Risk Management · Analysis

A Binder Is Not a Program: What Kitchen Risk Management Contains

Five tasks, three domains. Most kitchen leaders already do the work; the question is whether they do it as a system.

By Arthur Haggerty, Founding Editor · IKECA CECS · Published September 14, 2026

Abstract

“Risk management” is often pictured as a binder — a shelf of policies produced for an inspector and otherwise left closed. That picture is wrong, and the error is not cosmetic. A risk-management program is a working system that performs five distinct tasks across the three domains of commercial-kitchen hazard, and a binder is at most the residue of one of them. This article sets out the five tasks — identifying hazards, reducing them, documenting the work, transferring what can be transferred, and retaining what remains — and names the standards and codes that govern each. Most kitchen leaders already do this work. The question the article examines is whether they do it deliberately, in sequence, and with a record.

Three domains, then five tasks

A commercial kitchen generates hazard in three domains, and a program that addresses one while neglecting the others is not a program but a preference. The domains are fire safety, food safety, and workplace safety. Each is governed by its own body of standards, each produces its own liability exposure, and each demands different expertise.

Fire safety in a commercial kitchen is governed principally by NFPA 96, the Standard for Ventilation Control and Fire Protection of Commercial Cooking Operations, together with the companion standards that reach the rest of the fire-protection system: NFPA 17A for the wet-chemical extinguishing system over the cook line, NFPA 10 for portable fire extinguishers, NFPA 25 for water-based systems where sprinklers are present, and NFPA 72 for fire alarm and signaling. These standards acquire the force of law where a fire code — commonly a jurisdiction’s adoption of the International Fire Code — incorporates them by reference.

Food safety is governed by the retail food law a jurisdiction enforces, most of which are built on the FDA Food Code, and is managed operationally through the discipline of Hazard Analysis and Critical Control Points (HACCP), which identifies the points in a food process where control is essential and specifies how each is monitored.

Workplace safety is governed by the Occupational Safety and Health Act, whose General Duty Clause — Section 5(a)(1) — obliges an employer to furnish a workplace free of recognized hazards, and by the specific standards in the Act’s general-industry regulations addressing machine guarding, walking-working surfaces, hazard communication, and personal protective equipment.

These are the obligations. The five tasks are how a kitchen discharges them.

Identify

Identification is the first task and the one most often performed by intuition rather than method. Done deliberately, it maps the hazards native to the specific operation — the ignition sources and combustible grease loads on the fire side, the temperature-sensitive foods and cross-contamination points on the food side, the slip risks and unguarded machinery on the workplace side — and then maps those hazards to the codes, standards, and common-law duties that govern them.

The distinction between an intuitive and a mapped identification is the difference between knowing a fryer is dangerous and knowing which standard sets the cleaning interval for the exhaust above it, which authority enforces that standard, and what the operation’s own cooking volume implies for how fast the hazard returns. Identification without that mapping produces awareness; identification with it produces a list a program can act on.

Reduce

Reduction is the work itself: cleaning the exhaust system on schedule, holding foods within safe temperature ranges, guarding equipment, maintaining the suppression and detection systems, and training the people who operate the line. It is the task most kitchens visibly perform, because it is the one that shows up as activity — a technician on the roof, a log on the wall, a class on a Tuesday.

Reduction operates on two variables: the likelihood that a hazard is realized and the severity of the outcome if it is. Cleaning the exhaust reduces likelihood; a functioning suppression system reduces severity. A mature reduction program addresses both, and it addresses them across all three domains rather than concentrating on the one that happens to generate the most visible paperwork.

Document

Documentation is the task most misunderstood as overhead. It is not overhead; it is the evidence that the first two tasks occurred. A reduction effort that leaves no contemporaneous record — no dated logs, no inspection reports, no training records — is, in the eyes of an investigator or a plaintiff’s attorney, indistinguishable from a reduction effort that never happened.

The evidentiary weight of documentation turns on when it was made. A record created in the regular course of operations, at or near the time of the work, is the kind of writing the law of evidence is built to credit; the business-records exception to the hearsay rule, codified federally at Rule 803(6) of the Federal Rules of Evidence, admits exactly such records to prove that the work was done. A file assembled after an incident to reconstruct what was probably done carries far less weight, because it was made for the dispute rather than in the ordinary course. Documentation, in other words, is not the act of filing; it is the act of recording as the work happens, so that the record exists before anyone asks for it.

Transfer

Transfer shifts the financial consequence of a realized risk to a third party, almost always through insurance. It is a genuine task within a risk-management program, but it is effective only under a condition kitchen leaders frequently overlook: the insurer must have an accurate picture of the risk profile and the reduction measures actually in place.

Insurance operates on the information the insured provides. A material misrepresentation or omission — a maintenance interval represented but not kept, a condition of coverage described but not met — can void the coverage precisely at the moment it is needed, converting an apparent transfer into a retained loss. Transfer, then, is not a substitute for the first three tasks. It rests on them: what a kitchen can credibly transfer is bounded by what it has actually reduced and can actually document.

Retain

Retention is what remains after the first four tasks have run: the deductibles no policy covers, the operational disruption of an incident, the reputational cost, and the categories of risk that no insurer will write. Every kitchen retains these exposures. The only question is whether it retains them knowingly.

A kitchen that has not worked the first four tasks retains its residual exposure by default and discovers its size only when an incident reveals it. A kitchen that has worked them retains a residual it has identified, reduced where possible, documented, and transferred where feasible — which makes retention a conscious, quantified decision rather than a surprise. That is the purpose the first four tasks serve for the fifth: not to eliminate retention, which is impossible, but to make it a choice.

What makes it a program

A risk-management program is effective when all five tasks are visible, assigned, and repeatable — when someone owns each, the work recurs on a schedule rather than in response to an event, and the record of it exists before it is requested. None of the five is exotic. Each is within the ordinary capacity of a commercial kitchen. The difficulty is not in any single task; it is in performing all five, across all three domains, as a system rather than a set of disconnected habits.

The binder, in the end, is not the program. It is what a working program leaves behind.

References

• NFPA 96, Standard for Ventilation Control and Fire Protection of Commercial Cooking Operations; NFPA 17A (wet chemical extinguishing systems); NFPA 10 (portable fire extinguishers); NFPA 25 (water-based fire protection systems); NFPA 72 (fire alarm and signaling).
• International Fire Code — the model fire code commonly adopted by jurisdictions, incorporating the NFPA standards by reference.
• FDA Food Code — the model on which most retail food codes are based; and Hazard Analysis and Critical Control Points (HACCP) as the food-safety management discipline.
• Occupational Safety and Health Act, General Duty Clause, Section 5(a)(1); and the Act’s general-industry standards addressing machine guarding, walking-working surfaces, hazard communication, and personal protective equipment.
• Federal Rules of Evidence, Rule 803(6) — the business-records exception admitting records made in the regular course of activity.

Subscribe to the Brief— six minutes of operating intelligence, once a week.