Food Safety Audits Are Missing This Critical Step (And Why Micro-Businesses Are Most at Risk)

The artisan cheese maker selling at the farmers market. The small bakery supplying three local cafes. The family-run jam producer who just landed a SuperValu listing. All of them are one Environmental Health Officer visit away from discovering their food safety documentation has a hole you could drive a lorry through.

The hole is the same every time. No documented risk assessment.

What the Audit Finds (And What It Doesn't)

Food safety audits for small producers tend to focus on the visible stuff. Temperature logs. Allergen labelling. Cleaning schedules. Staff hygiene records. These matter, and most small operators have some version of them, even if the paperwork looks like it was written on the back of a flour bag.

What auditors find missing, consistently, is the foundational document that explains how the business identified its hazards in the first place. The risk assessment that says: here are the points in our process where something could go wrong, here is how likely that is, here is what we do about it, and here is how we know it is working. Without that document, every other record floats free. The cleaning schedule becomes a habit rather than a control. The temperature log becomes a box-ticking exercise rather than evidence of a system.

Larger food businesses have compliance teams, HACCP consultants, and quality managers who build this infrastructure as a matter of course. They also have something else: the institutional memory of what happens when you do not have it. Small producers often lack both the infrastructure and the institutional memory, which means they are making the same expensive discoveries their larger competitors made twenty years ago.

Why Micro-Businesses Are Carrying This Risk

A producer with three employees does not have a safety officer. They have a founder who also does the deliveries, manages the social media, and handles complaints. Risk assessment feels like a task for companies with HR departments and laminated wall charts, not for someone running a batch of 200 jars on a Tuesday afternoon.

This is a structural problem, not a character flaw. The regulatory framework does not distinguish much between a producer turning over €50,000 a year and one turning over €5 million. Both are food businesses. Both face inspection. Both are expected to demonstrate a systematic approach to food safety hazards. The expectation is proportionate in theory. In practice, the documentation gap between large and small producers is enormous.

The supply chain dimension makes this worse. When a small producer lands a contract with a retail buyer or a larger food service company, that buyer will often conduct their own supplier audit. This is where the missing risk assessment becomes immediately and commercially painful. From farm to fork, supplier audits by larger buyers increasingly require evidence of documented hazard analysis, not just records that production happened cleanly.

What a Risk Assessment for a Small Food Business Actually Needs

Strip away the jargon and a food safety risk assessment answers five questions.

What are the hazards? Biological (Listeria in soft cheese, Salmonella in raw egg products), chemical (cleaning product residues, allergen cross-contact), and physical (glass, metal, bone fragment). Every process step gets examined.

Who or what could be harmed? The consumer. Be specific. If your product reaches elderly people, immunocompromised individuals, or children, say so. The hazard profile changes.

What controls are already in place? Pasteurisation. pH control. Water activity limits. Cold chain management. These are real controls. Name them.

Are the controls adequate? This is the part small producers often skip. Having a fridge does not control temperature. Having a fridge that is checked twice daily, with records, that stays below 5 degrees Celsius, with a corrective action plan for when it does not, that controls temperature.

How will you know if something changes? Monitoring, verification, and review. A review triggered by a supplier change, a new product line, or a food safety incident.

This is HACCP logic. It is also exactly what the HSA's approach to food production safety demands. The HSA's farm safety code of practice, which covers food-producing operations, is explicit that hazard identification and risk control must be documented and reviewed. The code does not accept good intentions as evidence of a safe system.

The Supply Chain Problem Nobody Talks About

Here is where this gets interesting for buyers and producers alike. When a small producer cannot demonstrate a documented risk assessment, the liability does not disappear. It redistributes.

A retailer who sources from an undocumented producer and then has a food safety incident faces questions about their supplier approval process. Did they audit? What did they find? What did they require the supplier to fix? If the answer is that they accepted a price list and a few product samples as due diligence, that is a problem.

This is why supplier audits have become more rigorous, and why small producers who get their documentation right gain a genuine competitive advantage. The artisan producer with a clean, proportionate, well-maintained risk assessment is a more attractive supplier than one who makes a better product but cannot show they thought systematically about the hazards in making it.

The Practical Fix

The risk assessment does not need to be a 40-page document. For a small bakery or jam producer, a proportionate document might be ten pages. What it does need is to be real. Written by someone who actually knows the process. Reviewed when something changes. Signed, dated, and accessible during an inspection.

The FSAI provides guidance specifically for small food businesses. The HSA's codes of practice for food production operations sit alongside this. Neither organisation expects micro-businesses to have the same systems as a multinational processor. They do expect evidence that someone thought seriously about what could go wrong and built controls around it.

The distinction that matters in any enforcement action is not whether a business had perfect controls. It is whether a business had a documented, proportionate system that demonstrated they took food safety seriously. Environmental Health Officers conducting food safety inspections are looking for exactly this: not perfection, but evidence of a system.

The Turn

The market for Irish artisan and micro-produced food has never been stronger. Buyers want provenance, local supply, and small-batch quality. What they also want, increasingly, is the documentation to prove the product is safe. The gap between what small producers make and what they can prove is the gap that costs them contracts and, in the worst cases, their business.

Write the risk assessment. Review it once a year. Update it when the process changes. Everything else in your food safety system hangs off that document.