Everyone wants risk-based management, but fewer of us seem comfortable sitting with what it takes to get there.
Risk analysis technically encompasses the following steps:
(1) Hazard Identification – what will cause harm? Examples: bacteria, toxins, metals
(2) Hazard Characterization – What happens if exposure occurs, and how severe is it (dose-response)?
(3) Exposure Assessment – How likely and how much exposure is likely to occur?
(4) Risk Characterization – Use the above information to estimate the probability and severity of harm.
(5) Risk Management – What can be done to address the risk (monitor, manage, mitigate, etc.)?
(6) Risk Communication – How do we understand and communicate the risk?
As a food industry, we seem to really like the beginning of risk-based management. Step 1 is our go to – we like to identify a hazard. In fact, we are getting increasingly good at finding things. Better diagnostics, sequencing, environmental monitoring, remote sensing and massive datasets allow us to detect hazards and potential risk factors at levels we could not have imagined a generation ago.
We also like to embrace the appearance of step 5. Build a control. Change a practice. Establish a standard. Write a regulation. Find a root cause. Measure compliance.
But, what about that messy middle? It seems the steps in there make us increasingly uncomfortable.
Sitting right between hazard identification and risk management sits risk characterization. Risk characterization is all about determining how the presence of a hazard, combined with exposure, environmental conditions, pathways and uncertainty, translates into actual risk.
That step reads simple but is extremely difficult because it rarely produces a simple answer. Beyond not giving simple answers, those answers are often highly situational and may not apply to related scenarios or systems.
Let’s start breaking the middle apart so that we can get better in our risk-based efforts.
Finding a hazard does not automatically tell us the probability of harm. Finding a pathogen in water does not tell us whether it reaches a crop, nor that it will survive once there. Identifying an animal near a field does not tell us whether it creates a meaningful exposure pathway. Rainfall, flooding, irrigation practices, hydrology, temperature, agricultural activities and adjacent land uses can all matter—but they do not necessarily matter equally, everywhere, or all the time.
Risk exists in the relationships among these factors, and that is where risk characterization gets messy. It requires us to ask questions that are harder than: Did we detect something?
How much is there? How often does it occur? Under what conditions? Is there a plausible pathway to exposure? How does that pathway change over time? How much uncertainty remains? And, ultimately, how much does this change the probability of an adverse outcome?
Those questions can be uncomfortable because sometimes the answer is: we don’t know yet. They are also uncomfortable since they have a habit of identifying our vulnerabilities and uncertainties clearly and documented on paper – that is uncomfortable and scary for what it can force us to face.
But uncertainty and vulnerability are not reasons to skip risk characterization. Uncertainty and vulnerability are what risk characterization is supposed to address.
Without the important middle steps in the process, precautionary assumptions and efforts can easily become disconnected from risk. When we begin treating every detection, every hazard and every theoretical pathway as though they represent equivalent probabilities of harm, we will logically see resources flowing towards what we can detect, regulate or measure. Unfortunately, that means resources are not spent toward what reduces risk the most.
That isn’t risk-based management. It is hazard-based management.
True risk management requires characterization and differentiation (aka, the messy middle).
Some hazards deserve extraordinary resources and controls because the probability and consequence justify them. Some pathways deserve intensive monitoring only under particular environmental conditions. Some detections may be useful early-warning indicators without representing an immediate food-safety threat. And some factors that appear concerning individually may become meaningful only when several conditions converge.
Making those distinctions is not minimizing or ignoring risk. Making those distinctions is the actual real work of understanding risk.
Agriculture particularly needs this distinction because biological systems are variable by definition. I write about this a lot, but a field is not a factory. We know that weather will change, water will move, animals interact within the system, microbial populations will fluctuate, and agricultural practices vary across commodities, regions and seasons.
If our response to that complexity is to eliminate or shy away from the characterization step and simply demand that every conceivable hazard be prevented, we have not created a more sophisticated risk-management system. We have avoided the hardest part of building one and traded it for a system that feels more comfortable (we aren’t addressing the scary unknown bits). Doing so often costs us far more in consumer, business, and legal risk. That trade off doesn’t make sense.
The future should look different.
We should be building systems capable of continuously collecting information about hazards, pathways and environmental conditions; identifying combinations associated with increased risk; evaluating whether interventions shift those probabilities; and updating decisions as new information arrives.
That means moving beyond asking whether something was detected.
The better question is: What did this detection teach us about risk?
And then: What should we do differently because of it?
There will always be pressure to move directly from hazard identification to action. Sometimes, when consequences are severe or information is limited, precautionary action may be entirely appropriate. But even in those scenarios, the hard work of characterization should continue. Emergency action and scientific understanding are not mutually exclusive.
Ultimately, the objective is not simply to eliminate everything we can identify as hazardous. It is to continuously understand risk well enough to know that we can exist within it and reduce it. That requires accepting the messy middle and facing it head on.
If we are unwilling to characterize risk because the answer is complicated, uncertain or inconvenient, we should also stop calling what comes next risk-based management.
Our food safety system and regulatory structure have heavily invested in training and funding the two ends of the risk analysis process (hazard identification and concept of risk management) but we have largely ignored the challenges of building the analytical and social infrastructure that bridges between them.
To truly improve risk-based management and communication, it’s time we address the messy middle.
