A food safety risk assessment isn't optional — it's a legal requirement for every UK food business. Learn the HACCP-based approach to identifying hazards, implementing controls, and keeping your customers safe. Includes a free downloadable risk assessment template.
A food safety risk assessment is a systematic process of identifying potential hazards in your food operation and putting controls in place to prevent them. Required under UK food hygiene regulations and based on HACCP principles, risk assessments cover biological, chemical, physical, and allergenic hazards. This guide walks through the complete 5-step process — from identifying hazards through to reviewing controls — and explains how digital tools make the entire process faster, more accurate, and inspection-ready.
A food safety risk assessment is your formal process of identifying anything that could go wrong with the food you produce and putting proportionate controls in place. It's the foundation of your entire food safety management system — and under UK law, every food business operator must implement one. The legal basis comes from Regulation (EC) No 852/2004, which requires all food businesses to put in place, implement, and maintain a permanent procedure based on HACCP principles.
For most small and medium food businesses in the UK, this is fulfilled through the Safer Food Better Business (SFBB) system from the Food Standards Agency. The SFBB pack includes risk assessment templates designed for different business types — caterers, retailers, childminders, and residential care homes. But while SFBB provides the framework, you're still legally responsible for completing the assessment accurately for your specific operation.
A generic, copy-pasted risk assessment that doesn't reflect your actual kitchen, menu, and processes is worse than having none at all — it creates a false sense of security and will be torn apart by an EHO inspector who can see it doesn't match reality.
The FSA recommends a straightforward 5-step approach based on HACCP principles. Each step builds on the previous one, creating a complete chain from hazard identification through to ongoing verification:
The key principle is proportionality. A small café making sandwiches doesn't need the same level of documentation as a large-scale manufacturer. But the thinking process — systematically working through the steps — is identical. An EHO inspector is looking for evidence that you've genuinely thought about the risks in your business, not that you've produced a beautifully formatted document with no connection to reality.
Every food safety hazard falls into one of four categories. A thorough risk assessment addresses all four:
HACCP (Hazard Analysis Critical Control Points) is the international standard for food safety management — a rigorous, science-based system originally developed for the NASA space programme. SFBB (Safer Food Better Business) is the FSA's simplified implementation of HACCP for small food businesses. Think of HACCP as the complete framework and SFBB as the user-friendly version designed for cafés, takeaways, pubs, and care homes.
The 7 HACCP principles map directly onto the SFBB approach: (1) Conduct hazard analysis, (2) Identify CCPs, (3) Establish critical limits, (4) Monitor CCPs, (5) Establish corrective actions, (6) Verify the system works, and (7) Keep records. SFBB simplifies this into practical, everyday steps — your diary entries, temperature checks, cleaning schedules, and 4-weekly reviews all serve as HACCP monitoring and verification records.
For most small businesses, SFBB fully satisfies HACCP requirements. But larger operations, manufacturers, and businesses supplying other food businesses may need a full HACCP plan beyond what SFBB covers. If you're unsure which you need, your EHO can advise — but having something systematic and documented is always better than waiting until you know the perfect answer.
A proper risk assessment template has columns for each essential piece of information. Here's what a well-completed row looks like, using a real kitchen example:
| Step/Hazard | Risk Level | Control | Monitoring | Corrective Action |
|---|---|---|---|---|
| Cooking chicken — bacterial survival | High | Cook to core temp 75°C or equivalent time/temp combination. Probe thermometer calibrated monthly. | Check every batch. Record core temp in temperature log. Head chef signs off. | If temp below 75°C, continue cooking and re-check. If probe broken, use backup probe. Record incident in diary. |
| Fridge failure — food spoilage | Medium | Fridge maintained at 0-5°C. Temperature checked and logged twice daily. Door seals inspected weekly. | AM and PM temperature checks by kitchen staff. Weekly seal inspection by supervisor. | If temp exceeds 8°C for >2 hours, discard high-risk food. Move remaining food to backup fridge. Call engineer. Log incident. |
| Allergen cross-contact — nut contamination | High | Dedicated purple chopping board and utensils for nut-containing dishes. Separate prep area. Full clean down between uses. | Visual check before each use. Weekly audit by head chef. Allergen matrix kept updated. | If cross-contact suspected, discard affected batch. Review and re-train staff. Update allergen matrix if recipe changed. |
This isn't just paperwork — it's a living document that tells every staff member exactly what to do, when to do it, and what to do if something goes wrong. When an EHO inspector sees a risk assessment this specific, they know you're running a professional kitchen.
Paper risk assessments have the same problem as paper cleaning schedules — they become background noise. A folder of printed risk assessments sits on a shelf, updated once a year (if that), and consulted only when the EHO is due. Staff don't engage with them because paper doesn't remind, alert, or guide.
The Prevra app integrates risk assessment into daily operations. When a staff member checks the temperature of a chicken delivery, the app prompts them with the relevant hazard control — not just "record the temperature" but "check it's below 5°C and reject if not." The risk assessment isn't a separate document; it's embedded in the workflow. This means controls are actually applied, not just written down.
Prevra
We’re building Prevra to make food safety risk assessments easier to manage. See the early-access plan →
Key insight for inspections
An EHO inspector who sees a digital system where risk controls are embedded into daily checklists — with time-stamped evidence that controls are being followed every single day — knows immediately that food safety is embedded in your culture, not just your paperwork. That's the difference between a nervous inspection and a confident one.
Prevra · Early access
The app is not ready yet. See the planned features and contact us about early access.
See planned features
PREVRA