Change Country
-or-
In this article, I bring together the two themes from the previous articles: risk assessment and root cause analysis. You will learn:
By Denis Kiely
In the first article in this series, I looked at why food safety risk assessments often fail to reduce inherent risk. The key message was that risk assessment is not about completing a matrix. It is about understanding hazards, assessing probability and severity, judging whether controls are effective and making decisions that can be defended.
In the second article, I looked at root cause analysis and why it should be treated as a learning tool rather than a close-out exercise. When something goes wrong, the purpose of root cause analysis is not simply to close out a corrective action, it is to understand where the problem came from, what allowed it to happen and what needs to change so it is less likely to happen again.
This third article brings those two ideas together.
Risk assessment and root cause analysis are often treated as separate activities in food businesses. One happens before something goes wrong. The other happens afterwards. But in reality, they are part of the same system. Risk assessment is the preventive side of the process. Root cause analysis is the reactive side. If they are not connected, the business misses one of the most important opportunities for learning and improvement.
A risk assessment asks: what could go wrong, how likely is it and how severe would the impact be? Root cause analysis asks: something has gone wrong, so why did it happen and what needs to change? The timing is different, but the thinking is connected. The learning from one should strengthen the other.
That is why this article is really about the loop between prevention and learning. If we get that loop right, risk assessment becomes stronger, root cause analysis less likely but more useful when needed and the food safety management system becomes more mature over time.
The simplest way to explain the relationship is this: risk assessment is about prevention and root cause analysis is about reaction. Both are important, but they serve different purposes.
I often compare it to a car. The brakes are preventive. They help you avoid the crash. The seatbelt is reactive. It protects you if the crash happens. Both matter, but it is always better not to crash in the first place.
It is the same in food safety. A good risk assessment should help keep the hazard out of the food. Root cause analysis is what you do when something has not been kept out, or when a failure has occurred and the business needs to understand why.
That does not mean root cause analysis is less important. It means we need to understand its role. Root cause analysis protects the future by helping the business learn from what has happened. Risk assessment protects the future by helping the business prevent it happening in the first place.
When something goes wrong, the immediate focus is often on the incident itself. That is understandable. The business may need to protect consumers, respond to customers, manage product and deal with the immediate issue. But once the immediate situation is under control, the business needs to ask a deeper question: what did our original risk assessment miss?
A good risk assessment should reduce the need for root cause analysis. It will never remove that need completely because food businesses are complex and people can miss things. But if a business is repeatedly doing root cause analysis for the same type of issue, that is a sign of no continuous improvement.
The best way to think about risk assessment and root cause analysis is as a loop. Risk assessment sits before the incident. Root cause analysis sits after the incident. The learning from the root cause analysis must then feed back into the next version of the risk assessment.
That loop is continuous improvement. It is also the basis of Plan, Do, Check, Act. You plan your risk assessment. You do what you said you would do. You check whether it worked. You act when something goes wrong, when new evidence appears or when the system is reviewed.
This is important because food safety management systems cannot stand still. Processes change, people change, suppliers change, evidence changes and incidents happen. If the risk assessment does not change with that learning, it becomes weaker over time.
A good root cause analysis should not finish when the report is filed. It should finish when the learning has been built back into the system.
One weakness I often see is that risk assessment and root cause analysis are done by different people, using different thinking and sometimes completely different tools. That creates a disconnect.
A root cause analysis should not be handed to one person simply because a report needs to be written. It should not be done just to be documented and filed away. When it is scrutinised by a customer, an auditor or a regulator, that weakness will show.
If an incident has occurred, the same food safety team that was involved in the original risk assessment should be involved in the root cause analysis. That team needs to ask: what did we miss, what did we underestimate and what do we now need to strengthen?
This is not about blame. It is about accountability and learning. If the original risk assessment did not prevent the issue, then the system needs to improve. That is how continuous improvement works
A mature food safety management system does not rely only on certificates, audit grades or the fact that documents exist. Those things matter, but they are not enough on their own. The business needs evidence from its own system to understand how well it is performing.
One of the most important sources of evidence is microbiological data. In food safety, microbiology tells you a great deal about whether your controls are working or not. Product micro results and environmental micro results help a business understand whether it is operating at a poor, good, best or world class level.
That data has to be interpreted properly. Data leads to information, information provides knowledge and knowledge develops into wisdom. Wisdom is knowing what to do next based on the knowledge you have.
This matters because mature businesses are honest with themselves. They know where they are. They know what the data is telling them. They know whether their controls are working and they know where they need to improve.
Food safety culture is talked about a lot, but culture does not need to be made overly complicated. At its simplest, culture is the way people think and behave. If people do not think clearly about risk, they will not behave consistently around risk.
That is why I believe the future is risk-based thinking. Food safety professionals need to understand the concept, know how to apply it, know how to document it and know how to communicate it. That communication matters inside the business and outside the business.
Risk-based thinking should not sit only with the quality team. It needs to be understood by senior and middle management across the food business. The general manager, maintenance manager, operations manager, production manager, quality manager and even the accountant all influence food safety in some way.
A food safety professional is anybody whose action or inaction could jeopardise product safety. That definition matters. If funding is not released for a necessary mitigation measure, that can affect food safety. If the argument for that investment was not made clearly enough, communication has failed. Risk-based thinking gives people a common language to make those decisions clearer.
If people across the business do not understand the language of risk, they cannot have a useful conversation about it. Terms such as risk analysis, risk evaluation, risk assessment, inherent risk, residual risk, risk reduction, acceptable risk and unacceptable risk need to mean the same thing to the people using them.
The more professionals understand this language, the more likely the business is to make consistent and defensible decisions. That does not mean everyone needs to become a technical specialist. It means people need enough understanding to recognise risk, communicate risk and support the right decisions.
That is where training and education matter. Risk-based thinking is not something people simply pick up by accident. It needs to be taught, practised and reinforced.
Risk assessment and root cause analysis are not two separate boxes in a food safety system. They are two parts of the same learning process.
Risk assessment asks what could go wrong and how we can prevent it. Root cause analysis asks why something went wrong and how we can stop it happening again. The strength of the system depends on whether those two processes are connected.
If the learning from root cause analysis does not feed back into risk assessment, the business is not feeding the circle. It is not improving the system. But when the two work together, they create a practical continuous improvement loop that protects the consumer, strengthens decisions and builds a stronger food safety culture.
In the end, the message is simple: do not crash the car. Use risk assessment to prevent the crash. If the crash happens, use root cause analysis to learn from it and strengthen the system for the future.
At SQT, we help food industry teams build confidence in risk-based thinking, risk assessment and root cause analysis. That means helping people understand the language of risk, connect preventive and reactive controls and use learning from incidents to improve food safety management systems.
For food businesses, this is not just about compliance. It is about building the capability to make better decisions, communicate those decisions clearly and protect consumers through stronger, more connected systems.
Article 1 Why Most Food Safety Risk Assessments Do Not Actually Reduce Risk
Article 2 Why Root Cause Analysis Often Fails to Fix the Problem
Categories
ArchiveSign up to receive the latest industry and company news direct to your inbox.
2026