through Draft, Pending Approval, and Published states, with a Scheduled Review policy that forces periodic re-approval and flags an overdue plan before an auditor finds it.

How to write a justification that survives an audit

Auditors rarely challenge the hazard you identified. They challenge the one you dismissed. A "not significant" call with no written rationale is one of the most common findings in a food safety plan review.

A defensible justification has four parts: the claim, the evidence, the source, and the control you are relying on instead. Compare these.

Weak: "Not applicable." Weak: "This has never happened at our facility." Weak: "Our supplier guarantees this."

Strong: "Listeria monocytogenes is not significant at this step because the product receives a validated 5-log lethality treatment at the cook step downstream, and there is no product exposure between cook and seal. Environmental monitoring at Zone 1 supports the absence of post-lethality exposure."

Strong: "Glass is not significant because no glass is permitted in production areas, all lighting above open product is shatter-resistant and covered, and compliance is verified monthly under the glass and brittle plastic register."

Each strong example names a specific control, references a program that generates records, and would survive a follow-up question. Each weak example invites one.

Who has to do it

A preventive controls qualified individual must perform or oversee the hazard analysis. Perform means doing the work. Oversee means directing and approving work carried out by others, which is how most facilities operate in practice.

Oversight is not a signature at the end. A PCQI who reviews a completed analysis without having shaped the evaluation has not overseen it in any meaningful sense, and an investigator will probe that. Our guide to PCQI training programs covers the qualification requirement.

Who else belongs in the room: production, because they know what actually happens on the line rather than what the SOP says; sanitation, for allergen changeover and chemical hazards; maintenance and engineering, who know where metal comes from and which equipment is wearing; and purchasing, for raw material history and supplier capability.

Document the session: date, attendees, roles, and the basis for the decisions. The team composition is part of the record.

When you have to redo it

A hazard analysis is not a document you write once. Section 117.170 requires reanalysis of the food safety plan at least every three years, and sooner when any of four things happen:

1. A significant change at your facility creates a reasonable potential for a new hazard, or significantly increases an existing one
2. You become aware of new information about potential hazards associated with the food
3. An unanticipated food safety problem occurs
4. You find that a preventive control, a combination of controls, or the plan as a whole is ineffective

A PCQI must perform or oversee the reanalysis.

In practical terms, treat these as triggers: a new supplier or ingredient, new equipment or a line reconfiguration, a new product or formulation change, a recall or complaint cluster, a regulatory change, a positive environmental monitoring result that changes your understanding of risk, or a failed validation.

The three-year clock catches facilities that never trigger any of the four events and quietly let the plan drift. Scheduling the reanalysis as a recurring task is the simplest way to avoid the finding. Allera's Task Management tracks recurring instances as Completed On Time, Late, or Skipped, and Document Control's Scheduled Review flags a plan approaching its due date rather than after it has passed.

Hazard analysis across the certification schemes

If your site is certified, you are running one analysis that has to satisfy two masters: the federal rule and your GFSI-recognised scheme.

The scheme documents are the reference: the SQF Food Safety Code for Food Manufacturing (Edition 9), the BRCGS Global Standard Food Safety (Issue 9), and the FSSC 22000 Scheme Version 6. USDA also publishes a helpful overview of HARPC and HACCP for facilities working out which applies to them.

Preparing for a specific audit is covered in our SQF audit checklist and FSMA food safety plan guides.

Hazard analysis vs. risk assessment

These terms get used interchangeably and they are not the same thing.

A hazard analysis is a defined regulatory exercise producing a specific output: which hazards require a preventive control. A risk assessment is a broader analytical method applied to many kinds of question, including questions unrelated to food safety.

Two adjacent assessments sit alongside your hazard analysis without being part of it. A vulnerability assessment for economically motivated adulteration feeds the EMA hazard category. A vulnerability assessment for intentional adulteration supports your food defense plan and is a separate regulatory requirement with its own method.

Keeping the analysis current

Hazard analyses drift predictably. The file lives on one person's drive, the flow diagram no longer matches the line, and the three-year clock quietly expires.

Allera's Document Control module handles the version control side: an enforced approval workflow, Scheduled Review that fires before the due date, access control so operators see the published revision rather than a draft, and an exportable audit trail. Findings from a reanalysis can route into your corrective action plan process so they close rather than accumulate.

Get the evaluation right and the rest follows

The difference between a hazard analysis that holds up and one that does not is rarely the list of hazards. Most teams identify roughly the same set. The difference is whether the evaluation is documented, whether the dismissals are justified in writing, and whether the analysis has been revisited since it was written.

Start with the flow diagram. Walk it, confirm it matches reality, and fix it before you analyse anything. Then work the two axes, evaluate honestly, and write the justifications as if someone will question every one of them, because eventually someone will.

To see how the analysis, the plan, and the records that support them stay version-controlled and audit-ready in one place, take a look at Allera's food quality management software.