RISK-BASED THINKING IN MANAGING RISKS IN ISO 22000

Risk-based thinking in ISO 22000 is an approach that enables organizations to proactively identify, assess, and control potential hazards that may affect food safety. Proper implementation of risk-based thinking for managing Risks in ISO 22000 not only helps minimize incidents and improve operational efficiency, but also enhances the organization’s credibility within the food supply chain.

What Is Risk-Based Thinking in ISO 22000?

In today’s food industry, where product quality and food safety are subject to increasingly strict regulatory and customer requirements, the application of risk-based thinking has become a fundamental requirement of ISO 22000. This approach not only helps organizations control food safety hazards, but also enables them to proactively prevent incidents, enhance corporate reputation, and ensure legal and regulatory compliance.

Risk-Based Thinking in ISO 22000 is a systematic approach used to identify, assess, and control potential Risks in ISO 22000 that may impact the effectiveness of the Food Safety Management System (FSMS). Instead of reacting only after problems occur, organizations are required to proactively recognize potential risks at an early stage and implement appropriate control measures to prevent or minimize their impact.

Types of Risks to Be Considered in ISO 22000

Potential Risks in ISO 22000 may arise not only during production processes, but also from operational activities, suppliers, regulatory requirements, and market changes. Therefore, organizations need to establish a comprehensive control approach to minimize the likelihood of incidents and maintain the effectiveness of the Food Safety Management System (FSMS).

Risks in ISO 22000 That Organizations Need to Consider

Food Safety Risks

Food safety risks are considered the most critical category in ISO 22000 because they directly impact consumer health. Common hazards include microbiological contamination caused by bacteria, yeasts, or parasites in raw materials and the production environment; chemical residues such as pesticides, cleaning agents, or additives exceeding permissible limits; foreign matter contamination including metal, plastic, or glass fragments; and cross-contamination between raw materials and finished products.

If not effectively controlled through Prerequisite Programs (PRPs), Operational Prerequisite Programs (OPRPs), or Critical Control Points (CCPs), these risks may lead to product recalls, reputational damage, and noncompliance with food safety regulations.

Examples include:

- Microbiological contamination

- Chemical residues

- Foreign matter contamination

- Cross-contamination

Operational Risks

In addition to food safety hazards, organizations must also consider risks arising from daily operational activities. Equipment failure or inadequate preventive maintenance may disrupt production processes and compromise food safety control conditions. Unexpected power outages can interrupt the cold chain or affect critical operational parameters.

Furthermore, operational errors caused by insufficient employee training or failure to follow established procedures are common causes of nonconforming products. Labor shortages in critical positions may also reduce the effectiveness of monitoring and quality control activities throughout the production process.

Examples include:

- Equipment breakdown

- Power outages

- Operational errors

- Workforce shortages

Supplier-Related Risks

Under ISO 22000, the supply chain is regarded as an integral part of the Food Safety Management System. Organizations are therefore required to evaluate risks associated with suppliers of raw materials, packaging materials, and supporting services.

Raw materials that fail to meet quality or food safety requirements may directly affect the final product. Unstable delivery performance can also disrupt production planning and inventory management. In addition, suppliers that fail to comply with legal requirements or certification standards may expose the organization to regulatory risks and customer loss.

For this reason, supplier evaluation, approval, and monitoring activities should be conducted systematically and on a periodic basis.

Examples include:

- Nonconforming raw materials

- Unstable delivery performance

- Noncompliance with regulatory requirements

Legal and Market Risks

The regulatory and market environment within the food industry is continuously evolving, requiring organizations to stay updated to ensure ongoing compliance. Changes in food safety regulations, contaminant limits, or labeling requirements may directly impact manufacturing and business operations.

At the same time, customer expectations are becoming increasingly demanding regarding traceability, international certifications, and sustainability practices. For exporting organizations, keeping up with new international market standards is essential to maintaining competitiveness and avoiding the risk of shipment rejection.

Therefore, organizations should establish mechanisms to monitor regulatory updates and market trends as part of their overall risk management approach for managing Risks in ISO 22000.

Examples include:

- Changes in food safety regulations

- Changing customer requirements

- New export standards and requirements

Risk-Based Thinking Approach in ISO 22000

In ISO 22000, risk-based thinking is applied as a proactive management approach to identify, assess, and control factors that may affect food safety and the effectiveness of the Food Safety Management System (FSMS). Instead of responding only after incidents occur, organizations are required to establish preventive mechanisms based on risk analysis throughout all operational processes. This approach helps organizations improve hazard control capability, optimize resources, and continuously improve the food safety management system.

Step 1: Risk Identification

The first step in risk-based thinking is to comprehensively identify potential risks that may affect products, processes, and the management system. Organizations should determine where risks may occur, identify their root causes, and evaluate their potential consequences on food safety, customers, or operational activities. Risk identification should be conducted systematically and based on factual data rather than assumptions.

Organizations should determine:

- Where could the risk occur?

- What are the causes?

- What are the potential consequences?

Sources for risk identification may include:

- Production processes

- Internal audit results

- Customer complaints

- Previous incidents or nonconformities

Step 2: Risk Assessment

After identifying potential risks, organizations need to assess the level of risk in order to prioritize control measures. Risk assessment is generally based on two key factors: the likelihood of occurrence and the severity of impact on food safety or system operations. Risks with a high probability and severe consequences should be prioritized for control.

Organizations typically assess risks based on:

- Likelihood of occurrence

- Severity of impact

Depending on the organization’s assessment methodology, risks may be classified as low, medium, or high. This classification enables organizations to focus resources on critical control areas and supports decision-making in establishing appropriate preventive and control measures. It also serves as the foundation for hazard management programs based on HACCP principles within ISO 22000 and the effective management of Risks in ISO 22000.

Risk classification may include:

- Low risk

- Medium risk

- High risk

Critical risks should be prioritized for immediate control.

Step 3: Establishing Control Measures

After assessing the level of risk, organizations must implement control measures to reduce risks to an acceptable level. These measures may include establishing Critical Control Points (CCPs) or Operational Prerequisite Programs (OPRPs) for critical processes, strengthening supplier controls, implementing sanitation programs, providing employee training, and conducting preventive equipment maintenance.

Control measures may include:

- Establishing CCPs/OPRPs

- Supplier control and monitoring

- Employee training

- Sanitation control

- Preventive equipment maintenance

The objective is to reduce risks to an acceptable level.

The effectiveness of control measures depends on their suitability to actual operational conditions and their ability to be consistently maintained throughout production activities. Therefore, organizations should ensure that control measures are developed based on actual risk analysis results, supported by clear instructions, and effectively communicated to relevant departments. Effective control not only prevents food safety incidents but also enhances the stability of the entire management system.

Step 4: Monitoring and Evaluating Effectiveness

Risk-based thinking in ISO 22000 does not stop at implementing control measures; it must be maintained through continuous monitoring, evaluation, and improvement activities. Organizations should:

- Monitor control results regularly

- Periodically evaluate system effectiveness

- Update newly identified risks arising from operational activities or changes in the business environment

- Implement continual improvement activities

Risk-based thinking is not a one-time activity but an ongoing process throughout the entire ISO 22000 system. Through monitoring, internal audits, and management reviews, organizations can identify nonconformities and implement appropriate corrective actions and improvements. This helps maintain the long-term effectiveness of the ISO 22000 system and ensures adaptability to changes in products, technology, customer requirements, and legal regulations. Therefore, risk-based thinking should be considered a continuous and integrated process across the entire Food Safety Management System, rather than a temporary activity.

Practical Examples of Risk-Based Thinking in ISO 22000

► Example 1: Bread Manufacturing Facility

Risk: Microbiological cross-contamination from raw material areas to finished products.

Control Measures:

- Area segregation

- Controlled personnel and material flow

- Sanitation control for utensils and equipment

► Example 2: Fruit and Vegetable Processing Facility

Risk: Pesticide residues exceeding permissible limits.

Control Measures:

- Incoming material inspection

- Supplier evaluation and approval

- Periodic laboratory testing

Key Considerations for Organizations

During ISO 22000 implementation, many organizations focus excessively on documentation preparation for certification audits without effectively integrating the system into actual operations. This is one of the primary reasons why Food Safety Management Systems fail to deliver long-term effectiveness and continual improvement. Risk-based thinking in ISO 22000 should not exist only in procedures or forms, but must be integrated into all daily activities, including production, quality control, human resource management, and supply chain management.

In addition, employee awareness training is a critical factor for effective system operation. All departments should clearly understand what risks are, why they must be controlled, and the potential consequences of failing to manage hazards in food production processes. When employees fully understand their role in food safety control, organizations can significantly reduce operational errors, cross-contamination, and incidents affecting product quality. Training should not be conducted merely as a formal requirement, but should be practical, job-related, and regularly maintained to strengthen the organization’s capability in managing Risks in ISO 22000.

Furthermore, organizations should recognize that risks continuously evolve along with market changes and production activities. Factors such as new products, new technologies, regulatory updates, and increasing customer expectations may introduce new risks to the Food Safety Management System. Therefore, organizations should regularly review risk assessments, evaluate the effectiveness of existing control measures, and implement continual improvements to ensure the ISO 22000 system remains suitable for operational realities and current requirements.

Common Mistakes Organizations Make When Applying ISO 22000

During ISO 22000 implementation, many organizations encounter difficulties not because of insufficient documentation, but because the system is not properly aligned with actual operational practices. Mistakes in risk assessment, control point determination, or supplier management may reduce the effectiveness of the Food Safety Management System and result in nonconformities during certification audits.

Formalistic Risk Assessment

One of the most common mistakes is creating risk assessment documents merely to complete documentation requirements without applying them in actual operations. In many cases, risk assessment records are created initially but are not periodically updated when products, processes, or regulatory requirements change. Additionally, identified risks may lack specific control actions or are not implemented in daily operations. As a result, the ISO 22000 system becomes a paper-based system with limited practical effectiveness in preventing food safety incidents.

Common issues include:

- Failure to update risk assessments periodically

- Lack of specific control actions

- Failure to integrate controls into actual operations

► This causes the ISO system to exist only in documentation rather than in practice.

Incorrect Determination of CCPs and OPRPs

Incorrectly distinguishing between Critical Control Points (CCPs) and Operational Prerequisite Programs (OPRPs) is another common issue in ISO 22000 implementation. Many organizations identify too many CCPs without sufficient analytical justification, making the control system overly complicated and difficult to maintain. Conversely, some organizations confuse OPRPs with CCPs, resulting in control measures that do not match the actual level of risk.

Consequently, the control system loses effectiveness, monitoring activities become difficult, and certification bodies may issue nonconformities during audits. This is one of the most common implementation mistakes related to managing Risks in ISO 22000.

Documentation Not Aligned with Actual Operations

Some organizations use template documents or copy procedures from other companies without adapting them to their own production conditions. This leads to records, forms, and operational procedures that do not accurately reflect actual manufacturing activities. In many cases, operational employees do not fully understand the documented procedures or fail to follow them correctly.

During on-site audits, auditors can easily identify inconsistencies between documentation and actual operations, negatively affecting the effectiveness of the ISO 22000 system.

Inadequate Supplier Control

Suppliers are a critical part of the food safety chain, yet many organizations still lack effective supplier control mechanisms. Some organizations fail to conduct periodic supplier evaluations, establish raw material selection criteria, or maintain adequate traceability records.

This increases the risk of using nonconforming raw materials, directly affecting the quality and safety of final products. Under ISO 22000, supplier control is not merely a documentation requirement, but a critical preventive measure for managing risks throughout the food supply chain.

Risk-based thinking in ISO 22000 is the foundation for building an effective and sustainable Food Safety Management System. Proactively identifying, assessing, and controlling risks not only helps minimize incidents but also enhances competitiveness, brand reputation, and customer confidence.

In today’s food manufacturing environment, organizations that effectively apply risk-based thinking gain significant advantages in meeting legal requirements, customer expectations, and international market standards.

ISO 22000:2018 is not only about achieving certification, but about building a truly effective risk control system within operational activities.

If your organization needs proper implementation from the beginning, wants to avoid rework, audit nonconformities, and unnecessary implementation costs, NAPHA can support you with practical ISO 22000:2018 implementation solutions tailored to your operational reality, ensuring the system is not only compliant but also effectively operational.

CONTACT FOR FREE CONSULTING VIA HOTLINE: 0938.161.564

NAPHA CONSULTING CO., LTD

Địa chỉ:  3 Floor, An Phu Plaza, 117 - 119 Ly Chinh Thang Street, District 3, HCMC
Email: tuvannapha@gmail.com