Risk Management

I have mentioned "risk management" in previous blogs especially with regards to "Food Fraud".  But how do you conduct risk management and do a risk management analysis?  To start, when you find a process / procedure that has a risk associated with it there are three option.

1. Avoid dealing with the risk (poor business decision).
2. Deal with the risk via an action plan.
3. Knowingly (with reason) accept the risk and all potential  consequences.

Risk can come in various forms - Biological, physical, chemical, allergen, fraud, waste, etc.  Check our Wikipedia for a good primer on risk management   https://en.wikipedia.org/wiki/Risk_management.

Risk Management is common in the GFSI systems and HACCP programs.  The usage of risk management needs to be supported by upper management and practiced on a regular basis

HOW TO DO!

1. Perform a risk assessment.
• Based on Judgement and experience
• Identify and involve the "stakeholders" of the issue
• Uses science and knowledge
• Government laws need to be kept in mind such as "Canadian Food and Drug Act"
• Other standards used can include, BRC, SQF, Organic, Hallall, Fairtrade, ISO, Codex Alimentarius.
• Employ a risk Analysis Matrix
• Dark red area - Immediate action required.
• Red area - Critical area to have action plans and increase monitoring.
• Yellow area - regular monitoring schedules and management must be aware that the risk is present.
• Green area - May wish some monitoring if appropriate for the product.
• Matrix is used on one item / issue at a time.
• Codex (CAC/RCP1-1969, CAC/GL62-2007) has information on describing risk management but I find the above Matrix cleaner and easier to use.
2. Create Value
• Monitoring and corrective actions will cause resource and capital expenditure.  You will need to make a business case for the risk.  Some of these will be easy to do (Dark red and Red areas where Death or serious injuries may occur), other risks may need finance / accounting department to quantify the costs of the correction vs. the cost of the risk.
• The company may decide that the risk is low enough that it's acceptable to continue without correction.  Example - Overrun jelly donuts may get stale and produce customer complaints.  A solution is to scrap all overrun product.  If the cost to scrap the overrun is higher than the cost of complaints and brand image loss.
• The "Stakeholders" must buy into the analysis.
3. Must be Measurable
• Analysis is to be performed with a mind on the historical data, such as complaints, fines, loss of clients.
• Current data will need to be gathered to assess the effectiveness of the corrections.  If the correction is not effective the plan needs to be altered.  At this point a root cause analysis can be performed. A good way to see what is working, what is not working, and what needs to be done.
• Verification and Validation steps need to be put in place.  See my blog fro April 2013.
4. Transparent
• Report to management on the results and try to show how much $$$ was saved.
• Good to show staff the results in terms of lower complaint numbers, higher yields, or up time. 
• It is also beneficial to note the social / environmental impact of the change.  Customers are safer and lower waste and environment impact.