HACCP has been one of the most important food safety tools ever adopted by the food industry. It helped move food safety from a reactive model, based mainly on end-product testing, to a preventive, science-based system focused on identifying and controlling hazards before unsafe food reaches the consumer.

That achievement should not be minimized.

However, after looking at HACCP through the lens of modern risk management, I believe it is time to ask an important question:

Are we implementing HACCP in the most logical sequence for managing risk?

My concern comes from looking at HACCP not only as a food safety professional, but also through the lens of risk management, an area in which I completed a master’s degree and have continued to apply while evaluating food safety systems. From that perspective, I believe HACCP can be strengthened by improving the sequence used to identify hazards, assess risk, determine significance, define controls, verify effectiveness, and maintain evidence that the system works.

HACCP is recognized in ISO 31010 as a risk assessment technique. ISO 31010 supports the broader risk management approach outlined in ISO 31000, which focuses on identifying, analyzing, evaluating, and treating risk in a structured manner. At the same time, Codex Alimentarius remains the internationally recognized authority for food hygiene principles and HACCP guidance in the food sector.

This creates an important opportunity: HACCP should continue to serve food safety, but its application should be strengthened by the fundamentals of risk management.

The issue is not whether HACCP is valuable. It is.

The issue is whether the way we commonly teach, document, and verify HACCP always follows the logical sequence required to identify hazards, evaluate risk, determine significance, select controls, define effectiveness criteria, verify performance, and maintain evidence that the system is effective.

In many HACCP worksheets, the process begins with ingredients or processing steps. But from a risk management perspective, we should begin more broadly with sources of hazards.

A hazard may originate from formulation, raw materials, suppliers, equipment design, employee hygiene, sanitation, transportation, storage, labeling, intended use, target consumers, maintenance activities, or other relevant conditions. A processing step is not always the source of the hazard. It may only be the location where the hazard is introduced, transferred, survives, or increases.

This distinction matters. If we begin too narrowly, we may miss hazards that are not obvious from the flow diagram alone.

The next concern is hazard identification. In practice, many hazard analyses identify broad events or failure modes rather than the specific biological, chemical, or physical hazard being assessed. Terms such as “pathogenic bacteria,” “chemical hazard,” “metal,” or “misformulation” may not be specific enough to design an effective control.

A control that is appropriate for one pathogen, allergen, toxin, or foreign material may not be appropriate for another. If the hazard is not specifically identified, the selected control may become generic, incomplete, or even misdirected.

That leads to another important point: we should not decide whether a hazard is significant before evaluating severity and likelihood.

In a logical risk management sequence, the risk assessor first identifies the specific hazard, then evaluates the severity and likelihood of occurrence under the actual processing conditions. Only after that evaluation should the organization determine whether the hazard is significant, preferably using a validated risk matrix.

This is one of the weaknesses I see in the current structure of many HACCP worksheets. They often ask for a yes-or-no decision about whether a hazard is significant before the severity and likelihood have been clearly assessed. From a risk management perspective, that sequence is not as strong as it could be.

Once a hazard is determined to require control, the next question should be:

What control procedure is needed, who is responsible, what criteria define effectiveness, and where in the process will the control be applied?

This is where HACCP can become clearer.

A control procedure should not be confused with verification. For example, checking a cooler temperature may verify that the refrigeration system is performing, but the real control includes the activities, maintenance, design, calibration, operation, and management practices that ensure the equipment can consistently maintain conditions that control the hazard.

Similarly, a metal detector, X-ray unit, magnet, or filter may verify or detect the presence of a physical hazard, but the stronger control logic should also consider the preventive activities that reduce the likelihood of the foreign material entering the food in the first place.

A rethought HACCP sequence could therefore look like this:

1. Identify the sources of hazards.
2. Identify the specific biological, chemical, or physical hazards.
3. Evaluate severity and likelihood under the actual processing and use conditions.
4. Use a validated risk matrix to determine whether the hazard is significant.
5. Define the control procedure required for significant hazards.
6. Define who is responsible for implementing the control: supplier, receiving facility, customer, or consumer.
7. Establish the criteria, value, parameter, or critical limit that demonstrates control.
8. Identify the step or steps where the control is applied.
9. Define corrections and corrective actions.
10. Validate and verify the control procedures and the system.
11. Maintain documentation and records as evidence of effectiveness.

The purpose of this proposed sequence is not to make HACCP more complicated. It is to make it more logical, more consistent, and more aligned with how risk should be managed in a system.

This is especially important because food safety systems are expected to protect real consumers under real conditions. The intended use of the food and the intended consumer must influence the risk assessment. Food intended for the general population may still reach young children, elderly consumers, pregnant women, and immunocompromised individuals. Therefore, “general population” should not automatically be treated as a low-concern category.

My concern is not that HACCP has failed.

My concern is that HACCP has become so familiar that we may no longer question whether the sequence we use to implement it is the most effective one.

The food industry, regulators, certification bodies, trainers, consultants, auditors, and standard-setting organizations should consider whether HACCP guidance needs to be updated to better reflect the fundamentals of risk management.

This includes clearer expectations for identifying hazard sources, naming specific hazards, evaluating severity and likelihood before determining significance, using validated risk matrices, defining control procedures and responsibilities, establishing effectiveness criteria, and verifying that the system works.

HACCP remains essential.

But essential tools must also evolve.

A stronger, more logically sequenced HACCP approach can help us build food safety systems that are not only compliant, but demonstrably effective in preventing illness and protecting consumers.

What are your thoughts? Is it time to rethink the sequence of HACCP implementation from a risk management perspective?