Every food business needs to undertake a risk assessment to identify and address areas in which food hygiene risks may exist. Undertaking a risk assessment in your business can be a daunting task-- but it doesn’t need to be. Each food business is different, and so the risks in each business are different, but the process to follow is the same. The following is a practical walkthrough of how to undertake a risk assessment.

What is risk assessment?

Risk assessment may sound intimidating - but it’s something you do every day without even thinking about it. For instance, when you drive or cross the road, you’re constantly assessing the conditions around you, thinking about the risks to your safety and working out how to avoid those risks. This is an informal risk assessment. You don’t follow a written plan because you are performing everyday tasks that you are very familiar with.

Formal risk assessment is the same process, but it is undertaken in a much more considered way. In a business setting, you will be trying to identify risks not only to yourself, but to your team and your customers. In a formal risk assessment, you write down the risks and create a plan to either eliminate them or reduce them to the lowest possible level.

What does risk assessment in a food business look like?

Step 1: Identify Hazards

The first step is to identify anything in your food business that could cause harm. In a food context, hazards can be categorised as:

• Physical hazards. Any physical object which can get into your food shouldn’t be there. Physical contaminants include body parts like hair and fingernails, as well as other objects like jewellery and even flies.
• Microbiological hazards. These are small organisms which can exist on your food and in your kitchen, including bacteria, fungi and moulds. Some of them - particularly pathogenic bacteria - can make your customers very unwell.
• Chemical hazards. Chemicals, often those used for cleaning, can also reach your food. These chemicals may be poisonous and put your customers’ health at risk.
• Allergenic hazards. This occurs when allergenic ingredients are present in food that should not contain them. This can be the result of poor labelling or unsafe food preparation practices that allow cross-contamination. The UK government requires that the 14 most common allergens are always labelled and communicated.

How to identify hazards:

• Consider all stages of your food process: receiving, storage, preparation, cooking, cooling, packaging, and serving/distribution.
• Review incident logs, customer complaints, and past near-misses.
• Consult staff, as they often have practical insights into potential issues. This is a really important one - your team are your eyes and ears, make sure you use their experience!
• Check food safety regulations, industry guides, and best practices.
• Examine raw material specifications and supplier information.

Step 2: Determine who might be harmed and how

Once hazards are identified, consider who could be affected and how. This includes:

• Consumers/Customers: Think about your customers’ potential exposure to harmful bacteria, allergenic ingredients and physical and chemical contaminants.
• Employees: They could be exposed to hazards during food handling, cleaning, or equipment operation (e.g., burns, cuts, slips, exposure to chemicals).
• Visitors/Contractors: Anyone else on your premises who might interact with food or equipment.

For each hazard, ask: "Who is at risk?" and "How could they be harmed?" For example, if the hazard is undercooked chicken, the risk is food poisoning for customers. If the hazard is a wet floor, the risk is slips and falls for employees.

Step 3: Evaluate the risks and decide on control measures

This step involves assessing how likely the risk is and how much harm it could do. This helps prioritise risks.

• Likelihood: How probable is it that the harm will occur? (e.g., very high, high, medium, low, very low).
• Severity: How serious would the harm be if it occurred? (e.g., minor injury, moderate illness, severe illness, long-term disability, fatality).

Once risks are evaluated, decide on appropriate control measures that either eliminate the hazard or reduce the risk to an acceptable level. 

The ideal control is one that completely eliminates the hazard. A good example of this would be removing a specific allergen from your premises completely. However, elimination is not always possible - for instance, it is not possible to remove cleaning chemicals completely. It may be possible, however, to substitute a less harmful alternative.

Where risk cannot be eliminated, people must be protected to ensure their safety. For instance, guards can be installed on equipment with blades, and zoning can be used to prevent cross-contamination.

When no other effective controls can be put in place, PPE can be a suitable control, provided it is effective for the risk it is protecting against.

Some examples of control measures in food businesses are:

• Temperature Control: Proper cooking, chilling, and hot holding temperatures.
• Cross-Contamination Prevention: Separate chopping boards, utensils, and storage areas for raw and cooked foods; dedicated allergen-free zones.
• Personal Hygiene: Regular handwashing, clean uniforms, no jewellery, covering cuts.
• Cleaning and Sanitation: Regular and thorough cleaning schedules for all surfaces, equipment, and utensils. Schedule for emptying of bins.
• Supplier Control: Ensuring ingredients are sourced from approved, reputable suppliers.
• Allergen Management: Clear labelling, staff training on allergens, and preventing cross-contact.
• Pest Control: Regular checks and preventative measures to keep pests out.
• Maintenance: Regular maintenance of equipment to prevent physical contamination (e.g., metal fragments).

Step 4: Record Your Findings and Implement Them

Once you have identified the hazards and the methods you will use to control them, you must record your findings. This record should include:

• The hazards identified.
• Who might be harmed and how.
• What you are doing to control the risks (the precautions).
• Who is responsible for implementing and monitoring these controls.
• The date the assessment was carried out.

Ensure that the control measures identified are actually implemented. Communicate the findings and the necessary precautions to all relevant staff. Training is crucial to ensure everyone understands their role in maintaining food safety.

Click here for The Safer Food Group’s risk assessment template: upload template and insert

Step 5: Review and Update

Risk assessments are not a one-time activity. They should be reviewed regularly to ensure they remain effective and relevant.

Review your risk assessment:

• At least annually.
• If there are significant changes in your business (e.g., new equipment, new products, new processes, new ingredients, new staff roles).
• After an incident, near-miss, or customer complaint related to food safety.
• If new information about a hazard becomes available.
• If there are changes in legislation or industry best practice.

Update your risk assessment as needed and communicate any changes to your staff. This continuous improvement cycle is vital for maintaining high food safety standards.

By following these steps, a food business can systematically manage its risks, safeguard public health, and operate efficiently and legally.

What is HACCP?

You may have heard of HACCP as a system for managing risk in food businesses. HACCP stands for Hazard Analysis and Critical Control Points. It is a food safety management system which is designed to identify and target risks in your food business. A critical control point is any point at which an error would put your customers at risk. 

What is the difference between risk assessment and HACCP?

In reality, there is very little difference between a risk assessment and a food safety management system (FSMS) or HACCP. A risk assessment is a broad tool that considers all of the hazards that a food business might face. A FSMS or HACCP specifically involves assessing the risks to food safety, then introducing Critical Control Points that must be met to achieve safe food. By undertaking a risk assessment, you can equip yourself with the skills necessary to create and implement your own HACCP system.

It is a legal requirement for you to use the principles of HACCP in your food safety management system. As a result, risk assessments are not just important for protecting your customers; they are also a legal necessity.

What are some practical examples of risk assessment?

Let's walk through the creation of a burger and chips in a commercial kitchen to demonstrate risk assessment. In its simplest form, this can consist of 4 ingredients: beef, bread, lettuce, and potatoes. The first consideration is where your food has come from. It is your responsibility to ensure your food is safe, and this includes its delivery. It is crucial that you audit your suppliers and check each delivery to ensure that the food you receive is at the right temperature and in a good state. Once you have decided a supplier and received a delivery, the food will begin its journey in your business.

Firstly, consider the different types of food and where they will need to be stored. Your beef is raw meat, and so needs to be refrigerated at a temperature below 5°C to avoid growth of pathogenic bacteria. Similarly, your lettuce also needs to be refrigerated. Bacterial growth increases within the temperature 'danger zone' (8 - 63°C), so you need to be able to transfer your produce to fridges as soon as possible.

Within your storage, it is also important to consider the use dates. Old food, even when stored correctly, is at risk of microbiological contamination from mould growth. It is therefore important to know when your food arrived, and when it needs to be used by. This can be done with a first-in, first-out policy, as well as labelling dates on your produce. This is important for all four of our ingredients, but is less important for ingredients like sugar, which lasts for a long time and is therefore not 

Next comes the preparation of the food. Here, all four types of risk are present. Microbiological and allergenic contamination can occur here through cross-contamination. If you use a chopping board to prepare your beef patty, it cannot be reused to prepare your lettuce without thorough washing beforehand. Similarly, your bread must be kept separate from your other ingredients, as the gluten in it is one of the 14 major allergens and is therefore an allergenic contamination risk. It is also important to consider pre-existing contamination. Potatoes may still be covered in dirt, which can be both physical and microbiological contamination, and should be washed before use. The FSA also recommends washing your salad before use. Regularly cleaning your kitchen is also important to prevent contamination. This can remove chemicals, physical debris, and microbes from your work surfaces. Finally, there is a risk from people preparing the food. Staff may shed hair, a physical contaminant, and thus, enforcing hair net use can address this risk. Similarly, a staff member’s jewellery may pose a risk of physical contamination. Unwashed hands may be covered in bacteria, and so a thorough handwashing routine is crucial.

You may think that the job is done here, but the risks are not over yet. Hot food is a haven for bacteria unless kept above a safe temperature, so if it cannot be served straight away, keep your burger under a hot lamp. Your system for serving customers, too, may pose risks you haven't considered. Food for customers with allergies should be clearly marked, so your server can ensure that the right meal goes to the right person. Finally, your food service area is the last place you will see the food before it reaches the customer. This provides a chance to check for any physical contaminants which may have been missed up til now. If in doubt, do not serve.

What do I do now?

Your business may not serve burgers, but it serves some food. Some of the risks mentioned above will apply to your food, and some won't. There will also be some risks not mentioned above which do apply to your food. To undertake a risk analysis, methodically follow your food journey for each of your meals and ingredients. Note any place where these risks may occur, and put systems in place to address these risks. It is also important that your staff are trained in food hygiene so that they can mitigate these risks. Check out our Level 2 Food Hygiene course here, which contains more practical examples of assessing risk in a food business. Alternatively, if you would like to learn more about food safety management systems and HACCP, check out our Level 2 HACCP course, designed for food business managers.