Quick answer
An allergen risk assessment should examine the ingredients, processes, equipment and information routes that could expose a customer to an allergen. Assess intentional ingredients and unintended transfer, then define effective controls, ownership and review. It should inform the HACCP system without assuming that every allergen control is automatically a CCP.
Define the foods, activities and information involved
Start with the actual recipes, ingredients, suppliers, work areas and selling methods. Include drinks, toppings, bought-in components, specials and any free-from or other suitability claims. Identify who prepares, updates information and serves or delivers the food.
CookSafe’s allergen-management guidance treats allergens as hazards within food-safety management. A risk assessment should therefore connect with the actual process, not sit separately as an annual form with no effect on working methods.
Examine ingredient evidence and transfer routes
Check current supplier specifications and actual labels, including compound ingredients and substitutions. Then follow how the ingredient is stored, decanted, measured, prepared, cooked, held, packed and served. Consider equipment parts, shared oil or water, dust, spills, staff movement and cleaning tools.
Do not treat an ingredient matrix as proof that unintended transfer is controlled. It may accurately describe the intended recipe while missing a shared preparation or service route. Where information or control capability is uncertain, record the uncertainty and decide what must happen before an assurance is given.
Record the control and evidence needed
| Question | What to record |
|---|---|
| What is the allergen and route? | A specific ingredient or transfer mechanism at a defined stage. |
| Who or what could be affected? | The food, claim or order relying on the control. |
| What prevents exposure? | The actual separation, cleaning, information or service control. |
| What supports that control? | Relevant specifications, method evidence, observations or specialist assessment. |
| How is it maintained? | Owner, staff instruction, checks, response to failure and review triggers. |
FSA technical guidance explains risk-based precautionary information and the need for accurate, non-misleading claims. A “may contain” statement is not a replacement for assessing and controlling avoidable transfer.
Connect the findings with HACCP decisions
Assess whether the existing prerequisite arrangements adequately control a route or whether a hazard-specific measure and further evidence are needed. Use the chosen HACCP method and competent judgement to classify controls. Do not assign or remove CCP status just because the hazard is an allergen.
Illustrative example: a shared mixer is used for different recipes. The assessment needs to understand residue retention, cleaning capability, scheduling, identification and staff practice. A note saying “wash between uses” is not evidence that the method achieves the required purpose.
Check information, service and future changes
FSA non-prepacked-food best practice connects written information with a staff conversation and accurate handling of the request. Test whether the customer’s stated need reaches preparation staff and whether the final food can be correctly identified.
Assign review triggers for new ingredients, suppliers, equipment, recipes, claims and incidents. Use the existing recipe-change guide for information control and handover checklist for service. Confirm that actions are implemented and effective, not merely marked complete.
Next steps
- Define the food, claims, work areas and service routes.
- Identify intentional ingredients and unintended-transfer mechanisms.
- Select justified controls, owners and evidence; connect them with HACCP.
- Test the information/service chain and review relevant changes.
Read the official practical guidance — Use the current source alongside the procedures for your own business.