Risk Assessments in Pre-requisite Programs


Risk Assessment is the identification, evaluation, and estimation of the levels of risk involved in a process to determine an appropriate control method.

Applicable Code Requirements


Review Glossary Terms

  • Pre-requisite
  • Risk Assessment

Implementation & Audit Guidance

What does it mean?

A risk assessment is a specific requirement in food safety codes where the SQF practitioner or delegated resources perform a structured approach to identifying, evaluating, and estimating levels of risk to hazards that might be present or reasonably likely to occur in the process.

Why is it in the Code & why is it important?

Risk assessments are the backbone to any functioning food safety management system. They are inherently part of many of the system elements of SQF. Specifically, the food safety plan, environmental monitoring program, food defense, food fraud and allergen management program all employ the use of risk assessments in determine if hazards of concern need control. The structure and approach to complete these risk assessments are usually prescribed by other sources of authority such as Codex Alimentarius or regulatory authorities.

Where there might be risk in other aspects of the food safety management system, namely the pre-requisite programs, a risk-analysis or risk assessment is specifically asked for and may or may not be related to certain circumstances. The site should have a prescribed process for completing and documenting a risk assessment. The following 3 step process is recommended:

  1. Identification of hazards at any location or process step. Similar to how a hazard analysis is completed within the food safety plan the site should consider any biological, chemical or physical hazards that could occur and importantly what can cause them. Using descriptions from preventive control methodology hazards that are reasonably likely to occur in the absence of controls should be considered.
  2. Evaluate each hazard and how it might occur to determine if there are any controls that are being applied or can be applied to eliminate or reduce the hazard to acceptable levels. This evaluate is crucial so that risk can be assessed in the next step.
  3. Estimate the risk of the hazards using a likelihood vs severity assessment or similar type of tool. The definitions for each level of likelihood and severity will be important so that it can be consistently applied. A measurement tool should be applied so that the output can definitively indicate risk level and thereby any appropriate control.

RIO Road to Audits (Records, Interviews, and Observations)


The following are examples of records and/or documents to assist in the implementation and review of this topic:

  • Risk Analysis/Assessment
  • Hazard Control Records


The following are examples of people to interview to assist in the implementation and review of this topic:

  • SQF Practitioner
  • Risk Assessors
  • Operations Personnel

The following are examples of questions to ask to assist in the implementation and review of this topic:

  • How were the risk factors determined and defined?
  • What other team members were involved in the process and how were they trained?
  • Describe the role of the individuals conducting the risk assessments.
  • What controls are applied to reduce risk?


The following are examples of observations to assist in the implementation and review of this topic:

  • Activities or process step associated with assessment

Download the .pdf

Updated Date: 2022/10/01

Translations are provided as a service to SQF customers and are provided "as is." No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, or correctness of any translations made from English into any other language.

PDFs of the Guidance Documents and Tip Sheets are only available in English. To download translated versions, navigate to your desired language and save this page as a PDF. Press Ctrl + P, choose "Print to PDF" as the destination. For more help, check your browser's documentation or contact support.