Allergen Risk Assessment for Food Businesses: A Step-by-Step Guide
A documented allergen risk assessment is the foundation of a compliant food safety system. Here is a step-by-step approach for food businesses of all sizes.
An allergen risk assessment is a systematic review of how allergens enter, move through, and could contaminate food in your business. It is both a legal requirement under UK food safety law and a practical tool for preventing allergen incidents.
Step 1: Identify All Allergens in Your Business
List every ingredient used across your product range. For each ingredient, identify which of the 14 major allergens it contains or may contain. Include sub-ingredients — a spice blend, a sauce, a flavouring — that may contain allergens not obvious from the product name.
Step 2: Map Allergen Flows Through Your Kitchen
Identify every point at which allergens could cross-contact non-allergen food:
- Shared preparation surfaces
- Shared utensils, bowls, and equipment
- Shared cooking equipment (fryers, grills, ovens)
- Staff hands and clothing
- Storage proximity (allergen ingredients stored near or above allergen-free ingredients)
Step 3: Assess the Risk at Each Point
For each identified cross-contact point, assess:
- How likely is cross-contact to occur?
- What is the consequence if it does (which allergen, what consumer risk)?
- What controls are currently in place?
Step 4: Implement Controls
Controls that reduce allergen cross-contact risk include:
- Dedicated equipment (colour-coded chopping boards, utensils)
- Allergen-free preparation areas or time-separated production
- Documented cleaning and changeover procedures
- Allergen-safe product sequencing (produce allergen-free items first)
Step 5: Document and Review
Record your risk assessment in writing. Review it when a new ingredient is introduced, a recipe changes, or a new piece of equipment is acquired.
Manage your allergen data and product labelling on Shopify with Allergen Matrix — free to get started at saltai.app.
Step 6: Train Your Staff on the Risk Assessment
A risk assessment sitting in a folder achieves very little if the people working in your kitchen have never seen it. Every member of staff involved in food handling, preparation, or service needs to understand the specific allergen risks identified in your assessment, not just general allergen awareness. This means going beyond a one-off induction and embedding allergen awareness into your regular training cycle so it stays current as your menu and team change.
Training should be tied directly to the findings of your risk assessment. If your assessment identifies shared fryer oil as a high-risk cross-contact point for fish or gluten, your staff need to know that, understand why it matters, and know exactly what the correct procedure is. Abstract training that covers allergens in general terms but never references your actual kitchen, your actual products, or your actual risks will not be sufficient to protect a customer with a serious allergy.
Keep a record of every training session, including who attended, what was covered, and when it took place. If an allergen incident ever occurs, this documentation forms part of your defence that you took reasonable precautions. It also helps you identify gaps — if a particular team member has not completed refresher training since a menu update, your records will flag that before it becomes a problem rather than after.
Step 7: Review Your Supplier Information Regularly
Your risk assessment is only as accurate as the ingredient information it is based on. Suppliers change their formulations, manufacturing sites, and ingredient sources without always issuing a formal notification. A sauce that was gluten-free when you first listed it on your menu may no longer be following a supplier factory change, and if you have not checked recently, your risk assessment will not reflect that reality.
Build a formal schedule for reviewing your supplier specifications — at minimum once per year, and immediately whenever a supplier notifies you of a change. Request up-to-date technical data sheets or allergen declarations directly from your suppliers rather than relying on older documentation or product packaging alone. For high-risk ingredients — those that sit close to a known allergen risk point in your kitchen — consider requesting written confirmation of any changes as part of your supplier agreement.
Pay particular attention to ingredients labelled with precautionary allergen statements such as "may contain" or "produced in a facility that also handles." These statements indicate a manufacturing-level cross-contact risk that your own kitchen controls cannot eliminate. If a product arrives with a new "may contain" declaration that was not there previously, you need to review whether it can still be used in the same way, or whether your product labelling and customer communication needs to be updated immediately.
Step 8: Apply Your Risk Assessment to Online Product Listings
Food businesses selling through an online store — including Shopify — carry the same allergen labelling obligations as those selling in person. Your risk assessment should directly inform what allergen information appears on each product page, and the two need to stay in sync. If your risk assessment identifies a new cross-contact risk with a particular allergen, that information needs to be reflected in your online listings promptly, not at your next scheduled review.
For prepacked food sold online in the UK, Natasha's Law requires full ingredient lists and allergen emphasis on packaging. But your online product description also serves as a first point of information for customers with allergies who are deciding whether to purchase. Clear, accurate allergen information at the point of sale reduces the likelihood of a customer receiving a product that triggers a reaction and reduces the liability risk to your business. Vague language such as "may contain various allergens" is not sufficient and is likely to frustrate allergy-aware customers rather than reassure them.
Using a tool like Allergen Matrix allows you to manage your allergen data centrally and push accurate information through to your Shopify product pages at scale. Rather than manually updating each listing every time a recipe or supplier specification changes, you maintain a single source of truth that feeds through to your storefront. This significantly reduces the risk of your online information falling out of step with your actual kitchen risk assessment, which is one of the most common and most dangerous gaps food businesses face.
Step 9: Handle Customer Allergen Enquiries as Part of Your Risk Process
Customer allergen enquiries are not just a customer service matter — they are a critical part of your allergen risk management process. When a customer contacts you to ask whether a product is safe for someone with a specific allergy, your response needs to be grounded in your risk assessment, not a best guess or a reassurance given to avoid a difficult conversation. A well-documented risk assessment makes it possible to give accurate, confident answers to allergen questions rather than vague or inconsistent ones.
Establish a clear internal protocol for handling allergen enquiries. Designate who in your business is authorised to respond to allergen questions, and ensure they have access to your current risk assessment documentation and supplier specifications. If you are not able to confirm that a product is safe for a particular allergen — because of a cross-contact risk identified in your assessment, for example — say so clearly. It is far better to lose a sale than to provide inaccurate reassurance that results in an allergic reaction.
Document allergen enquiries and your responses where possible. This record-keeping creates a useful feedback loop: if you are regularly receiving the same question about a particular allergen on a particular product, that is a signal that your product labelling or online descriptions may not be communicating the risk clearly enough. Use that information to improve your listings and your risk assessment documentation, so that customers with allergies have the information they need before they even need to contact you.
Step 10: Conduct a Periodic Full Review of Your Risk Assessment
A risk assessment is a living document, not a one-time task. Beyond the trigger-based reviews mentioned in Step 5 — new ingredients, recipe changes, new equipment — you should schedule a full, structured review of your entire risk assessment at regular intervals. For most food businesses, an annual review is a reasonable minimum, though businesses with high product turnover or complex kitchens may benefit from reviewing more frequently.
A full review involves going back to Step 1 and working through the entire process again with fresh eyes. Ingredients that have been on your list for years may now be sourced differently, prepared differently, or combined with new products that create risks that did not previously exist. Kitchen workflows evolve over time, and controls that were adequate when you first documented them may have drifted in practice. A periodic review catches these cumulative changes before they create an unmanaged gap in your allergen controls.
Use your full review as an opportunity to audit your documentation as well as your physical processes. Check that your training records are current, that your supplier specifications are up to date, that your online product listings accurately reflect your risk assessment findings, and that any incidents or near-misses since your last review have been formally incorporated into your controls. A thorough, well-documented review is strong evidence of due diligence — and for any food business selling to the public, that due diligence is not optional.
Try Allergen Matrix free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.