NCA Best Practice: Hazard Analysis Critical Control Point (HACCP)

Transcription

1 NCA Best Practice: Hazard Analysis Critical Control Point (HACCP) Introduction Hazard Analysis Critical Control Point (HACCP) is a systematic approach to food safety management throughout the supply chain. The HACCP process involves identification of hazards specific to a food, evaluation of the risks associated specific to this food, and establishment of control procedures to assure safe product is delivered at the point of consumption. In confectionery processing, as in all segments of the food industry, HACCP is an integral component of a company s quality and food safety management program. HACCP enables the program to be proactive and to rely on prevention of food safety issues, rather than detection of problems in finished products. HACCP was first developed by the Pillsbury Co. in a cooperative effort with NASA for space flights during the 1960s. It was critically important to prevent food safety issues for astronauts, and there was no good way to sample and test enough products to guarantee zero defects. Although FDA was interested in the development and application of HACCP principles, it was not until 1995 that FDA issued regulations for mandatory HACCP implementation in the seafood industry. In 2000, the USDA-regulated meat and poultry sectors were the next segments of the food industry to require HACCP. This was followed by mandatory HACCP regulations for the fruit and vegetable juice processors in In the current regulatory climate, it is expected that new legislation will involve rule-making that requires a systematic approach to food safety similar to HACCP for all food manufacturers, including confectioners. It is noteworthy that although HACCP is a globally accepted system that manages food safety, it is only as effective as the prerequisite quality and food safety component programs that support it. KEY definitions: - Biological Hazard: A food safety hazard caused by a biological source; typically a microbe commonly associated with the food supply (e.g., Salmonella). - Chemical Hazard: A food safety hazard caused by a chemical source; it can be naturally occurring like mycotoxins, or it can be extraneous such as heavy metals or pesticides; this category includes food allergens. - Control Point: Any point, step, or procedure in a supply chain where food safety hazards are controlled. - Corrective Action: Steps prescribed following a process deviation of critical limits; designed to return the process to a controlled state. - Critical Control Point (CCP): A point, step, or procedure in a food process at which control can be applied to prevent, eliminate, or reduce a hazard to an acceptable level. - Critical Limit: The maximum/minimum levels to which an identified food safety hazard must be controlled; the difference between acceptance and rejection. - Deviation: Failure to meet a critical limit.

2 - Food Safety Hazard: A biological, chemical, or physical agent in, or condition of, food with the potential to cause illness or injury in the absence of control. - Monitor: To regularly conduct a planned sequence of observations or measurements to assess CCP critical limits, with the intent of producing process control records. - Physical Hazard: Any potentially harmful extraneous matter in food, which can be natural such as shells or pits or extraneous such as metal and glass. - Preventative Measure: An intervention used to control an identified food safety hazard. - Risk: The chance or probability that an identified food safety hazard will be realized; the likelihood of its occurrence and the severity of its effects. - Severity: The degree of seriousness of the manifestation of a food safety hazard. - Validation: The use of methods and measures to determine if a HACCP system is effective and appropriately implemented, in light of state of the art knowledge. - Verification: The use of methods and measures, whether used in regular process monitoring or in addition to them, to confirm the performance of the HACCP plans, and to indicate if revalidation is required. Developing a HACCP Plan: There are three primary areas of focus in a strong HACCP system: management support, effective prerequisite programs, and resources. Although there is significant overlap between these three pillars, each is essential to the implementation of a successful HACCP system. Management support will help drive the HACCP approach to food safety. Time, financial support, and critical decision making are required from all levels of management, especially during the event of a food safety incident. This extends to the operation and execution of effective prerequisite programs such as GMPs, SOPs, pest control, supplier assurance, allergen control, foreign object control, consumer contact management, and laboratory testing. The resources necessary to implement HACCP begin with a lead coordinator, and a HACCP Team. Proper training and, in some cases, certification will be required. For each organization, there must be a structured approach to accountability for food safety responsibilities, including management and implementation of HACCP. In the case of a global business, there may be a group responsible for assuring food safety across all company facilities. For a smaller operation, the HACCP coordinator may need to wear a number of hats, including one that manages food safety programs. Nonetheless, the HACCP coordinator must take on the role of technical expert, and must be properly trained in HACCP. The coordinator has direct accountability for development, organization, and management of the HACCP plan. This person is typically the Quality Assurance Manager for the business, or the person responsible for answering quality and food safety issues from customers or consumers.

3 The HACCP coordinator will be accountable to appoint a HACCP Team. The HACCP Team will represent all operational areas of the business, for example, R&D, Engineering, Operations Management, Commercial/Procurement, Logistics, and even Sales and Marketing. All of these groups must, at a minimum, have a top level understanding of HACCP. Within the broader team, there will be a core group of company experts that control product processing. This group will be responsible for management of the actual HACCP process and implementation of the control measures for receiving raw materials and converting them to the company s finished products; this smaller group will have knowledge of the process, cleaning & sanitation, raw materials and packaging, equipment maintenance, environmental controls, and the use of operators that work in the facility. The HACCP Coordinator as well as a back up person should have thorough training, and should probably be certified in HACCP. The core group should be trained to attain a thorough understanding of HACCP and its supporting prerequisite programs. The HACCP Team should meet regularly, and be responsible for conduct of initial and ongoing risk assessments as well as implementation of HACCP plans. The HACCP plans will need to be revised and updated for any changes to the process, including raw materials, and for all new products, equipment, or facility changes. Excess deviations from critical points will also trigger a revision of the HACCP plans. In addition, new and emerging food safety issues may call for an updated hazard assessment. A strong change control system is actually one of the KEY prerequisite programs necessary for an effective HACCP plan. The HACCP Team will begin their approach by conducting an initial risk assessment. The first step is to understand the product and process for each line operation within a facility or across facilities for multiple plant sites. Some of the questions that require answers are: - What is the product (i.e. chocolate, sugar, gum)? - What is the intended use of the product (retail sales, further processing, food service items)? - What is the nature of the product (agricultural commodity, highly processed confection, cooked, blended/combined)? - What type of distribution and storage is required (ambient, refrigeration, freezing)? - What is the shelf life of the product? - What further steps are necessary for preparation (ready-to-eat, microwave)? - What is the potential for mislabeling/misbranding? - Are there any special considerations required for the product? Following the rigorous steps taken to describe the product, the HACCP Team will proceed to develop a process flow diagram. The diagram has accompanying tables to aid the HACCP Team in the hazard identification process. There are some examples for various confectionery operations given at the end of the best practice document. The process flow diagram provides the basis of the HACCP plan, and must be carefully

4 composed with input from all members of the HACCP Team. It must cover all phases of manufacturing starting with raw materials and packaging, materials receiving and storage, processing, packaging, and product shipment. Handling of product by the customer and consumer are important considerations for the overall HACCP plan, however the flow diagrams focus on those areas that are in the control of the manufacturer, typically in the factory itself. The HACCP Team must assure the completeness of the flow diagram, and confirm that it represents all phases of the process, and all the possible hazards to which products can be exposed. The Seven Principles of HACCP Following the initial discovery process and development of the flow diagram, the Seven Principles of HACCP are applied. Principle # 1: Conduct of Hazard Analysis. Confectionery manufacturers must conduct a hazard analysis specific to their own product and process. This step will determine if any biological, chemical, or physical hazards are significant (likely to occur), and if their presence carries a level of severity that could lead to illness or injury. The HACCP Team needs to consider all preventive measures in place to control the identified hazards. Both hazards introduced from outside the process facility and those that may come from inside the facility need to be considered. If all hazards are listed, and the means of control are in place (or could be implemented) then priority hazards that require special attention will come to light during this analytical process. One important objective for the HACCP Team is to focus on the most critical hazards, and not to dilute their significance. Those truly significant are typically supported by scientific research, epidemiological data, and/or industry experience. The most common biological hazards for confectioners are pathogenic bacteria like Salmonella, which most often come from raw materials or the food process environment. Chemical hazards could be naturally occurring in a product and added during production, or inadvertently introduced by contamination somewhere along the supply chain. Chemical contaminants most commonly found in confection include food allergens, heavy metals (such as lead), pesticide residues, and mold toxins (i.e. aflatoxin). Physical hazards can be from a natural source such as nut shells, or an unnatural source like metal or glass. A structured questionnaire should be followed for each product and process evaluated in the risk assessment: 1. Review ALL ingredients, including components of blends and those that may be provided by brokers or in co-manufacturing operations: - Are there potential hazards associated with the raw materials or packaging materials? Is there any history of issues?

5 - Can the materials support microbial growth and the development of toxins? - Are the raw materials and packaging sourced from approved suppliers? - Do primary (product contact) packing materials contain only approved inks/films? - Are all raw material labels correct for allergens, ingredients, and additives? 2. Review each process flow diagram for storage, handling, and processing procedures: - Are there points in the process that support microbial growth? - Are there opportunities in the process flow where in-process ingredients or rework can become contaminated? - Are there opportunities for the finished product to become contaminated in the distribution channels, or even at the point of consumption? - Are food contact surfaces cleanable, and are SSOPs in place to prevent residual cleaning and sanitation chemicals? - Is the process water supply clean? - Are the lubricants, process aides, and cleaning agents all food grade and FDA approved? - Are the pesticides used for the pest management program properly stored and applied? - Is equipment monitored to prevent disintegration and generation of foreign materials like plastic and metal? 3. Compile a list of all the biological, chemical, and physical hazards that have been identified through the risk assessment process, and indicate where each one occurs. An example chart is given in the best practice document for a number of examples of confectionery products. Each will have its own unique set of critical hazards, and controls must be implemented according to the specific product and its process facility. For example, food allergens will be on many confectionery manufacturers lists, but how the risk is managed depends on the number of lines producing in a site, if there is common equipment, and other compounding factors. How it becomes integrated into specific HACCP plans will be subject to all of those factors. Conducting the risk assessment in a semi-quantitative manner at this point can be expressed as a matrix where the likelihood of occurrence is plotted against the severity of the presence of the hazard. The risks that are not managed by prerequisite programs become targets for process controls, or possibly Critical Control Points (CCPs). Where there are hazards identified as likely to occur, and when present they have the potential for severe illness/injury, these must absolutely be controlled by measures which prevent, eliminate or significantly reduce the hazard.

6 Principle # 2; Identification of Critical Control Points (CCPs) The Codex Alimentarius Decision Tree

7 A critical control point is a step in the food process at which control can be applied, and is essential, to eliminate a food safety hazard or reduce it to an acceptable level. The accurate identification of a CCP is essential to controlling a food safety hazard. If the first step has been accomplished and the significant hazards have been identified, then CCPs can be determined for preventative measures to control the hazards. Examples of CCPs include thermal processes like cocoa bean roasting, and metal detection of finished products. As stated previously, it is important to recognize that many hazards are controlled by strong prerequisite programs, and do not need to be identified as a CCP. A decision tree can assist in the accurate identification of a CCP; an example series of questions is suggested as follows: Question #1: Do preventative measures exist at this step for the identified hazard? If the answer is YES, ask Question #2. If the answer is NO, investigate whether the step is necessary for safety, and if control is in place somewhere else in the process flow. If the answer is NO, the step is not necessary for safety, the specific hazard is not a candidate for control by a CCP. If the answer is YES, there is a significant hazard not being controlled, then a preventative measure needs to be implemented which may involve development of a CCP. Question #2: Does this step eliminate or reduce the likely occurrence of a hazard to an acceptable level? To accurately answer this question, the entire process flow should be reviewed to understand if this process step is the best place to control the hazard. If the answer is YES, then this step could be identified as a CCP. If the answer is NO, then ask Question #3. Question #3: Could contamination with identified hazards occur in excess of acceptable levels or could the contaminants increase to unacceptable levels? This question probes whether a contamination is preexisting at this step, or if it is introduced or exacerbated at this process step. If the answer is NO, then the step is not a CCP for the specific hazard. If the answer is YES, then ask Question #4. Question #4: Will a subsequent step, prior to consumption of the food being processed, eliminate the identified hazard or reduce the likely occurrence to an acceptable level? If the answer is NO, then the step being evaluated is a candidate CCP. If the answer is YES, then the step is not considered a CCP. It is difficult to determine the specific hazards that may reach the consumer when improperly controlled. Surely it is nearly impossible to consider every possible hazard for each food product. The focus in the identification process for CCPs requires a clear understanding of the sources of the significant, specific hazards, the process conditions that may introduce additional hazards or increase the levels of hazards, and the process control measures in place to either eliminate or reduce the hazards to an acceptable level.

8 If a hazard is identified for which a control point (CCP) cannot be implemented, the situation calls for a process/product redesign to assure a safe product can be delivered to the consumer. Examples of typical confectionery CCPs include: - A raw material that must exhibit the absence of a hazard, such as aflatoxin in raw peanuts. - Proper temperature controls in line for ingredients, such as refrigerated dairy products. - A thermal process step, such as cocoa bean roasting or almond roasting. - Control of water activity in products, such as molded chocolate truffle centers. Principle #3; Establishment of critical limits After a CCP has been identified for the process, the next step is the specification of critical limits. Critical limits are basically operating parameters within which the CCP is controlled; they set criteria for acceptable and unacceptable product. If there is more than one hazard identified for a CCP, then critical limits need to be established for each individual hazard. If a critical limit is not met, the CCP is out of control. By definition, an out of control CCP indicates the resulting product is a potential health risk for the consumer. An out of control CCP requires that corrective action be taken to regain control of the process. This fact distinguishes HACCP from other quality control parameters: an out of control CCP can lead to production of an unsafe product, whereas an out of control quality parameter, although it may result in a costly rejection of product, does not result in a product that could cause illness or injury. Control limit determination may require in-plant research, although some information may be obtained through the scientific literature. Again, it is essential that CCPs are dedicated to food safety only. Including quality control points in the HACCP system will dilute the focus, and result in an ineffective approach to food safety. Process variability must be defined for each individual operation, and the operating limits validated for the defined performance criteria. Typically, performance criteria can be readily measured on a real time basis. Therefore, using microbiological control limits is not desirable. For example, if the process needs to exclude a microbial pathogen such as Salmonella, and it uses a thermal process to achieve the pathogen reduction, the heating regimen needs to be specified. A specific example is roasting cocoa beans to an internal temperature of 220 to 250 F, which has been shown to produce a safe end product. The critical limits should be based on a validated heat step for the specific bean roasting operation. Although some cocoa bean roasting equipment comes with instructions for the thermal process, the equipment must be validated after installation to confirm the performance criteria are achieved. Once the critical limits are determined for a given CCP, the process must be subject to repeated trials to assure it is capable of operating within the boundaries of the critical limits. Some would argue that the activity called validation, is really the eighth Principle of HACCP. If a monitoring check indicates there is a trend toward repeated out of control situations for a CCP, an operating limit may need to be

9 implemented. Going back to the cocoa bean roasting example, in order to produce acceptable cocoa flavor, the CCP heat regime parameters may need to be held constant and not increased. Therefore, a preliminary tempering stage may need to be introduced as an operating limit to assure the cocoa beans are at a certain temperature just before they go into the cocoa bean roasting equipment. Operating limits are as important as the CCP itself, since they cannot be violated without compromising the CCP. Process adjustments for operating limits are intimately connected to corrective actions, since they directly impact the safety of the product being produced through the CCP. As a matter of course, any products made by an out of control process should be considered a food safety hazard, and, thereby, should be rejected. The amount rejected is dependent on the definition of lot size or process batch size. When food processes are continuous, this becomes a very difficult situation to define. Technically, a clean break in the process will be necessary to prove the contaminant is confined to a specific period of time. This implicates the need for a validated cleaning and sanitation procedure. Every set of critical limits needs to establish a control plan for implementing corrective action to bring the process back into control, and must include what to do with the affected production made during the period of time the process was out of control. Some examples of critical limits used for food processes are as follows: - Time - Temperature - Moisture / A w - ph - Titratable acidity - Levels of preservatives - Salt concentrations - Viscosity - Physical dimensions - Inspections / observations - Validated sanitation protocols - Supplier certifications /Raw material COAs Information for assistance in developing critical limits can be obtained from the scientific literature, food equipment manufacturers, regulatory agencies, other government agencies, trade associations, experimental research, and from technical experts/committees. Principle # 4; Process monitoring Monitoring is the process of assessing whether a CCP is under control through observation and measurement. Accurate and timely monitoring will yield results that indicate a deviation from a critical limit, and adequate time to react to the results. Establishing a monitoring system will assure each CCP stays under control, and that the critical limits set for the process are consistently met. Monitoring methods need to be as close to real time as possible to be effective. Typically, physical and chemical checks are

10 preferred, since the application of microbiological testing will require a delay in getting the monitoring results. In the most effective means of monitoring a process, an adjustment (corrective action) can correct the process and return it to control before products are affected. Under any circumstances, the finished product made during an out of control situation must not be permitted to reach the consumer. Monitoring results provide HACCP documentation that verifies products were made by a process maintained in control, and in compliance with the company s HACCP plan. Monitoring of critical limits can involve process readings, product sampling, or observations to confirm a preventative measure at a CCP is being performed. The equipment and tools involved in monitoring must assure consistent accuracy. Periodic calibration must be conducted to assure ongoing conformance to these requirements. The frequency of checks is determined according to process capabilities; the most effective measures are done on a continuous basis. Examples of continuous CCP monitoring could be thermal process recording charts for milk pasteurization or for cocoa bean roasting, and metal detection system monitoring of packaged finished products. Although there are some systems that have automatic diversion, or line stoppage, most continuous checks require human intervention. The more quickly an operator reacts to an out of control data point, the less product is at risk for loss or reprocessing. Some non-continuous checks involve periodic roasting checks for time and temperature when a chart recorder is not in line, temperature checks on refrigeration equipment, or product moisture or water activity tests. All operators involved in the monitoring process must be thoroughly trained, and understand the critical nature of their work within the HACCP plan. They need to have total knowledge of the CCP, its critical limits, and how to react to the results generated by the monitoring activity. HACCP training needs to be extended to maintenance personnel and line managers as well who will be involved in decision making activities for the line operation. All monitoring results are recorded and considered controlled documentation, providing official records that report deviations from critical limits as well as normal operations for producing acceptable products. The documentation should be authorized by the operators involved in the monitoring activity, and by the line manger confirming control of the CCP. Principle # 5; Corrective actions When a critical limit shows a deviation, a corrective action must be taken. Any out of control situation for a CCP warrants immediate follow up action. The actions are normally part of the prescribed HACCP plan, and the documented work instruction for executing the corrective actions should be ready to quickly implement. Procedures for containing any suspect product and for bringing the line operation back into control should be available for the line operators. As previously stated, the primary objective in designing monitoring of critical limits is to generate CCP deviations as soon as possible such that products at risk are minimized. As a rule of thumb, the corrective action

11 protocols are written in an if then format. For example, if the peanut roaster temperature drops below a critical temperature, then the roaster is shut down, peanuts in the roaster and the cooler are captured and held for evaluation, the equipment is cleaned and sanitized, and the roaster is restarted only after validated as clean. Some of the actions that should be documented in the corrective action protocols are as follows: - Isolate and hold products for further hazard evaluations - Divert products and/or ingredients to another line where the deviation may not be critical and the hazard risks are mitigated - Rework the specific lots/batches that showed the deviation from control - Reject raw materials or packaging that showed a deviation from specifications - Destroy materials and/or products involved in the CCP out of control point If a high frequency of unanticipated critical limit deviations occurs, or there is an unusual deviation, it is imperative that the entire HACCP plan be reevaluated for its effectiveness. It would be ideal to have automated feedback loops that systematically review the monitoring data and look for trends in deviations and their frequency of occurrence; but, in reality, this is most often done through a rigorous manual check of the monitoring data to determine the plan s effectiveness. Records of process deviations must be collected, and be part of a documented corrective action report that shows the product involved, the volume of affected products, a description of the critical limit deviation, the corrective action taken, product evaluations conducted, product dispositions resulting from the evaluations, and the people involved in the corrective action process and decision making. Principle # 6; Verification Verification is a means of regularly assessing the effectiveness of the HACCP system, and providing ongoing confirmation that it is compliant with the food safety program expectations. Every HACCP plan must integrate verification steps for a regular review of each CCP, and for the periodic evaluation of the overall HACCP system. There should be a prescribed schedule in each HACCP plan for the type of verification and the frequency of its conductance. Periodic verification can provide insight as to the level of the HACCP plan sensitivity; for example, it can help discover unforeseen issues like unanticipated uses of products by the retail customer or consumer. The verifications can be records reviews of a production shift, periodic process reviews, supplier audits, or instrument calibrations. One possible verification step can be an overall HACCP system audit. This can be an internal audit conducted by company experts, or it can be an external audit conducted by auditors contracted by the company or its customers. In some cases the external audit may be used to certify the HACCP plan against a recognized HACCP standard. In any case, audits are considered systematic evaluations of the company HACCP plan. If done correctly, they

12 are unbiased, and provide feedback on the overall management of the HACCP plan. Another means of verification is to regularly review customer and consumer input. There is a very sensitive sampling of products available to all companies through their consumer complaints which can provide a level of insight into defects that cannot be obtained through product sampling. The consumer contact information can be sorted for that segment relating to product safety, and then applied to the HACCP plan effectiveness for preventing specific hazards from reaching the consumer. Some level of chemical contaminant sampling and microbiological testing of finished products can be applied as a verification step. For example, a certain category of raw materials from approved company sources may be surveyed for the presence of pesticides or heavy metals. Samples pulled for regulatory inspection surveys can provide verification input, and samples tested by customers may provide similar HACCP system feedback. As previously stressed, the sample information and all verification data must relate to food safety parameters only, in order to be applied to the HACCP plan. Validation, as distinguished from verification, must also be required on a regular basis. Validation is absolutely necessary during the HACCP plan development, since it will determine the fit for purpose of the HACCP plan itself, all CCPs identified, and the planned programs for monitoring each CCP. If, in the process of verification, there is an indication that the HACCP plan as designed in not effective, or if there are component parts of the HHACP plan that are found to be ineffective in controlling specific hazards, the plan and/or the failed areas within the HACCP plan must be revalidated. The validation conducted for the company HACCP plan will address the entire company food safety program and confirm the integration of all prerequisite programs along with the HACCP system, being one component part of the whole. Principle # 7; Record Keeping Procedures Record keeping is an essential component of the company HACCP plan. Records provide written proof that the food safety system is operating effectively to control the identified hazards. The results of monitoring document that the process has been successfully operating within the defined critical limits, and, if deviations have occurred, that the prescribed protocols were followed and corrective actions were implemented to address product and process control. The records may provide insight into trends for driving equipment preventative maintenance, and the need to adjust process equipment calibrations. All records must be documented at the time the data is gathered; it is unacceptable to record critical process monitoring information after the fact. Any falsification of data, or deliberate tampering/changing of records must not be tolerated by the company. It is strongly suggested that all HACCP plan related documentation be signed by the operator conducting the monitoring and initialed by a reviewer. Computerized records are acceptable, but their accuracy should be authenticated by a reviewer. The same is true for automated process control data like chart recordings for time and temperature monitoring.

13 All records should be retained for a defined period of time; it is typically suggested that records be kept for six months to a year beyond the shelf life of the product, at a minimum. Depending upon the current regulatory rules, there may be a need to share process control records with regulatory authorities, during routine inspections and product investigations for cause. Some typical HACCP plan records that may be required include the following: - The HACCP plan and documentation supporting its development - A list of the HACCP team members with their responsibilities - Hazard evaluations with proposed control measures - Food safety prerequisite programs - Foods processed by the company, their distribution, and their intended use by the customer and consumer - Verified process flow diagrams and related charts - Data from CCP monitoring; e.g., time and temperature charts / logs - COAs from suppliers of critical raw materials - Metal detection results, calibrations, and verification challenges - Verification data such as results from microbiological testing - Corrective action reports including product hold reports and incident reports - Change management reviews and adjustments to the HACCP plan - Record keeping protocols and company documentation requirements - Verification of equipment calibrations - Results of internal and external food safety audits - Training records for operators and managers involved in HACCP activities In an appendix, there are a number of process flow diagrams and related charts to illustrate typical HACCP plans for various chocolate, sugar candies, and gum operations. These are modeled after segments of the food industry already regulated by a mandatory HACCP requirement. Although a regulatory rule or guideline does not currently exist for confectionery products, it is likely that one will be legislated in the near future. It is very important to understand that the information in this best practice document and the accompanying illustrations are only a guide. Every HACCP plan is a customizedprogram that is unique to the manufacturing confectioners own facility and line operations, and, thus, it must be developed accordingly, applying the Seven Principles of HACCP to each specific product and process.