Food Safety Magazine

Ask the Regulators | December 2001/January 2002

Microbial Risk Assessment: Achievements and Future Challenges

By Sherri B. Dennis, Ph.D., Robert L. Buchanan, Ph.D., and Arthur J. Miller, Ph.D.

Microbial Risk Assessment: Achievements and Future Challenges

The primary mission of the U.S. Food and Drug Administration’s Center for Food Safety and Applied Nutrition (FDA CFSAN) is to safeguard public health by ensuring the safety of food products in the United States. To accomplish this goal, we increasingly rely on a risk analysis approach to enhance the scientific basis of regulatory decisions, evaluate risk management options and implement food safety programs.

The World Health Organization (WHO) describes risk analysis as a process composed of three elements—risk assessment, risk management and risk communication.[1] Risk assessment includes using scientific information to describe the likelihood and magnitude of harm attributed to a specific hazard. Risk management includes all activities undertaken to control a hazard. Risk communication is the exchange of information and opinions about a hazard among concerned parties. Risk analysis is accomplished through the efforts of separate but integrated assessment, management and communication teams.

The interrelationships among these components of risk analysis are illustrated with three overlapping circles (Figure 1). Although separation of assessment and management activities maintains scientific integrity and helps to ensure that the results are not biased by political pressures, active interaction is equally important so that the risk assessment is responsive to the needs of the risk manager.[2]

While FDA has more than 30 years of experience conducting and using safety and risk assessments for food additives and chemical contaminants, only recently have we begun to apply these techniques to microbial food safety issues.[3] With the application of innovative approaches, quantitative microbial risk assessment (QMRA) is emerging as an important discipline for addressing complex food safety problems. This approach combines existing laboratory and surveillance databases with computational techniques to yield models that predict public health outcomes. Simply stated, QMRA answers three questions:

1. What can go wrong?

2. How likely is it to happen?

3. What are the consequences should the unwanted event occur?

Microbial risk assessment is a process used to evaluate the likelihood of adverse human health effects occurring after exposure to a pathogenic microorganism. In a quantitative risk assessment, the risk is expressed as a mathematical statement of the chance of illness (or other outcome) after exposure to the pathogen, and it represents the cumulative probabilities of specific events and the uncertainty of those events.

In 1995, a joint consultation of WHO and the Food and Agriculture Organization (FAO) of the United Nations on the application of risk analysis to food standards issues stated that “risk assessment techniques for microbial food safety issues are not likely to be available in the near term.”[1] By that time, research in predictive microbiology had been active for about 10 years and these techniques were beginning to be applied to microbiological food safety issues.[4] Increased awareness and support for the use of risk assessment to address food safety problems was bolstered by the 1997 interagency report to the President, “Food Safety From Farm to Table—A National Food Safety Initiative.”[5] The Food Safety Initiative (FSI) was instrumental in providing much needed political and financial support to improve microbial risk assessment capabilities and the initiation of research.

The theoretical became a reality in 1998 when the first formal QMRA, “Salmonella Enteritidis in Eggs,” was published by a U.S. regulatory agency.[6] Two years later, FDA’s Center for Veterinary Medicine released a risk assessment on the human health impact of fluoroquinolone resistant Campylobacter associated with the consumption of chicken.[7] In January 2001, CFSAN issued two draft risk assessments for public comment: Listeria monocytogenes in ready-to-eat foods and Vibrio parahaemolyticus in raw oysters.[8,9] Another QMRA, USDA’s Escherichia coli O157:H7 in ground beef risk assessment, is currently undergoing peer review by the National Academy of Sciences.[10] Scientists from the U.S. are also actively participating in international efforts to use QMRA to examine the risk of microbial hazards in imported foods. Reports from the WHO/FAO expert consultations on risk assessment of microbiological hazards are available ( These microbial risk assessments are playing an increasingly important role in the deliberations of international standard-setting bodies such as Codex Alimentarius.

How were we able to advance this field so quickly? In addition to the increased national and international interest in risk assessment, there were technological advancements. The proliferation of personal computers with sufficient memory and speed to allow desktop calculations of complex mathematical models cannot be overlooked. Another technology that helped to advance QMRA is the availability of commercial software and other modeling tools that allow risk assessors to solve complex problems by simulation instead of deriving and solving complex algebraic equations.[11] Third, there has been increased interest and funding of research to generate the type of data needed for QMRA. A complete list of CFSAN’s FSI research and risk assessment activities is available at[12]

The generally accepted framework separates risk assessments into four components: hazard identification, exposure assessment, dose-response assessment and risk characterization. These components are used in a five-step process to format scientific data in a computer compatible manner to answer key risk management questions.[13]

Step 1. Statement of the problem. A risk assessment is conducted to help answer a risk management problem. Therefore, it is the responsibility of the risk managers to develop and provide risk assessors with the question(s) to be answered and the key assumptions that define the scope of the work. Developing the statement of the problem is begun during the planning of the assessment and is refined as the risk assessors and risk managers meet to discuss the need for the assessment.

Step 2. Hazard identification. This step includes gathering information about the pathogen, its presence in foods and the adverse outcome (illness or death) associated with consumption of contaminated foods.

Step 3. Exposure assessment. The purpose of the exposure assessment is to provide an estimate of the levels of the pathogen consumed.  This includes the probability that the pathogen will be present in the commodity, the levels of the pathogen in the food consumed and th impact of food handling, processing and storage conditions on the overall potential exposure.

Step 4. Dose-response assessment (or hazard characterization). In this step, the relationship between the exposure level (dose) and frequency of illness or other adverse effect (response) is estimated.  The severity of the health effect also must be considered.  This often includes the challenge of attempting to extrapolate data acquired from animal models to humans.

Step 5. Risk characterization. This step combines the findings of prior steps to determine the likelihood of the adverse outcome from exposure to the pathogen (i.e., consumption of a food). In this step, the exposure and dose- response assessments are integrated to mathematically express the probability of the effect on public health. An important part of this step is to determine the degree of uncertainty in relation to the results and to distinguish this from the variation that is inherent in any biological system. The results of the risk characterization are generally interpreted by the risk assessors so that they effectively communicate the information needed by the risk manager.

Communication is a key element to successfully conduct a risk assessment within a risk analysis framework. The overlapping portions of the purple and blue circles in Figure 1 represent the interaction (communication) between risk assessors and risk managers. Risk management activities, such as conducting an assessment of intervention or control options, are represented by the purple area and the blue area represents the conduct of the risk assessment, including gathering data and developing the mathematical model. Where the risk management and risk assessment circles overlap (yellow area) there is an exchange of information between the two teams. For example, this interaction is needed to develop specific assumptions to use in the risk assessment model when definitive data are lacking. While the risk manager has responsibility to formulate the questions and the risk assessor to answer the questions and be responsive to the needs of risk management, the risk assessor also has responsibility to explain how assumptions affect the results, including the level of uncertainty in the risk estimate.

The need for exchange of information and opinions also extends beyond the risk assessment and risk management teams to stakeholders including consumers, industry and other interested parties. Through Federal Register notices and public meetings, CFSAN invites public comment on planned assessments and encourages submission of scientific data and information that would improve the risk assessment. CFSAN also seeks the advice and opinions of advisory committees and solicits peer review from experts within and outside of the agency. As part of its commitment to use the best information available, CFSAN issues draft risk assessment documents for public review and comment. Our risk assessments are also posted on the Internet at and printed copies are available via fax request at (877) 366-3322.

Risk assessment of complex topics should be an iterative process, requiring collaboration between the various risk analysis teams and other interested organizations and individuals. As the risk analysis teams actively exchange information and ideas and collaborate on decisions, the objective, assumptions, and data used in the risk assessment will be continually refined. A continuous dialogue helps to ensure that the risk managers’ expectations about the use of the risk assessment results are met and are understood by all participants. An iterative approach also encourages the use of the risk assessment model as a tool for risk managers to focus regulatory efforts, identify special concerns, develop food safety standards, and evaluate potential intervention strategies.[14]

Risk assessment models can be continually improved, and the uncertainty in the model may be reduced when new data or modeling techniques become available. Incorporating new data to replace incomplete datasets can strengthen the power of the predictions. However, this makes it difficult to know when the risk assessor should stop and give the results to the risk manager. As additional scientific knowledge about the hazard, additional exposure or dose- response data, or improved modeling techniques become available, the assessment and its conclusions may have to be reevaluated or updated. Thus, a risk assessment as a snapshot of the risk associated with a hazard will have a life span after which time it may need to be reevaluated.

Transparency also is a critical part of conducting risk assessment. It includes stating any biases that impact the risk assessment, and clearly and concisely documenting the assessment. All assumptions used in the assessment, the model structure and calculations, and the scientific rationale and data used to estimate the impact of the various factors influencing the risk must be clearly stated. In attempting to provide all of the information used in the risk assessment model, the resulting documents tend to be lengthy and technical. Documents lack transparency if they are so technical that only a few experts can understand them. Therefore, CFSAN also prepares an interpretive summary as a companion to the technical report; it is written for non-scientists and provides a non-technical explanation of the assessment process, results and conclusions.

Research. Research specifically designed to provide data to be used in quantitative risk assessments is needed. For example, the majority of the published data on the occurrence of Listeria monocytogenes (Lm) in foods is reported as either presence or absence. For QMRA, the level of Lm in food on a per gram basis, not just the presence, is needed. A new study conducted by the National Food Processors Association (NFPA) Research Foundation will provide exactly this type of data for ready-to-eat food samples collected at retail.[15] Comprehensive, up-to-date data sets of contamination and growth data for specific microorganisms are needed and ideally should be made available to risk assessors through the Internet.

An important aspect of risk assessment is determining the degree of uncertainty in relation to the results and distinguishing this from the variation that is inherent in any biological system. One way to decrease uncertainty is to conduct research. However, this does not mean that if one collects enough data that a single, “right” value will be reached. One of the challenges in using a risk analysis approach is that an “accurate” risk assessment captures the variability inherent in the food safety system instead of generating a single value.

Better modeling tools. In the future it may be possible to have an electronic “bookshelf” of model components or modules to select and use in risk assessments in combinations as needed to answer a specific problem. The USDA/ARS “Pathogen Modeling Program” is one example of a stand-alone module that has been incorporated into QMRA models. Other modules that could be developed include dose-response for specific pathogens, thermal inactivation and intervention. This approach will be difficult for process models because there is a need to tailor a model to the specific situation to allow useful prediction within the limitations of the available data.[16] However, individual unit operations could be modeled and eventually linked.

Education. Scientists and researchers need to better understand how data are used in risk assessment so that future research efforts are targeted and meet the needs of risk assessment modeling. One example of an effort to provide training in fundamental approaches used in risk analysis is a new professional development program being sponsored by CFSAN’s Staff College and the Joint Institute for Food Safety and Applied Nutrition (JIFSAN). JIFSAN was established between FDA and the University of Maryland in April 1996 to provide research and educational programs on food safety (

Communication. Among the greatest challenges to the acceptance and advancement of microbial food safety risk assessment is the need to disseminate the tools and fundamental knowledge of risk assessment. To confront this challenge, there is a need to develop new outreach methods. The Internet, which is already proving to be an important resource for providing educational materials to a broad audience, can also be used to distribute modeling tools and data sets. The JIFSAN Food Safety Risk Analysis Clearinghouse ( is one example of how the Internet is used to promote microbial risk assessment. Information available so far on the Clearinghouse include:

• Database of cold temperatures of foods at retail outlets, during transport to the home, and in the home refrigerator or freezer.

• Database of cooking temperatures of a range of foods.

• A questionnaire template to obtain dose-response data from a foodborne disease outbreak.

• An on-line tutorial, “Introduction to the Monte Carlo Process.”

FDA looks forward to further improvements in modeling techniques and scientific information and the application of these advances to quantitatively assess microbial food safety problems.

Sherri B. Dennis, Ph.D., is the Risk Assessment Coordinator for the Office of Science, U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition (FDA/CFSAN). She is the project manager for the Listeria monocytogenes risk assessment and is actively involved in CFSAN’s extramural research activities associated with risk assessment.

Robert L. Buchanan, Ph.D., is the Senior Science Advisor for FDA/CFSAN and the Director of CFSAN’s Office of Science. He has more than 25 years experience teaching and conducting research in food safety and is an internationally recognized expert in microbiology and risk assessment.

Arthur J. Miller, Ph.D., is CFSAN’s Lead Scientist for Microbiology and the Associate Director for the Joint Institute for Food Safety and Applied Nutrition (JIFSAN). He is an internationally recognized leader in applying experimental and risk assessment approaches to the understanding of the behavior and control of foodborne hazards.

1. World Health Organization. Application of Risk Analysis to Food Standards Issues. A report of the Joint FAQ/WHO Expert consultation. Geneva, Switzerland. 1995. (
2. World Health Organization. The Interaction Between Assessors and Managers of Microbiological Hazards in Foods. A report of a WHO expert consultation. Kiel, Germany. 2000. (
3. Gaylor, D.W., et al. Health risk assessment practices in the U.S. Food and Drug Administration. Regulatory Toxicology and Pharmacology, (26), pp. 307-321. 1997.
4. Buchanan, R.L. and R.C. Whiting. Risk assessment and predictive microbiology. J. Food Protection Supplement, pp. 31-36. 1996.
5. National Food Safety Initiative. Food Safety from Farm to Table: A Report to the President. U.S. Environmental Protection Agency, U.S. Department of Health and Human Services, and the U.S. Department of Agriculture, Washington, DC. 1997.
6. U.S. Department of Agriculture’s Food Safety and Inspection Service. Salmonella Enteritidis Risk Assessment, Shell Eggs and Egg Products. Washington, DC. 1998.
7. U.S. Food and Drug Administration. Draft Risk Assessment on the Human Health Impact of Fluoroquinolone Resistant Campylobacter Associated with the Consumption of Chicken. 2000. (Revised Jan. 5, 2001.) (
8. U.S. Food and Drug Administration, and Food Safety and Inspection Service. Draft Assessment of the Relative Risk to Public Health from Foodborne Listeria monocytogenes Among Selected Categories of Ready-to-Eat Foods. 2001. (
9. U.S. Food and Drug Administration. Draft Risk Assessment on the Public Health Impact of Vibrio parahaemolyticus in Raw Molluscan Shellfish. 2001. (
10. Food Safety Inspection Service. Draft Risk Assessment of the Public Health Impact of Escherichia coli O157:H7 in Ground Beef. 2001. (
11. Vose, D.J. The application of quantitative risk assessment to microbial food safety. J. Food Protection, 61(5), pp. 640-648. 1998.
12. Center for Food Safety and Applied Nutrition. Research in Support of the National Food Safety Initiative and Produce and Imported Foods Safety Initiative. 2001. (
13. Buchanan, R.L. National Advisory Committee on Microbial Criteria for Foods “Principles of Risk Assessment for Illnesses Causes by Foodborne Biological Agents.” J. Food Protection 60(11), pp. 1417-1419. 1997.
14. Buchanan, R.L. and SB. Dennis. Microbial risk assessment: a tool for regulatory decision making. J. Association of Food and Drug Officials, 65(3), pp. 36-46. 2001.
15. Gombas, D. NFPA’s risk assessment: a team approach. NFPA Journal, 2(5), p. 16. 2001.
16. Whiting, R.C. and R.L. Buchanan. Predictive modeling and risk assessment. Food Microbiology: Fundamentals and Frontiers, 2nd Ed. ASM Press. Washington DC. 2001.


Categories: Contamination Control: Microbiological; Management: Best Practices, Risk Assessment