Level 3 HACCP

Module 3: Hazards, risk assessment and controls

Assess the nature, likelihood and severity of food hazards and prioritise suitable controls for the food, process and customers.

Video runtime: 14:47

What you will learn in this module
  • Risk assessment considers likelihood and severity in the actual process, not just the name of a hazard.
  • Allergen control depends on current information and preventing cross-contact, not guessing or cooking away the ingredient.
  • Prioritise evidence-based likelihood and severity while retaining the prerequisite controls that support all food safety.

Load this video from YouTube. Your browser will connect to YouTube; embedding follows your cookie preferences.

Watch on YouTube (opens a new tab)

External playback does not record on-page study progress.

Module 3: Hazards, risk assessment and controls

Module 3: Hazards, risk assessment and controls

Assess the nature, likelihood and severity of food hazards and prioritise suitable controls for the food, process and customers.

Records your study progress, not an assessment result or certificate.

Browse course modules

Key points

  • Risk assessment considers likelihood and severity in the actual process, not just the name of a hazard.
  • Prevent contamination and relevant bacterial growth; reheating is not a guaranteed cure for unsafe cooling.
  • Physical contamination needs prevention and assessment; finding and removing one fragment is not proof of safety.
  • Chemical controls must govern real storage and use, not only the presence of product paperwork.
  • Allergen control depends on current information and preventing cross-contact, not guessing or cooking away the ingredient.
  • Assess cross-contact through shared equipment and final orders; do not present food as suitable when allergen safety cannot be confirmed.
  • Assess high-risk food and process combinations and vulnerable customers; specialist processes need appropriate competent controls.
  • Prioritise evidence-based likelihood and severity while retaining the prerequisite controls that support all food safety.

Lesson guide

3.1 Hazards, risks and controls

A hazard is something that can make food unsafe. Risk considers the likelihood of harm and its severity. A control prevents, removes or reduces the relevant hazard to an acceptable level. These terms are connected, but they do not mean the same thing.

Raw chicken illustrates the distinction: the microbiological hazard exists, while warm storage, proximity to ready-to-eat food or insufficient cooking can increase risk. Suitable storage, separation and cooking controls address the hazard in that process. Consider the food, customer group, equipment, staff and real handling conditions. A hazard list without this context is not enough to decide which controls are important or how they should be checked.

3.2 Microbiological hazards

Harmful bacteria, viruses, parasites and moulds can reach food through raw ingredients, water, pests, dirty hands and equipment or staff illness. Relevant bacteria can multiply under suitable food, moisture, warmth and time conditions; this must not be generalised to viruses multiplying in food.

Cooked rice cooled poorly can allow bacteria to grow and toxins to form that reheating may not remove. Supervisors need realistic cooling methods, sufficient fridge capacity, checks, records and illness reporting. Identify where contamination, growth or survival could occur, rather than focusing only on the final cook. Safe process design and staff practice must remain effective during normal and busy work.

3.3 Physical hazards

Physical hazards include glass, metal, plastic, stones, hair, jewellery, false nails, staples, screws, packaging fragments, cleaning materials and pest parts. Damaged containers, lights or machinery may introduce fragments while food is prepared or packed.

Controls can include supplier standards, covered food, inspections, maintenance, staff rules and suitable equipment. In manufacturing, methods such as sieving, filtration, magnets or metal detection may be relevant to a particular hazard and process; they are not universal requirements for every kitchen. If contamination is suspected, assess the affected food and the source of damage under the procedure. Removing one visible object does not establish that the rest of the batch is safe.

3.4 Chemical hazards

Chemical hazards can involve cleaners, sanitisers, pesticides, maintenance chemicals, fuels, lubricants, incorrectly used additives and residues in the supply chain. Managers need approved products, clear labels, correct storage and instructions appropriate to the workplace.

Train staff in the required dilution, contact time and any rinsing instructions; do not improvise chemical mixing. Keep chemicals separate from food and never decant them into a food or drink container that could cause confusion. Plan spill response and check how products are actually used. A safety data sheet in a file does not prove correct daily practice. Report and assess potential contamination rather than guessing whether a chemical smell or spill is harmless.

3.5 Allergenic hazards

An undeclared allergen or unintended cross-contact can cause serious harm even when the food otherwise appears normal. Consider compound ingredients and hidden sources: mustard in mayonnaise, celery in stock, milk in bread, sesame in tahini, spice mixes, sauces and garnishes. Supplier and recipe changes can make existing information outdated.

Use current ingredient information, recipes, allergen matrices, appropriate labels and order communication. Storage, preparation, equipment and cleaning controls need to address the actual cross-contact risks. Staff must not guess or offer unsupported suitability assurances. Cooking or removing a visible ingredient does not reliably remove allergen risk; uncertainty requires stopping and checking with the responsible person.

3.5 Allergenic hazards — source repeat

The current recording repeats subsection 3.5 at 9:18. This repeated teaching remains in the complete transcript and source chronology; it is not silently renumbered as a new topic. It reinforces the need to check current recipes, ingredients, labels and customer communication.

Shared fryers, ovens, grills, boards, scoops and packing areas can transfer allergens, so suitability depends on the business’s actual controls rather than an ingredient list alone. Managers should consider clean or separate equipment and verified methods appropriate to the process, including changes between products. If cross-contact cannot be controlled or information cannot be confirmed, do not present the food as suitable. Use the repetition to check the whole pathway, from ingredient receipt to the final order.

3.6 High-risk foods, processes and customers

Cooked meats, fish, dairy foods, rice, pasta, salads, sandwiches and cream or custard products can present significant risk depending on their preparation and storage. Ready-to-eat products are especially important because there is no later cooking step before consumption. Advance preparation, cooling, reheating, holding and specialist processes can add hazards.

The source mentions reduced-oxygen or vacuum arrangements and a specialist cooking term with uncertain auto-caption spelling; these require appropriate competent process assessment, not generic controls invented here. Consider vulnerable groups such as children, older people, pregnant women and people with weakened immune systems, including care, nursery, school and hospital settings. Assess actual batches, time, equipment and customers and use the relevant procedures rather than treating every product identically.

3.7 Prioritising controls

Risk assessment considers both the likelihood and severity of harm. A rare but severe allergen labelling error may still require strong control. Use process evidence, incidents, near misses and repeated failures to judge priorities, rather than assuming only frequent problems deserve attention.

A recurring cooling delay or allergen near miss should trigger review of the method, resources and checks. Prioritising significant risks does not mean ignoring prerequisites such as cleaning or maintenance, which support the entire system. The source does not prescribe a new numerical risk matrix. Make justified, business-specific decisions and document the controls and review needed; update the assessment when the process or evidence changes.

In practice

Mustard introduced by a supplier change

Source teaching example rewritten as a formative scenario; not a real reported incident

A recipe’s prepared ingredient changes, but the matrix and service information remain the old version.

Can staff confirm suitability from the old matrix?

Stop and check current ingredient information, then update affected records, labels and communication before use.

The source highlights hidden and changed allergens across the process.

A rare but severe label error

Source teaching example rewritten as a formative scenario; not a real reported incident

There have been few complaints, but an undeclared allergen could affect a large batch.

Should rarity alone make the hazard low priority?

Consider severity as well as likelihood and provide a justified control and review.

Risk prioritisation is not a count of how often people complained.

Reflect on your learning

What does risk consider?

Select one answer.

What can poor rice cooling leave unresolved by reheating?

Select one answer.

Allergen suitability cannot be confirmed for a customer's order. What should a manager ensure happens?

Select one answer.

Can rare severe hazards still need strong control?

Select one answer.

For your own learning — not the certification assessment.

FAQs

Do all microorganisms multiply in food?

No. The guide scopes growth conditions to relevant bacteria. The broader source wording must not be used to imply that viruses multiply in food.

Is a specialist process covered by ordinary generic limits?

This module identifies the need to assess food and process risk. Specialist controls need appropriate competence and evidence; no additional generic thresholds are invented here.

Does an ingredient list alone establish that shared equipment is suitable for an allergy order?

No. Current ingredient information is necessary, but shared fryers, grills, boards, scoops and packing areas can also transfer allergens. Assess and apply the business's actual cross-contact controls and do not offer unsupported suitability assurances.

Further reading

  • Food safety management systems for businesses (opens a new tab)

    Supplementary overview of HACCP-based procedures, checks and records.

    UK Government / Food Standards Agency. Applicable jurisdiction: UK overview; check the relevant national regulator and business-specific rules. Supplementary reading; checked 2026-10-07.

  • Allergen guidance for food businesses (opens a new tab)

    Supplementary current ingredient information, labelling and cross-contact guidance.

    Food Standards Agency. Applicable jurisdiction: England, Northern Ireland and Wales; use Food Standards Scotland guidance for Scotland. Supplementary reading; checked 2026-10-07.

  • CookSafe: House Rules (opens a new tab)

    Role-specific training and practical hygiene, maintenance, temperature, stock and allergen controls.

    Food Standards Scotland. Applicable jurisdiction: Scotland; catering businesses. Supplementary reading; checked 2026-10-07.

Jump to a key moment
Transcript

[0:00] Welcome to lesson 3.1 understanding
[0:02] hazards, risks and controls. In hack, it
[0:06] is important to understand the
[0:07] difference between a hazard, a risk, and
[0:09] a control. A hazard is something that
[0:12] could make food unsafe.
[0:14] This may be harmful bacteria, glass,
[0:17] cleaning chemicals, undeclared
[0:19] allergens, or anything else that could
[0:20] harm the customer. A risk is the chance
[0:23] that the hazard will actually cause harm
[0:25] and how serious that harm could be. Some
[0:28] hazards may be present but well
[0:30] controlled. Other hazards may be more
[0:33] likely to cause harm because the process
[0:34] is weak, the food is high risk or the
[0:37] customer is vulnerable. A control is the
[0:40] action used to prevent, remove or reduce
[0:42] the hazard to a safe level. For example,
[0:45] raw chicken may contain harmful
[0:47] bacteria.
[0:48] The hazard is microbiological
[0:50] contamination.
[0:52] The risk increases if the chicken is
[0:54] stored too warm, prepared near ready to
[0:56] eat food, or not cooked properly.
[0:59] Controls may include chilled storage,
[1:01] separation, handwashing, cleaning, and
[1:04] thorough cooking. At level three, you
[1:07] need to think beyond simply naming
[1:08] hazards. You should consider where the
[1:11] hazard appears, how likely it is to
[1:13] cause harm, who may be affected, and
[1:15] what controls are needed. Good hack
[1:17] decisions are based on understanding the
[1:19] food, the process, the staff, the
[1:22] equipment, and the customer. The key
[1:24] messages, hazards show what could go
[1:26] wrong, risks show how serious or likely
[1:29] the problem is, and controls show how
[1:31] the business prevents harm.
[1:33] Welcome to lesson 3.2, Microbiological
[1:36] Hazards. Microbiological hazards are
[1:40] caused by harmful microorganisms such as
[1:42] bacteria, viruses, parasites, and molds.
[1:46] These hazards are a major concern in
[1:48] food safety because they are often
[1:50] invisible. Food may look, smell, and
[1:52] taste normal, but still contain harmful
[1:54] microorganisms or toxins.
[1:57] At level three, managers and supervisors
[2:00] must understand how microbiological
[2:02] hazards enter, grow, and spread in food
[2:04] operations.
[2:06] Bacteria may come from raw meat,
[2:08] poultry, fish, eggs, unwashed
[2:10] vegetables, pests, dirty equipment,
[2:13] contaminated water, food handlers, or
[2:15] poor cleaning. Viruses may spread
[2:18] through poor hand hygiene, especially if
[2:21] staff work while ill. Molds and
[2:23] parasites may also be relevant depending
[2:25] on the food and process.
[2:28] Microorganisms can grow when they have
[2:30] food, moisture, warmth, and time. High-
[2:33] risk foods such as cooked meat, poultry,
[2:36] fish, dairy products, cooked rice,
[2:38] cooked pasta, sauces, gravy, sandwiches,
[2:41] and prepared salads need strong
[2:43] controls.
[2:45] For example, cooked rice cooled too
[2:47] slowly may allow bacteria to grow and
[2:49] produce toxins.
[2:51] Reheating may not always make the food
[2:53] safe if toxins have already formed.
[2:55] Controls may include approved suppliers,
[2:58] temperature control, cooking, cooling,
[3:01] reheating, cleaning and disinfection,
[3:03] hand washing, separation of raw and
[3:06] ready to eat foods, pest control, and
[3:08] illness reporting. At level three, you
[3:11] should also look for system weaknesses.
[3:14] Are cooling methods realistic? Are
[3:17] fridge checks done honestly? Are staff
[3:19] trained to report illness? The key
[3:22] message is microbiological hazards are
[3:24] often invisible, so they must be
[3:26] controlled through strong procedures,
[3:28] monitoring, and corrective action.
[3:31] Welcome to lesson 3.3. Physical hazards.
[3:35] Physical hazards are objects that should
[3:36] not be in food. They can injure
[3:39] customers, cause choking, damage teeth,
[3:41] or make food unsafe to eat. Examples
[3:45] include glass, metal, plastic, stones,
[3:48] hair, jewelry, false nails. staples,
[3:51] screws, packaging pieces, cleaning
[3:54] materials, pest fragments, or broken
[3:56] equipment parts. At level three,
[3:59] managers and supervisors need to
[4:01] understand how physical hazards can
[4:02] enter food and what controls are needed
[4:04] to prevent them. Physical contamination
[4:07] can happen during delivery, storage,
[4:10] preparation, cooking, packing, display,
[4:12] or service.
[4:14] It may come from damaged packaging,
[4:16] poorly maintained equipment, broken
[4:18] containers, staff jewelry, poor
[4:20] housekeeping, or supplier issues.
[4:23] For example, if a plastic food container
[4:26] is cracked, small pieces may break off
[4:28] into food. If a light cover is missing,
[4:31] broken glass could contaminate open
[4:33] food. If equipment is poorly maintained,
[4:36] screws, blades, or fragments may become
[4:38] a hazard. Controls may include supplier
[4:42] checks, delivery inspections, protective
[4:44] covers, maintenance checks, equipment
[4:46] inspections, staff clothing rules, hair
[4:49] control, jewelry restrictions, good
[4:51] housekeeping, and breakage procedures.
[4:54] In some food manufacturing or packing
[4:57] environments, controls may also include
[4:59] siving, filtration, magnets, metal
[5:02] detection, or final product checks. At
[5:05] level three, you should make sure staff
[5:07] report damaged equipment and
[5:08] contamination risks immediately. The
[5:11] response should not be to simply remove
[5:13] the visible object and continue if the
[5:15] food may still be unsafe. The key
[5:18] message is physical hazards are
[5:19] preventable through good maintenance,
[5:21] careful handling, staff discipline, and
[5:23] immediate action when breakages or
[5:25] damage occur. Welcome to lesson 3.4. The
[5:29] chemical hazards.
[5:31] Chemical hazards happen when harmful
[5:32] chemicals contaminate food or are
[5:34] present at unsafe levels in food
[5:37] businesses. Chemical hazards may come
[5:39] from cleaning products, sanitizers, pest
[5:42] control chemicals, maintenance
[5:44] chemicals, lubricants, fuel, incorrect
[5:46] additives, or chemicals stored too close
[5:49] to food. Chemical contamination can
[5:52] happen quickly. For example, spraying
[5:55] sanitizer near open food may allow
[5:57] droplets to land on the food. Using too
[6:00] much cleaning chemical may leave residue
[6:02] on a food contact surface.
[6:05] Storing chemicals above ingredients may
[6:07] lead to leaks or spills. At level three,
[6:10] managers and supervisors must make sure
[6:12] chemical controls are practical and
[6:14] followed. Controls may include approved
[6:17] chemicals, clear labels, correct
[6:19] storage, staff training, safe dilution,
[6:22] following manufacturer instructions,
[6:24] contact times, rinsing where required,
[6:27] separation from food, and procedures for
[6:29] spilages or accidental exposure. Kosh
[6:32] information and safety data sheets may
[6:34] also support chemical safety, but staff
[6:36] still need clear workplace instructions.
[6:40] For example, if a cleaner transfers
[6:41] chemical into an unlabeled bottle, this
[6:44] creates a serious risk. Staff may use
[6:47] the chemical incorrectly or mistake it
[6:48] for something safe. Managers must make
[6:51] sure chemicals are never stored in food
[6:53] or drink containers.
[6:55] Chemical hazards can also come from
[6:57] supplier products such as pesticide
[6:59] residues or contaminants, so approved
[7:02] supplier controls may be needed. At
[7:04] level three, you should check whether
[7:06] chemical controls are understood in
[7:08] practice.
[7:09] Are bottles labelled? Are staff using
[7:12] correct dilution? Are chemicals kept
[7:15] away from food? The key messages:
[7:18] chemicals are useful when controlled,
[7:20] but dangerous when misused.
[7:23] Strong storage, labelling, training, and
[7:25] supervision prevent chemical
[7:27] contamination.
[7:28] Welcome to lesson 3.5. Allergenic
[7:31] hazards. Allergenic hazards happen when
[7:34] food contains an allergen that the
[7:36] customer has not been told about or when
[7:38] an allergen accidentally gets into food
[7:40] through cross contact. For some
[7:42] customers, even a small amount of the
[7:44] wrong allergen can cause a serious or
[7:46] life-threatening reaction. This means
[7:49] allergens must be treated as food safety
[7:51] hazards, not customer preferences.
[7:54] At level three, managers and supervisors
[7:56] must understand how allergenic hazards
[7:58] enter the food process and how they are
[8:00] controlled.
[8:02] Allergens may be part of the recipe,
[8:04] hidden inside compound ingredients
[8:06] introduced by a supplier substitution,
[8:08] added through a garnish, transferred by
[8:10] shared equipment, or missed because
[8:12] records are out of date. For example,
[8:15] mustard may be hidden in mayonnaise or
[8:17] spice mix. Celery may be in stock
[8:20] powder. Milk may be in a sauce or bread
[8:23] product. Sesame may be on buns or in
[8:26] tahini. Controls may include supplier
[8:30] checks, recipe control, accurate
[8:32] allergen mattresses, menu updates, PPDS
[8:35] labels, staff training, storage
[8:37] separation, clean utensils, cleaning
[8:40] controls, customer communication, and
[8:42] final order checks. Allergen cross
[8:45] contact also needs assessment.
[8:47] Shared fryers, ovens, grills, boards,
[8:51] knives, display areas, scoops, and
[8:53] packaging may all create risk. At level
[8:56] three, managers must make sure staff
[8:58] never guess allergen information and
[9:00] never promise food is suitable if the
[9:02] risk cannot be controlled. The key
[9:05] message is allergenic hazards require
[9:07] accurate information, strong
[9:08] communication, and practical cross
[9:10] contact controls.
[9:12] If allergen safety cannot be confirmed,
[9:14] the food should not be served as
[9:16] suitable.
[9:18] Welcome to lesson 3.5, allergenic
[9:20] hazards.
[9:22] Allergenic hazards happen when food
[9:24] contains an allergen that the customer
[9:25] has not been told about or when an
[9:27] allergen accidentally gets into food
[9:29] through cross contact. For some
[9:32] customers, even a small amount of the
[9:33] wrong allergen can cause a serious or
[9:35] life-threatening reaction. This means
[9:38] allergens must be treated as food safety
[9:40] hazards, not customer preferences.
[9:43] At level three, managers and supervisors
[9:46] must understand how allergenic hazards
[9:48] enter the food process and how they are
[9:49] controlled. Allergens may be part of the
[9:52] recipe, hidden inside compound
[9:54] ingredients, introduced by a supplier
[9:56] substitution, added through a garnish,
[9:59] transferred by shared equipment, or
[10:00] missed because records are out of date.
[10:04] For example, mustard may be hidden in
[10:06] mayonnaise or spice mix. Celery may be
[10:09] in stock powder. Milk may be in a sauce
[10:12] or bread product. Sesame may be on buns
[10:15] or in tahini.
[10:17] Controls may include supplier checks,
[10:19] recipe control, accurate allergen
[10:21] matrices, menu updates, PPDS labels,
[10:25] staff training, storage separation,
[10:27] clean utensils, cleaning controls,
[10:30] customer communication and final order
[10:32] checks. Allergen cross contact also
[10:35] needs assessment.
[10:36] Shared fryers, ovens, grills, boards,
[10:40] knives, display areas, scoops, and
[10:42] packaging may all create risk. At level
[10:46] three, managers must make sure staff
[10:48] never guess allergen information and
[10:49] never promise food is suitable if the
[10:51] risk cannot be controlled. The key
[10:54] message is allergenic hazards require
[10:56] accurate information, strong
[10:58] communication, and practical cross
[10:59] contact controls.
[11:01] If allergen safety cannot be confirmed,
[11:04] the food should not be served as
[11:05] suitable.
[11:07] Welcome to lesson 3.6. High-risk foods,
[11:10] processes, and customers. In hack, some
[11:13] foods, processes, and customers need
[11:15] stronger controls because the risk of
[11:17] harm is higher. High-risisk foods are
[11:19] foods that can support the growth of
[11:21] harmful bacteria and are often eaten
[11:23] without further cooking. Examples
[11:26] include cooked meat, poultry, fish,
[11:28] seafood, dairy products, cooked rice,
[11:31] cooked pasta, prepared salads,
[11:33] sandwiches, sauces, gravy, custards,
[11:37] cream cakes, and ready to eat foods.
[11:40] High-risk processes include cooking,
[11:42] cooling, reheating, hot holding, cold
[11:44] holding, vacuum packing, reduced oxygen
[11:47] packaging, suzy, handling ready to eat
[11:50] food, and preparing food in advance.
[11:53] For example, cooling a large batch of
[11:55] cooked rice or curry can be high risk if
[11:57] the food stays warm for too long.
[12:00] Bacteria may grow before the food
[12:02] reaches chilled storage. Customers can
[12:05] also affect risk. Vulnerable customers
[12:08] include young children, older people,
[12:10] pregnant women, and people with weakened
[12:12] immune systems or underlying health
[12:14] conditions.
[12:16] They may suffer more serious illness
[12:17] from contaminated food. At level three,
[12:21] managers and supervisors should consider
[12:23] whether the business serves vulnerable
[12:24] groups such as care homes, nurseries,
[12:27] hospitals, or schools. Controls may need
[12:30] to be stricter because the consequences
[12:32] of failure can be more serious.
[12:35] Risk is also affected by how food is
[12:37] handled. A ready to eat sandwich
[12:40] prepared with cooked chicken and salad
[12:42] needs strong hygiene, chilled storage,
[12:44] date control, and allergen information.
[12:47] The key message is high-risk foods,
[12:49] processes, and customers require
[12:51] stronger control. Managers must identify
[12:54] where the consequences are greater and
[12:56] make sure controls are reliable.
[12:59] Welcome to lesson 3.7, risk assessment
[13:02] and prioritizing controls.
[13:04] Risk assessment in hack means looking at
[13:06] hazards and deciding which controls are
[13:08] most important. At level three, managers
[13:12] and supervisors need to think about both
[13:14] likelihood and severity. Likelihood
[13:16] means how likely the hazard is to
[13:18] happen. Severity means how serious the
[13:21] harm could be if it does happen. For
[13:24] example, undercooked chicken has high
[13:26] severity because harmful bacteria may
[13:28] survive and cause food poisoning. If
[13:31] cooking checks are weak, the likelihood
[13:33] may also be high. This means strong
[13:36] controls are needed. Another example is
[13:38] a missing allergen label on PPDS food.
[13:42] The severity could be very high for an
[13:44] allergic customer. So label checks and
[13:46] recipe control must be taken seriously.
[13:49] Prioritizing controls means focusing
[13:51] attention on the points where failure
[13:53] could cause the greatest harm. This does
[13:56] not mean ignoring basic hygiene.
[13:58] Prerequisite controls such as cleaning,
[14:01] pest control, training, and maintenance
[14:03] must still be strong. Managers should
[14:06] ask practical questions.
[14:08] Which hazards are most serious? Where
[14:11] are controls most likely to fail? Which
[14:14] foods are high risk? Which staff need
[14:17] more training? Which checks are
[14:19] critical? Which records show whether the
[14:22] system is working? If a business has
[14:25] repeated problems such as missed cooling
[14:27] checks or allergen near misses, those
[14:29] areas should be prioritized for review
[14:31] and corrective action. The key message
[14:34] is risk assessment helps managers focus
[14:36] on the most important food safety
[14:38] controls.
[14:40] Strong hack decisions are based on
[14:41] likelihood, severity, evidence, and real
[14:44] workplace practice.