Allergen Risk Assessment: How to Identify and Control Risks

Running a food business means managing hundreds of moving parts every single day — suppliers, recipes, staff, equipment, and customers with needs you cannot afford to overlook. Among those moving parts, allergen management sits in a category of its own, because a single mistake can send a customer to hospital or worse. Yet many food business owners still treat allergen control as a labelling exercise rather than a structured risk management process. They list ingredients on a product page, tick a compliance box, and move on. That approach is not only dangerous — in the UK it is increasingly illegal, and in the US it exposes you to serious liability under the Food Allergen Labeling and Consumer Protection Act.

The real problem is that allergen risk does not live only in your finished product. It lives in your supply chain, your kitchen workflow, your staff training records, your packaging process, and your customer communications. Each of those areas is a potential failure point, and most small food businesses have never mapped them systematically.

This post walks you through a practical allergen risk assessment framework: how to identify where allergen risks exist in your operation, how to evaluate their severity, and how to put controls in place that actually hold up under scrutiny. Whether you are a bakery selling through Shopify or a meal kit brand shipping nationally, the principles here apply directly to your business.

What Is an Allergen Risk Assessment — and Why Does It Matter?

An allergen risk assessment is a structured process for identifying every point in your operation where an allergen could cause harm to a customer, and then deciding what you will do about it. It is not simply a list of ingredients — it is a documented analysis of hazards, likelihood, severity, and controls. In the UK, Natasha's Law (enforced since October 2021) requires pre-packed for direct sale food to carry full ingredient and allergen labelling, and the Food Standards Agency expects businesses to have evidence of how they manage allergen risk. In the US, the FDA requires disclosure of the nine major food allergens on packaged food labels, with sesame added to that list in 2023.

Beyond legal compliance, a risk assessment gives you operational clarity. When you know exactly where peanut contamination could enter your process — through a shared scooping tool, a mislabelled supplier bag, or a member of staff who forgot to change gloves — you can design controls that prevent it. Without that map, you are reacting to incidents rather than preventing them, which is a much more expensive and dangerous way to operate.

For food businesses selling through Shopify, the stakes are compounded by scale. A product page viewed by ten thousand people carries allergen information that needs to be accurate for every single one of those customers. If your supplier changes a recipe and you do not catch it, that outdated information is live on your store, potentially reaching someone with a life-threatening allergy. A risk assessment process ensures you have systems in place to catch those changes before they reach your customers.

Step One: Identify the Allergens Present in Your Operation

The first step in any allergen risk assessment is building a complete picture of every allergen present in your facility, even in products that are not themselves allergenic. In the UK, the 14 major allergens regulated under UK Food Information Regulations include celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame, soybeans, and sulphur dioxide. In the US, the nine major allergens are milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame. Your starting point is a thorough audit of every ingredient that enters your premises.

Request full ingredient specifications from every supplier, not just their marketing descriptions. Suppliers can and do change formulations without proactively notifying customers, so build a review process into your procurement cycle — at minimum, recheck specifications every six months or when a supplier issues a new batch. Create a master allergen matrix that maps every ingredient to the allergens it contains or may contain, including "may contain" statements from your suppliers, which signal cross-contact risk in their own facilities.

Once you have your ingredient-level data, overlay it with your product recipes. Which products contain which allergens? Which products share production lines or preparation surfaces with allergenic products? Which products are marketed as free-from, and are those claims actually supported by your processes and supplier data? This inventory gives you the raw material for the rest of your assessment — without it, you are guessing.

Step Two: Map Your Cross-Contact Risk Points

Cross-contact — the unintentional transfer of an allergen from one food to another — is responsible for the majority of serious allergen incidents in food businesses. Unlike cross-contamination with pathogens, cross-contact cannot be eliminated by cooking, so prevention at the source is the only effective strategy. Mapping your cross-contact risk points means following the physical journey of allergenic ingredients through your operation, from goods-in to dispatch.

Start with your goods-in area. Are allergenic and non-allergenic ingredients stored in clearly labelled, separate containers? Are bulk ingredients scooped with dedicated utensils, or is the same scoop used across multiple bins? Move through to preparation areas: are surfaces cleaned between allergenic and non-allergenic production runs, and can you demonstrate what that cleaning procedure involves and how long it takes? These are the kinds of questions a food safety auditor will ask, and you need documented answers.

Packaging and dispatch are often overlooked risk points. If you pack a nut-containing product and then pack a nut-free product on the same bench without a cleaning protocol, you have a cross-contact risk even if the two products never share an ingredient. For Shopify businesses fulfilling orders from a home kitchen or small commercial unit, this is especially relevant — the physical space is limited, and the temptation to cut corners on cleaning between runs is real. Map every touchpoint, and assign a risk rating to each one.

Step Three: Evaluate the Severity and Likelihood of Each Risk

Not all allergen risks are equal. A risk assessment needs to evaluate both the likelihood of a hazard occurring and the severity of the outcome if it does. A useful framework is a simple 3x3 risk matrix: score each risk point on likelihood (low, medium, high) and severity (low, medium, high), and multiply the scores to prioritise where your controls need to be strongest.

Severity in allergen risk is almost always high for the 14 UK or 9 US major allergens, because reactions can range from hives to anaphylaxis. That means your risk score will be driven primarily by likelihood — how probable is it that this cross-contact or mislabelling event actually occurs? Likelihood is shaped by factors like the frequency of the activity, the complexity of the task, staff training levels, and the physical setup of your workspace. A business running dedicated allergen-free production lines has lower likelihood scores than one running mixed production on shared equipment.

Document your scoring decisions with evidence, not just intuition. If you rate a risk as low likelihood because staff are trained, you need training records to back that up. If you rate a risk as low likelihood because equipment is dedicated, you need labelling and SOPs to support it. This documentation is what transforms a risk assessment from a paper exercise into a defensible compliance record that protects your business in the event of a complaint or investigation.

Step Four: Implement and Document Your Controls

Control measures are the practical steps you take to reduce allergen risk to an acceptable level. They fall into three broad categories: physical controls (dedicated equipment, separate storage, colour-coded utensils), procedural controls (cleaning protocols, production scheduling, goods-in checks), and management controls (staff training, supplier approval processes, labelling verification). Effective allergen management typically requires controls from all three categories working together.

For food businesses selling on Shopify, digital controls matter just as much as physical ones. Your product listings, ingredient pages, and allergen statements need to be connected to a live data source so that when a recipe or supplier specification changes, your customer-facing information updates accordingly. Tools like Allergen Matrix are designed specifically for this kind of operational integration — giving you a structured way to manage allergen data across your product catalogue and keep your Shopify store accurate in real time.

Review your controls regularly, and record those reviews. A control that worked six months ago may be inadequate today if you have launched new products, taken on a new supplier, or hired staff who were not part of the original training programme. Schedule a formal allergen risk assessment review at least annually, and trigger an ad hoc review any time there is a significant change to your ingredients, processes, or team.

Step Five: Train Your Team and Maintain Your Records

Even the best-designed control system will fail if the people implementing it do not understand why it matters. Allergen training needs to go beyond "these are the 14 allergens" — it needs to give staff a clear understanding of cross-contact, the consequences of errors, and exactly what they are responsible for in their specific role. A packer needs different training to a chef, and a customer service agent handling allergen queries needs different training again.

In the UK, the Food Standards Agency recommends that all staff handling food receive allergen awareness training, and that records are kept. There is no prescribed format, but training records should capture who was trained, when, by whom, and what the training covered. In the US, the FDA Food Safety Modernization Act requires that qualified individuals oversee food safety plans, and allergen control is a key component of those plans. Training documentation is a central piece of evidence in any regulatory inspection or legal proceeding.

For small Shopify food businesses, training often happens informally — a verbal walk-through when someone starts, rather than a documented programme. That approach will not withstand scrutiny. Create simple written training materials, require staff to sign that they have read and understood them, and keep those records somewhere you can retrieve them quickly. It takes a few hours to set up properly, and it provides genuine protection for your business and your customers.

Conclusion

Allergen risk assessment is not a one-time task — it is an ongoing operational discipline that sits at the heart of responsible food business management. The framework covered here gives you a clear path: inventory your allergens, map your cross-contact risk points, score those risks systematically, implement layered controls, and back everything up with staff training and documentation. Each of these steps builds on the last, and together they create a system that is both legally defensible and genuinely protective of your customers.

The key takeaways are simple: know every allergen in your operation, control every point where cross-contact could occur, and keep records that prove you have done so. For Shopify food businesses, that means connecting your physical controls to your digital product information so that customers always see accurate allergen data. Your next step is to audit your current processes against this framework and identify your highest-priority gaps.

Try Allergen Matrix free at saltai.app — no credit card required.