Computing with HACCP Risk and Safety Characterizations

Abstract

The focus of this paper is the semi-quantitative approach to risk analysis in HACCP (Hazard Analysis and Critical Control Points), where we show how alternative computations in the risk matrix, combining probability and impact, can be provided based on algebraic and many-valued logical techniques. Doing so, we further show how applying such computations requires being formal concerning underlying information structures, which in turn enables being formal concerning functional representation of mappings between information structures appearing within risk analysis in risk management. Our mathematical algebraic framework also enables a more formal treatment of the duality between threat and opportunity.

1. Introduction

Socrates would say “Thou shouldst eat to live; not live to eat”, whereas modern times acknowledge the pleasure of eating. Epicurean nudging brings that pleasure forward to being on a path to healthier eating, so that eating pleasure may even be an effective lever for healthy eating. In our times, we would thus rather say “we eat to live, and we live to eat”, combining health and pleasure, but thereby, unfortunately, also being forced to deal with safety issues related to food and eating.

Food safety systems and processes are applied in order to ensure that food reaching the consumer is safe. Risk management in food safety on national levels is based on international standards like the Codex Alimentarius [1], WHO/FAO’s guideline on Risk characterization of microbiological hazards in food [2], and the European Commission NOTICE 2022/C 355/01 [3].

Food-related hazards can be managed using different methods, of which HACCP is one of the most well known. The HACCP system has evolved over decades into a widely recognized standard endorsed by the Codex Alimentarius Commission [4]. HACCP has revolutionized food safety management by providing a structured framework for hazard identification, risk assessment, and monitoring [5].

Mathematical and computational modeling within HACCP’s process descriptions, traditionally based on statistics and probability theory, has been extended with semi-quantitative approaches developed at the turn of the 21st century [2]. The influence of this computational extension is still strong today [3,6].

In this article, building upon [7], we examine the semi-quantitative approach to risk analysis from a mathematical and logical perspective, leaning on algebraic models, extending the arithmetic-based risk analysis that has been at the heart of risk calculation for the last twenty years. Thereby, we also focus more on sets and structures of risk sources and on formalizing functional and algebraic relations between such structures, thus improving the functional modeling of the food safety management process. The algebraic approach complements numeric approaches as traditionally provided within HACCP’s probability theory-based computational approach.

This paper aims to reveal the weakness of computations adopted within traditional risk analysis and risk matrices, or more precisely, the lack of acceptance that we may have computations beyond simply using arithmetic operations. We present a complemented, improved, and extended model that better reflects reality in the sense that reality calls for embracing a larger scope and variety of computations. The restriction only to use arithmetic operations in many cases enforces a computational straitjacket on assessment, whereas moving from arithmetic to include more general algebraic computations opens up a spectrum of assessment operations. Color coding commonly used in risk matrices is thereby also more clearly and logically explained within the algebraic machinery.

Our mathematical algebraic framework also enables us to more formally treat the ‘duality’ between threat and opportunity.

The outline of the paper is as follows. In Section 2, we provide a brief overview of HACCP. In Section 3, we discuss the dualities within risk and safety. Section 4 introduces the formalism adopted within our functional approach, and the approach is applied in Section 5 for nomenclatures and definitions in guidelines and standards. Section 6 extends the mathematical modeling by using the algebraic technique proposed in this paper to provide a formal description of how risk and safety are antinomies. In Section 7 we discuss some examples and concrete cases where a broader approach to risk matrix computations is required. Section 8 concludes this paper. Additionally, in Appendix A, we provide an overview of quantales and their properties, and in Appendix B, we discuss some concepts in probability theory and how there is sometimes confusion about these concepts. Appendix C presents a brief vocabulary and short summary of mathematical notation used in this paper.

2. HACCP

HACCP was originally developed to ensure food safety for NASA’s space program in the 1960s. Later on HACCP came to be used also for non-food processes or activities [4,8,9]. In 1993, the Codex Alimentarius [1], led by FAO and WHO [2], adopted the HACCP system as part of the Codex Guidelines [10]. In 1994, the Codex formed the basis for the international food safety requirements for trade, and the guidelines play a significant role in harmonizing the HACCP system in international practice [11].

Nowadays, HACCP is seen as a proven and scientifically based system, and the use of HACCP is required in most countries for organizations anywhere within the food chain, from primary production to consumption. HACCP systems are expected to be promoted by national and local health departments as they can effectively determine food safety procedures [3,7,8,9], and, as stated in [12], adherence to HACCP is indispensable and should be adopted at all levels of the food industry to maintain food safety and quality for the public. The use of HACCP is also important in regions that have ecological problems [13]. HACCP is promoted nationally and within regions by authorities, and it differs from country to country, and within countries, even from region to region.

Within organizations, an understanding of HACCP is required at all levels, although it is mainly used at operational levels. Hazard assessment methods aim to ensure food safety and that risks are minimized by monitoring, and further by controls throughout a process rather than through inspections at the end of the process. The technique provides a structured model for identifying sources of risk, i.e., threat and hazard, and putting controls in place in all relevant process steps [9,14]. HACCP is used mainly in relation to health and safety issues of a product and not so much with respect to other perspectives, such as quality, defense, and authenticity of the product. However, the principles of HACCP are the basis of most food assurance systems [6,14].

The CODEX presents HACCP as formed from twelve CODEX HACCP application steps. The first five steps are preliminary actions, and the rest are the seven CODEX HACCP Principles. CODEX’s preliminary actions are the following ([15], p. 33):

• Step 1: assemble HACCP team
• Step 2: describe product
• Step 3: identify intended use
• Step 4: construct flow diagram
• Step 5: on-site confirmation of flow diagram

In HACCP procedures, presented in different context for example in ([15], p. 33) and [7,14], these preliminary actions may be formulated differently in comparison with the CODEX definitions. There are also differences in the number of preliminary steps, and the descriptions vary depending on the source. The same goes also for descriptions of the seven principles. Depending on the context of the application, what is done in each step may vary.

The seven CODEX HACCP Principles are the following:

• Principle 1: Conduct a hazard analysis
• Principle 2: Determine critical control points (CCPs)
• Principle 3: Establish critical limits
• Principle 4: Establish a system to monitor control of the CCPs
• Principle 5: Establish corrective actions
• Principle 6: Establish verification procedures to confirm HACCP effectiveness
• Principle 7: Establish record-keeping and documentation procedures

The strength of the HACCP risk assessment technique is that, as a structured process, it provides documented evidence of quality control and the identification and reduction in risks. It focuses on practical questions of how and where sources of risk can be found and controlled in the process. HACCP encourages proactive risk management throughout the process, rather than relying on the inspection of the final product. It focuses on the risk and on preventive control given critical control points, at times during or after control implementation [9,14,15].

The limitations of the technique are that HACCP requires that hazards are identified, i.e., the risks represented as defined, and that their significance is understood as input to the process. Appropriate controls must also be defined, and HACCP might need to be combined with other tools to provide these inputs. Taking action only when control parameters exceed the defined limits can miss gradual changes in control parameters that are statistically significant, and hence such changes should be considered and added into implementations [9,16].

The starting point for an effective HACCP system for food safety is the implementation of the planning steps, hygiene practices, and prerequisite programs, which are in place and in operation. Based on these, the HACCP technique can be applied in accordance with the seven HACCP principles, identifying specific risk points in production and determining risk management methods for them [7,14].

HACCP begins with a hazard analysis, based on flow diagrams. In a hazard analysis, at a general level, products or product groups are defined and listed, hazards and risk factors related to production processes are identified and assessed, and the probability and severity of the risk are assessed. After this, critical control points, their control measures, monitoring, monitoring assurance, and documentation are determined. If the nature of the hazard makes it inappropriate to use critical control points, control points/O-PRP can be selected, and the monitoring procedures to be used in them are determined [7,14,15]. Finally, verification procedures are established for recording and documenting the resulting data for the monitoring of critical control points. Hazard assessment should cover the entire operation and interact with the food safety management system [7,14].

In the following, we discuss HACCP Principles 1–5 in some more detail.

HACCP Principle 1 is the “information critical” principle in the sense that it involves not just identifying hazards and providing a listing of (all) potential biological, chemical, or physical hazards appearing at all stages of production, but also involves the evaluation of each and every hazard in terms of severity and occurrence. Once the severity and occurrences of hazards have been estimated using pre-defined levels, the levels of severity and occurrence are combined into overall qualifications of risk related to these hazards. The aggregation of severity and occurrence levels into a risk level is a non-trivial task since there is no “universal formula” for defining a risk matrix, and so that it can be claimed as valid for all types of hazards. In Section 5 and Section 7 we present various options for the provision of such risk matrices.

HACCP Principle 2 identifies specific CCPs, where the CCPs are points or procedures within the production process, to which sublists of hazards reached in P1 are assigned, and where loss of control may lead to unacceptable risk.

Corrective actions according to HACCP Principle 5 are then applied to eliminate, reduce, or prevent the hazard from appearing within acceptable limits established by HACCP Principle 3.

Monitoring according to HACCP Principle 4 involves observations and measurements in support of determination whether or not critical limits are being met and maintained.

HACCP Principles 1–5 can be seen as implemented in a feedforward workflow that also benefits from backward reinforcement, in particular when the establishment of critical limits turns out to be connected with uncertainties. In terms of general aspects of risk analysis, the Codex Alimentarius [1] recognizes that risk analysis is an iterative process, and interaction between risk managers and risk assessors is essential for practical application. It is also stated that the risk management options selected should reflect the degree of uncertainty and the characteristics of the hazard. This essentially calls for reinforcing experiences from Principle 5 backward to Principle 3.

3. Understanding Risk and Safety

Risk assessment in HACCP, one of the most relevant risk assessment techniques to food safety, and risk assessment more broadly, involves many terms like safety, risk, threat, probability, and severity. The terminology is not uniform, and different sources define and use terms in various ways. This can be confusing. Effective risk management requires agreement on the terminology used [2,16,17].

In general, it is important to understand that risk assessors and others define terms based on their own understanding. The terms are then more or less subjective and should be critically examined [2]. The approach in this paper is similar in that our use of terms also reflects our understanding, and in particular, as we propose complementary computational models. We do not attempt to define the terms exhaustively, but we do aim to define the terms from a mathematical perspective and primarily so that mathematical modeling discussed in relation to food safety risk assessment can be rigorously explained.

Let us start with the terms risk and safety. From the point of view of the risk management process, it is important to define the term ‘risk’ so that risk can be identified and characterized. Identification and characterization are prerequisites for risk assessment because unidentified risks cannot be managed [2,16].

There is no clear consensus on the definitions of risk and safety, where ambiguity in nomenclatures and definitions is also seen within and between various standards related to risk and safety. Over time, there have been many definitions of ‘safety’. Overviews of contemporary definitions and interpretations of safety are presented in [18,19,20].

We may agree that risk is indeed crucially linked to safety. Since in this paper we are considering risk from a functional perspective, we should define risk due to the relationship between cause, risk, and effect. Risk as an object has two dimensions, namely uncertainty, described as “probability”, and effect on objectives, described as “impact”. A risk is then defined as any uncertainty that, if it occurs, will affect one or more objectives [16,21].

Uncertainty is associated with risk, and risk can be defined as the effect of uncertainty [15,16,21]. Uncertainty can be seen as the root source of risk, namely any kind of “deficiency of information” [21], which matters in relation to objectives ([16], p. 24), and thereby specifies the relationship between these two terms, so that risk is a measurable uncertainty and uncertainty is an unmeasurable risk. Notions of uncertainty related to probability and likelihood are discussed in more detail in Appendix B.

Risk has a focus on minimizing and eliminating the downsides of risk sources identified within the working processes, whereas safety has a focus on maximizing and maintaining the upsides of activities promoted within these processes. Maintaining safety and proactively augmenting its upsides is at least as important as preventing risk and reactively abate its downsides.

Safety is frequently understood as the successful avoidance of risk, whereas here we describe safety as also including commitment to continuous improvement. These two types of safety, i.e., successful avoidance of risk and commitment to promoting upsides, is in [20] called “Safety-I” and “Safety-II”.

3.1. Two Natures of Risks: Opportunities and Threats

Returning to defining risk, in the early 2000s, risk management professionals have been debating the definition of risk. The debate was about whether the definition of risk includes both threats and opportunities, or whether risk is limited only to threats related to the organization’s objectives [16]. In recent definitions of risk, risk is defined in terms of its positive and negative effects. In [15,21], risk is defined as the effect of uncertainty of objectives, where the effect is a deviation from the expected. Deviation can be positive, negative, or both, and can address, create, or result in opportunities and threats.

In addition, it is interesting how [17,21], and also [15], deal with the concepts of threat and opportunity.

An opportunity is a positive situation and can arise from a positive deviation from a risk, as pointed out in [15,21]. According to [21], the opportunity gain is likely and one has a fair level of control. An opportunity is a combination of circumstances that are expected to be favorable to an organization’s objectives [16]. In [15,21], the relationship between risk and opportunity is described so that opportunity is a positive situation that can arise from a positive deviation from a risk. Taking or not taking an opportunity are both a source of risk, but all positive effects of risk result in opportunities. On the other hand, an opportunity for one party may pose a threat to another, and vice versa [21].

A threat is determined as a negative situation that may damage one’s objectives. It is a potential source of danger, harm or other undesirable outcome [16]. According to [21], a threat is a negative situation in which loss is likely and over which one has relatively little control.

Whereas “risk source” is included in the nomenclatures, “safety source” is not. Generally speaking, a threat can be seen as a risk source, or as part of a situation involving hazards which are related to risk sources. Opportunity can correspondingly be seen as a safety source, or a situation related to a safety source.

Hazard is a source of potential harm and can be a source of risk. Hazard is a factor that has the potential to cause a negative deviation from the expected outcome, either alone or in combination with other factors [21].

Hazard and threat are defined in [21] as being quite similar terms. They describe both the negative effect of risk on the objectives as sources of potential harm. The positive counterpart to a threat is used as an opportunity, but on the other hand, the definitions of the terms are not mirror images. A threat is defined as being relatively difficult to control, while an opportunity is easier to control. There is no direct opposite term for hazard, which as a term describes a possible situation that is difficult to control.

In [16], the risk and safety antinomy is dealt with in terms of threat and opportunity. Risk is more conventionally defined as related to risk-as-threat (“bad things”), whereas opportunity is connected with professional activities in order to maintain safety (“good things”).

In other areas, e.g., as in policy-making, it is said that transformative policy design risks are underestimated, and economic opportunities are not assessed in practice [22], where a “risk-opportunity analysis” extends conventional economic cost–benefit analysis, providing new guiding principles for policy-making.

The antinomy, represented by some order-reversing antinomic mapping, is frequently said not to be “involutive” in the sense that the antinomic mappings are self-inverses, i.e., mapping a point to a point, and “mapping it back” brings us to the same point where we started. However, even if the situation with mappings is not involutive, it may well contain some fixpoints, i.e., some characterizations may be mapped and mapped back to the same original point where the mapping started. This situation is discussed in the context of so-called “Galois connections”, explained in Appendix A.

3.2. Risk Management Needs to Combine Process Views and Information Structures

The understanding of risk management and its process varies in different contexts [1,2,15,16,17]. Our purpose in this paper is to illustrate the risk management process, based on our own understanding, so that we can tie the functional knowledge to the risk management process.

In [17], the risk management process is described as involving the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording and reporting risk. This process is illustrated in “Figure 4—Process” in [17].

The risk management vocabulary in [21] provides terminology separately related to “risk”, “risk management” and “risk management process”, where “risk” is seen as a deviation from something expected, and which can result in opportunities and threats. “Risk management” is seen as coordinated activities within an organization, where risks affect their strategic, tactical or operational objectives. A “risk management process” is in [21] defined as a systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk. In this general definition of the risk management process, “risk assessment” is not explicitly mentioned, but appears as defined within the nomenclature as an overall process of risk identification, risk analysis and risk evaluation.

The view on “process” in [2] differs from views represented by [17,21], as it puts risk analysis in focus, saying that risk analysis is a process consisting of risk assessment, risk management and risk communication, having emerged as a structured model for improving food control systems, i.e., focus is placed on the “process of computations”. For the purpose of this paper, and as generally discussed in this section, we adopt both views, recognizing that a formal definition of “risk management” is not needed, and that risk management involves information connected with risk, and processes managing such information, where management includes information handling, and where risk assessment is the most “computing intensive”.

Risk assessment in turn covers the identification, analysis, and evaluation of risk, based on the information scope observed and recorded within a particular context of risk monitoring and communication, corresponding to the view presented in “Figure 4—Process” in [17].

Information within the scope of risk is, within the subprocess of risk identification, recorded for a set of risk sources. Risk identification is followed by the subprocess of risk characterization, where each risk source is annotated with a quantification or qualification by means of a characterization function, defined in Section 4, i.e., risk characterization is a prerequisite to risk analysis.

In this article, we focus on the characterization of risk within risk analysis. We build upon our functional view related to risk sources, uncertainties, probabilities, and consequences associated with this process step. We look at the identified risks based on the assumption that the risks have been correctly identified.

Assessment in “risk assessment” is a generic name for a procedure of working or a general policy, and not to be confused with mathematical functions representing assessment in the computational sense, where computational risk assessment embraces numeric or symbolic estimations or assignments of numeric or symbolic values that appear in the range of functions that map sources in the domain of the function to values in the range of the function.

Risk analysis is frequently used in contexts involving food safety and biochemistry. It is somewhat surprising that modelling success of treatments and interventions in medical contexts shows less involvement of risk analysis. In clinical contexts, clinical guidelines are developed for the purpose of lowering risks, focusing on the use of probabilities. However, impact in the form of adverse events is often not properly included in risk models, including the evaluation of the effect of interventions given diagnostic thresholds on modelled risk [23].

3.3. Food Safety

Risk management and its process, as discussed in general in the previous sub-section, embraces specific food safety risk management, where the main objectives are to protect consumer health and ensure fair practices in food trade ([1], p. 102). However, the most important issue is to protect consumers’ health and safeguard public health [1,8]. In this sub-section, we will look into more detail on food safety and “how to stay safe”.

Food safety is understood through its effects on consumers, i.e., humans and animals. Food is defined as “safe” when it does not cause adverse health effects on consumers. The definition of food safety in this context, however, does not include other aspects of safety, for example, malnutrition (see [2], p. 19 and [15], p. 5).

The term “Food Safety” should not be confused with the terms “Food Security”, “Food Quality”, “Food Defense”, and “Food Authenticity” ([15], p. 5 and [6]). However, Ref. [1] offers the term Food Hygiene, the definition of which is wider, but also includes a safety perspective.

Functionally speaking, risk is a function of the probability of an adverse health effect and the severity of that effect, consequential to one or more hazards in food ([1], p. 104 and [15], p. 5). In [15], the concept of “hazard” is from a probability theory point of view defined fairly well. Saying that (food) safety is related to (the presence of food) safety hazards is obviously saying that safety relates to the presence of hazards, and then it makes sense to say hazards can occur. In that case “hazard” is, from probability point of view, seen as an event, whereas a hazard as an agent ([15], 3.22) would rather be seen as a sample. However, in the discrete case of a random variable, a singleton set of samples is indeed an event. In its “Terms and definitions”, ref. ([15], 3.22) indeed defines food safety hazard [1,24] as a “biological, chemical or physical agent in food”, i.e., a hazard is an agent, which then can be viewed as a risk source, i.e., as a sample in the sample space. See Appendix B for definitions of formal concepts used in probability theory.

Food safety is primarily seen as the occurrence of food safety hazards at the point of consumption when it is prepared and/or consumed according to its intended use, where definitions establish the understanding to ensure that the safety of food occurs at all stages of the food chain, from production to consumption ([1], p. 20 and p. 102, [2], p. 19 and [15], p. 5).

In organizational levels, the management of food safety risks and the assurance of the necessary conditions and measures are carried out by an entity formed by several mutually supporting parts/sub-systems in organizations [7,10,14,15]. In [17], management is generally defined as coordinated activities to direct and control an organization with respect to risk. In the context of food, the management system can be called, for example, a Food Safety Management System (FSMS) ([7], pp. 22–44 and [15], p. vi).

HACCP is included in FSMS sub-systems. It is important to understand that food safety is ensured by an entity, but for the terms used in connection with it, such as FSMS, the understanding of its formation and sub-systems varies depending on the sources and organizations. However, the understanding of HACCP and Good Hygiene Practice is quite universal.

Properly applied prerequisite programs provide the foundation for an effective HACCP system [10,14]. The prerequisite program (PRP) can be defined as the basic conditions and activities that are necessary within the organization and throughout the food chain to maintain food safety. The PRPs needed depend on the segment of the food chain in which the organization operates and the type of organization [7,15].

In other contexts, good agricultural practice (GAP), good veterinary practice (GVP), good manufacturing practice (GMP), good hygiene practice (GHP), good production practice (GPP), good distribution practice (GDP), and good trading practice (GTP) are related to PRP. Sometimes, they can be understood as part of PRP [7,10]. On the other hand, ref. [15] defines these terms as equivalent to PRP.

As part of the Food Safety Management System, risk assessment methods are used to identify risk. Ensuring food safety, significant food safety hazards need to be controlled by control measures [2,15]. From the perspective of risk assessment, the question of how to distinguish risk from significant risks and when it is necessary to control risk by measurement can be considered quite relevant.

4. A Functional Approach to Risk Analysis

In this paper, we focus on analysis in the sense of mathematical and statistical methods of analysis of data, and how such analysis is used to support decision-making as supported by more formal mathematical–logical structures. Doing so, we need to be precise about the functional notation, and we need to be unambiguous about the terms and definitions that appear in the domain and range of selected functions, in particular as far as functional representation in risk characterization is concerned.

Risk characterization is in [1] “defined”, and in [2] adopted, as the qualitative and/or quantitative estimation, including attendant uncertainties, of the probability of occurrence and severity of known or potential adverse health effects in a given population based on hazard identification, hazard characterization and exposure assessment. Obviously, this “definition” does not have the nature of a mathematical or computational supporting definition but is rather a general name for what risk characterization includes.

The notion of attendant uncertainties is mentioned in [1,2] a few times, without further clarification. In the end, it refers also to elements in some set of qualifications, where such elements in [2] are named, e.g., as “high, medium, low, negligible”. However, even if it is stated that logical qualitative reasoning can provide conclusions, it is then stated simply, without drawing any attention to mathematical–logical formalism and languages, that logic cannot “combine” to determine the overall effect. In this paper, we indeed show how the alternatives for such “combinations” are many, which increases the burden, and we believe joy, of the risk assessor to choose the most appropriate “combinators” for given contexts. In [2], it is rightfully stated that probability assessment, with qualitative characterizations, runs the risk of being too subjective if risk assessors apply their own concepts of the meaning of such qualitative characterizations. Obviously, such meanings will differ from person to person, but the argumentation in this paper is that this freedom and subjectivity will be significantly restricted once the many-valued logical framework for the “combinations” guides and supports the assessor indeed to choose contextually appropriate combinators. It is then very important to note how we need not only to provide meaning to the characterization elements but also, and in particular, to the meaning of the “combination” itself, which in this paper is modeled as an algebraic operation, for which we can choose many, rather than lean on simple and straightforward arithmetical operations.

Reference to mathematical logic in [2] is indeed very shallow, if not actually non-existent. A more formal algebraic and many-valued logical definition of qualitative and/or quantitative and uncertainties is discussed in Section 4.1. An introductory discussion on the algebraic structure of the set of characterizations is provided in Section 4.2, and explanations about how to compute with such characterizations, i.e., how to “combine to determine overall effect”, are provided in Section 4.3.

The functional representation starts with using S to denote a set of sources and by Q a set of (quantitative or qualitative) valuations, and then a characterization or evaluation of sources can be represented by a characterization function

$$f:S\to Q$$

(1)

which in [2] is called “categorical labeling” in the context of “semi-quantitative risk assessment”. In this situation, the source set S, the domain of the function, may be a set without any structure, i.e., a set of named sources, or it may be a structured set, e.g., capturing how sources are categorized. The source set is often a set of quantifications in the form of numbers, either natural numbers or real numbers, so that in the case of real numbers the function f has the form $f:\mathbb{R}\to Q$, where Q, the range of the function, is a set of qualifications like

$$Q=\{low,medium,high\}$$

(2)

i.e., the function f transforms quantitative-numerical values into qualitative-symbolic values. In [2], values in Q are called “probability phrases” that have to be interpreted, whereas the algebraic view is that elements in Q are graded truth values to be used in various forms of many-valued logic.

It is important to note how we, in the context of occurrence and severity, have separate characterization functions, respectively, for characterizations of occurrence and severity.

4.1. Quantitative and Qualitative Values

The distinction between quantitative and qualitative values is important (even if not needed to be all that formal), as is the distinction between evaluations and transformations. In this distinction, we prefer not to introduce concepts like “semi-quantitative” as used in Appendix 2 in [3], but rather to be sufficiently formal about values whenever they are treated as numeric or symbolic values.

Computing with numerical values almost always makes use of functions and operations within mathematical analysis, where continuity and differentiability are often important and useful properties of such functions. Working with numerical values also enables us to use distance metrics and geometric properties of numbers, vectors, and many-dimensional objects represented by numbers. Quantitative analysis with numerical values indeed makes use of a wide range of mathematical functions, and typically as used within (real-valued random variable-based) probability theory and statistics.

Qualitative analysis is different, where Q is often a finite set of qualifications, and as such is a set of “ordinal values” in the sense that the valuation set Q can be ordered as a partially ordered set or arranged as a lattice, where lattices are special types of partially ordered sets. In finite situations, a lattice is always complete in the sense that it has a smallest element and a largest element. For example, in (2), the intuitive and mostly adopted order is

$$low<medium<high$$

which could be graphically represented as

$$\begin{gathered} \mathit{high} \\ \left| \\ \mathit{medium} \\ \right| \\ \mathit{low} \end{gathered}$$

Note that these qualifications are indeed just names of symbols, where their meaning has to be explained in the context where they are used. We could use the symbols $Q=\{\perp ,a,\top \}$ for exactly the same qualification context as long as the symbols are explained exactly in the same way. In this case, the symbol ‘⊥’ would represent the “bottom element”, and ‘⊤’ the “top element”. We could even use numbers as symbols for qualification, like in $Q=\{0,1,2\}$, with the “equivalent” (isomorphic) graphical representation

$$\begin{gathered} 2 \\ \left| \\ 1 \\ \right| \\ 0 \end{gathered}$$

and with the identical contextual explanation, paying attention never to fall for the temptation to compute algebraically or otherwise numerically with the symbols ‘0’, ‘1’ and ‘2’, since in this context they are not numbers.

In [2], it is said that 5-point scales are frequently used in semi-quantitative risk assessment, and “sometimes with a sixth category representing zero for probability and impact, and a seventh ‘certain’ category for probability representing a probability of 1”. From quantales point of view, these sixth and seventh values are, respectively, the bottom and the top element of the lattice. We also see, e.g., in [3], the use of 4-point scales, whereas 3-point scales are rarely used.

4.2. Finite and Infinite

Generally speaking, quantification values, numbers and numerical values mostly appear as elements in infinite sets, whereas qualification values, symbols mostly, are included in finite sets.

There are indeed many different types of infinite sets of numbers, and we may often deal with a continuum of decimal numbers either being an interval or the whole range of all real numbers. In probability theory, the continuum of probabilities is the unit interval $[0,1]$. Loosely speaking, in [3], “likelihood” is said to be the “probability that the hazard is occurring”. Likelihood should not be confused with probability, as likelihood is the “likelihood of a model, " modeling achieved by parameterizing the probability of events, whereas probability is the “probability of an event, whenever a certain model is given. Likelihood and probability values are both in $[0,1]$, but should indeed be understood differently, in particular when likelihood and probability values are discretized to be represented by symbolic values like ‘High’, ‘Medium’, ‘Small’ and ‘Very small’. In this case, we may have a characterization function, e.g., of the form

$$f:[0,1]\to \{VerySmall,Small,Medium,High\}$$

with $Q=\{VerySmall,Small,Medium,High\}$ graphically represented as

$$\begin{gathered} \mathit{High} \\ \left| \\ \mathit{Medium} \\ \right| \\ \mathit{Small} \\ | \\ \mathit{VerySmall} \end{gathered}$$

and with Q being a finite set of qualifications as the range of the qualification function f.

A Likelihood–Impact matrix is discussed in [25], where a nonlinear/geometric labeling scheme supports matrix comprehension better, particularly when likelihood and impact scales are nonlinear.

Qualification values in finite sets and as ranges of qualification numbers appear in many-valued logic as truth values, and ordered as ranging from “totally false” to “totally true”, where the “in-between” truth values are understood as qualifications of truth or degrees of certainty. Note that many-valued logic in this sense should not be confused with fuzzy logic, where Q is taken to be the unit interval $[0,1]$, and where “fuzzy values” in the unit interval, as set membership values, are not to be confused with probabilities.

We may note that valuation sets Q may be used in different ways in various contexts. The case $Q=\mathbb{R}$ may be understood as involving quantitative valuations derived from observations or measurements, where the function f with domain S and range $\mathbb{R}$ is more like a random variable

$$X:S\to \mathbb{R}$$

with S being a sample set, and $\mathbb{R}$ is the set of outcomes, i.e., the outcome of a sample $s\in S$ is $X\left(s\right)$. However, we may note that the nomenclature and terminology in probability theory is not always in consensus concerning the distinction between sample and outcome, sample and event, density and distribution functions and their cumulation, etc., as we point out in Appendix B.

4.3. Computing with Qualification

The finite set Q of qualified valuations is often an algebra with some operations. We need to further consider the situation that we are dealing with multiple valuations of risk sources, typically at least for occurrence and severity. We may also have multiple sources, like in situations, e.g., involving sources of biological and chemical hazards, where relations between sources are qualified rather than quantified.

Source sets for biological and chemical hazards, $S_{biol}$ and $S_{chem}$, may indeed be equipped with relations R being subsets of the product $S_{biol}\times S_{chem}$, i.e., $R\subseteq S_{biol}\times S_{chem}$.

A relation R between these two source sets $S_{biol}$ and $S_{chem}$ can equivalently be written in a functional form ${\varphi }_R:S_{biol}\times S_{chem}\to \{0,1\}$ so that for a source $a\in S_{biol}$ and a source $b\in S_{chem}$ we have ${\varphi }_R(a,b)=1$ if and only if a and b are related with respect to R, i.e., $(a,b)\in R$. In relational calculus, it is often written “$aRb$” to mean “a and b are related with respect to the relation R”.

In these relational situations, we see how a pair of sources is either related or not related. However, relations can also be many-valued and qualified by some Q, so that a many-valued relation of sources can functionally be represented by

$$\varphi :S_{biol}\times S_{chem}\to Q$$

In this situation, it is important to note how a many-valued relation between sources is indeed qualified, not quantified, even if sources themselves can be both quantified as well as qualified. A quantification related to a pair of sources would be more like a “geometric distance” between the sources, not to be confused with looking for “similarity between sources”, which is qualified. In the two-valued situation, similarity is equality, i.e., based on an equality relation “a = b”, where equality and similarity is indeed qualified, not quantified.

In the case of sets Q of qualitative valuations of specific risk source sets, we may typically have separate qualifications for occurrence and severity, and we may include other types of qualifications, e.g., for detectability, with all qualifications separately denoted, e.g., by $Q_{occ}$, $Q_{sev}$, and $Q_{det}$.

Concerning severity, assume that we have the following situation. In order to kill a certain type of pathogens, a High-Temperature Short-Time (HTST) pasteurization at 72 °C for 15 s will suffice to ensure food safety, alternatively using higher temperatures up to Ultra-High Temperature (UHT) pasteurization at shorter time or Low-Temperature Long-Time (LTLT) pasteurization. Outcomes of measurements in a pasteurization process can then be triples of values and symbols, e.g., like $(72 °\mathrm{C},15\mathrm{s},HTST)$, $(70 °\mathrm{C},25\mathrm{s},HTST)$ and $(77 °\mathrm{C},13\mathrm{s},HTST)$. In this situation, we have an obvious question about the “critical control point”, whether the control point is just “72”, with “at least 15 s” being hidden data, and “HTST” seen as a context for the measurement rather than part of the outcome data itself. If the risk source relates to the whole triple “(temperature, duration, pasteurization type)”, and we have, say, two such triples $(T_1,d_1,p_1)$ and $(T_2,d_1,p_2)$, where in a special pasteurization situation we would have $p_1=p_2=HTST$. What are then the criteria for saying $(T_1,d_1,HTST)$ “is less than” $(T_2,d_2,HTST)$, and how do we categorize such triples? If we would use categorization of severity, e.g., as informally defined in [3] according to limited, moderate, serious and very serious, with a valuation function $f:S\to Q_{sev}$ and S as the set of sources in the form of such triples, what is the order relation to choose so that for a triple $(T,d,p)$ we can determine, e.g., whether $f(T,d,HTST)=limited$ or $f(T,d,HTST)=moderate$ for a certain temperature T and a recorded duration d of time?

Note on occurrence how occurrence of illness due to a hazard is not to be confused with the occurrence of a hazard. In [8], “occurrence” is mentioned in connection with hazard evaluation within HACCP’s Principle 1, saying that each potential hazard is evaluated based on the severity of the potential hazard and its likely occurrence. Reducing the occurrence of foodborne illnesses is an objective typically appearing in guidelines for managing food safety [26].

Concerning detectability we should note that detectability e.g., in [1,2] appears mostly in the context of a (microbiological) “limit of detection”, i.e., detectability is related to a quantified value appearing in $\mathbb{R}$ rather than as a qualified value as we typically see within FMEA (Failure Mode and Effect Analysis) [27], where severity, occurrence and detectability is treated “side-by-side”, and aggregation of related qualification valuations are provided by simple arithmetics to arrive at the Risk Priority Number (RPN). The simplicity of proposed aggregations in HACCP and FMEA is indeed mathematically comparable even if the context for “risk” and the content of “sources” is very different. Concerning the intertwining of the logical and probabilistic machinery presented in this paper for HACCP, it is expected that it may well be useful also for similar developments of computational contexts for FMEA. However, the discussion of a possible “spill-over” to FMEA is outside the scope of this paper.

4.4. Risk Functions and Matrices

The source of a risk is a named and ideally also a coded source within some dedicated nomenclature and ontology. This in turn enables one to create a contextual set or structure S of sources, for which, possibly distinguished at each point in time, we have a characterization function $f_{occ}:S\to Q_{occ}$ for occurrence, and a characterization function $f_{sev}:S\to Q_{sev}$ for severity, so that the risk matrix given by

$$“Risk=Occurrence\ast Severity”$$

can be established with a suitable choice of an algebraic operator

$$\rho :Q_{occ}\times Q_{sev}\to Q_{risk}$$

(3)

as the functional form of risk matrix, where the suggestion in this paper is to consider operations ∗ in quantales $(Q,\ast )$ as suitable candidates for risk matrix computations. In this, case the quantales $Q_{occ}$, $Q_{sec}$ and $Q_{risk}$ are assumed to be “structurally identical” in the sense of being algebraically isomorphic, even if the elements in each quantale are equipped with different types of semantic explanations.

It is important to clearly distinguish between “table” and “matrix”. The product $Q\times Q$ is a risk table, where the operation $\rho :Q\times Q\to Q$ is a risk matrix. Note that a table is empty until we fill some or all cells with content, where that content functionally is a mapping of risk sources into a risk table defined by the function

$$\sigma :S\to Q\times Q$$

(4)

In the special situation of mapping risk sources into the occurrence-severity risk table $Q_{occ}\times Q_{sev}$, the characterization functions $f_{occ}:S\to Q_{occ}$ and $f_{sev}:S\to Q_{sev}$ can be used to define $\sigma :S\to Q_{occ}\times Q_{sev}$ according to

$$\sigma \left(s\right)=(f_{occ}\left(s\right),f_{sev}\left(s\right))$$

(5)

The risk function

$$f_{risk}:S\to Q_{risk}$$

(6)

can then be provided by the composition

$$f_{risk}=\rho \circ \sigma$$

(7)

where $\rho :Q_{occ}\times Q_{sev}\to Q_{risk}$ is the risk matrix, and $\sigma :S\to Q_{occ}\times Q_{sev}$ is the mapping of risk sources in S into the occurrence-severity risk table $Q_{occ}\times Q_{sev}$.

If the risk matrix $\rho$ is represented by the (quantale) operation ∗, then the computation in the risk matrix is

$$f_{risk}\left(s\right)=f_{occ}\left(s\right)\ast f_{sev}\left(s\right)$$

(8)

which is now the formal functional representation of the widely used and accepted informal expression “$Risk=Occurrence\ast Severity$”.

The use of algebraic approaches, like those provided and enabled by quantales, for the operation ‘∗’, thus introduces an algebraic calculus of risk characterizations.

In these functional representations, the set S of risk sources remains mostly unspecified. In practical situations, S may take the form of a “sample set”, where we may have even just one risk source but several sample values for that risk source. In this case, risk calculations apply to a set of sample values for a single risk source rather than to a set of different types of risk sources. In other situations, we may have single sample values for a set of different risk sources. Therefore, in the functional context, it is always important to explain the elements appearing in the respective sets, whether in the domain or range of a function.

Quantales as risk matrices can be depicted as in

Table 1. A quantale as a risk matrix.

∗	…	$x_{col}$	…
…	…	…	…
$x_{row}$	…	$x_{row}\ast x_{col}$	…
…	…	…	…

with the operation ‘$a\ast b$’ presented “row-by-column” as ‘$rowsymbol\ast columnsymbol$’, i.e., as $x_{row}\ast x_{col}$.

A quantale is a semigroup operation over a complete lattice, where the operation is join-preserving in both variables. Quantales and their properties are formally defined and explained in Appendix A.

In

Table 2. A $5\times 5$ (colored) risk matrix.

∗	0	1	2	3	4
0	0	0	0	0	0
1	0	1	1	1	1
2	0	1	2	2	2
3	0	1	2	3	3
4	0	1	2	3	4

, the $5\times 5$ risk matrix, for Q being the 5-point chain, is the meet operation, i.e., the many-valued logical “$AND$”, of the underlying lattice, where the operation is quantale 5.5.723 in [28].

A quantale operation being join-preserving in both variables means, in particular, that the operation is increasing in both variables, which in Table 2 shows as the risk level remaining unchanged or increasing when shifting rightward and downward in the risk matrix. Computing with the bottom value ‘0’ of the quantale will always produce ‘0’, which essentially means that combining anything with a ‘total problem’ or ‘totally unacceptable’ means that the overall risk is also ‘totally unacceptable’. In Section 5 we show more examples of quantale-based risk matrices.

5. Nomenclatures and Definitions in Guidelines and Standards

The nomenclature and definitions that appear and are adopted within HACCP lean mostly on [1,2,3]. These guidelines in turn lean on nomenclatures appearing, e.g., in [15,17,21].

In the following, we focus on [1,2], and particularly in [2] showing how we find implicit functional content not explicitly formulated.

The Codex Alimentarius [1] is a collection of internationally accepted food standards in a uniform manner, the purpose of which is to guide and promote the establishment and consolidation of food definitions and requirements in order to harmonize them. The main nomenclature and definitions of sources referenced in this article, for the modeling of the HACCP method, are more or less influenced by the Codex Alimentarius. The significance of Codex Alimentarius for food safety is undeniable, even if the framework it provides is very general. Further, in terms of modeling food safety risk management, it is limited and allows for a wide variation.

“Risk analysis” is in [1] seen as an overarching and undefined conglomerate of activities, as it is stated that it is recognized that risk analysis is an iterative process. Therefore, “analysis” in “risk analysis” in [1] is not to be confused with “analysis” in “hazard analysis” as explained in HACCP’s first principle (Conduct a hazard analysis) of its Seven Principles.

Further, in [1], there is a more specific understanding of “assessment” in “risk assessment” as it is said that there should be a functional separation of risk assessment and risk management. However, “assessment” refers here to the four steps [...] for setting action levels for residues of veterinary drugs detected in foods of animal origin [...], referring to the Guidelines on the Application of Risk Assessment for Feed (CXG 80-2013) and risk assessment approaches, where step 1 is “Assess animal dietary exposure assessment” and step 2 is “Estimate anticipated residue levels in food commodities of animal origin”. The meaning of “assessment” is thus not specifically connected to mathematical and statistical methods of analysis typically seen as being part of “assessment”. Step 3 is “Set Action levels”, and Step 4 is “Evaluate human dietary exposure assessment”.

In its Section 4.1 in [1] on “Working principles for risk analysis for application in the framework of the Codex Alimentarius”, there are 41 principles in ([1], pp. 99–103), grouped according to

• Scope (Principles 1–3)
• Risk Analysis—general aspects (Principles 4–12)
• Risk assessment policy (Principles 13–26)
• Risk management (Principles 27–36)
• Risk communication (Principles 37–41)

• Principle 9 states that “there should be a functional separation of risk assessment and risk management”, but guidelines, suggestions, or examples of such separations are not provided, nor is “functional” defined. Principle 11 states that “the degree of uncertainty and variability [...] should be explicitly considered”, but provides no suggestions on how risk management options “should reflect the degree of uncertainty and the characteristics of the hazard”. Principle 19 states that “risk assessment should be conducted in accordance with statements 13–16 in Appendix Section A1.2” [1], e.g., where statement 15 simply repeats what is stated in Principle 9 on “functional separation of risk assessment and risk management”. Statement 16 trivially states that “risk assessment should use available quantitative information to the greatest extent possible”, similar to what is stated in Principle 20, including “based on all available scientific data”, without any indication of how such information appears in functional contexts.

The Codex Alimentarius indeed underlines the need to be “functional”, but suggestions or indications about how such mappings and functions, e.g., involving risk sources and their characterizations, are not provided in any style or format comparable to our functional notation provided in Section 4.

For functional modeling, Ref. [2] is more important and sufficiently detailed, and Ref. [2] is indeed a central source in modeling food safety risk management. The guideline also has a wide influence and serves as the basis for the food safety risk management methods used in [3].

In ([2], p. 12), it is said that risk assessment is the science-based component of risk analysis, i.e., in [2], “assessment” is more clearly connected with biological, chemical and physical methods of observations and measurement together with mathematical and statistical methods of analysis of data derived from such observations and measurements.

Examples discussed in Section 4 on “Semi-quantitative risk characterization” in [2] intuitively scratches the surface of algebra and logic even if the examples never enter its formal mathematical treatment embedded in algebraic notation. The examples can indeed be described algebraically using notation in Section 4, as we do in the following, and which will show how the “semi-quantitative risk assessment” in fact means “algebraic and many-valued logical risk assessment”, where “score” is an element in the characterization quantale. In [2], “semi-quantitative” risk assessment is said to “provide an intermediary level between the textual evaluation of qualitative risk assessment and the numerical evaluation of quantitative risk assessment, by evaluating risks with a score”, i.e., “semi-quantitative mathematics” would be something between non-mathematical text evaluation and mathematical-numerical evaluation using probability theory. Obviously, the mathematical disciplines of algebra and logic are not situated between non-mathematics and probability theory, but we should rather view algebra as the foundation of many-valued logic as a complementary approach to knowledge representation together with the corresponding but different representation provided within and by probability theory.

Sets $Q_{Occ}^{T4.x}$ and $Q_{Sev}^{T4.x}$ of characterizations can be seen in [2] given as

$$Q_{Occ}^{T4.x}=Q_{Sev}^{T4.x}=\{VeryHigh,High,Medium,Low,VeryLow,None\}$$

(9)

corresponding to the content of Tables 4.1, 4.2 and 4.4 in [2]. It is implicitly assumed that $Q_{Occ}^{T4.x}$ and $Q_{Sev}^{T4.x}$ are chains as partially ordered sets, i.e., we have

$$VeryHigh<High<Medium<Low<VeryLow<None$$

(10)

with $VeryHigh$ as the bottom element. The bottom element labeled ‘Death’ in Table 4.2 in [2] is the characterization $VeryHigh\in Q_{Sev}^{T4.x}$.

Table 4.1 in [2] defines a mapping

$$f_{Occ}^{T4.x}:[0,1[\to Q_{Occ}^{T4.x}$$

(11)

from probabilities to characterization given by

$$f_{Occ}^{T4.x}\left(p\right)=\left\{\begin{array}{cc}None,\hfill & \mathrm{if}p=0\hfill \\ VeryLow,\hfill & \mathrm{if}0<p<{10}^{-4}\hfill \\ Low,\hfill & \mathrm{if}{10}^{-4}\le p<{10}^{-3}\hfill \\ Medium,\hfill & \mathrm{if}{10}^{-3}\le p<{10}^{-2}\hfill \\ High,\hfill & \mathrm{if}{10}^{-2}\le p<{10}^{-1}\hfill \\ VeryHigh,\hfill & \mathrm{if}{10}^{-1}\le p<1\hfill \end{array}\right.$$

(12)

At this point, it is appropriate to underline that our algebraic extension of traditional “semi-quantitative” risk characterization, as part of probability theory-based risk analysis, is indeed an extension and not by any means a replacement of statistical methods used in risk management. What our algebraic extension does is to show that “arithmetic aggregation” of characterization values is unnecessarily restrictive, and the use of algebraic operations opens up a wider spectrum of such aggregations, which in a many-valued logical context establishes an algebraic-logical formalism in support of the decision-making processes, following the preceding statistical–analytical processes.

The algebraic-logical approach, based on the algebraic calculus of risk characterizations, indeed complements the statistical–analytical approach, where a bridge between the two needs to be constructed, and a main objective of this paper is indeed to contribute to the design of that bridge.

In Appendix B we discuss the statistical–analytical machinery in more detail, together with connecting values and observations used with formal concepts, well known within the mathematical and measure theoretical understanding of probability theory, and so that sets and functions used in statistical analysis and probability theory are connected with corresponding mathematical objects within the algebraic-logical modeling as presented in Section 4 and Appendix A.

Returning to tables as presented in [2], Table 4.2 in [2] does not formally define a function as it only gives an impact description of each characterization in $Q_{Sev}^{T4.x}$.

Table 3. A general view on (occurrence independent) characterization of severity.

Category	Description of Impact
None	no impact
Very Low	feeling slightly affected and ill, without a need to seek help
Low	having gastroenteric of other symptoms, treated with self care
Medium	symptoms and illness, that requires to seek medical attention
High	long-lasting or chronic medical condition, caused by the illness
Very High	terminal illness or death

shows a general version and candidate for understanding the elements in $Q_{Sev}^{T4.x}$.

In Table 4.4 in [2], the notion of the P-I (probability–impact) table is introduced, saying that the “numbers in the table are indices for identified risks”. We may write an “identified risk” as $r_i$, and write $S_{15}$ for the set of those 15 “risks”, or risk sources, i.e.,

$$S_{15}=\{r_1,\dots ,r_{15}\}$$

(13)

In [2] it is now implicitly assumed that each risk source in $S_{15}$ maps to a probability in $[0,1[$, i.e., there is mapping

$$g:S_{15}\to [0,1[$$

(14)

so that a function of the form (1) can be given as the composition

$$f_{Occ}^{T4.x}\circ g:S_{15}\to Q_{Occ}^{T4.x}$$

(15)

Together with a corresponding severity characterization

$$f_{Sev}^{T4.x}:S_{15}\to Q_{Sev}^{T4.x}$$

(16)

Table 4.4 in [2], with “IMPACT” for severity and “EVENTS PER YEAR” for occurrence, is uniquely given by the function

$$\sigma :S_{15}\to Q_{Occ}^{T4.x}\times Q_{Sev}^{T4.x}$$

(17)

defined by

$$\sigma \left(r_1\right)=(High,Medium),\sigma \left(r_2\right)=(VeryHigh,VeryHigh),\dots ,\sigma \left(r_{15}\right)=(High,High)$$

(18)

The definition of the mapping $f_{Occ}^{T4.x}$ can be seen as the very spot in [2] where the risk table invites to use arithmetic operations for risk scoring, i.e., where we might even say that HACCP’s “arithmetization of risk matrices” originates from the approach that, as stated in [2], “a log scale is used to define each categorical scale”.

To see this “arithmetization” more clearly, let the elements in Q, the “categorical labels”, be isomorphically represented by the “numbers as symbols”

$$0\left(VeryHigh\right)<1\left(High\right)<2\left(Medium\right)<3\left(Low\right)<4\left(VeryLow\right)<5\left(None\right)$$

(19)

and allow these symbols to play the role of numbers n as exponents in power expression ${10}^n$, $n=0,1,2,\dots$. Since we have $n=lo{g}_{10}{10}^n$, we might say that “semi-quantification” focuses on the exponents from probability values represented by powers, as shown in Table 4.5 in [2] for the probability score. In other words, in situations where occurrence has an exponential behavior so that the corresponding log scale is linear, in [2] it is stated that “if a log scale is used to define each categorical scale [...] the probability and impact scores can be designed such that the severity score of a risk is then the sum of the probability and impact scores”.

The exponential situation thus seems to be a main justification for using addition as the operator aggregating occurrence and severity scores into an overall risk score, as seen in Table 4.6 in [2], even if it is also stated that one could use “some other simple mathematical equation”. Here we should obviously speak about “operation” rather than “equation”, and, as pointed out in Appendix A, there are 11,329 quantales available for such an operation on 6-point chains.

We should also note how the probability approach in [2] almost desperately holds on to characterization levels as symbols and elements in algebras, but nevertheless treats these symbols as numbers in order to enable the use of the arithmetic machinery in risk calculations. The “probability score” e.g., in Table 4.5 in [2] is essentially based on a hidden mapping

$$\pi :Q\to \mathbb{N}$$

(20)

assigning a characterization level as an element in the quantale Q to a natural number $n\in \mathbb{N}$ appearing as an exponent in some value expression or interval including a power expression like $a·{10}^n$. This clearly shows how the risk computational framework in [2] either ignores or is reluctant to compute with symbolic values $q\in Q$, since the arithmetic machinery enforces risk scoring to compute with numeric values $\pi \left(q\right)\in \mathbb{N}$.

A main point of this paper is that the “addition algebra” $(\mathbb{N},+)$ is just one algebra, whereas the algebras represented by quantales $(Q,\ast )$ are many, and indeed quite many.

On associativity (A1) of the operator, we may also note how in Table 4.8 in [2] the $MAX$ operator is used for determining an overall severity score involving three different impact types, respectively, for ‘Health’, ‘Econonomic’ and ‘Social’.

Since addition “adds”, and even if it is used in calculating “mean”, addition is logically more like a “disjunctive” operator, whereas the $MAX$ operator more clearly is a disjunction. Notably, $MAX$ is associative. Particularly, here, there is no reason not to consider the use of quantale operations. Presenting a “transfer back into logs” as another option for an overall severity score simply shows how the risk matrix computational framework in [2] remains loyal to arithmetic operation.

The risk matrix in Table 4.9 in [2], shown in

Table 4. Algebraic adaptation of Table 4.9 in [2].

∗	0	1	2	3	4	5
0	0	0	0	0	0	0
1	0	2	2	2	3	3
2	0	2	2	3	3	4
3	0	2	3	3	4	4
4	0	2	3	4	4	4
5	0	3	4	4	4	4

excluding ‘NIL,’ which always computes to ‘NA’, is presented within a $5\times 5$ risk table, where only three risk levels, ‘High severity’, ‘Medium severity ’, and ‘Low severity’, are used in the range of the operator, and therefore the algebraic properties of the operator remain unclear.

Table 4.9 in [2] is in Table 4 depicted row-by-column as a $probability\times impact$ risk matrix, where in [2] the probability dimension is named “EVENTS PER YEAR” and the impact dimension is named “IMPACT”.

The characterization ‘VHI’ (very high), ‘HI’ (high), ‘MED’ (medium), ‘LO’ (low), and ‘VLO’ (very low) in Table 4.9 in [2] correspond in Table 4, respectively to ‘1’, ‘2’, ‘3’, ‘4’, and ‘5’, where in Table 4 the bottom element ‘0’ is added as corresponding to ‘certain’ (totally unacceptable risk), which combined with anything results in total unacceptability. Therefore, in our example tables below, we use

$$Q=\{0,1,2,3,4,5\}$$

(21)

as the underlying quantale, and again we remind ourselves that the elements of Q are ordinal symbols, and not numbers.

We have in Table 4 further, as one option, identified ‘High severity’ with ‘2’ (‘HI’), ‘Medium severity’ with ‘3’ (‘MED’), and ‘Low severity’ with ‘4’ (‘LO’). Doing so, a first observation is that the risk operator in Table 4.9 in [2] is not associative, since we have the counterexample

$$(VHI\ast MED)\ast MED=HI\ast MED=MED\ne HI=VHI\ast MED=VHI\ast (MED\ast MED)$$

At this point, we remark how in [2] it is stated that it is “imperative that the categories are carefully constructed”, but nothing is said about the need to carefully select the operation. After all, the 6-point chain is an ordinal structure, not a numerical one. Sub-section 4.3.3 in [2] on “Limitations of semi-quantitative risk assessment” presents the limitations as being caused by the scoring scale, but no discussion is provided on these limitations possibly arising due to the acceptance only of arithmetic operations for the overall risk scoring.

In the following, we present a few quantales that might be seen as candidates to be similar to the risk matrix depicted in Table 4.

Before doing so, we may note how the addition operation used in Table 4.9 in [2] essentially introduces a certain form of a “disjunction” of probability and impact. In our candidate tables, when represented by unital quantales, we will see, e.g., how the position of the unit makes the risk computation intuitively being positioned relatively to the additive operation, i.e., being clearly below the “addition” corresponds intuitively more to a logical conjunction, a many-valued “$AND$”, whereas comparable to the “addition” corresponds intuitively to a logical disjunction, a many-valued “$OR$”.

Table 5. Quantale 6.15.9177 in [28], which is unital, with ‘2’ as the unit.

∗	0	1	2	3	4	5
0	0	0	0	0	0	0
1	0	1	1	3	3	5
2	0	1	2	3	4	5
3	0	3	3	5	5	5
4	0	3	4	5	5	5
5	0	5	5	5	5	5

shows a quantale which is commutative and unital, with risk level ‘2’ as the unit, i.e.,

$$2\ast q=q\ast 2=q$$

(22)

for all $q\in Q$.

Table 6. Quantale 6.15.8746 in [28], which is unital, with ‘3’ as the unit.

∗	0	1	2	3	4	5
0	0	0	0	0	0	0
1	0	1	1	1	4	5
2	0	1	2	2	4	5
3	0	1	2	3	4	5
4	0	1	4	4	4	5
5	0	5	5	5	5	5

shows a quantale which is non-commutative and unital, with risk level ‘3’ as the unit, i.e.,

$$3\ast q=q\ast 3=q$$

(23)

for all $q\in Q$.

The ‘∗’ operator in Table 5 appears to be somewhat more “additive” and “disjunctive”, whereas the ‘∗’ operator in Table 6 is intuitively more “conjunctive”. However, Table 4 seems to be more in between the two, thus not being as “additive” and disjunctive as expected, and maybe due to the way the added numbers in Table 4.9 in [2] are lumped together to appear as clustered within respective risk levels. Indeed, addition is more of a disjunction but the categorization of the results of additions may bring the matrix operation “downwards” towards being more neutral between conjunction and disjunction.

As explained in Appendix A, quantale operations generate certain forms of many-valued logical implications, which as consequence relations can be seen as the logical counterpart to causation and conditionality in probability theory.

The use of quantales for risk matrix computation shows that algebraic approaches beyond using only arithmetic open up a wider spectrum of options for risk matrix computation. It also shows how an algebraic approach complements traditional approaches based only on probability theory and, in fact, increases the underlying mathematical complexity of risk management, particularly when dealing with “semi-quantitative” risk modelling.

On semi-quantitative risk management, in [2] a general statement is made saying that “it does not require the same mathematical skills as quantitative risk assessment”. By “mathematics” is then obviously meant probability theory and statistics, thus ignoring methods potentially provided by algebraic and mathematical logical techniques, as described in this paper. It is further said that “nor does it require the same amount of data”, where in fact the algebraic approach makes use of precisely the same data as probability theory and statistics, where that data is expected to have been properly typed and structured within the original information sources from where that data has been extracted. Probability theory and statistics use numerical values only, with logical expression integrated ad hoc whenever needed. Probability theory as used in [2] is thus more or less disconnected from the understanding of mathematical logic and algebra.

6. Risk and Safety as Antonyms and Antinomies

In this section, we look at some formal algebraic aspects which may become interesting to further investigate with respect to the relation between risk and opportunity, i.e., on the duality and connection between avoiding risk and maintaining safety. A more in-depth formal treatment is outside the scope of this paper, but some further algebraic subtleties are provided in Appendix A.

Risk and safety, as names in nomenclatures, may appear and be treated as antonyms, whereas they appear more like antinomies when dealing with their respective many-valued logical characterizations. The degrees of safety and risk are related more with respect to the underlying lattice, whereas their characterization values are treated more with respect to the underlying quantale. A higher degree or characterization value of safety intuitively means a corresponding lower degree or characterization value of risk.

Formalizing such an antinomic view of risk and safety calls for dealing with mappings (functions) between risk and safety, as well as “opposite” mappings between safety and risk, and further invites to identifying the algebraic properties of such pairs of mappings. In [16], the relations and mappings between the antinomies threat and opportunity are discussed on an intuitive level only, without formalization of such relations and mappings. For instance, it is in ([16], p. 102) said that a risk including both threat and opportunity can be treated simply as a particular case of different impact types. A “double P-I Grid” (“table” is in [16] called “Grid”) is recommended, and in ([16], p. 103) it is said that a useful alternative is the so-called “mirror P-I Grid”, where the opportunity side is rotated by reversing the impact scale, creating a symmetrical double grid. The “Attention Arrow” in Figure 3 in ([16], p. 104) covers the worst threats and the best opportunities, which together should be the focus of management attention and action ([16], p. 103). The size of that zone can and should indeed be modified to reflect the reality and objectives in specific contexts, but there should also be some relation between respective table values together with suitable algebraic properties between them, in order to explain the relational structure between threat and opportunity.

In order to introduce algebraic aspects of this relation between threat and opportunity, let us first note that an antinomy is often seen as a contradiction, or an “opposite truth” in some logical sense, with opportunity being the antinome of risk, and vice versa, risk being the antinome of opportunity, whatever the precise definition of “antinome” might be.

Algebraically and logically speaking, such antinomies can be modeled by order-reversing functions, or using many-valued logical negation.

To be more precise, a function f is said to be order-reversing (also called antitone) if $f\left(x\right)\ge f\left(y\right)$ whenever $x\le y$, i.e., being order-reversing is dual to being order-preserving (also called monotone or isotone) if $f\left(x\right)\le f\left(y\right)$ whenever $x\le y$.

For reasons previously explained, in this paper we have recommended the quantale $Q_r$ for risk characterizations to have its top element ${\top }_r$ as a “no problem”, i.e., meaning “no risk”. If the corresponding quantale $Q_o$ for opportunity characterizations has its top element ${\top }_o$ similarly as a “no problem”, but in this case in the sense “highest and best possible opportunity”, then the antinomic relation between risk and opportunity is suitably modeled by order-reversing mappings

$$f:Q_r\to Q_o,g:Q_o\to Q_r$$

Note in the risk matrix that $Q_r$ and $Q_o$ are “identical” (or isomorphic) as quantales, even if the names of the elements in respective quantales are understood differently.

The composition of the order-reversing functions (mappings) f and g gives order-preserving mappings

$$f\circ g:Q_o\to Q_o,g\circ f:Q_r\to Q_r$$

An assumption that these compositions are identities, i.e., $f\circ g={\iota }_o$ (the identity mapping for $Q_o$) and $g\circ f={\iota }_r$ (the identity mapping for $Q_r$), would be a very strong assumption, leaving less freedom for interpretation of the antinomic relation between risk and opportunity. A weaker assumption providing a special and interesting connection between f and g is the so-called Galois connection, which for a risk characterization $x_r\in Q_r$ and an opportunity characterization $x_o\in Q_o$ means that we have an equivalence

$$x_o\le f\left(x_r\right)\iff x_r\le g\left(x_o\right)$$

In this case the compositions $g\circ f$ and $f\circ g$ are idempotent, i.e.,

$$(g\circ f)\circ (g\circ f)=(g\circ f),(f\circ g)\circ (f\circ g)=(f\circ g)$$

and, moreover, we have that $f\left(x_o\right)$ is the largest opportunity characterization $x_o$ such that $x_r\le g\left(x_o\right)$, and that $g\left(x_o\right)$ is the largest risk characterization $x_r$ such that $x_o\le f\left(x_r\right)$.

If f and g form such a Galois connection, then

$$x_r\le (g\circ f)\left(x_r\right),x_o\le (f\circ g)\left(x_o\right)$$

for all $x_r\in Q_r$ and all $x_o\in Q_o$.

Tarski’s fixed-point theorem (also called the Knaster–Tarski theorem) [29] guarantees the existence of fixed points for both $g\circ f$ and $f\circ g$, i.e., there exists (at least one each) $x_r$ and $x_o$ sich that

$$(g\circ f)\left(x_r\right)=x_r,(f\circ g)\left(x_o\right)=x_o$$

which shows how $g\circ f$ and $f\circ g$ are not identities but indeed some kind of “incomplete identity functions”.

The antinomic relation between characterizations of risk and opportunity in terms of many-valued truth can further be defined and explained by using the quantale to construct logical negations. A quantale defines left and right implications, which can be arranged in functional forms so as to form a Galois connection. Details are shown in Appendix A.

These discussions show how the formalization of the intertwining of and antinomic relation between risk and safety, and between threat and opportunity, can be provided within algebraic and logic frameworks, not recognized, e.g., in [16,20], where the antinomic relation is treated more intuitively and from viewpoints of appearance in practical and/or professional situations in risk management.

Further subtleties, beyond the additional discussion as provided in Appendix A, connected with these algebraic and logical treatments are mostly outside the scope of this paper. However, these views invite further development, where Appendix A serves the purpose of including basic notions of quantales in support of further extensions related to such treatments.

7. Case and Examples

In previous sections, we have extended the mathematical modeling of risk analysis, focusing on risk matrices as they appear within the HACCP method. The functional approach, and more generally, the algebraic approach to risk analysis, as introduced in Section 4, is in Section 5 shown to apply suitably to risk analysis within HACCP. Traditional statistical methodology in HACCP [2,30] provides mappings from probabilities to characterizations, and we have shown how the methodology can be extended with an algebraic calculus of characterizations enabled by quantales.

In this section, we illustrate the challenges of arithmetic-based spreadsheets through practical examples, and we show how a broader use of algebraic calculus complements traditional arithmetics based approaches.

Our case discussed in this paper is drawn from [7], which describes reindeer meat cutting and slicing processes, based on developments within a cooperation project with a reindeer meat cutting and slicing company in Finland. Internal discussions within the company, in particular concerning methods used and the reality about the CCPs of metal detectors, was the background to and underlying motivation for developments presented in [7], and also became the motivation to develop the functional model as presented in this paper.

In this example case, we will arrive at risk matrices for risk sources represented by foreign object hazards, respectively, for metal and reindeer botfly found in reindeer meat within these processes. We will demonstrate the advantages of adopting the functional approach and the use of quantale-based risk matrices for these risk sources. We thereby indicate how our algebraic calculus in risk analysis can potentially be exploited in real situations and within risk management processes.

Before going into case detail, it is important to understand the legislative framework based on which food operators like reindeer meat cutting companies implement their food safety actions when creating their own risk management system and self-monitoring plan. In these respects, for risk assessment in Finland, national legislation sets minimum requirements for ensuring food safety. This national legislation is largely based on the requirements set by the European Union, which in turn takes effect from international guidelines [1,2]. In addition, food operators are affected by various standards [7]. Finnish food operators comply well with both legislation and standards, and with models and methods presented in [1,2,3], a compliance driven and enforced by the Finnish Food Authority.

In order to understand the existing challenges, we will now dive into detail concerning the reindeer meat cutting and slicing process. The production processes of a reindeer meat cutting plant are fairly simple and straightforward from a HACCP perspective. The hazard analysis performed for reindeer meat, particularly in its cutting and food production, examines biological, chemical, and physical risks, and sometimes also allergens and radiological risks. Overall, reindeer meat can currently be classified as a low-risk food in Finland. In general, the health of reindeer is good, and there are no dangerous diseases transmitted through reindeer meat, and in this context, we consider reindeer meat products intended for heat treatment [31].

Biological risks are caused, among others, by bacteria and parasites. The risk of infection is mainly related to eating uncooked or poorly cooked meat. Common parasites found in meat include the reindeer botfly (Hypoderma tarandi) [31]. Even if botfly larvae can cause myiasis if such ectoparasites have penetrated the skin of humans, the appearance of such larvae in reindeer meat does not cause harm to humans if that reindeer meat is properly processed and used in food production. That is, the botfly larva itself, as a risk source, does not contribute to risk, whereas incomplete or insufficient food processing increases risk. Logically, we may say that the combination “reindeer botfly larvae AND proper heating (of reindeer meat)” is risk-free, whereas “reindeer botfly larvae AND improper heating” comes with risk. This shows that we need to understand the role of the (logical operator) “AND”. We also need to note how the risk source “improper heating” itself, in general, may lead to consumers becoming susceptible to harm. This, in turn, means that the risk matrix for “presence of a risk source s AND improper heating” will depend on the risk source s.

The situation “reindeer botfly larvae in reindeer meat AND proper heating of reindeer meat” will indeed not impose any risk at all, which means that the risk matrix in this situation is given by the quite rare “risk-free matrix” shown as the left-hand side quantale in

Table 7. The left-hand matrix is quantale 6.15.11329 and the right-hand matrix is quantale 6.15.1 in [28].

∗	0	1	2	3	4	5	∗	0	1	2	3	4	5
0	0	0	0	0	0	0	0	0	0	0	0	0	0
1	0	5	5	5	5	5	1	0	0	0	0	0	0
2	0	5	5	5	5	5	2	0	0	0	0	0	0
3	0	5	5	5	5	5	3	0	0	0	0	0	0
4	0	5	5	5	5	5	4	0	0	0	0	0	0
5	0	5	5	5	5	5	5	0	0	0	0	0	0

. This is indeed an extreme situation, where quite the opposite risk situation as represented by the right-hand side quantale would correspond to a situation where the risk is constantly “total” for whatever characterization values related to probability and impact. Such risk situations are also rare.

Other types of risks, like chemical risks, arise from contamination of reindeer meat by various chemicals in the environment and toxins produced by plants and microbes. In the slaughtering process, chemical contamination can occur, among other things, from detergents and disinfectants, technical chemicals, packaging materials, pest control agents, possible paint surfaces or building materials [31].

Physical hazards like metal and glass are caused by foreign objects ending up in reindeer meat. Foreign objects can come from, among other things, the environment, people, contact materials such as work tools and protective clothing, and from packaging materials. In the case of metals, foreign objects can come from breaking knives and saw blades, pieces detached from carcass rails, rail grease, or from rust and parts of equipment. In addition, with regard to reindeer meat, there is a possibility of finding bullets from shotguns that may have been fired at animals [31].

In the case of metal objects, they all have different impacts. In some cases, the impact is less severe, in other cases more so. Moreover, the probability of their occurrences, estimated for each impact level, is not the same, not even for one particular foreign object, when occurrences are observed over time within one and the same production process. This obviously calls for paying attention to the choice of a quantale or quantales for the risk matrix annotated to a certain foreign object or to a set of similarly impacting foreign objects. The quantale(s) selected to model the risk must indeed match the outcomes and consequences observed within the production processes and correspond to experiences and lessons learned in production. Obviously, this type of algebraic risk modeling must also be aligned with rules and regulations as provided and imposed by the authorities.

In the production processes of reindeer meat cutting and slicing, a more specific problem is that foreign objects can be identified as “death” hazards with a low probability but high severity in some cases. Such a hazard can be caused, for example, by metal pieces that have ended up in food from metal blades used in production. In the risk matrix proposed in [3], a low probability with a high-severity hazard is never placed in the “red area”, but in the “orange area”, which does not correspond to reality [7].

Characterizing the occurrence of physical hazards like metal is quite different from characterizing the severity of such foreign body ingestion, particularly in pediatric cases. Metal and glass objects are the most involved sharp or pointed foreign bodies, where endoscopic retrieval is difficult in about 4% of cases [32]. However, perforation during gastrointestinal passage is very rare.

If we consider the “death” hazard for the risk source being metal pieces from metal blades,

Table 8. The left-hand table is an incomplete matrix, and the right-hand matrix is quantale 6.15.7902 in [28].

∗	0	1	2	3	4	5	∗	0	1	2	3	4	5
0	0	0	0	0	0	0	0	0	0	0	0	0	0
1	0	1					1	0	1	1	1	1	1
2	0		1		1	2	2	0	1	1	1	1	2
3	0			2			3	0	1	1	2	2	3
4	0				2		4	0	1	1	2	2	4
5	0	1	2	3		5	5	0	1	2	3	3	5

shows a quantale suitable for a corresponding risk matrix, and it explains a main point of this paper, namely, that we first provide characterized values and then select the operator to be used for computations in the risk matrix. In the general risk formula

$$“Risk=Occurrence\ast Severity”$$

traditional risk analysis first constrains the operator ‘∗’ to be of arithmetic type, and in some cases, like in HACCP, anticipates that it will be “arithmetically additive”. In some other cases in risk management at large, there may be intuitive justifications that the operator is “arithmetically multiplicative”. Whatever the choice of arithmetic style operator in these traditional cases, the decision to use arithmetic for computing with characterized values comes before characterizations of $Occurence$ and $Severity$ have been provided. In HACCP, we have seen the use of the log scale for characterizing occurrences seems natural without any detailed justification, or even worse, the use of the log scale may be understood as justified indeed because the use of arithmetic addition has been determined and fixed in advance. The characterization of severity, like in Table 4.2 in [2] and Table 3 in Section 5, is generic and assumed to be essentially independent of the characterization of occurrences. This means that the characterization of occurrences also essentially comes before the characterization of severity. Thus, in HACCP, the choice of the operator and the characterization of severity is given before the characterization of the occurrences is provided, which means that the characterization of the occurrences will be affected by the given characterization of severity and the fixed and “universal choice” of adopting arithmetic for computing with characterizations of occurrences and severity.

In our approach, we suggest being aware of the order of providing characterizations and selecting operators. We essentially say that “first, characterize occurrences and severity, and then choose the operator”. If we adopt this order, characterization of occurrences may remain to be performed within the realm of statistics and probability theory, and the characterization of severity may follow traditions within HACCP and risk management in general. A key point in our paper is that selecting the operator after having provided characterizations of occurrence and severity will open up an avenue of using a much wider spectrum of operators within the realm of the discipline of algebra, and computing with symbols rather than arithmetically computing with numbers.

The need to choose the operator after having provided characterizations is further justified as illuminated in the following situation in ([16], p. 103), where the challenge of symmetric risk assessment tables and matrices is discussed. In assessing the significance of a risk, most risk assessors’ intuitive understanding is that the impact of the risk is not of “equal significance” as compared with the probability of the risk, but the impact should be considered more important than the probability. For example, if risk source $s_A$ has a low probability but a large impact, and risk source $s_B$ has a high probability but a small impact, most risk assessors would prefer to say “A is more important than B”. The relative importance of these two cases is clearer at the extremes. For example, when considering threats, a small chance of a disaster is more important than an almost certain small harm.

Designing a risk matrix in the case of the “death” hazard would typically start off by fixing a few expected risk values, and arriving at an incomplete risk matrix as shown on the left-hand side of Table 8. Given these preferences for selected positions in the risk table, i.e., representing certain fixed conditions for the risk matrix, the right-hand side shows quantale 6.15.7902 as being one particular quantale that is a completion of that incomplete quantale.

There are often several alternatives for the choice of the completing quantale. In these situations, assessors could either seek to justify a particular choice or add further preferences in other selected positions in the risk table. The pdf file [28] that lists all quantales up to 6 points can be used to develop various “semi-automatic” searches of quantales, and the quantale suggested in Table 8 was reached, for the purpose of this paper, using a heuristic search method. The underlying data structure of the listing in [28] has not been disclosed. However, demonstrators can be developed, where the choice of particular quantales is simplified. In the end, the suitability and practicality of such demonstrators depend on the particular application context. As stated in [33], SAT solvers were used to enumerate quantales on up to 6 elements, and later on Mace4 was used for quantales up to 9 elements. The scope of all quantales up to 9 points, and there are hundreds of millions of them, has been described [33], but not fully documented. The pdf file [28] for quantales up to 6 points is already quite large, so the documentation of quantales up to 9 points must be done in different ways, explaining which is beyond the scope of this paper.

Note in Table 8, with row-by-column being Probability-by-Impact (or Occurrence-by-Severity), how values in certain blank positions in the left-hand side risk table cannot be chosen as any value in the quantale, as the algebraic properties of quantales means, e.g., that the semigroup operation ‘∗’ in the quantale is order-preserving in both its arguments. For instance, since $2\ast 2=1$ and $2\ast 4=1$, then also $2\ast 3=1$. Obviously, since $1\ast 1=1$ and $5\ast 1=1$, then $q\ast 1=1$ for all $q=1,2,3,4,5$. Further, since $2\ast 4=1$ and $4\ast 4=2$, we expect to have either $3\ast 2=1$ or $3\ast 2=2$. Simularly, since $5\ast 3=3$ and $5\ast 5=5$, we expect to have either $5\ast 4=3$, $5\ast 4=4$ or $5\ast 4=5$.

The quantale 6.15.7902 in [28] is indeed one option that fits the selected and fixed values for the “death” hazard case in the left-hand table in Table 8. One may wonder if we can be dissatisfied with one or two values in the right-hand side quantale and modify the values, still respecting the order-preservation. In such cases, we have to be careful, since changing a few values, even if respecting the order-preservation, might destroy the associativity property (A1) of the quantale.

In our example case, we should also remark that for the reindeer meat cutting and slicing processes examined in [7], it was not possible to demonstrate any CCPs by using risk assessment methods, but only CPs. Unlike the output produced by the risk matrix, in reality, the risks of foreign objects could require that metal detectors be determined as a CCP. However, the BRCGS (Brand Reputation through Compliance Global Standards) assesses the risk of a foreign object as high if the X-ray machine points are always determined as a CCP. BRCGS requires the inspection of raw materials and finished products using an X-ray machine.

8. Conclusions

The practice of risk management is multidimensional, in particular, as it is concerned with the duality of opportunity and threat, where we might sometimes see threat as requiring insurance as an additional option to guard against threats, whereas fertilization of opportunity is expected to be interest-yielding. There is indeed a variety of objectives for risk management, and how organizations decide to take action based on risk analysis.

From the viewpoint of food risk management, we live in our modern society where the meaning of food is no longer to serve solely as a source of energy, and modern supply chains are inherently complex. Food safety management has focused mainly on ensuring that food is safe to consumers. Food safety is more than just ensuring safety, and methods can also be used to ensure the quality and authenticity of food, as pointed out e.g., in [2,6,34]. In addition to health risks, risk assessment further takes into account other types of effects, such as financial losses or deterioration in quality of life. Other perspectives of food management obviously introduce not only multiple risks but also multiple risk tables and related matrices. Complexity increases the need for Safety II based [20] thinking in risk management, and on the other hand, new types of risk assessment and methods.

As we point out in this paper, the probability–impact risk table and matrix can be constructed in a wide variety of ways, not restricted to the use only of arithmetic operations but also more generally making use of algebraic operations like quantales, thereby opening up a wider spectrum of applications of the risk matrix computationally defined based on its risk table.

HACCP is undeniably an important tool in ensuring food safety. In [6], the application of the familiar food safety tool HACCP is presented more broadly in ensuring food assurance, so that it takes into account risks related to food defense (TACCP), food authenticity (VACCP) and food quality in addition to food safety. Furthermore, as pointed out in [16], the HACCP method can be applied more broadly, not only to hazards but also to possibilities.

In this paper, we have discussed risk management, its terminology, process modeling and functionality at a general level and examined it from the HACCP perspective of food safety. We might say that HACCP and many other risk assessment methods like FMEA and HAZOP indeed follow the ISO 31000 [17] process to some extent. However, user communities connected with different risk assessment methods could consider whether risk management can be modeled even more accurately in the future based on the ISO 31000 process and ISO 31073 [21] definitions and terms. Risk management can be seen as very general regardless of the field and could benefit from more comprehensive uniformity.