Every step checked for completeness and every significance decision tested for the reasoning behind it, with replacement wording supplied.
A hazard analysis review examines whether the hazards at each process step have been identified completely, whether the significance decision for each is justified in writing, and whether the control measures assigned follow from that reasoning. It is the part of a HACCP system auditors probe hardest, because a plan can reach entirely correct conclusions and still fail on the absence of reasoning behind them.
The distinction that decides the outcome is between a conclusion and a judgement. A conclusion states that a hazard is significant. A judgement shows the likelihood and the severity that led there. Auditors test the second, which is why a plan with entirely correct conclusions can still attract findings across the analysis.
Completeness, reasoning, boundary and control logic checked step by step, with wording you can put straight into the document. Delivered remotely, in any language, quoted on scope.
Eight checks applied at every process step, with the failure each one catches most often.
| Check | What it establishes | Common failure |
|---|---|---|
| Step completeness | Every process step present, including intake, storage, rework, holding and dispatch. | Steps omitted because nothing happens to product there, which is where hazards hide. |
| Hazard identification | Biological, chemical, physical and allergen hazards considered at every step. | Allergens treated as a separate exercise instead of a hazard within the analysis. |
| Source of each hazard | Whether the hazard is introduced, increased or fails to be controlled at that step. | The same hazard listed at every step with no statement of what the step does to it. |
| Likelihood and severity | Both assessed and both recorded, with the basis for each stated. | A significance verdict written as a conclusion with no reasoning behind it. |
| Significance decision | A defensible judgement following from the likelihood and severity recorded. | Significance assigned to match the controls already in place. |
| Control measure logic | The control assigned genuinely addresses the hazard identified at that step. | A control that manages a different hazard, or one that belongs in a prerequisite programme. |
| Prerequisite boundary | Hazards controlled by prerequisite programmes distinguished from those needing a CCP. | Prerequisite matters escalated to CCPs, producing a plan nobody can monitor. |
| Supporting evidence | Scientific or regulatory basis cited where a hazard is dismissed or a limit set. | Hazards dismissed on experience with nothing recorded to support it. |
The difference between a hazard analysis that holds and one that attracts findings is visible in a single entry.
| Entry type | How it reads | Verdict |
|---|---|---|
| Conclusion only | Significant. Controlled at step 7. | Fails. Nothing shows how the judgement was reached, so an auditor cannot test it. |
| Reasoning recorded | Vegetative pathogens may be present on incoming material and this step provides no reduction. Severity high, likelihood moderate without control. Significant. | Holds. Likelihood and severity are stated and the conclusion follows from them. |
| Dismissal without basis | Not significant. Never had a problem. | Fails. Absence of incidents is not evidence a hazard was assessed. |
| Dismissal with basis | Water activity below the level supporting growth, supported by product data. Not significant. | Holds. The dismissal rests on a property of the product that can be checked. |
Eight failures, and the first is a frequent source of findings on its own.
One of the most common findings in any hazard analysis. Significance is stated and nothing shows how it was reached, so the auditor has nothing to test and raises the clause.
Never had a problem is not an assessment. Absence of incidents may reflect good fortune, low volume or unreported cases, and none of those are evidence.
A single significance score with no separate view of how likely the hazard is and how serious it would be. Standards expect both, and the two move independently.
A hazard carried down the whole analysis without stating what each step does to it. The analysis looks thorough and identifies nothing about the process.
Allergen control documented separately and never assessed as a hazard at each step. Auditors expect it inside the analysis.
The controls already in place decide which hazards are significant. It produces a plan that matches the operation and evidences no assessment.
Hygiene and cleaning treated as critical control points, producing a plan with monitoring nobody can sustain and corrective actions that make no sense.
A new ingredient, a new line, a new supplier or a process change, with the analysis untouched. It now describes a process that no longer exists.
Replacement reasoning is supplied per hazard, so the analysis can be corrected directly.
| Element | What it covers |
|---|---|
| Step by step findings | Each process step marked sound, weak or missing, with the reason stated. |
| Completeness gaps | Steps and hazards absent from the analysis, identified explicitly. |
| Reasoning assessment | Where significance is stated without the likelihood and severity behind it. |
| Replacement wording | Written reasoning you can put into the analysis directly, per hazard. |
| Boundary corrections | Hazards sitting at the wrong level, whether escalated to a CCP or left in a prerequisite. |
| Evidence needs | Where a dismissal or a limit needs a scientific or regulatory citation to stand. |
| Priority order | Findings ordered by the consequence each would carry at audit. |
| Change triggers | The events that should prompt a reassessment, so the analysis stays current. |
Food manufacturers, processors, packers and catering businesses operating a HACCP based system. It suits any business whose audit findings concentrate in the analysis instead of being spread across the plan.
An auditor has raised findings across your hazard analysis.
Significance decisions are recorded with no reasoning behind them.
You have more CCPs than the process warrants.
Allergens are managed outside the analysis entirely.
The analysis was inherited and nobody can defend it.
A new ingredient, line or supplier has been introduced.
The analysis came from a template and was never adapted.
You are moving to a new standard and want the analysis checked first.
You send the hazard analysis, the flow diagram, product descriptions and the standard you work to.
The flow diagram is checked against the operation, since an analysis built on a wrong flow is wrong throughout.
Every step is checked for presence, and every hazard type is checked at each step.
Each significance decision is tested for whether likelihood and severity are recorded and whether the conclusion follows.
Hazards sitting at the wrong level are identified, and control measures are checked against the hazards they claim to address.
Replacement reasoning is supplied per hazard, in priority order by audit consequence.
Building an analysis from scratch. Where there is little to review, HACCP plan development is the service that applies.
Validation studies. Where a control measure needs evidence that it works on your equipment with your product, the review says what study is needed.
The wider plan. CCP determination, critical limits, monitoring and verification are covered by a HACCP plan review.
Every review is quoted against its own scope. A six step process with one product and a forty step process across a product range are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
It is the process of identifying the biological, chemical, physical and allergen hazards at every process step, assessing how likely each is and how serious it would be, and deciding which are significant enough to need a control measure. It is the foundation of a HACCP plan, and everything after it depends on it being right.
Reasoning. A significance decision recorded as a bare conclusion gives an auditor nothing to test, so the clause is raised even where the conclusion is correct. What holds up is a record showing the likelihood and the severity considered, and a judgement that follows from them.
No. Absence of incidents may reflect low volume, good fortune or cases that were never traced back to you. A dismissal has to rest on something checkable, such as a product property, a process parameter or published evidence.
Yes. They move independently, and standards expect both to be visible. A hazard that is unlikely and catastrophic needs a different response from one that is frequent and mild, and a single combined score hides which is which.
A prerequisite programme controls hazards across the operation generally, such as cleaning or pest control. A CCP controls a specific significant hazard at a specific step, with a measurable critical limit and an immediate product decision when it is breached. Escalating prerequisite matters to CCPs produces a plan nobody can operate.
Yes, at every step where they could be introduced or fail to be controlled. Allergen management documented entirely outside the analysis is a common finding, because the analysis is where auditors look for it.
On a defined cycle, and immediately after any change to ingredients, process, equipment, packaging, supplier or intended use. An analysis untouched through a line change describes a process that no longer exists.
Every significant hazard does. Hazards assessed as not significant need the reasoning recorded and no control. The value of the analysis is in separating the two defensibly.
Scientific literature, regulatory guidance, industry codes, product data such as water activity or pH, and your own validation work. The point is that a reader can check the basis for a decision instead of taking it on trust.
A HACCP plan review covers the whole plan, including CCP determination, critical limits, monitoring, corrective action and verification. This review goes deeper into the hazard analysis alone. Businesses whose findings concentrate in the analysis should take this one.
The review supplies replacement wording for the reasoning, per hazard, which you put into your own document. Building a full analysis from scratch is HACCP plan development and is quoted separately.
Step by step findings marked sound, weak or missing, completeness gaps, an assessment of where reasoning is absent, replacement wording per hazard, boundary corrections where hazards sit at the wrong level, evidence needs, findings in priority order and the change triggers that should prompt a reassessment.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
An independent technical review of your existing HACCP plan, checking that the hazard analysis holds and that the CCPs are genuinely the right ones.
Read about HACCP Plan Review →A review of the prerequisite programmes underneath your HACCP plan, since a hazard analysis is only as sound as the PRPs it assumes.
Read about Prerequisite Programme Review →Certificated course covering hazard analysis, CCP determination and validation.
View Certified HACCP Manager →Expert HACCP consulting worldwide. HACCP plan development, hazard analysis, CCP determination, validation, internal audits and training for food businesses of all sizes.
See HACCP Consulting →Expert ISO 22000 consulting worldwide. Gap assessments, FSMS design, internal audits, mock certification audits and ongoing compliance support for food businesses of...
See ISO 22000 Consulting →Expert FSMA consulting worldwide. Preventive Controls for Human Food, HARPC food safety plans, PCQI support, FSMA 204 traceability and FDA compliance for food businesses.
See FDA FSMA Consulting →Send the analysis, the flow diagram and the standard you work to, and receive a written quote covering the scope, the deliverable and the price.