Risk assessment and HACCP are related, but fundamentally different processes. Four major elements of risk assessment are commonly described (hazard identification; exposure assessment; dose-response assessment or hazard characterization; and risk characterization). Some similarities exist between the inputs for the first elements of risk assessment (hazard identification) and HACCP (hazard analysis). However, HACCP involves the identification of critical control points of a process for the purpose of producing a 'safe' product, and thus is essentially a risk management procedure that does not estimate risk with attendant uncertainty as in the formal structured procedure described for risk assessment. For quantitative models in microbial risk assessment, exposure assessment requires data for pathogen occurrence, density or level, and distribution in foods and live animals, parameters for growth and decline, and consumption information. A crucial difference between chemical and microbial risk assessment is that for the latter, exposure models must account for pathogen growth and deactivation, termed predictive microbiology. This field has emphasized prediction of the expected changes in a population of organisms and is extended by an example accounting for the stochastic or random variability of microbial growth in a given circumstance. Dose-response assessment, the third element of risk assessment, is the crucial link between exposure in food to adverse human health outcomes. Data, from controlled human studies with healthy adult volunteers to describe dose-response relationships, are limited. Differences between human sub-populations may be inferred from animal studies, based on a common mechanism, such as the observed pre-disposition of antibiotic-treated animals to subsequent challenges with enteric pathogens. Professional organizations, such as the Society for Risk Analysis, can greatly assist governments, industry, academia, and stakeholders in scrutinizing the risk analysis processes of risk assessment, risk management, and risk communication. Published by Elsevier Science Ltd.