Glossary
Hazard Analysis
Definition
Hazard analysis is the systematic process of identifying potential food safety hazards that could be reasonably likely to occur in your manufacturing process, and evaluating each hazard's severity and the probability that it will actually cause harm without controls in place.
The output of a hazard analysis is a documented determination: which hazards require a preventive control or critical control point, and which do not, along with the reasoning behind each decision.
It is not a one-time exercise. It is a living document that must reflect your current products, processes, suppliers, and facility conditions.
Where It Fits
Managing hazard analysis documentation in paper binders and spreadsheets creates real operational risk. When a process changes, updating paper-based documentation across multiple programs, HACCP plans, SOPs, training materials, supplier specifications, requires manual coordination that is easy to miss.
Digital food safety management platforms support hazard analysis program management by centralizing documentation, enabling structured record-keeping, and connecting hazard analysis records to related programs including preventive controls, CAPA workflows, and pre-shipment reviews.
SafetyChain's Food Safety Programs capability supports the digitization and organization of food safety documentation, including HACCP monitoring records, CCP verification workflows, pre-operational checks, and CAPA management. These are not designed to automate the judgment-based work of hazard analysis itself, which requires human expertise. They are designed to ensure that the documentation supporting your hazard analysis decisions is organized, complete, and retrievable when it matters, whether during a routine operational review or an unannounced audit.
Customers have used SafetyChain to significantly reduce the time required to prepare for audits and reassess HACCP programs. JBS USA, for example, reduced HACCP reassessment time from more than five days of work per facility to approximately six hours, an 85% reduction, by accessing structured electronic CCP data rather than pulling and re-entering paper records. That time savings allowed FSQA managers to return meaningful working hours to proactive food safety activities rather than administrative reconstruction.
FAQs
Every hazard analysis must address three categories of hazards. Missing one category is itself an audit finding.
Biological hazards include disease-causing bacteria (such as Salmonella, Listeria monocytogenes, and E. coli O157:H7), viruses, parasites, and allergens. Allergen cross-contact is classified as a biological hazard under FSMA and must be addressed in your hazard analysis.
Chemical hazards include pesticide residues, naturally occurring toxins (such as mycotoxins or histamine), food additives used above approved levels, cleaning and sanitizing chemicals, and unapproved or undeclared food and color additives.
Physical hazards include hard foreign objects that could cause injury when consumed, such as glass fragments, metal shavings, bone fragments, and plastic pieces. Not all foreign material is automatically a hazard requiring a preventive control, your analysis must evaluate severity and likelihood to determine which physical hazards require controls.
Regulatory compliance is the floor, not the ceiling. Here is what hazard analysis actually protects in practice.
It Determines Where Your Controls Live
Your HACCP plan, your preventive controls, your allergen programs, none of these can be properly designed without a completed hazard analysis. The analysis tells you which hazards require control and at which point in the process. Build your controls without it, and you're guessing about whether you've addressed the right risks.
It Is the Evidence Auditors Trace Everything Back To
During a regulatory inspection or third-party audit, investigators and auditors routinely begin with the hazard analysis and trace forward. They want to see that your documented hazards align with your control measures, that your monitoring procedures correspond to identified critical limits, and that your CAPA program connects back to hazard-related deviations. A weak or missing hazard analysis creates a chain of credibility problems throughout your food safety plan.
It Must Evolve With Your Processes
A hazard analysis written when your facility was producing three SKUs does not automatically cover the twelve you produce today. Any significant change, a new ingredient, a new supplier, a new piece of equipment, a process modification, a new customer specification, should trigger a review of the hazard analysis to determine whether previously identified hazards have changed or new ones have been introduced.
FSMA requires that you reassess the food safety plan when you become aware of new information about potential hazards. Waiting for an audit to surface this gap is a costly approach.
It Supports Recall Readiness and Traceability
The FDA's Food Traceability Rule, which applies to foods on the Food Traceability List, establishes requirements for lot-level tracking using Critical Tracking Events (CTEs) and Key Data Elements (KDEs). When hazard analysis is properly documented and connected to your traceability records, the path from an identified hazard to an affected lot becomes traceable. Without it, investigations become reactive and time-consuming at exactly the moment when speed matters most.
The Stakes Are Significant
According to FDA data, approximately 48 million people in the United States are sickened by foodborne illness each year, resulting in approximately 128,000 hospitalizations and 3,000 deaths annually. These figures underscore why regulators treat hazard analysis documentation as a non-negotiable baseline, not an administrative exercise. A well-documented hazard analysis demonstrates that your facility has systematically thought through what could go wrong and has controls in place to prevent it.
Quality and food safety managers who have been through difficult audits will recognize these patterns:
The analysis is outdated. The hazard analysis reflects the facility as it existed two product launches ago. New ingredients, new suppliers, or new equipment have not been incorporated into the formal analysis, even if staff are managing those hazards informally.
The reasoning is absent. The analysis identifies hazards but does not document why certain hazards were deemed to require a control while others were not. Under FSMA, the "why" is as important as the "what."
The analysis is disconnected from preventive controls. The hazard analysis identifies allergen cross-contact as a significant hazard, but the allergen control program was built independently and references a different categorization scheme. Auditors look for alignment between the analysis and the controls.
CAPA is not linked back to hazard analysis findings. When a deviation occurs at a CCP or preventive control, the corrective action and the associated root cause investigation should connect back to the hazard analysis. Facilities that manage CAPA separately often struggle to demonstrate this connection during an audit.
The team conducting the analysis lacked the right expertise. FSMA requires that the hazard analysis be conducted or overseen by a PCQI. Beyond that credential, the analysis benefits from cross-functional input, operations, quality, maintenance, procurement, because hazards do not respect departmental boundaries.
A well-functioning corrective and preventive action program is inseparable from hazard analysis in practice. When a deviation occurs, a temperature excursion at a critical control point, a metal detection failure, an allergen cross-contact incident, the CAPA process should:
- Document what happened and at which process step
- Conduct a root cause investigation
- Determine whether the hazard analysis adequately anticipated this type of failure
- Implement corrective action and verify effectiveness
- Assess whether the food safety plan, including the hazard analysis, requires updating
FSMA auditors and GFSI auditors have intensified scrutiny of CAPA programs in recent audit cycles, specifically looking for the linkage between CAPAs and the underlying food safety plan. A CAPA that resolves an incident without feeding back into the hazard analysis misses the preventive dimension of the requirement.
Yes. HACCP and FSMA's Preventive Controls Rule are separate frameworks with overlapping but distinct requirements. USDA-regulated establishments follow HACCP under 9 CFR Part 417. FDA-regulated facilities follow the Preventive Controls Rule under 21 CFR Part 117. Many facilities subject to FDA jurisdiction also voluntarily follow HACCP principles, but FSMA requires a documented hazard analysis regardless.
FSMA requires reassessment of the food safety plan whenever there is new information about potential hazards or whenever there is a significant change in the food, facility, equipment, processing, packaging, labeling, distribution, or intended use. A common industry practice is to conduct a formal review at least annually, in addition to event-triggered reviews.
The analysis must be conducted or overseen by a PCQI. Beyond that, effective hazard analysis benefits from cross-functional input including operations, quality assurance, maintenance, sanitation, and procurement. These teams have direct knowledge of process conditions, equipment behavior, and supplier practices that affect the accuracy of the analysis.
These terms are sometimes used interchangeably but refer to distinct activities. Hazard analysis identifies which hazards exist and evaluates their severity and likelihood. Risk assessment may layer additional context, such as epidemiological data, exposure probability modeling, or severity-weighted scoring, to support more granular decision-making. Hazard analysis as defined under FSMA and HACCP frameworks is the foundational requirement.
An incomplete or outdated hazard analysis can result in a major nonconformance under GFSI-benchmarked schemes, a Form 483 observation during an FDA inspection, or, in more serious situations, be cited as a violation that triggers enforcement action. More practically, an inadequate hazard analysis undermines the defensibility of your entire food safety system.
Compliance Requirements
FSMA: The Preventive Controls Rule (21 CFR Part 117)
Under the FDA's Food Safety Modernization Act, virtually every food manufacturing facility subject to registration is required to conduct and document a hazard analysis. The specific requirement is found in 21 CFR Part 117, Subpart C, "Hazard Analysis and Risk-Based Preventive Controls for Human Food."
The regulation requires facilities to:
- Identify and evaluate known or reasonably foreseeable hazards for each type of food manufactured
- Determine which identified hazards require a preventive control
- Document the hazard analysis in writing
The hazard analysis must be conducted by or under the oversight of a Preventive Controls Qualified Individual (PCQI), a role with defined training and competency requirements under FSMA.
A documented hazard analysis is not optional. Under FSMA, the determination that a hazard does not require a preventive control must itself be documented, along with the reasoning. Silence is not a valid answer.
For facilities that rely on a trading partner or customer to control a hazard (rather than implementing their own control), 21 CFR § 117.136 establishes the specific conditions and documentation requirements that must be met to support that determination.
USDA/FSIS: 9 CFR Part 417
For establishments producing meat, poultry, and processed egg products regulated by USDA's Food Safety and Inspection Service, hazard analysis requirements are established under 9 CFR Part 417, the HACCP regulation for FSIS-inspected facilities. These facilities must:
- Conduct a hazard analysis to identify food safety hazards that are reasonably likely to occur
- Identify critical control points (CCPs) for each hazard that requires control
- Document the hazard analysis in writing prior to implementing their HACCP system
FSIS-regulated facilities operate under a different regulatory framework than FDA-regulated facilities, but the core obligation, a written, documented hazard analysis, is the same.
Foreign Supplier Verification: 21 CFR Part 1, Subpart L
If your facility imports food ingredients or finished products, hazard analysis obligations extend to your supply chain. The FSMA Foreign Supplier Verification Programs (FSVP) rule, codified at 21 CFR Part 1, Subpart L, requires importers to conduct a hazard analysis for each food type and each foreign supplier. This analysis must evaluate biological, chemical, and physical hazards before the food enters your facility.
GFSI-Benchmarked Schemes (SQF, BRC, FSSC 22000)
Facilities pursuing certification under GFSI-recognized schemes, including SQF, BRCGS, and FSSC 22000, are required to conduct and maintain hazard analyses as part of their food safety management systems. While the specific clause requirements vary by scheme, the expectation is consistent: hazard analysis must be documented, current, and linked to your control measures. Auditors under these schemes review hazard analysis documentation and will issue nonconformances when the analysis is incomplete, outdated, or disconnected from current process conditions.
Ready to Strengthen Your Food Safety Documentation?
Explore SafetyChain's Food Safety Programs capabilities or request a walkthrough with one of our food safety operations specialists.