How to Assess Risk and Deploy Resources

Some aspects of risk management have always been a part of doing business for food companies, but with FSMA’s proposed rules, risk assessment, management, and its documentation are becoming more of a must than a should. With people and resources already stretched to—or beyond—capacity across the industry, how can you further stretch your company’s ability to assess risk and deploy resources?

It may seem counter-intuitive, but deploying resources for the development of a risk assessment program will save time and resources in the long-run, and provide for a safer finished product. “You really need risk assessment because you will never have all the resources you need. That’s the nature of business,” said Roger Lawrence, corporate vice president of quality assurance and regulatory for McCormick. “It’s not just an investment to comply with FSMA, it’s a good business investment.”

This is because, Lawrence said, “There is no such thing as 100%.” Risk is inherent in the development of any product – whether it be an automobile or food. But taking that risk and intelligently managing it is also what enables the creation of value and return. “Our CEO always says that without risk, you have no business, because without risk you have no return,” he said. “So risk assessment is needed to enable us to have something with high value and a reasonable, controlled amount of risk.”

With this in mind, risk assessment for food safety can be looked at in those same terms, and a program developed.

Assessing Incoming Goods. McCormick deploys risk assessment on all its incoming goods as well as its suppliers and vendors. The vast majority of McCormick spices are imported, with no spice available from fewer than two countries. Thus its assessment of incoming goods/spices focuses primarily on imports using scales of severity and probability with respect to microbiological, chemical, physical, environmental, and naturally occurring contamination.

1. Categorizing. The first step in the assessment of incoming spices is grouping them into categories according to type. For example, onion and garlic have similar properties and sources, as do black and white pepper. So an assessment of one can be used for both in the category.
    
2. Severity and probability. Next, each category of spice is ranked for severity and probability of risk on a scale of 4 to 1, with 4 as highest. In severity, 4 would be given for a product whose potential hazard is greatest, with 1 given for that with little to no consequence. In probability, 4 would equate to that which is highly likely to occur and 1 if risk is extremely remote or improbable.
    
3. Rank. The results of the severity and probability scales are then multiplied together and ranked. For example, a product with highest severity and highest probability would result in a 16, whereas one with very low to none of either would be given a 1.
    
4. Results. From these results, risk is then assessed as:
   • 1 to 4 = low risk
   • 5 to 8 = medium risk
   • 9 to 16 = high risk

“Doing that for each of the aspects guides the deployment of resources,” Lawrence said. This may be that a high-risk spice receives greater testing and auditing to ensure there is no issue, the company may conduct more research for prevention, a preventive program may be put in place, or any combination of the above may be implemented.

New Suppliers. In addition to assessing the spices themselves, McCormick assesses its suppliers, with its purchasing and quality assurance groups working together to conduct assessments critical to each. “We ask a whole series of questions that are not just ‘yes’ or ‘no’ answers, so they have to demonstrate some know-how,” Lawrence said. In this way, they can tell if a supplier really has a good program or is one of more form than substance. McCormick then requests that the supplier undergo a third-party audit and provide samples for review.

The assessment of new suppliers is also conducted through mathematical formulas, including factors such as material risk, impact on business, and amount of volume and cost. From the results, a numerical index is calculated from which the supplier is set into a four-quadrant grid (as shown below).

“We use this mostly for food safety, but you also can apply this tool for quality and regulatory compliance,” Lawrence said.

But McCormick doesn’t just leave it to the tangible, rather, he said, “the first thing we do is try to get a sense of their principles, ethics, and values. So there also is an intangible associated with risk.”

ROI. By spending time and effort on the front end to assess the products and suppliers, the company saves time and money long-term. “It’s like a rifle shot instead of a shot-gun approach—you can target your resources.”

For example, Lawrence said, salt is a very low-risk product—it is highly resistant to growth; it’s white so contaminants can be easily seen; and it’s a mineral. So, at the plant, quality samples are taken for size and to ensure it meets the 99.9% sodium chloride specifications. But it is so low risk, he said, there’s no reason to spend a lot of time or money on assessment.
 

On the other hand, he said, giving examples such as meat and dairy, “Others we know are susceptible to microbiological contamination, so we’ll spend more time on them.”

By conducting such risk assessments, Lawrence said, “It gives you the best probability that you can have the best deployment of resources to make it as impactful as possible, which places public health and safety first and foremost.”

The author is Editor of QA magazine. She can be reached at llupo@gie.net.