Hazard analysis is the first of the seven HACCP principles: you identify every biological, chemical, and physical hazard that could reasonably occur at each step of your process, then judge each one on severity and likelihood to decide which are significant enough to control. Its output is the list of significant hazards that the rest of the plan is built to manage.

Principle 1 is where HACCP plans are made or broken. Get it wrong and every downstream principle inherits the error: you set critical limits on the wrong steps, monitor things that do not matter, and miss the hazard that actually hurts someone. This post walks through what a hazard is, the three hazard types, the two-stage method the FDA and NACMCF guidelines lay out, how to weigh severity against likelihood, and how to document the result so an auditor can follow your reasoning.

What is hazard analysis in HACCP?

Hazard analysis is the process of collecting and evaluating information on hazards so you can decide which are significant to food safety and must be addressed in the HACCP plan. NACMCF defines a food safety hazard as a biological, chemical, or physical agent that is reasonably likely to cause illness or injury in the absence of its control. The word that does the work is significant: not every conceivable hazard makes the plan, only the ones that clear a severity-and-likelihood threshold.

The analysis runs in two stages. First is hazard identification, a broad brainstorm of everything that could go wrong at each step. Second is hazard evaluation, where you weigh each candidate and keep only the significant ones. Skipping the second stage is the classic rookie error: a plan that lists forty hazards and controls all of them is not thorough, it is unfocused, and it dilutes attention from the few steps that truly matter. Principle 1 sits on top of your HACCP plan foundation and directly feeds Principle 2, critical control points.

What are the three types of food safety hazards?

Food safety hazards fall into three categories: biological, chemical, and physical. Every hazard you list in Principle 1 is one of these three, and naming the type sharpens how you think about the control.

The three types of food safety hazards Every hazard is one of three types Biological Salmonella Listeria monocytogenes E. coli O157:H7 Clostridium botulinum norovirus parasites, spore-formers controlled by cook, chill, pH, aw Chemical undeclared allergens cleaning-chemical residue mycotoxins heavy metals pesticide residue excess additives controlled by supplier, label, formulation checks Physical metal fragments glass hard/sharp plastic bone stones wood splinters controlled by sieves, magnets, metal detect, x-ray
The three hazard types and the kinds of controls each usually needs. Naming the type is the first move in evaluating any candidate hazard.

Biological hazards are the pathogens: bacteria, viruses, parasites, and the toxins some of them produce. They cause the large majority of foodborne illness, and spore-formers like Clostridium botulinum and Clostridium perfringens survive many cooks, so they drive cooling and stabilization rules. For the full picture see biological hazards in food. Chemical hazards include undeclared allergens (the most common cause of U.S. recalls), cleaning-chemical carryover, mycotoxins, heavy metals, and pesticide residues; allergens get their own program because a single mislabeled ingredient can injure a sensitized consumer. See chemical hazards in food and allergen management. Physical hazards are hard or sharp foreign objects large enough to choke or lacerate: metal, glass, hard plastic, bone, and stones.

How do you conduct a hazard analysis?

You conduct a hazard analysis by working step by step down a verified process flow diagram, listing candidate hazards at each step, then evaluating each for significance. The sequence below is the working method most plants use, and it maps directly onto the NACMCF two-stage model of identification followed by evaluation.

  1. Assemble the team and describe the product. Pull in people who know the process, the equipment, and the microbiology. Write down the product, its ingredients, how it will be distributed and stored, the intended use, and the consumer, including whether it will be eaten by an at-risk population.
  2. Draw and verify the process flow diagram. Map every step from receiving to shipping, then walk the floor to confirm the drawing matches reality. Hazard analysis is only as good as the flow diagram it runs on.
  3. Identify hazards at each step (stage one). For every step, brainstorm the biological, chemical, and physical hazards that could be introduced, increase, or fail to be controlled there. Cast wide here; do not filter yet.
  4. Evaluate each hazard for significance (stage two). Score each candidate on severity and likelihood. Keep the ones that are reasonably likely to occur and serious enough to matter; document why you excluded the rest.
  5. Identify control measures. For each significant hazard, name the measure that prevents, eliminates, or reduces it, and note whether it lives in a prerequisite program or is a candidate for a critical control point.
  6. Record the rationale. Capture the reasoning, not just the conclusion. NACMCF is explicit that the hazard analysis summary and rationale should be kept for future reviews.

How do you decide which hazards are significant?

You decide significance by weighing two independent factors for each hazard: severity, meaning how serious the health consequence is, and likelihood, meaning how probable the hazard is to occur if it is not controlled. A hazard is significant when the combination is high enough that a prudent establishment would address it. Neither factor alone settles the question.

Severity and likelihood risk matrix Significance = severity x likelihood SEVERITY of harm → LIKELIHOOD without control → High Med Low Low Med High SIGNIFICANT not significant botulism in canning stray fiber on a floor
A hazard reaches the plan only when severity and likelihood together are high enough to matter. A catastrophic-but-near-impossible hazard and a trivial-but-common one both sit outside the significant zone.

Severity is the easy axis: a hazard that causes botulism or an anaphylactic reaction is high-severity by definition. Likelihood is the honest one, because it forces you to reason about your actual process, ingredients, and history rather than worst-case fantasy. NACMCF frames it as "reasonably likely to occur," which excludes purely theoretical risks but includes anything a sensible operator would guard against. Severity is inherent to the hazard; likelihood is something your prerequisite programs, such as GMPs and supplier controls, actively push down before you ever reach a control point.

Where do hazards enter the process?

Hazards enter at specific, identifiable steps, which is exactly why the analysis is done step by step rather than for the product as a whole. The same hazard can be introduced at one step, grow at another, and be controlled at a third, so you evaluate every step for all three possibilities: introduction, increase, and failure of control.

Hazards analyzed per process step A hazard is analyzed at every step, not once for the product receiving cold storage mixing cooking cooling packaging B: pathogens on ingredients B: growth if temp abused C: allergen cross-contact B: survival of pathogens B: spore-former growth P: metal fragments Steps in red carry hazards that survived evaluation as significant, the candidates for Principle 2 B = biological · C = chemical · P = physical
The same product, analyzed step by step. Cooking, cooling, and packaging carry the significant hazards here, which is why they become the focus of critical control point analysis.

Notice that receiving and storage carry hazards too, but many of them are handled by prerequisite programs rather than control points: a supplier approval program keeps pathogen loads on incoming ingredients within reason, and temperature-controlled storage limits growth. That distinction, whether a hazard is best managed by a prerequisite program or must be a critical control point, is the whole subject of Principle 2 and the CCP decision tree.

Facts worth pinning

From analysis to a working plan

Principle 1 produces a list; the value shows up only when that list survives contact with a running plant. The failure mode is not usually a bad first analysis, it is a good analysis that goes stale: a new supplier, a reformulation, a line moved to a different room, and the hazard picture shifts while the paper does not. That is why hazard analysis is not a one-time exercise but the thing you reassess on a schedule and whenever the process changes, a discipline that ties directly into Principle 6, verification.

Keeping the analysis current is a documentation problem as much as a food-science one. When hazard reviews, supplier changes, and floor observations live in separate binders and inboxes, the plan drifts out of sync with the plant. Putting the hazard analysis, the flow diagram, and the change history in one place your team actually updates is the same digitize-the-paper move Harmony runs for production and quality records (see how CLS did it), and it is what makes the eventual jump to HACCP certification a query instead of a scramble. See how a connected operation keeps these records live on the features overview.