What is a hazard analysis in food manufacturing, and how do you complete one?

If you're building a food safety program from scratch, the hazard analysis is where everything starts. It's the document that tells you (and any regulator or auditor who reviews your records) that you've thought seriously about what could go wrong in your process and why your controls are the right ones to prevent it.

It sounds more intimidating than it is. But it's also more consequential than most people realize when they first encounter it. Done well, a hazard analysis isn't just a compliance checkbox. It's a map of how your product stays safe.

This guide walks through what a food safety hazard analysis actually is, how to conduct one step by step, and what the finished document should look like, whether you're operating under Canada's Safe Food for Canadians Regulations (SFCR) or the FDA's Preventive Controls for Human Food rule in the United States.

What a hazard analysis is (and what it isn't)

A hazard analysis is a systematic evaluation of your production process to identify potential hazards that could cause harm to a consumer, determine which of those hazards are significant enough to require a control, and establish what controls you'll use to prevent, eliminate, or reduce them to an acceptable level.

It is not a list of things you hope won't happen. It's a documented, reasoned conclusion supported by evidence about what could realistically go wrong and what you're doing about it.

In both the Canadian and US regulatory frameworks, the hazard analysis is the foundation of a written food safety plan. Under SFCR, it underpins your Preventive Control Plan (PCP). Under FSMA Preventive Controls, it's explicitly required as the first step in your written Food Safety Plan. The language differs slightly between jurisdictions, but the logic is the same.

You'll sometimes hear the terms "hazard analysis" and "HACCP" used interchangeably. They're related but not identical. HACCP (Hazard Analysis and Critical Control Points) is a specific food safety management system developed in the 1960s; a hazard analysis is the foundational analytical step within it. Modern regulatory frameworks like FSMA Preventive Controls and the SFCR PCP system are built on HACCP principles but extend them. If you're conducting a hazard analysis under either of those frameworks, you're doing HACCP-based thinking whether or not your program is formally called a HACCP plan.

The three categories of hazard

Every hazard analysis works through the same three categories. No matter how simple or complex your operation, these are the hazard types you're evaluating.

Biological hazards

Biological hazards are microorganisms (bacteria, viruses, parasites, and mould) that can cause illness if present at unsafe levels in your finished product. The most commonly evaluated biological hazards in food manufacturing include:

• Listeria monocytogenes: particularly relevant for ready-to-eat products and any facility handling refrigerated foods

• Salmonella: common in low-moisture ingredients including spices, flours, and dried herbs

• E. coli (O157:H7): primarily associated with raw produce and beef, but relevant to any facility handling these materials

• Clostridium botulinum: critical for low-acid, shelf-stable, or modified atmosphere products

• Mould and yeast: relevant for products with intermediate water activity or those susceptible to post-process contamination

For most small manufacturers, the biological hazards associated with your ingredients and your process will be the most significant part of your analysis.

Chemical hazards

Chemical hazards include naturally occurring toxins, intentionally added substances that could become hazardous at elevated levels, and unintended chemical contamination. Common categories include:

• Food allergens: the most consequential chemical hazard for the majority of small manufacturers. Undeclared allergens are the leading cause of food recalls in both Canada and the United States.

• Mycotoxins: naturally occurring fungal toxins present in certain agricultural commodities, including corn, wheat, nuts, and dried fruits

• Pesticide residues: relevant if you're sourcing raw agricultural commodities

• Preservatives and additives: substances that are safe at permitted levels but hazardous at elevated concentrations (sodium benzoate, potassium sorbate, sulfites, and others)

• Cleaning and sanitizing chemicals: residue from sanitation procedures if rinse protocols are inadequate

• Heavy metals: particularly relevant for products made with sea vegetables, certain spices, or water sourced from older infrastructure

Physical hazards

Physical hazards are foreign materials that could cause injury (lacerations, choking, dental damage) if present in a finished product. Common sources include:

• Metal fragments from worn equipment, broken blades, or maintenance activities

• Glass from jars, gauges, light fixtures, or laboratory equipment

• Hard plastic from equipment components or packaging materials

• Bone fragments in meat or poultry products

• Natural stones or wood from raw agricultural ingredients

Physical hazards are generally easier to identify and control than biological or chemical ones, but they shouldn't be treated as an afterthought.

How to conduct a hazard analysis: four steps

1. Step one: map your process

   Before you can evaluate hazards, you need a clear picture of your process. Start by drawing a process flow diagram: a simple, step-by-step map of everything that happens to your product from receiving raw materials to releasing finished goods.

   This doesn't need to be elaborate. For a small manufacturer, a one-page flowchart with 8 to 15 steps is typical. What matters is that it's accurate and complete. Every step where something happens to your product (receiving, storage, weighing, mixing, heating, cooling, filling, labelling, warehousing, shipping) should appear on the diagram.

   Common steps to include:

   • Receiving (by ingredient type if hazard profiles differ)

   • Cold or ambient storage

   • Weighing and batching

   • Mixing or blending

   • Cooking, heating, or pasteurization

   • Cooling

   • Filling and sealing

   • Labelling and coding

   • Finished goods storage

   • Shipping and distribution

   Once you have your process flow, verify it against what actually happens on your production floor. It's common to discover that the documented process and the real process diverge in small but meaningful ways. A hazard analysis based on an inaccurate process map will have gaps.
   

2. Step two: identify potential hazards at each step

   With your process map in hand, work through each step and ask: what biological, chemical, or physical hazards could reasonably occur here?

   For each step, consider:

   • What ingredients or materials enter at this step? What hazards do they carry?

   • What conditions exist at this step? Temperature, pH, water activity, and time all affect microbial growth.

   • What equipment is used? What is it made of? How is it cleaned?

   • What is the potential for cross-contamination? From other products, surfaces, personnel, or the environment?

   • What is the potential for intentional contamination? Food defence is a required component of FSMA hazard analysis.

   You're not trying to anticipate every theoretical possibility. You're identifying hazards that a knowledgeable person would reasonably expect to occur in your type of operation. That "reasonably foreseeable" standard is important: it gives you a defensible scope.

   Document every potential hazard you identify, even ones you'll later determine don't require a preventive control. The analysis, including your reasoning for the hazards you ruled out, is part of the record.
   

3. Step three: assess significance

   Not every identified hazard requires a preventive control. The next step is to determine which hazards are significant, meaning they pose a risk that requires a control to ensure the food is safe.

   Significance is typically assessed across two dimensions:

   Severity: how serious would the consequences be if this hazard occurred in a finished product at an unsafe level? A hazard that could cause severe illness or death (botulinum toxin, Listeria in a product consumed by a vulnerable population) scores higher than one that would cause minor, self-limiting illness.

   Likelihood: how probable is it that this hazard could occur in your product, given your ingredients, process, and environment? Consider historical data, your ingredient sourcing, your facility conditions, and published scientific literature.

   A hazard that is both severe and likely is clearly significant. A hazard that is severe but vanishingly unlikely in your specific context may not require a formal preventive control, but your reasoning needs to be documented and defensible.

   Under FDA's Preventive Controls rule, this assessment is explicitly framed as evaluating hazards that are "reasonably likely to occur" in the absence of preventive controls. Under SFCR, the equivalent concept is embedded in the requirement to identify hazards that require a control measure. The logic is the same.
   

4. Step four: identify your preventive controls

   For each significant hazard, identify the control (or combination of controls) that will prevent, eliminate, or reduce it to an acceptable level.

   Under FDA's Preventive Controls framework, controls fall into four categories:

   • Process controls: steps in your process that apply a measurable intervention to control a hazard. Thermal processing to a validated internal temperature is the most common example. Others include acidification to a target pH, reduction of water activity, and UV treatment.

   • Allergen controls: procedures that prevent undeclared allergen cross-contact, including scheduling, cleaning validation, and label verification.

   • Sanitation controls: procedures that address environmental pathogens (particularly Listeria in ready-to-eat environments) or food contact surface contamination that process controls alone cannot adequately address.

   • Supply chain controls: verification activities applied to ingredients or materials where a hazard exists that you cannot control within your own process. If you're receiving a heat-treated ingredient and relying on your supplier's kill step, that reliance needs to be documented and verified.

   Under Canada's SFCR, the same types of controls apply. They're simply described within the PCP framework rather than the FDA's preventive controls taxonomy.

   One hazard can have more than one control, and one control can address more than one hazard. Your documentation should make these relationships explicit.

What the finished hazard analysis document looks like

A completed hazard analysis is typically organized as a table or series of tables: one row per process step, with columns for each hazard type, significance determination, justification, and assigned control. Most food safety plan templates follow this structure.

The document should be readable by someone unfamiliar with your operation and lead them to the same conclusions you reached. That's the practical test: if a regulator or auditor picked it up cold, could they follow your logic?

Supporting documentation matters too. Your significance determinations should reference sources, whether published scientific literature, regulatory guidance documents, or validated process data from your own facility. "We cook to 85°C for at least 15 minutes" is stronger with a thermal process validation behind it than without one.

When to update your hazard analysis

A hazard analysis isn't a document you write once and file. Under both SFCR and FDA Preventive Controls, you're required to review and update your food safety plan when:

• You introduce a new ingredient or change an existing ingredient's source or specification

• You make a change to your process, equipment, or facility

• A new hazard is identified in your product category (emerging pathogen data, recall events in your sector)

• You receive a customer complaint or internal finding that suggests a control may not be working as intended

• A specified time interval has passed (FSMA requires at least a three-year review cycle)

In practice, for a small manufacturer running a relatively stable product line, this means building a habit of asking "does this change affect my hazard analysis?" every time something in your operation shifts. Most changes won't, but the discipline of asking is what keeps your plan current.

Who is qualified to conduct a hazard analysis

Both regulatory frameworks have something to say about who is qualified to perform a hazard analysis.

Under FDA's Preventive Controls rule, the Food Safety Plan must be prepared (or its preparation overseen) by a Preventive Controls Qualified Individual (PCQI). PCQI training is delivered through standardized coursework; the Food Safety Preventive Controls Alliance curriculum is the most widely recognized. If you're using software to build your Food Safety Plan, the PCQI requirement still applies, but a well-structured system makes the work of a qualified individual considerably more efficient and the resulting documentation more defensible.

Under SFCR, the requirement is framed in terms of the licence holder having the knowledge and competency to prepare and implement the PCP. There's no formal credentialing requirement equivalent to the PCQI designation, but regulators expect that whoever prepared the plan understands the science behind it.

If you're a sole operator preparing your own food safety plan, investing in PCQI training is worthwhile even if you're primarily operating under SFCR. The curriculum is rigorous and the concepts translate directly to both frameworks.

The bottom line

A hazard analysis is the most intellectually demanding part of building a food safety program, not because the process is complicated, but because it requires you to think carefully and honestly about your product and your operation. The discipline of doing it properly pays forward: every other element of your food safety plan flows from a solid hazard analysis.

If you find yourself writing a hazard analysis that concludes nothing in your process requires a control, that's a signal to slow down and revisit your work. Every production process has hazards that require management. A thorough hazard analysis finds them and gives you a defensible, documented basis for how you're addressing them.