Introduction
Bakeries operate under a more complex food safety burden than most food categories. A single production line can simultaneously generate combustible flour dust, harbor persistent pathogens in cooling zones, and process five of the nine major allergens—often on shared equipment. Since 2009, flour-linked outbreaks have caused 168 known illnesses and 20 hospitalizations, and bakery products consistently lead all food categories in allergen recalls.
Process Hazard Analysis (PHA) gives bakery operators a systematic framework to identify, evaluate, and control these risks before they result in contamination events, product recalls, or regulatory action. It forms the analytical backbone of any compliant food safety program and provides the structured hazard identification required under FSMA.
Conducted early in facility design or line planning, PHA allows operators to eliminate hazards at the source—through layout, equipment selection, and airflow decisions—rather than layering controls onto problems that are already built in.
Summary
- PHA systematically identifies biological, chemical, physical, and allergen hazards across every bakery production stage
- Bakeries face unique hazard combinations: raw flour pathogens, post-bake Listeria risk, allergen cross-contact, and combustible dust
- Six steps define the PHA process: team assembly, process mapping, hazard identification, risk assessment, control determination, and documentation
- PHA and HACCP work in sequence: PHA identifies and evaluates the hazards; HACCP puts the controls in place
- Facility design directly impacts hazard severity—early A&E engagement reduces the number of CCPs requiring operational management
What Is Process Hazard Analysis in Food Manufacturing?
Process Hazard Analysis is a systematic review of each step in food production to identify hazards — biological, chemical, physical, and allergen-related — that could compromise product safety if left uncontrolled. It applies during facility and process design and continues as an ongoing operational tool, answering the same question at every production step: what could go wrong, and how severe would the impact be?
PHA and HACCP: Different Tools, Shared Goal
PHA and HACCP are not interchangeable. Under 21 CFR 117.130, PHA is the analytical layer that identifies hazards and evaluates their significance based on severity and probability. HACCP is the operational management system—built on seven principles—that puts controls, monitoring, and corrective actions in place based on PHA findings. PHA diagnoses the risks; HACCP prescribes the response. One cannot function effectively without the other.
The 2020 Codex HACCP revision reinforces this relationship. Principle 1 now explicitly states: "Conduct a hazard analysis and identify control measures." PHA delivers both components.
Common PHA Methods
Food processors use several PHA approaches depending on complexity:
- What-If Analysis: Simple and flexible, well-suited for smaller bakeries or single-product lines
- HAZOP (Hazard and Operability Study): A structured, node-based method for complex multi-line operations
- FMEA (Failure Mode and Effects Analysis): Assigns quantitative risk scores to prioritize hazards by severity and likelihood
- Checklist-Based Reviews: Regulatory compliance audits using standardized templates, often used for FSMA readiness
Most small to mid-sized bakeries use What-If or checklist methods. Larger facilities with automated production lines benefit from HAZOP or FMEA rigor.
Key Hazards in Bakery Processing
Biological Hazards
Bakeries face three major biological threats:
Salmonella and E. coli in raw flour. The FDA confirms that flour is a raw food harboring Salmonella and pathogenic E. coli—processing raw grains into flour does not kill harmful bacteria. In 2016, a multistate outbreak linked to General Mills flour caused 63 illnesses across 24 states, including 17 hospitalizations. A 2023 outbreak resulted in 14 illnesses and 3 hospitalizations.
Listeria monocytogenes in post-bake environments. Baking is a validated kill step, but post-bake cooling and packaging zones reintroduce risk. In January 2025, FGF LLC recalled over 2 million baked goods—donuts, fritters, pastries—due to potential Listeria contamination. Listeria colonizes wet cleaning zones, condensate harborage points, and ambient-temperature packaging areas where open products are most vulnerable.
Bacillus cereus in starch-rich environments. B. cereus forms heat-resistant spores that survive baking temperatures. The emetic toxin it produces is also heat-stable, making pastries and starch-heavy bakery items recognized risk foods.
Chemical and Allergen Hazards
Bakeries commonly use five of the nine major allergens regulated under FALCPA and the FASTER Act: wheat, milk, eggs, tree nuts, and peanuts (sesame became the ninth allergen on January 1, 2023). FDA data shows that bakery products are the #1 food type involved in allergen recalls, with undeclared milk the most common trigger.
Cross-contact occurs through:
- Shared mixers, bowls, and utensils without validated cleaning
- Airborne flour dust settling on allergen-free products
- Inaccurate ingredient labels or changeover failures
Chemical hazards include:
- Cleaning agent residues left on food-contact surfaces after sanitation
- Food-grade lubricants migrating from equipment bearings and moving parts
- Pesticide residues carried in raw grain ingredients
Physical Hazards
Metal fragments from worn mixer blades, slicers, and scoring equipment are the most common physical hazard. Others include:
- Bone or shell fragments introduced through eggs or nut-based ingredients
- Glass from overhead lighting or equipment gauge covers
- Packaging material fragments and hardened dough buildup that breaks free during production
Flour dust accumulation presents two distinct risks: product contamination and combustible dust ignition. OSHA regulation 29 CFR 1910.263 requires flour sifter enclosures to be dust-tight, and NFPA 652 mandates Dust Hazard Analysis for facilities handling combustible dusts.
How to Conduct a Process Hazard Analysis for Your Bakery
PHA works best as a living process, not a one-time compliance exercise. The most common failure is conducting the analysis after facility and production lines are already fixed, making retrofits costly and incomplete.
Step 1 – Assemble the PHA Team
Form a cross-functional team that includes:
- Production management
- Quality assurance
- Sanitation and environmental services
- Maintenance and engineering
- An outside technical advisor or Preventive Controls Qualified Individual (PCQI)
Team diversity is critical. Hazards at the maintenance or sanitation stage—lubricant leaks, wet cleaning schedules, condensate accumulation—are often invisible to production-only teams.
Step 2 – Map the Full Process Flow
Create a detailed process flow diagram covering every step:
- Raw material receiving and ingredient storage
- Mixing, proofing, baking
- Cooling, slicing, packaging
- Metal detection and shipping
Include inputs (ingredients, packaging, cleaning chemicals, water), transfers between zones, and holding conditions (temperature, humidity, time) at each step. That completed map is what you'll walk step-by-step in Step 3 to surface hazards.
Step 3 – Identify Potential Hazards at Each Process Step
At each step on the process flow diagram, ask: what biological, chemical, physical, or allergen hazard could be introduced, increased, or fail to be eliminated here?
Examples:
- Receiving — Biological hazard: Salmonella in raw flour; Physical hazard: stones from grain harvest
- Mixing — Allergen hazard: cross-contact from shared bowl; Chemical hazard: lubricant from mixer gearbox
- Baking — Physical hazard: metal fragment from oven belt or scoring blade
- Cooling — Biological hazard: Listeria harborage from condensate or ambient air exposure
- Packaging — Allergen hazard: incorrect label on finished product
Step 4 – Assess Risk (Likelihood × Severity)
Under 21 CFR 117.130(c), hazard evaluation must assess the severity of illness or injury if the hazard occurs and the probability it will occur absent preventive controls.
Assign each identified hazard a risk score using a simple matrix (typically 3×3 or 5×5). This scoring determines which hazards are "significant" and require formal control measures versus those managed adequately by Good Manufacturing Practices (GMPs) and prerequisite programs alone.
Step 5 – Determine Critical Control Points and Preventive Controls
Significant hazards identified in Step 4 are candidates for Critical Control Points (CCPs) or preventive controls. A step is a CCP if it is the specific point where a control measure can prevent, eliminate, or reduce a hazard to an acceptable level and no subsequent step will do so.
Bakery-relevant CCP examples:
- Baking — Time/temperature as the biological kill step for pathogens (validated to achieve 5-log reduction)
- Metal detection — Physical hazard CCP with defined sensitivity limits
- Allergen changeover cleaning — Verification swab testing using allergen-specific ELISA kits
Per 21 CFR 117, not all preventive controls are CCPs. Allergen controls and sanitation controls may function as preventive controls without being designated CCPs.
Step 6 – Establish Monitoring, Corrective Actions, and Documentation
For each CCP or preventive control, define:
- The parameter being monitored (such as oven core temperature)
- The method used (calibrated probe, visual check)
- The monitoring frequency (continuous, per batch, or daily)
- The responsible party (line operator, QA technician)
Establish corrective actions for any deviation — for instance, product hold and oven recalibration when bake temperatures fall short. Documentation (logs, calibration records, deviation reports) is both a legal requirement under FSMA and the foundation for continuous improvement.
Verification (confirming the system works) and validation (proving the control measure is effective) must also be built in. The FDA Draft Guidance Chapter 6 cites a study showing baking at 350°F for 13 minutes achieves at least a 5.2-log Salmonella reduction in peanut butter cookies. Your validation must be product- and process-specific.
PHA for Bakeries: A Practical Walkthrough
This walkthrough follows a simplified bread production line through the PHA process. Actual bakery PHAs are more detailed and product-specific, but this illustrates the logic.
Receiving and Storage
Hazard identified: Incoming raw flour is a biological hazard source (Salmonella, E. coli).
Risk assessment: High severity/medium likelihood.
Control measure: Approved supplier program, Certificate of Analysis review, and dry storage segregation from ready-to-eat ingredients. This is managed by a prerequisite program, not a CCP.
Mixing and Allergen Handling
Hazard identified: Allergen cross-contact when switching between allergen-containing and allergen-free product runs.
Control measure: Defined cleaning and sanitation procedure between runs with allergen swab verification using ELISA kits (not ATP swabs). AIB International recommends targeting the hardest-to-clean surfaces.
This is a common gap bakeries underestimate and a likely Allergen Control Point or CCP. The FDA warning letter to Breadbox Co. cited a mixer cleaned only by scraping and wiping, leaving visible yellow residue before use on a product without those allergens. Sesame seeds were found embedded in breadstick surfaces not formulated with sesame.
Baking and Post-Bake Stages
Baking is the primary biological hazard CCP — the kill step. Define critical limits (for example, internal product temperature reaching a validated minimum), monitor with calibrated probes, and establish corrective actions for deviations.
Post-bake cooling is where re-contamination risk peaks. Listeria thrives here because open product is exposed in humid environments where condensate, inadequate airflow, and poor zone separation combine to create ideal harborage conditions. Facility design decisions at this stage carry the greatest weight:
- Directional airflow from high-care to low-care zones
- Physical separation between baked and unbaked product areas
- Sanitary surface specifications that resist moisture and biofilm accumulation
Packaging and Metal Detection
Metal detection is a physical hazard CCP. Critical limits are set based on the smallest detectable fragment size, and corrective action requires automatic reject plus root cause investigation — not just product hold.
Packaging label accuracy — specifically allergen declarations — is a control point that PHA teams frequently miss, and it's a leading cause of recalls. The FDA warning letter to Bimbo Bakeries cited Sara Lee bread products listing sesame, walnuts, almonds, and hazelnuts that were not in the formulations.
How Hixson Supports Safer Bakery Facility Design
Many of the hazard control challenges uncovered in a PHA are fundamentally facility design problems: post-bake contamination zones, allergen cross-contact between production areas, condensation-driven mold harborage, and inadequate equipment cleanability. When layout, material flows, and environmental controls are designed with PHA outcomes in mind from the start, the number of critical control points a bakery must manage operationally is significantly reduced.
With over 75 years of experience designing food manufacturing facilities, Hixson's integrated team of architects, process engineers, and controls specialists translates PHA findings directly into facility design decisions:
- Zone separation between raw and ready-to-eat areas to prevent cross-contamination
- Sanitary surface specifications that eliminate harborage points and support effective cleaning
- Ventilation design to manage condensate and flour dust, reducing both food safety and combustible dust risks
- Hygienic equipment layout that supports changeover cleaning and minimizes allergen cross-contact
Hixson's 20 in-house technical disciplines work collaboratively under one roof, enabling real-time coordination when a PHA identifies multi-discipline gaps. If a PHA reveals inadequate airflow separation between cooling and packaging zones, for example, MEP engineers, process engineers, and architects can develop an integrated solution together: adjusting HVAC design, revising zone boundaries, and specifying equipment placement without the delays common in multi-vendor coordination.
Engaging an A&E partner before production lines are fixed allows PHA results to shape capital decisions rather than trigger costly retrofits later. Bakery operators planning new construction, expansion, or line additions can contact Hixson to discuss how food safety planning and facility design can be aligned from day one.
Frequently Asked Questions
What is a hazard analysis in food processing?
A hazard analysis is a systematic evaluation of each step in food production to identify biological, chemical, physical, and allergen hazards that could harm consumers. It determines which hazards require formal control measures based on severity and likelihood of occurrence.
What are the hazards in the bakery industry?
Bakery hazards fall into four categories: biological (Salmonella in raw flour, Listeria in post-bake environments), chemical (cleaning residues, inadvertent contaminants), physical (metal fragments, bone/shell), and allergen cross-contact — treated separately given its frequency and regulatory weight.
What are the 7 steps of hazard analysis?
The seven HACCP principles are:
- Conduct hazard analysis
- Identify critical control points (CCPs)
- Establish critical limits
- Establish monitoring systems
- Establish corrective actions
- Establish verification procedures
- Establish documentation and recordkeeping
PHA serves as the analytical foundation that feeds into this framework.
What are the methods of process hazard analysis?
The main PHA methods used in food manufacturing are What-If Analysis, HAZOP, FMEA, and checklist-based review. Bakeries typically use What-If or checklist approaches for smaller operations and HAZOP or FMEA for complex production lines.
Is HACCP the same as process hazard analysis?
No. PHA is the analytical process used to identify and evaluate hazards. HACCP is the formal management system built on those findings — establishing controls, monitoring protocols, and corrective actions.
How often should a bakery update its process hazard analysis?
A PHA should be reviewed after any significant change — new ingredients, equipment, process steps, product lines, or facility modifications. At minimum, review it annually as part of HACCP system verification.
