HACCP Hazard Analysis: How to Identify Every Risk in Your Food Production

The step that everything else depends on

Hazard analysis is the first principle of HACCP, and it's the one that determines whether the rest of your plan is worth anything. If you miss a hazard here, no amount of monitoring or record keeping later will catch it. Get the hazard analysis right and the rest of the plan more or less builds itself.

Yet it's also the step where small producers most often go wrong. Some list every conceivable hazard until the plan becomes unusable. Others list almost nothing and end up with a plan an auditor can dismantle in minutes. The skill is in being systematic, honest, and specific to your actual operation.

Here's how to do it properly.

What a hazard actually is

A hazard is anything in your food that could cause harm to the person eating it. In HACCP terms, hazards fall into four categories, and you need to consider all four at every step of your process.

The four categories are biological, chemical, physical, and allergenic. You'll sometimes see them shortened to B, C, P, and A. Allergens were historically grouped under chemical hazards, but because they carry such specific legal and health consequences in the UK, they're now treated as their own category in most modern HACCP plans.

Biological hazards

These are living organisms or their toxins: bacteria, viruses, parasites, and moulds. They're the cause of most foodborne illness, and they're the hazards your critical control points most often target.

Common biological hazards include:

1. Salmonella - associated with poultry, eggs, and raw meat
2. Listeria monocytogenes - a particular concern in ready-to-eat foods, soft cheeses, and chilled products because it grows at refrigeration temperatures
3. E. coli (including O157) - linked to undercooked beef, raw milk, and contaminated produce
4. Campylobacter - the most common cause of food poisoning in the UK, strongly associated with raw poultry
5. Clostridium botulinum - rare but extremely dangerous, a risk in vacuum-packed and canned low-acid foods
6. Bacillus cereus - associated with cooked rice and pasta left at room temperature

For a bakery, biological hazards might be limited because baking is a kill step for most bacteria, but they reappear if you add cream fillings or handle the product after baking. For a dairy, they're front and centre because milk is a perfect growth medium. For a meat processor, they dominate the entire plan.

Chemical hazards

These are harmful substances that can contaminate food, either from outside or from the process itself.

Common chemical hazards include:

• Cleaning chemicals - sanitisers, detergents, and descalers that could contaminate food or surfaces if used incorrectly or not rinsed
• Pest control products - rodenticides and insecticides stored or used near food
• Machine lubricants - non-food-grade oils on production equipment
• Mycotoxins - naturally occurring toxins from mould growth on grains and nuts
• Heavy metals - from water supply or certain ingredients
• Process contaminants - such as acrylamide, which forms when starchy foods are cooked at high temperatures

For most small producers, the realistic chemical hazards are cleaning chemicals and pest control products. The control is usually a prerequisite programme: correct storage, correct dilution, and a clear separation between chemicals and food.

Physical hazards

These are foreign objects that could cause injury: choking, cuts, or dental damage.

Common physical hazards include:

1. Metal - from worn equipment, broken blades, staples, or wire from packaging
2. Glass - from light fittings, jars, or windows in the production area
3. Hard plastic - from broken containers, utensils, or packaging
4. Wood - splinters from pallets or wooden utensils
5. Stones or bone - in raw agricultural ingredients
6. Personal items - jewellery, plasters, hair, or buttons from staff

Physical hazard controls are usually a mix of prerequisite programmes (glass and hard plastic policies, a no-jewellery rule, blue detectable plasters) and sometimes a critical control point such as metal detection or sieving.

Allergenic hazards

In the UK, 14 allergens must be declared by law. An allergen becomes a hazard when it ends up in a product where the customer doesn't expect it, whether through an incorrect recipe, cross-contamination, or a labelling error.

The 14 declarable allergens are celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soybeans, and sulphur dioxide and sulphites (at concentrations above 10mg/kg or 10mg/litre).

Allergen hazards are unusual because the food itself is perfectly safe for most people. The hazard is specific to the person who is allergic, and for them the consequence can be fatal. That's why allergen management gets its own controls: separation, scheduling, cleaning between products, and rigorous labelling.

How to actually do the analysis

The method is straightforward but it takes discipline. Work through your process flow diagram one step at a time, and at each step ask: what could go wrong here, in each of the four categories?

For each hazard you identify, you then assess two things:

1. Severity - if this hazard occurred, how serious would the harm be? A mild stomach upset is low severity. A potentially fatal allergic reaction or botulism is high severity.
2. Likelihood - how likely is it to occur, given your normal operation and your existing prerequisite programmes?

Multiply or cross-reference these two and you get a risk rating. A common approach is a 5x5 matrix: severity scored 1 to 5, likelihood scored 1 to 5, giving a risk score from 1 to 25. The higher the score, the more significant the hazard, and significant hazards are the ones that go forward to the critical control point decision.

This is exactly where small producers tend to struggle. Scoring consistently across dozens of hazards is genuinely hard, and auditors can spot when scores have been guessed rather than reasoned. This is one of the areas Sage was built to handle: it draws on a curated library of pre-verified UK and EU hazards across all four categories, and applies a consistent severity and likelihood matrix to every one, so your scoring is defensible and consistent across the whole plan rather than varying by mood and memory. You review and confirm every hazard, but the logic underneath is the same every time.

Common hazard analysis mistakes

1. Listing hazards that don't apply to your process. Copying a generic template means you end up defending hazards that have nothing to do with what you make. Auditors notice immediately.
2. Missing allergen cross-contamination. Producers often capture the allergens in their recipes but miss the ones that could transfer between products sharing equipment.
3. Scoring everything the same. If every hazard scores medium, you haven't actually assessed anything. Honest analysis produces a spread.
4. Forgetting the steps where nothing is added. Storage, chilling, and transport steps still carry hazards even though no ingredient enters there.
5. Treating the analysis as a one-off. Every new product, new ingredient, or new piece of equipment changes the hazard picture and should trigger a review.

The foundation for everything else

Once your hazard analysis is complete, the significant hazards flow into your critical control point determination, your control charts, and your monitoring records. Get this step right and the rest of your HACCP plan has a solid foundation. Get it wrong and you're building on sand.

If you want to understand what happens next, our guide to determining your critical control points walks through the Codex decision tree step by step.

Food safety compliance, handled.