RISK-BASED QUALITY AND INSPECTION
Deciding where to inspect first
Allocate inspection resources transparently and consistently, in proportion to the risks associated with foods, processes and each establishment’s demonstrated performance.
FOCUS INSPECTION WHERE IT MATTERS
What does risk-based prioritisation mean?
Risk-based inspection uses documented information to direct time, frequency and depth towards activities with greater potential to affect public health. Lower priority does not mean no oversight: the aim is to differentiate the intensity of follow-up on a defensible basis.
Uniform approach
The same frequency for every establishment is simple to administer, but can allocate similar resources to activities with very different consequences, exposure and performance.
Risk-based approach
Combine the inherent risk of an activity with evidence on controls, compliance and history to set priorities that can be reviewed as circumstances change.
The matrix supports decisions; it does not replace them. Alerts, outbreaks, complaints, recalls or changes in activity may warrant inspection outside the routine programme. Urgent concerns must follow the applicable incident-response procedures.
TWO COMPLEMENTARY DIMENSIONS
Inherent risk and establishment performance
Inherent risk
The potential for harm associated with what an establishment produces or does, considered separately from how effectively it manages that risk.
- Severity and likelihood of relevant hazards.
- Food type and processing conditions.
- Potential for growth or survival.
- Volume and distribution reach.
- Vulnerability of the intended consumers.
Performance and control
The demonstrated ability to prevent, detect and correct deviations during actual operation.
- Compliance history.
- Severity and recurrence of findings.
- Implementation of good hygiene practices (GHP) and HACCP.
- Traceability, recall readiness and incident response.
- Quality of records and corrective actions.
Keep both dimensions traceable. A high-inherent-risk process may be well controlled and still require a minimum level of oversight consistent with its potential consequences.
DESIGNING THE CRITERIA
Factors and scoring rules
Each authority or organisation must adapt the factors to its objectives, available evidence and applicable framework. Use observable definitions so that different evaluators can reach consistent judgements.
| Factor | Operational question | Possible evidence | Caution |
|---|---|---|---|
| Hazard and food | What harm could occur, and in which food matrix? | Hazard profile, treatment, pH, water activity (aw) and cold-chain conditions. | Do not rely only on broad product categories. |
| Exposure | How many people are reached, and how often? | Volumes, portions, distribution and shelf life. | Do not automatically penalise business size without context. |
| Vulnerability | Are consumers particularly susceptible to the relevant hazard? | Institutional catering, hospitals, young children or older adults, as applicable. | Define the relevant population and hazard explicitly. |
| Controls | Are preventive measures appropriate and implemented effectively? | GHP, HACCP, validation, monitoring and verification evidence. | Distinguish paperwork from actual implementation. |
| Compliance | What do previous inspections show? | Findings, recurrence, deadlines and verified closure. | Consider severity and age of the evidence. |
| External signals | Are there incidents or new information? | Outbreaks, alerts, recalls, complaints and surveillance. | Verify information and update the profile through defined procedures. |
Document the scale direction, weights, thresholds, evidence requirements and treatment of missing data. Avoid counting the same issue repeatedly under correlated criteria. Test whether reasonable changes in weights or uncertain inputs alter the priority.
CATEGORISATION METHODS
Four possible approaches
Binary classification
Separate activities using a decisive condition. Transparent and workable with limited data, but may provide little distinction within each group.
Decision tree
Use a sequence of questions and explicit rules. This supports consistent explanations, provided that the branches are justified and tested.
Scoring system
Assign scores and weights to criteria. It offers finer ranking but can imply more precision than the underlying evidence supports.
Algorithmic model
Combine multiple information sources and potentially update dynamically. This requires data governance, validation, explainability and monitoring for bias.
AN EDUCATIONAL EXAMPLE
Inherent risk × performance
This matrix illustrates how the two dimensions can inform priority. Its categories and the frequencies associated with them must be defined and validated for the real inspection system. It is not a universal regulatory recommendation.
| Inherent risk ↓ / Performance → | Good | Intermediate | Poor |
|---|---|---|---|
| Low | Low priority | Low priority | Medium priority |
| Medium | Low priority | Medium priority | High priority |
| High | Medium priority | High priority | High priority |
Safeguard: good performance may reduce relative inspection intensity for a high-inherent-risk activity, but should not erase the need for oversight consistent with the potential consequences.
“Good performance” describes stronger demonstrated controls. In a numerical score where higher values mean greater concern, weaker performance must receive higher scores—not the reverse.
TRANSPARENT SCORING
Worked example: institutional catering
A service catering for a vulnerable population
Consider a simplified five-criterion scale from 0 to 4. Here, 0 means the lowest concern and 4 the highest concern under the criterion’s definitions. The example uses equal weights; both the scale and any classification thresholds require validation before operational use.
| Criterion | Score | How to read the direction |
|---|---|---|
| Hazard and process | 4 / 4 | Greater hazard-related concern produces a higher score. |
| Exposure | 3 / 4 | Greater relevant exposure produces a higher score. |
| Vulnerability | 4 / 4 | Greater susceptibility produces a higher score. |
| Control weaknesses | 2 / 4 | Weaker controls produce a higher score. |
| Adverse compliance history | 3 / 4 | More concerning findings or recurrence produce a higher score. |
This is 80% of the maximum possible score, not an 80% probability of harm. In the educational scenario it is treated as a candidate for high priority. A formal classification cannot be derived without pre-established, validated thresholds.
Before setting inspection frequency, review evidence quality, open findings, mandatory rules and the resources needed. Record any shortfall in delivery capacity separately rather than lowering the risk classification to fit available resources.
- Document the source and date of each score.
- Apply predefined tie-breaking and safeguard rules.
- Obtain a second evaluation when appropriate.
- Record the category, rationale and next review date.
Different examples, different methods: this simple 16/20 sum, the two-dimensional matrix above and the linked interactive tool are not interchangeable calculations. Check each method’s criteria, weights and thresholds before comparing results.
FROM CATEGORY TO INSPECTION PROGRAMME
Priority, frequency and depth
Frequency · when to inspect
Use priority to inform planned intervals, subject to mandatory minimums and additional inspections prompted by incidents or new evidence.
Scope · what to examine
Use the risk profile to identify processes, hazards, records and controls requiring more detailed examination.
Resources · who and how long
Account for complexity, specialist knowledge and expected duration when assigning teams and inspection capacity.
Frequency is not an automatic reward or punishment. It is a risk-management measure that must integrate prevention, follow-up, incident response and operational planning. No fixed inspection interval is prescribed by this guide.
A DYNAMIC CYCLE
Update, verify and improve
01 · Categorise
Apply documented criteria to current evidence and record uncertainty.
02 · Plan
Allocate frequency, scope and resources in the inspection programme.
03 · Inspect
Collect consistent evidence and record comparable findings.
04 · Recalibrate
Update establishment profiles and evaluate whether the model improves outcomes.
Reassess after material changes and at defined review intervals. Review both the reliability of individual classifications and the effectiveness of the overall programme.
GOVERNANCE AND FAIRNESS
Essential safeguards
Consistency and traceability
- Accessible definitions and assessment manuals.
- Training and evaluator-agreement exercises.
- Traceable data, weights and model versions.
- Human review of unusual results.
Fairness and accountability
- A process to correct outdated or inaccurate information.
- Review of biases linked to size, location or data availability.
- Separation of prioritisation from enforcement decisions.
- Indicators of effectiveness, not just inspection counts.
Incomplete data do not mean low risk. Establish explicit procedures for uncertainty, new businesses and missing history. Missing evidence must not silently become a favourable score.
COMMON PITFALLS
What to avoid
Model design
- Double-counting the same risk through correlated factors.
- Assigning weights without justification or validation.
- Confusing inherent risk with non-compliance.
- Presenting weak or subjective data as precise numbers.
Operational use
- Using the routine matrix without urgent-response procedures.
- Leaving categories unchanged despite new evidence.
- Reducing frequency without appropriate minimum oversight.
- Measuring success only by the number of visits.
SOURCES AND FURTHER READING
Technical references
- FAO Risk-based Inspection Resource Kit: the modular framework for categorisation, inspection planning, delivery and improvement.
- FAO — Establishing inspection priorities and frequencies (Module 6). Also listed on the Resource Kit page.
- FAO — Choosing the risk categorization approach (Module 5). Also listed on the Resource Kit page.
- FAO — Risk-based imported food control: related guidance in the import-control context.
- FAO/WHO — Strengthening Official Food Safety Control Services (2004): background on official control systems.
An educational QualiFood adaptation, not an official FAO model or regulatory instrument. The illustrative scores and matrix do not replace applicable requirements, validated local procedures or professional judgement.
Apply the approach with the interactive matrix
Configure criteria, weights and scores, compare scenarios and obtain an indicative classification with its dominant factors. The interactive tool is available in English. Review its own calculation method and limitations before interpreting a result.