All food processes have a residual risk, some are small, some very small and some are extremely small: zero risk does not exist

As risk-based approaches are increasingly recognized and used to manage food safety hazards, their implementation requires a recognition and appreciation of residual risk. We define residual risk as the one that remains even after a fully compliant food safety system has been implemented. As true ‘zero risk’ is essentially unattainable, understanding and assessing the residual risks for different products is essential for the different actors involved in the food production system. Understanding residual risk is particularly critical as improved surveillance systems (e.g. facilitated by whole genome sequencing) can detect small outbreaks and potentially link cases to a product, even when they are consequences of residual risk rather than a non-compliant food safety system. Future work on assessing residual risk for different pathogenfood combinations are essential at both the company and governmental level to further fine tune food safety systems with the definition of an acceptable residual risk.


Introduction
Consumers, food industries and governments typically desire foods that are 'free of any risk'. In practise this is not achievable. Microorganisms are present in most environments, including the raw materials required for making food, the tools and machinery used to process that food, and even at the humans that are employed in food processing facilities and other food establishments (e.g. restaurants). While some of those microorganisms have a beneficial impact on human health (e.g. probiotics), others can potentially cause food spoilage and/or disease. Although most foodborne illnesses cases are characterized by mild symptoms, some cases can lead to severe ailments and even death, especially with the most sensitive members of a population (e.g. the young, the elderly, pregnant women, immunocompromised individuals). For that reason, food industries design processing treatments to inactivate the microorganisms that may be present in the food product, implement measures to avoid or mitigate microbial growth during storage, and apply a plethora of measures to validate and verify that the processes used to control foodborne pathogens and spoilage organisms are implemented consistently. However, it does not matter how stringent these measures are, they can never be perfect. Consequently, a residual risk always remains, making zero risk in foods -as in many other aspects of life -unattainable in practice.
It is important that the residual risk and its possible sources are understood and considered by the different actors involved in the food production system. For instance, it could be argued that we should aim for a system where every food product is sterilized (by application of intense treatments that shall kill every microorganism). Although this system would reduce the risk of foodborne disease, it would also increase the energy requirements of food production, have a detrimental effect on several quality and nutritional aspects of the food product [1], and would eliminate most food options that are part of the cultural heritage of different populations. Therefore, food production is multifaceted and measures for increasing food safety may come at the expense of higher environmental impact and potentially less nutritious food [2]. One of the methods most commonly used nowadays to tackle the complex task of assessing and managing food safety risks is Microbial Risk Assessment (MRA) [3], a science-based methodology to evaluate the risk of illness associated with the consumption of a food product. MRA makes a clear distinction between hazard and risk. According to the European Food Safety Agency (EFSA), 'hazard' is 'something that has the potential to harm you' [4]. Hence, in the context of microbial risk assessment, Salmonella cells or botulinum toxin potentially present in a product are examples of hazards. On the other hand, the term 'risk' is defined by EFSA as 'the likelihood of a hazard causing harm' [4]. Therefore, risk combines the probability of presence and level of the hazard and the probability of it causing an illness (estimated using a dose-response model) to estimate the probability of illness. Then, in the previous example, the risk would be the probability of contracting salmonellosis or botulism after consuming the food product. Conceptually, food safety management can use either a hazard or a risk-based approach. While the value of risk-based approaches is increasingly being recognized and includes the ability to balance risks and benefits [5], one can argue that this differentiation is artificial and that most food safety systems use aspects of both hazard and risk-based approaches [6].
The MRA methodology is nowadays one of the tools that can be used by food industries and regulatory bodies to estimate the risk associated with different food products. Besides this calculation, MRA studies can provide additional information relevant to food safety, such as scenario analysis (where the effect of different measures on the total risk is analysed [7]) or sensitivity analysis (where the elements of the food chain more relevant for the risk are identified [8]). Hence, MRA is usually much more informative than the results of a sampling in a food industry, especially in cases with low prevalence of microorganisms. For instance, if we based decisions only on testing, we could (falsely) conclude that if a hazard has not been detected, the associated risk must be zero. As an example, the fact that a given pathogen (e.g. Listeria monocytogenes) has never been detected in a product does not ensure that the implemented safety controls assure a 'hazard-free' or zero risk product. Because sampling is limited, it is feasible that the microorganism entered the system at some point, but it was not yet detected or identified. Alternatively, it is also possible that the hazard has not yet entered the system, but that does not ensure it will never in the future, as the ecology in a food production environment is dynamic [9]. Therefore, the absence of positive is no proof of the absence of risk in the current, past or future. For that reason, food industry and regulators increasingly use MRA to evaluate risks and identify control strategies that reduce risk to an acceptable level and use testing as a mean to validate control strategies for their ability to deliver a targeted risk reduction and verify consistent implementation of the validated risk reduction strategies.
Implementation of risk-based approaches, however, requires a recognition and appreciation of residual risk, which we define here as the risk that remains even after a fully compliant food safety system (where the level of microorganisms in raw materials is within target levels, and processing and storage conditions conform to specifications) has been implemented for a given product.
Although every product has a residual risk, the severity of the risk varies between products because it depends on a variety of factors. For instance, the probability of developing a foodborne disease after consuming a sterilised food product is extremely small, whereas the one associated with the consumption of half a dozen raw oysters is much bigger. However, when comparing different products, the relevance of this risk varies depending on the perspective. For a consumer, the risk associated with the consumption of one serving may be of high relevance, whereas for a government the total number of cases may be more important. The relevance of the residual risk will also be influenced by severity of the consequences. For example, cases of foodborne botulism are rare but potentially life threatening, while biogenic amines resulting from spoilage bacteria typically produce short term mild symptoms with low risk (but not zero) of severe consequences. In this opinion article we will highlight several examples showing the relevance of the residual risk from the perspective of different agents of the food system: industries, consumers and governments. We will also describe the different risk metrics available can be used to understand the risk associated to a given food product. This overview should aid in the understanding the persistence of this risk and highlight several common misconceptions, demonstrating that a situation of zero-risk is unattainable in food production with the technology available nowadays (and likely in the foreseeable future) and resulting in a residual risk.

Inactivation is never absolute
Inactivation treatments in food processing are usually designed targeting a number of log-reductions of the microorganisms of interest. For thermal treatments (the most common technology nowadays), the treatment temperature and its duration are usually decided based on predictive microbiology models based on the D-value (the time required to cause a 10-fold reduction of the microbial count) [10,11]. This modelling approach is supported on empirical results showing that, in some situations, the microbial count during an isothermal treatment decays exponentially [12]. Hence, it is common to refer to processes whose duration equal six times the D-value (expected 1 000 000-fold reduction of the microbial count) as '6D treatments'.
A common misconception in the application of this approach assures the absence of microorganisms after the treatment. If, for instance, the initial concentration of a pathogen in a food product is 10 3 cfu/g, it is relatively common to claim that a treatment causing >3 logs of inactivation would result in absence of the microorganism because the level is below 1/g. This is, of course, not correct. First of all, these calculations are done per gram, so the expected microbial count per serving is usually higher. For instance, if the product unit (and serving size) is 100 g, the initial number of organisms in the product is 10 5 cfu/100 g, hence after a 3-log reduction, approx. 100 cfu per serving would remain; these organisms could grow to higher counts or cause a disease in a consumer, even without subsequent growth. Furthermore, even when the expected number of microorganisms is below 1 cfu per serving, that results does not imply absence. If a 100-g food product from the previous example was treated with a 6D treatment, the remaining level is 10 À3 cfu/g or, using other units, 10 À1 cfu/100 g, meaning indeed that the level is below 1 organism per product. However, the concentration of 0.1 cfu per product is an expected value and can alternatively be considered as 1 serving out of every 10 would contain 1 cfu per serving. Therefore, this is not an absolutely 'safe' or sterile product, there is a residual risk; 9 products out of 10 will not contain the pathogen, but 1 out of 10 will contain it. Even after a 12D reduction, still 1 out of 10 million products will contain the pathogen (10 3 cfu/gÁ100 gÁ10 À12 = 10 À7 cfu/100 g). One can similarly calculate a residual risk for every heat treatment, using the log reduction achieved by a heat treatment as well as the level and frequency of pathogen contamination in the raw materials used. For example, an individual company could easily calculate the likely value of the residual risk of (i) L. monocytogenes contamination of finished products and (ii) human listeriosis cases linked to their product, assuming a fully compliant pasteurization process is implemented (e.g. for fluid milk) as long as data on raw milk L. monocytogenes contamination levels and frequencies in raw milk used for processing are available.
Low concentrations of bacterial cells can still be a health risk. One reason is that foodborne pathogens may be able to grow during storage; some of them, even under refrigeration conditions. As a result, a product with a low bacterial concentration after processing can still pose a significant risk at the moment of consumption. Clostridium botulinum in canned foods provides a pertinent example. Apart from sterilisation no other control measure is applied in canned foods, even not refrigeration. Hence, if endospores of the organism were able to survive sterilisation, they could subsequently germinate, grow and produce botulinum toxin, which is highly toxic for humans. Because of the high mortality and severity of the outcome, as well as the large numbers of canned products consumed worldwide, the risk needs to be controlled at a very high level (i.e. 12D). For a rough estimate of 100 billion cans yearly worldwide, an initial spore level of 1 per can, this would result in 0.1 surviving Clostridium spore per year. It should be realised that industry if often sterilising with an F 121 > 3 min (and 3 min gives more than 12D), to inactivate also spore forming spoilage organisms, indicating that risks will even be lower.
Even in cases where the pathogen cannot grow during storage, low concentrations of pathogens can still be a health concern. Every pathogenic cell has a probability of causing a human infection, which is typically expressed as the r value [13]. Consequently, even in cases without potential microbial growth, a low number of survivors can still be of relevance, and the residual risk should be considered. Pertinent examples in this case are Shigella spp. or Campylobacter jejuni, for which doses as low as 10 or 500 cells have been reported to result in illness [13]. The following sections of this opinion shall exemplify the methods available to quantify the risk associated with these low survivors.

The limitations of traditional sampling schemes
A food company may test a fraction of the production for the presence of various pathogenic microorganisms. It is a common belief that if a pathogen has not been detected in the historical data of a company, that organism is not present in the food and the food hence is 'safe' or 'zero risk'. However, due to technical limitations and the fact that microbial tests are destructive, it is essentially impossible to test a whole production lot (and have remaining product to sell). Instead, testing is generally limited to a relatively small part of the production. Therefore, the fact that during a long sampling period no evidence supports the presence of the microorganism in the food does not ensure that the product is absolutely safe [14,15]. The correct conclusion would be that the pathogen is not detected in the specific samples investigated by the employed sampling plans and detection methods; essentially, every given sampling plan could be used to characterize the residual risk that remains even if all samples are negative (if the sampling were used as a sole strategy to assure safety).
As an illustrative example of this seemingly contradicting claim, let us consider the risk of Salmonella in chocolate bars. Let us assume contamination of 1 Salmonella enterica cell per 10 000 bars of 25 g, and that the company produces 100 000 chocolate bars a day. Let us consider that testing is limited to 5 samples per day, that each sampling unit is a whole bar, and that the probability of false negative or false positive is zero (if the cell is present in the bar, it will be identified, and if not, the test is negative). Then, the probability of detecting Salmonella in each sampling unit (one chocolate bar) equals 0.01% (1/ 10 000 = 0.0001), and the probability of detecting it in the product in a given day is 0.05% (1À(1À0.0001)^5 = 0.0005). In other words, we expect a single positive every 5.5 years (1/(0.0005Á365)). On the basis of this result, it could seem reasonable to conclude that the risk of salmonellosis is insignificant. However, a single cell of S. enterica has a probability of causing illness that has been estimated to be 1 case per 400 (0.25%) [16]. Therefore, if we consider that 10 bars of the 100 000 daily production contain a single S. enterica cell (100 000 bars per day and 1 in 10 000 contaminated), the expected number of yearly cases of salmonellosis is 9.125 (10/400Á365), a value that is certainly not insignificant. Although sampling will rarely show a positive, there is clearly a residual risk.
There are several reasons why the absence of the hazard in product testing does not ensure the associated risk is zero. Firstly, only a very small amount of the whole food production is sampled for the test (in this example, 5 out of 100 000 bars), whereas most of the food produced is 'sampled' (consumed) by the consumer giving an appreciably risk in a population. Each day, there are 10 cells present in the 100 000 bars, resulting in a 2.5% (10/400) probability that someone would get ill. Looking at the risk per serving, the risk is again be very low (0.00000025). However, the total yearly production is 36 500 000 (365Á100 000), which results in an expected 9.125 expected cases of salmonellosis.
Another aspect to consider is that usually only 25 g of the product are tested, which is smaller than a full bar and a serving. So, it is possible that a bar was tested negative in 25 g, but had the microbe present in full bar of for example 50 g. Therefore, the above calculations are relevant for a sample and a serving of 25 g. If a sample of 25 g would be taken from a 50 g bar at the same Salmonella concentration, the sampling probability would be as given above, but the number of cases a factor two higher. Another aspect is the fact that the ecology within a production plant is dynamic [9,17]. As a result, it is possible that a contaminant that was not present in the past enters the production plant at some point in the future. Therefore, testing is a good method for verification, but cannot be considered control [18]. A more holistic approach is better, defining appropriate critical control points that, if complied with the pre-set critical limits, control the risks at an appropriate level (e.g. using an inactivation treatment as part of a HACCP system).
Residual risk in the era of molecular epidemiology and large scale food production As discussed above, the traditional means of ensuring the microbiological safety of foods has been the combination of preventing the introduction of pathogenic microorganisms through hygienic practices, the elimination (or more accurately reduction) of pathogenic microorganisms through intervention technologies, and the validation and verification of these two food safety approaches through targeted testing for pathogens, indicator microorganisms, or their metabolic activity. Additionally, the (validated and verified) prevention of outgrowth contributes to control certain hazards. However, over the course of the past 50 years there have been several trends and advances that are now challenging this traditional approach. One of the two key factors has been the size of production lots. As food manufacturers attempt to take advantage of the economies of scale, advances in food processing, packaging, and 'just in time' production have led to increases in the scale of production. This is particularly true with dry products where production may take place over the course of multiple days, weeks, or even months without a true break in production that includes a complete hygienic cleaning of a facility. Further, the globalization of the food industry and the development of worldwide distribution of products increases the likelihood that a single, multi-day production lot of a food could be distributed to multiple countries.
The second key factor in the evolution of the food industry is the emergence of molecular epidemiology. The development of molecular biology-based tools has led to the ability to 'fingerprint' microorganisms associated with foodborne disease outbreaks. In particular, the development of 'whole genome sequencing' (WGS) techniques is rapidly changing the types of foodborne disease being identified and traced to a single source. These advances are increasingly changing the detection of outbreaks from events associated with a limited time frame and location to those that involve diverse geographic locations and extended time periods. However, it is not just the technologies that had led to this change. It is also the information systems and data handling technologies that are key to potential applications. For example, the ability in the United States of the Center for Disease Control and Prevention (CDC), the Food and Drug Administration (FDA), the Food Safety and Inspection Service (FSIS) and the various States' departments of health, agriculture, or environmental protection have resulted in an impressive ability to gather and disseminate potential outbreaks data [19]. This has been further augmented by similar capabilities globally.
As a way of exploring what impact these two factors have had on the consideration of residual risks and our ability to predict them, we will return to our earlier hypothetical example involving the manufacture of chocolate bars and preventing them from becoming a vehicle for Salmonella. This is a dry product wherein S. enterica does not grow, but can survive for extended periods of time. In this hypothetical product, we will assume that the bars weigh 100 g and can be divided into four 25-g servings. In this scenario, it is assumed that manufacturer produces 1 000 000 bars per day in a continuous process that lasts for 90 days. Thus, over the course of three months' production, the company produces 90 000 000 bars which is equivalent to 9 000 000 000 g and 360 000 000 servings.
As a starting point, we will assume that the company has established a 'hold and release' microbiological criterion assuming bars are randomly contaminated with Salmonella at 1 CFU/kg, and the manufacturer uses the most rigorous sampling plan generally employed, that is, sixty 25-g samples assessed individually using an enrichment protocol (Table 1). For the sake of comparison several other sampling plans are also described in Table 1 with several alternate, less rigorous plans. The most rigorous plan is designed to have a reasonable probability of rejecting a product that has S. enterica at a level !1 CFU/kg. However, the effectiveness is substantially reduced as the number and/or size of the samples decreases (Table 1). It is also readily apparent that a 10-fold reduction in the level of S. enterica strongly reduces the effectiveness of the sampling plan to the point where detecting a contaminated lot would be unlikely (25.11% probability of rejection for the most stringent scheme, see Table 1). Even lower contamination rates would make it highly unlikely that S. enterica would be isolated during routine 'hold and release' testing.
If we now consider a production scenario that has excellent prevention and intervention programs, but has a harborage site that results in a single genotype of S. enterica being present at a residual contamination rate of 0.0000033 CFU/g. Such a low level of contamination would be highly unlikely to be detected, even with a stringent sampling plan. This level of contamination is equivalent to a total of 0.0000033 CFU/g X 9 000 000 000 g over 3 months = 29 700 CFU being distributed randomly in the 3-month lot. At this low level of contamination, a reasonable assumption is that any contaminated serving will have only a single Salmonella cell, so 29 700 servings will be contaminated with S. enterica. Drawing on the dose-response model from JEMRA risk assessment on S. enterica, it was estimated that the likelihood that a single S. enterica would lead to a case of salmonellosis was approximately 1 in 400 exposures [16]. This leads to the prediction that the number of illnesses resulting from the 29 700 contaminated servings would be equal to 29 700 Â 0.0025 = 74.3 cases. On the basis of classical microbiological techniques, these cases would most likely be considered sporadic, without any link between them. However, considering even a moderately unique genotype, the application of modern molecular epidemiology analysis could identify a link between these cases [20 ]. Hence, this could lead to the identification of a suspected geographically and temporally diffuse outbreak, and an investigation would be initiated to determine the source of the outbreak. Such sized outbreaks are now routinely investigated and the suspect food identified [20 ]. It is important to note, however, that the substantial underreporting of human salmonellosis cases would likely lead to less than 1/30 of these cases [21] actually being available for genotype analysis, hence any residual risk that predicts less than 60 salmonellosis cases (and hence 2 or less cases available for genotyping) might not be detected as an outbreak. In addition, while illustrative, the scenario above also assumes that all cases that constitute the residual risk are caused by the same subtype, which is unlikely if the residual risk is due to random survival of Salmonella present in raw material from various specific sources (e.g. different farms or different fields).
The take home message from this hypothetical but realistic scenario is that between large scale production lots with extremely low levels of a foodborne pathogenic bacterium coupled with the modern molecular epidemiology systems could lead to detection of an outbreak at levels well below that which a food manufacturer can verify by traditional testing. This leads to the potential policy gaps when regulatory agencies or food distributors/retailers provide realistic and practical testing guidelines and specifications for foods that are substantially less stringent than the ability to detect a low-level outbreak after literally millions of servings have been consumed by the public. This hypothetical example shows how residual risks of microbial hazards is to be topic of substantial debate and legal challenges in the coming decades. On the other hand a residual risk that could not be detected by end product testing, and could not be detected by classical isolate identification techniques can now be detected, what can be further used to prevent future cases.
Role of residual risks in microbial risk management Zwietering et al. 87 Table 1 Examples of different sampling plans acceptance/rejection characteristics as calculated by the ICMSF Sampling Software for 2-class enrichment samples [22] using a s of 0.5 Different ways to look at the residual risk: risk per serving, total risk and burden of disease As shown in the previous examples, zero risk does not exist in food production. This is especially relevant when looking at the risk at a large scale, such as the complete production of a large company, or the yearly consumption of a certain food commodity in a certain country. Depending on the scope, different risk metrics can be used to compare the risk between products. One of them is the risk per serving, defined as the risk of contracting an illness by consuming a single serving of the product. This metric can be used to compare the choice of consuming a certain food product or another, giving an estimation of risk from the perspective of the individual consumer. An alternative risk metric is the (expected) number of cases per year. This index combines the risk per serving with the number of servings consumed by the total population, providing an estimate of the overall risk of a hazard in a certain food. Because this metric is strongly dependent on the size of the population and the number of servings of the food consumed annually, it is common to give a relative measure, such as (expected) number of cases per million inhabitants per year.

Assumed level of contamination
These risk metrics provide complementary information that can be used to better understand the risk associated with a hazard in a given product or commodity. As shown in Table 2, one US study estimated the per serving risk for acquiring listeriosis from consumption of unpasteurized milk (7.1Á10 À9 ) as seven times larger than per serving risk associated with consumption of pasteurised milk (1.0Á10 À9 ), the expected number of cases per million population is 30 times larger for pasteurized milk (0.31 cases/million population) than for unpasteurized milk (0.011 cases/million population). This seemingly contradictory result is due to the fact that consumers in the United States of America (USA) favour pasteurized milk over unpasteurized milk. The risk per serving gives the probability of contracting a foodborne disease when consuming a single serving of a food commodity; information that can be useful from the perspective of the individual consumer. Hence, it can drive the decision of a single consumer towards a safer product; a typical example being the changes in women's diet during pregnancy to avoid raw milk or raw milk dairy products due to the risk of miscarriage associated to listeriosis. On the other hand, the annual number of cases provides a more general view of the risk to public health of the whole population. This information can be useful from the perspective of governmental agencies or a food company, to drive measures towards reducing the incidence of the product with the higher risk on the whole population. For instance, a measure that could half the risk per serving of unpasteurised milk would reduce the expected number of cases per year in the USA by 1.5 cases (   [29] metrics, it is important to note that the specific risk metrics in this example do not represent the residual risk of listeriosis due to pasteurized or unpasteurized milk, rather they represented the risk estimated for the US, which included both residual risks as well as risk due to inappropriate food safety issues practices. There are only few risk assessments or related documents that specifically and explicitly define the residual risk for different foodborne diseases -food combinations (assuming production under full compliance with all regulations). However, the FAO/WHO 2004 Listeria risk assessment [24] provides a calculation of residual risk in ' It is very difficult to relate the current existing cases to the proportion related to products compliant with all regulations and cases related to inappropriate food management. In outbreak cases sometimes mismanagement is encountered, in other cases processes and products do comply with official regulations. It is difficult to relate an outbreak to a specific food product, and subsequently, when a food product is identified it is very difficult to determine retrospectively the exact root-cause. But with the new tools of molecular epidemiology more insight will be gained progressively in both steps of the investigations. There is a clear future needs for these types of risk assessment both at company level and at a country (or worldwide level). In other words, cases can occur as result of residual risk or as result of errors, which are difficult to distinguish, but with new tools we will more and more be able to distinguish these two.
Another illustrative example (also taken from Table 2) can be taken from a risk assessment of human listeriosis cases attributable to deli meats. From this risk assessment, which again does not specifically quantify residual risk, it can be seen that even though the risk of listeriosis per serving of deli meat in the US was estimated as relatively small (7.7Á10 À8 % 1 in 13 million servings), still many cases attributable to deli meats do occur in a large population (5.5 cases/million population). The risk per year per person is 1 in 180 000 and hence for a lifetime of 80 years the risk of acquiring listeriosis is 1 per 2300. On the other hand, 5.5 cases yearly per million population represents approximately 1800 cases for the US population (assuming the current population of about 330 million), 5.0 cases per day. This shows that the perspective of the risk from a consumer (risk per serving, risk per year, risk per lifetime) can be distinct than from the perspective of public health of a county (an estimated 1800 cases would result in about 185 deaths; assuming the 15.9% death rate reported by Scallan et al. [21]). Even if the chance of the event is very low, the 'dice' is thrown a large number of times in the whole country, resulting in a total number of cases that can be relevant from a governmental perspective. As a similar example of risk perspective, it is estimated that in the Netherlands there are yearly 200 000 cases of foodborne disease related to meat consumption [30]. This number in the population is large, because this can be seen as a whole small city that gets ill per year. Assuming a 1% risk of sequelae for each case (calculated as a lower bound based on the ratio between deaths and cases by Refs. [21,31]), 2000 people would experience sequelae with 1% of these dying, leading to an estimated 20 deaths. On the basis of these estimates, foodborne disease related to meat consumption would likely be considered relevant from a public health perspective. But this can also be seen from the perspective of a consumer. This consumer risk is a yearly risk per person of 200 000/17 million people. This is a risk of 1/85.5 years, so that is per person once in a lifetime. That can be considered an acceptable risk from a consumer perspective. Also, the mortality risk is about 1 per million per year, which has been considered the threshold for be an acceptable risk, in environmental regulation, although is not necessarily considered relevant to microorganisms [32].
As another important aspect, the risk per serving or the (expected) number of cases per million inhabitants do not take into consideration the severity of the disease. The Codex definition of risk mentions it is a function of the probability of an adverse effect and the severity of that effect, consequential to a hazard in food [33 ]. Therefore, this information is important to include as the severity of the symptoms strongly vary between foodborne pathogens. For instance, campylobacteriosis is usually a mild disease, it has a case-fatality rate of 0.03% [34 ], whereas listeriosis has a case-fatality rate of 15.5% [34 ]. This information can be incorporated in the risk assessment using an index that includes the burden of disease, the most common being the DALY (Disability Adjusted Life Years) [35]. This index equals the addition of the years of life lost (YLL) plus the number of years lived with a disability (YLD). The YLL represent the number of years lost due to mortality at an age earlier than the life expectancy, whereas the YLD combines the duration of the illness with the severity of the symptoms. Therefore, this index combines the risk of contracting the disease with the severity of the symptoms. DALYs thus may be another appropriate metric to quantify residual risks, since it includes the severity and even combines the severity of several health outcomes.  Table 3).
Therefore, DALYs (or other similar indexes) provide information that can be of high value to governmental agencies. It combines the risk of disease with its severity, providing an estimate of the overall impact of the disease in the population. This information could also be of interest for large food producers. Indeed, several scientific studies have suggested the development of sampling plans that take into consideration the burden of the disease [37,38]. On the other hand, DALYs might be more difficult to interpret for a non-expert audience. For instance, the risk per serving might be more valuable for an individual consumer when deciding between food products. Therefore, it is best to report values at both scales for better interpretation. Furthermore, actual risks need to be compared to expected residual risks.

Conclusion
Taking into account that most foodborne pathogens are endemic to most elements of the food system (farms, industries, operators . . . ) a situation of zero risk in food production is unattainable with the technology available nowadays. Regardless of the severity of inactivation treatments or the stringency of sampling schemes, a residual risk will always remain. As shown in this article, the risk per serving and the (expected) number of cases provide complementary information that can be combined to better understand the risk to human health of a given commodity. In most food products, the risk per serving is virtually zero, resulting in a very low chance of the individual consumer contracting a disease. However, from a governmental perspective, the (expected) number of cases for products largely consumed can be relatively large, resulting in a relevant risk. Therefore, because zero risk does not exist for food products, the residual risk must be evaluated using the appropriate risk metrics. Future work on assessing residual risk for different pathogenfood combinations or for all pathogens associated with a specific food are essential at both the company and governmental level, in order to further fine tune food safety systems. For example, a government may decide that the residual risk associated with a currently mandated heat treatment (e.g. milk pasteurization) may be too high and hence may require additional measures to improve food safety (e.g. increased heat treatment). Assessment of residual risks (e.g. for produce) will also facilitate future risk benefit analyses (e.g. population level foodborne disease risk versus nutritional benefits associated with affordable produce) that will help with definition of an acceptable residual risk. On the other hand, a company may decide that the residual risk associated with a large volume product they produce may be too high (and may represent an enterprise risk, for example, due to the risk of causing an outbreak and additionally that can be detected by public health agencies) and hence may voluntarily raise food safety standards above those that are required by regulations. Table 3 DALYs of several common foodborne pathogens. The data has been extracted from two scientific studies [31,36 ]