Building the HARA is not the hard part. The hard part is keeping it current. The study gets built once, with a lot of effort, for the first BRCGS Packaging Materials audit. Then the adhesive supplier changes, a new structure comes in, a customer starts hot filling, and the spreadsheet never finds out. When the annual review comes around, someone copies last year’s and changes the date.

This guide covers what the standard actually requires to maintain the HARA, why spreadsheets fall short, and what a HARA looks like when it lives inside your management system instead of a shared folder.

What the standard requires to maintain the HARA

In BRCGS Packaging Materials Issue 7 (audited since April 28, 2025), the HARA lives in section 2: 11 clauses, all at fundamental level. A major non-conformity there can cost you the certificate. For maintenance, what matters most is:

Review at least annually and before any change that affects the hazards or their controls (clause 2.10.3). Before, not after. The standard lists the triggers: raw materials, suppliers, composition, process, equipment, customer use, trends, emerging risks, verification results, audits, recalls and legislation.
Flow diagram verified on site at least once a year and whenever something changes.
Likelihood and severity assessed for every hazard, without counting additional controls, with justified acceptable levels.
Critical control measures (Issue 7’s term for what used to be CCPs) with validated limits, monitoring, corrective actions and validation before any change.
A multidisciplinary team led by a trained leader who can demonstrate competence.
Documentation that supports all of the above.

None of this is impossible in Excel. The problem is that in Excel everything depends on someone remembering.

Why spreadsheets fall short

These are the symptoms we see most in packaging plants that run their HARA in spreadsheets:

Versions that multiply. “HARA_final_v3_reviewed_JL.xlsx”. Nobody knows which one is approved or what changed between them.
A matrix without justification. There are severity and likelihood scores, but no reason behind them. The auditor asks and the answer is “it came like that”.
Hazards that connect to nothing. The study says a hazard is controlled by “the blade program”, but there is no way to jump to that program or see whether it was verified this month.
A review nobody triggers. The supplier change went through purchasing and quality, but the HARA never heard about it. Issue 7 requires reviewing before the change, and a spreadsheet does not send alerts.
A matrix you cannot change without breaking everything. If you adjust the scale, hazards assessed with the old one are left hanging.

What the HARA looks like in AdminISO

In AdminISO, the HARA has its own module, next to the HACCP that food plants use, designed for what BRCGS Packaging Materials asks for, starting with the vocabulary: in the HARA there are no CCPs, there are critical control measures.

Start with the HARA you already have in Excel

You do not have to enter your study from scratch. You upload the spreadsheet (Excel or CSV) and the AI builds a draft study with its steps, hazards and control measures. If your matrix rates from 1 to 3 or with High, Medium and Low, you confirm the equivalence once and the original value is written on each hazard. Nothing is created until your team reviews it.

Product description built for packaging

The product record has the fields packaging needs instead of food fields: material structure (layers, resins, inks, adhesives, coatings), contact type, target food, conditions of use (microwave, hot fill, freezing, sterilization), market and applicable legislation, foreseeable misuse and its declaration of compliance. Each raw material also records its food contact suitability and its supplier’s declaration.

The hazard types from clause 2.5.1

Each hazard is classified in eight groups that cover everything the standard asks you to consider: chemical and migration, recycled material, physical, microbiological, allergens, use and critical defects, functional integrity, and malicious and fraud. And by what it affects: safety, quality or legality. You no longer start from a food list.

A matrix that comes already justified

Severity times likelihood on 1 to 5 scales, assessed as inherent risk (without the control measure you are analyzing, as clause 2.5.2 requires). Low risk is controlled by a PRP, medium calls for a PRP with greater attention and high goes through the decision tree. Every hazard with severity 5 goes through the tree even if its risk comes out lower. The level is calculated by the platform, not by the person entering it.

The methodology is published in AdminISO’s Trust Center, with its scales and criteria: it is the justification of acceptable levels that clause 2.5.3 asks for, and your plant adopts it instead of defending a homemade matrix. It is also versioned: each study keeps the version it was approved under, so no assessment is left hanging.

Every assessment stores its justification. When the auditor asks why a hazard scored low, the answer is in the record, with a name and a date.

Guided decision tree

For each significant hazard, the Codex 2022 decision tree is answered step by step inside the study, with a note for each answer, and it stays as the justification for why that control is, or is not, a critical control measure.

Hazards linked to their controls

Each hazard links to the prerequisite program that controls it (blades, glass and brittle plastics, pests, hygiene) or to its critical control measure, with limits, monitoring and corrective actions. Limits can be numeric or qualitative, such as artwork release against the approved standard, and a low or medium hazard without a PRP is flagged. From the hazard you reach the control, and from the control its records and verifications. The same goes for defense and fraud: TACCP and VACCP assessments link to the study.

Review before the change, not after

When a supplier, material, structure or process change is coming, you record the review beforehand, with its clause 2.10.3 trigger. If the change affects the hazards, a new version of the study opens right then and goes through approval. AdminISO alerts you when the annual review or the on-site flow diagram verification is due, and the AI gathers what changed in the period (materials and suppliers, product complaints, non-conformities, verifications) so the review is not a copy of last year’s.

A team that can demonstrate its competence

Each HARA team member records their competence and uploads their certificates as PDFs. If the leader has no evidence, the study tells you before the auditor does.

Monitoring, deviations and actions in one flow

Monitoring records for critical measures are filled in online. A deviation becomes a corrective action with an owner, root cause and verifiable closure, linked to the hazard that triggered it.

An audit-ready file

The approved study prints as a PDF file with its version, who approved it and when, the team’s competence, the flow diagram verification and the change reviews. When the auditor asks for section 2, you do not assemble a folder: you open it.

Where artificial intelligence comes in

AdminISO works as your plant’s Quality Brain: the AI knows your system, your approved documents and your findings. For the HARA it helps you:

Suggest hazards by step based on the process type: extrusion, printing, lamination, curing, slitting, thermoforming, board, glass or metal. Each one comes with its severity, likelihood and justification; you decide which ones apply.
Draft the justification for an assessment or the decision tree notes from the data you already captured.
Prepare the study review: what changed in the period and what is missing by section 2 clause (hazards without a PRP, unvalidated limits, critical measures without monitoring), before the auditor finds it.
Import your HARA from Excel as a draft study ready to review.

The AI proposes; your HARA team reviews and approves. Responsibility for the study stays with your plant, as the standard requires.

The HARA as part of the system, not a separate document

The value of running the HARA in software is not having the study on another screen. It is that it stops being a document updated once a year and becomes part of how your plant operates: connected to your prerequisites, monitoring, corrective actions, internal audits and document control.

The HARA is included in every AdminISO plan that comes with HACCP: Food Protection, together with Food Defense and Food Fraud; HACCP; and ISO 22000 and FSSC 22000, which add the rest of the system: audits, risks, indicators, food safety objectives and management review. If your plant only makes packaging, you turn HACCP off and keep the HARA.

Want to see how AdminISO fits your plant’s HARA? Request a demo and we will go through it with your products, your processes and the way your team works today. Request a demo →

HARA Software: From Spreadsheet to a Living System for BRCGS