Quantitative Risk Assessment in HACCP Plans - Decisions, Decisions... Last week, | spoke about how to set up a Risk Matrix and the considerations on how to determine risk scales. | mentioned how Risk methods provide the objectivity needed for many organizations, but a team is need to ultimately make the decision. | was reviewing some material in the Food Safety industry, and once again Risk came up, specifically to HACCP. HACCP (Hazard Analysis Critical Control Points) in itself is @ Risk Management Tool, and is adopted by many of the GFSI Compliance standards. Itis concerned with looking at the various potential hazards within the food safety plan and assessing what types of controls need to be put in place. Controls lke these come in many flavors (no pun intended), most notably Prerequisite Programs or Critical Control Points (CCP). What | was interested in was, "How do you accurately determine whether a step in the process is a CCP or not earned there are two schools of thought to this. One is the Decision Tree and another is Quantitative Risk Assessment, Decision Trees seemed to be mare commer HACCP Plans, maybe because mast HACCP Plans haven't automated to the point where Risk has become necessary. But as more Foad Safety Management Systems become automated, new technologies are introduced that streamline the process. The trouble with decision trees, in my opinion, is that it ends itself to subjectivity. Depending on who is filling out the decision tree, the answer could change. That is not to say that there is a problem with decision trees OR the person filling them out - but the combination of the two can be problematic. HACCP needs logical, systemic methods for determining the significance of a hazard in a repeatable way. Risk Assessment is the best method for this. It relies on a defined verbal scale, it uses a singular, common mathematic method for determining a hazard, and sets guidelines for actions based on the result. Furthermore, itis a repeatable mtehod - if done properly, the risk ‘matrix will spit out the same result every time. Let's take an example. Here's a hazard for a step that involves a potential CCP - Pathogens (lovely ean) [egal Surat paar We know the hazard and the severity/likelihood, but we still need to come up with a determination of whether a CCP is, necessary. A decision tree would lank something like this: 1. Do preverive measures) xs rhe enified hazard?” he T ves7 Gould cantainason wih enti hazard) occur n exces oh cept ive(s) oF oul these increas to unsecepeate levels)? _[NO. + “4. Wilaubsequer sap, poo cersuring he food, elmira he certited nazar) or rece the tly occurrence tan acceptable level? [NO. Ts canted at tis slop nacwasary To salty? ves ‘(My head hurts looking at this) r...we can try and put the hazard into a Risk Matrix, using the verbal scale and assigning a weight to each level on the scale: 4. Fotality ‘A. Common Occurrence 2. Serious tiness 1B. Krownto Occur 2. Product Recall Could Occur (published) 4. Customer Complaint. Not Expected to Occur 5. insignificant £.Practialy impossible nN Gi 1 Fatality A 2 Saroustiness an Vs a eo ca Fe 13. Product Real ss a vw 4 CustemerCompiit = «10k 1 senicat sop pom Bs Now, we have a repeatable and systemic matrix for looking at the risk. We can setup our risk thresholds (let's say for this, example 1-10 is a CCP), and then apply the verbal scale to the matrix: a a i 6 13 ProductRacall . 8 Bo ov » 4 customercompiaim 30k | insgnitcant soe zoe os And then we have a quantitative result to draw from. We can then enter it into the hazard analysis, and record the results: ma — EE eS = ee | Ss — a — SATE PSS reer It’s not enough to just have a risk matrix, in food safety or any other compliance-related process. You need a team in place to analyze the risk and leverage the data to make the decisions. There is always "tweaking" based on other factors and human.experience. HACCP is about common sense. Risk will help to automate it and give a consistent, auditable, and logical result. But experience is also important in determine hazards. So there is a marrying of the two methods that will ultimately make for a efficient Food safety system. Risk Management and Risk Assessment are prevalent in all industries. Food Safety is no exception, and like all industries, Risk requires a certain degree of human element coupled with a quantitative taal to be effective.