Risk assessments that reflect reality
Making risk assessments match the shop floor, reviewing them after incidents, choosing a scoring method, and chemical and environmental risks.
A risk assessment that looks good on paper but doesn't match the shop floor protects nobody. Our trainers on making them work.
Q: How do we make sure risk assessments reflect reality?
Take them onto the shop floor. Use the desk review to flag key points, then challenge them on a site tour: check controls, talk to operators, even walk the factory with the risk assessment in hand.
Q: An incident happened. How do we judge whether our risk assessment worked?
- Compare the incident with the assessment. Was the risk identified? If so, did the controls work? If not, update it.
- Review whether controls were properly implemented or need strengthening.
- Do a root cause analysis. Remember, "human error" is not a root cause.
- Ask the staff involved whether the controls were practical and understood.
- Monitor the changes over time.
Add a step to your RCA form: "now update the risk assessment with the new controls". It closes the loop. Record the incident as the reason for the update in the document's change history, and you'll have a clear audit trail.
Q: How often should we review a risk assessment, and can we change our scoring method?
Keep risk assessments under constant review: they are there to anticipate risks, not just react to them. Formally review at least annually, and straight away whenever something changes, such as a new process, product, supplier or piece of equipment. An incident or trend within its scope is also a trigger to check whether the assessment missed something. Your scoring method (likelihood and severity, optionally detection) is yours to choose, and if it isn't working well, change it. Our BRCGS Risk Assessment course compares different scoring models.
Q: Can a risk assessment alone close an NC?
Not usually. It helps judge severity and guide decisions, and for a minor issue it may justify no further action if the risk is low. For more serious issues, auditors expect corrective action. Relying only on a risk assessment risks another NC. Under the BRCGS audit protocol (Part III in Food Safety Issue 9, and the same across the Standards), each NC needs a correction, a root cause analysis and a preventive action plan.
Q: How do we manage environmental risks in non-high-care areas?
Regular inspections and maintenance rather than complex controls: monitor temperature, humidity and airflow (simple sensors with alerts help), check ceilings and walls for damp, maintain drainage and ventilation, follow cleaning schedules, replace filters and control dust.
Q: How should we handle chemical and physical hazards in HACCP?
Chemical: identify chemicals that could be a problem (cleaning agents, lubricants, pesticides), assess likelihood and impact, control storage, labelling and handling, train staff, and monitor. Chemical control (4.9.1.1) is one of the most common Issue 9 non-conformities.
Physical: common sources are glass, metal, plastic, wood, stones, bones and personal items. Use detection (metal detectors, X-ray, sieves, filters, magnets), glass and brittle plastic registers and inspections, equipment maintenance, personal item rules, and raw material checks, and learn from complaints.
More short videos on our STC & QTC Explains channel: https://youtube.com/@stcandqtc
Reviewed by Chisala Ngandwe, Technical Manager & Trainer, STC · November 2026
These Q&As share general best practice from our trainers and auditors. They aren't consultancy advice for your site. For support specific to your site and systems, we can refer you to our sister company QTC.
Learn more: BRCGS Risk Assessment, Advanced Risk Management Methodologies and the course calendar.