In this issue of Food Safety Magazine, we explore the state of the Hazard Analysis & Critical Control Points (HACCP) system-its emergence as a routine component of the food company’s food safety program, and the limitations of the system now arising as it becomes widely implemented by non-mandated industry segments.

In Part I of this article, we will consider the benefits and general limitations of the first two HACCP principles regarding hazard analysis and the determination of CCPs.  In the next issue of Food Safety Magazine, Part II will discuss the application limitations of the remaining five HACCP principles, and what can be done by the food industry to address these limitations and the controversies surrounding them.

Before the Hazard Analysis & Critical Control Points (HACCP) concept evolved, food safety (often referred to as food hygiene, food sanitation or food protection) activities focused on sanitation inspections based on food laws and regulations, Good Manufacturing Practices (GMPs) and end-product testing. Each made a unique contribution to evaluate the attributes of foods; the conditions under which foods were produced, processed, stored, marketed and prepared; and the operations and practices to which the foods were subjected. Despite these quality control and food protection activities, contaminated foods were identified, out-of-compliance code violations were commonly found, and foodborne diseases continued with increasing incidence or estimates of occurrences.

Because of these observations, there were growing frustration about the traditional approaches to food hygiene/sanitation/protection/safety. With the inspection approach, for example, hazards only are identified when inspections are made, which may be hours, days, weeks or months after the first occurrence of the hazards. The greatest limitation of the inspection approach is that the hazards, or even the operations at which the hazards (i.e., critical control points [CCPs]) are likely to occur, may not be occurring at the time of the inspection, or the foods of concern may not be processed or prepared then, and thus not evaluated. Yet, an unchecked (as out-of-compliance or deficient) item on an inspection form implies satisfactory compliance. End- product testing has several limitations, as well, such as the fact that an adequate number of samples frequently are not collected to provide a high confidence that the product under investigation is not contaminated. For example, three samples showing negative results give 95% confidence that the lot or batch is 75% or more contaminated, but it can be less contaminated without detection. Even 60 samples showing negative results gives this level of confidence that the lot or batch is 5% or more contaminated, but less—and perhaps much less—confidence if the lot is contaminated at a lower percentage. It would take 300 negative samples to provide this level of confidence that the lot or batch is 1% contaminated, and more samples are needed if it is less contaminated. Additionally, corrective actions cannot begin until the results of the tests are received, which often is a few days or a week or longer after samples are collected compared to immediate action with monitoring of CCPs associated with the HACCP concept.

With these and several other concerns regarding the overall efficacy of traditional approaches to food protection, the introduction of the HACCP concept appeared on the scene as a promising way to better ensure food safety. As the concept has matured and many food operations have implemented these systems, some limitations of the approach have come to the fore, causing loss of impact on food safety that it was originally planned to have.
Benefits and Limitations Become Known

The HACCP concept emerged because of the need to ensure safe foods for the U.S. space program. It was based on known information about food processing and quality control, microbial preservation and control measures, good manufacturing and preparation practices, food regulations, and foodborne disease prevention. It considered the Pareto Principle, which states that certain problem situations (hazards in the HACCP concept) for any operation or product occur more frequently than others. These are known as the “vital few,” and the others are known as the “trivial many.” Prevention and control activities in the HACCP approach are focused on the “vital few” (critical control points). Additionally, information about sources and modes of transmission, survival in foods and their environments, destruction and propagation of foodborne pathogens were considered during hazard analyses. Also, there was a desire to have a fail-safe process. Although there is no such thing as zero risk, efforts were to aim at eliminating contaminants or reducing the quantity of contaminants if they could not be eliminated, minimizing the chances of contamination and preventing or delaying their propagation, if still present. This included monitoring critical operations where contamination, survival or growth could occur, and taking prompt action to correct an unsafe situation. Early information about the HACCP concept was published following conferences and from expert opinion on the subject.[1-10]

In the 1990s, there were a few additional significant publications on the HACCP concept. For example, a how-to manual, “Procedures to Implement the Hazard Analysis Critical Control Point System,” was prepared by the Committee on Communicable Diseases Affecting Man of the International Association of Milk, Food and Environmental Sanitarians.11  A hazard analysis manual for use in developing countries was published by the World Health Organization (WHO), and other materials on the subject have been issued by this organization.[12-16]  Seven principles of the HACCP concept were specified by the National Advisory Committee on Microbiological Criteria for Foods (NACMCF).17 Many organizations have developed manuals or guidelines on this concept.18  The concept was further defined by the Codex Alimentarius Commission and NACMCF.[19-21]  Within many texts and chapters there are reproductions of regulation and guidelines by U.S. federal agencies that relate to HACCP systems.[22-24]

The seven principles of the HACCP concept have been stated and restated; these are:

1. Conduct a hazard analysis.

2. Determine the CCPs in the process.

3. Establish critical limits for preventive measures associated with each identified CCP.

4. Establish CCP monitoring requirements and monitor.

5. Establish corrective actions to be taken when monitoring indicates that there is a deviation from an established critical limit.

6. Establish procedures for verification that the HACCP system is working effectively.

7. Establish effective documentation of all procedures and records appropriate to these principles and their application.

The HACCP approach is a series of interrelated actions that can be applied at any link of the food chain—production, processing, transporting, storing, marketing and preparing—or in establishments for which it is designed, implemented and maintained. It is basically a hazard-focused, self-monitoring activity. It is applicable for large and small, privately- owned and chain establishments. The HACCP concept is rational because it is based on historical data about causes of illness. It focuses attention on critical operations where control is essential. It is comprehensive because it relates to ingredients, processes and subsequent uses of products. It is continuous because problems are detected when they occur and action then is taken for correction. It is systematic because it is a thorough plan covering step-by-step operations. These are the benefits of the HACCP concept for food safety, and there is high assurance of low risk of foodborne illness resulting from products processed and prepared under a properly designed, implemented and maintained HACCP system.

As the HACCP concept evolved, it became the most clearly defined and focused concept of all the approaches for food safety. This is why it is difficult to understand the misunderstanding of the concept that exists in the minds of some persons and its misuse in some establishments. Certain groups have reworded a few of the early definitions (sometimes to the detriment of the concept) and included agenda, such as prerequisites, diverting the initial intent of the approach from the prevention of foodborne diseases to good manufacturing practices and sanitation or food regulatory control. These misunderstandings and misuses probably occurred because many persons who use the terms associated with the concept have not read carefully the key articles and texts cited above, and they jumped to conclusions based on fragmentary information coupled with an unwillingness to change their original concepts of food sanitation and food regulations.

If all of these principles and activities are in effect in this near-utopian concept, why are contaminated foods found and out-of-compliance code violations identified, and why do foodborne diseases frequently occur? Something is either missing or improperly designed or applied. Limitations of the design and implementation of HACCP systems are discussed with reference to each principle of the HACCP concept.

Hazard Analyses and Risk Assessments
The Codex Alimentarius HACCP document defines “hazard” as “a biological, chemical or physical agent in, or condition of, food with the potential to cause an adverse health effect.”[20] The NACMCF document defines the word similarly, but states that the agent is “…reasonably likely to cause illness or injury in the absence of its control.”[21] These are quite general definitions, but the word “hazard” in context to the HACCP concept needs to relate to contamination, survival of contaminants and propagation of pathogens or other hazardous substances associated with food to guide hazard analyses and verification/validation activities. Hazard analyses are, therefore, (a) investigations that detect hazards (source and mode of actual or potential contamination by pathogens, their survival during processing and their propagation), and/or (b) reviews of data generated in the establishment or industry and from epidemiological or scientific investigations that have detected actual or potential hazards.

There is no set duration for conducting hazard analyses. This aspect of the HACCP system ends when the designer(s) of the system and key members of the company in which the HACCP system is to be used feel(s) that all known hazards associated with production, processing and/or preparation of the foods under consideration are identified. This information may come from:

• Years of experience processing food

• Epidemiological data about food- borne diseases associated with the food and factors that contributed to outbreaks

• Tests done to evaluate the process

• Data from examination of the food for pH, water activity and/or microorganisms

• Measurements of time-temperature exposures at various operations

• Challenge studies to evaluate the outcome of actual or potential contaminants under various conditions to which the product may be subjected

• Observation of daily and periodic operations

• Discussions among persons such as the HACCP team who are experienced with the operations and knowledgeable about potential hazards.

Lacking any of these can result in overlooking or underemphasizing hazards. Some HACCP guidelines recommend, and some large companies’ practices involve, a team to discuss each potential hazard and to develop the HACCP system for each food that is processed. Such teams have representatives from the quality control department and processing operations and often are supplemented by others, such as representatives from engineering, maintenance and legal departments. This provides for a variety of inputs by persons with a diverse knowledge of operations; aids those involved to understand the hazards associated with the food and operations and controls specified in the HACCP systems; and stimulates cooperation in implementing the system.

Team members, however, have varied knowledge of hazards and risks, and often are defensive of changes that affect their routine activities and procedures. Despite their diverse membership, some teams do not have members who are knowledgeable of all the hazards associated with product and operations or effective control and monitoring activities. Team deliberations are labor-intensive and only consider potential problems and solutions within the experience of HACCP-team members. Thus, persons who understand the epidemiology of foodborne diseases; the microbiology of pathogens associated with the foods being processed, ingredients, the workers and the environment; the chemistry of toxins; and operations that can aid in the spread of pathogens or their propagation or survival are essential members of the team. Without such talent, the resulting system must be carefully scrutinized and validated as being safe.

Such a team approach, however, is seldom done within smaller food processing companies, on farms, on cruise ships, on boats that harvest from the sea, and in markets and foodservice operations. Either the time for the persons who should be involved is unavailable or expertise is lacking to be able to identify all the hazards and establish the HACCP system. This can lead to HACCP systems that either are incomplete or lack consideration of some hazards. Therefore, the task is often delegated to one person in the company or to a consultant. Whoever undertakes this activity should be knowledgeable of the foods, their processes and likely associated hazards. Considerable variations in HACCP systems are seen, however, depending on the knowledge of hazards, operations, and the HACCP approach of those who develop or review the system.

Epidemiological information about the foods that are processed or prepared ought to be known to assess the potential hazards, the severity of the outcome if they remain in the final product and the risks or probability of occurrence, as well as focus attention during the hazard analysis and to provide guidance for the selection of CCPs.[18] This is not always the case. Such information is crucial in conducting hazard analyses, and the lack of it often results in a complex quality control program, undue attention to aesthetic concerns, and costly structural repairs or equipment replacement rather than on a system that ensures food safety.

Over time, hazard analyses during outbreak investigations generate data on contributory factors to outbreaks, which suggest likely CCPs (Table 1).[2,25-30] Knowledge of these factors in association with the foods being, or proposed to be, processed is essential.

The term “risk” has been eliminated from recent Codex Alimentarius and NACMCF documents.[20-21] This is a poor decision, because the probability of occurrence of a hazard is germane to any hazardous situation. High-risk situations must be given more scrutiny than low-risk situations, and monitoring and corrective actions must be more stringent. Risk assessments are difficult to do, and some degree of assumptions must be made. Some who are called upon to develop HACCP systems want to avoid being put into a position to make these assumptions and assessments, and some are unqualified to do so. Yet, they are part of determining the extent of hazards and whether an operation calls for a CCP.

Critical Control Point Determination
Selection of CCPs is one of the most important steps in developing a HACCP system, and it is essential for having high assurance of foodborne disease prevention. As stated, the selection must be based on knowledge of the step-by-step operations and on epidemiological information and test results about likely sources and modes of contamination; survival or inactivation of pathogenic microorganisms or toxic substances; and proliferation of pathogenic bacteria and toxigenic molds or the prevention or delay of their growth, which may be associated with ingredients and the processing or preparation of the product.

All hazards do not need a CCP at the location of their occurrence. This often is misunderstood and, in some cases, CCPs are established at these sites, and consequently HACCP systems become quite complex, over-burdensome to implement and cause unnecessary record keeping. The CCP can be at a subsequent operation or even at a later location in the food chain, but if so, notification of this and control measures must be passed along. Action at the CCP may affect hazards, but not necessarily all of them.

Further misunderstood is that all CCPs have equal impact on control. By definition there are different kinds of CCPs resulting in different preventive and control effects on the hazards involved, and sometimes different effects on different microorganisms at any CCP. Appropriate action at the CCP may eliminate a hazard; exclude a hazard; prevent further development of a hazard but not eliminate it; significantly minimize contamination; or significantly delay further development of a hazard. Thus, hazards may still be present after successful preventive and control action at a CCP, but the risk of their occurrence should be reduced if the other aspects of the HACCP system are in effect.

Because of the misuse or misunderstanding of the term “critical control point” to include certain matters relating to GMPs, general sanitation, food regulations and aesthetics, there is an ever- increasing need to classify control points into categories of “critical” (or disease) control,” “quality control,” “regulatory compliance,” and perhaps “aesthetic issues.” These terms should be self-defining and separated by calling them, for example, CCPs (that is, disease control), quality control (QC) points, and regulatory control points. Disease prevention and control of foodborne pathogen concerns should be given highest priority and greatest attention for monitoring, verifying and validating.

Guidelines for selecting CCPs have been developed as decision trees.[20-21,31-32] Because these do not work well for all food commodities or all processes, modifications have been suggested.[33-34] Of particular concern and limitation is that they do not specify the type of CCP (e.g., elimination, prevention and reduction) that has been selected. There is one tree, however that does make this distinction. [35] Tables also have been devised to aid in assigning the type of CCP to a generic process.36 Decision trees, which appear simple, are laborious to apply to all operations, particularly when there are many products and operations. At operations where CCPs are not selected, it is important to determine if the operations are covered by the so-called “prerequisites,” or are unrelated to hazards.

Some groups and agencies have advocated the so-called prerequisites for HACCP systems.[20-21,37] These essentially are good manufacturing or preparation practices or good sanitation and hygiene practices, which are relevant to food operations and often included in food regulation and quality control policies. They may be adjuncts to a HACCP system, but certainly they should not be considered as prerequisites. HACCP systems should be aimed at food safety and exclude QC processes and aesthetic concerns. Although most of these prerequisites are basic to good production, manufacturing and preparation practices, not all of them have direct relationships with operations that have contributed to the causation of foodborne illness.

Prerequisites have been used by some companies to minimize the number of CCPs that must be monitored and records kept for review by agencies that verify the operations and validate the systems. For example, in some plants, many critical operations are classified as prerequisites and only metal detection, which is automatically monitored is considered a CCP. Refrigeration practices or cleaning equipment and associated operations, for example, are excluded as CCPs. True, these operations are basic to GMPs, but rapid cooling of heated foods is a critical operation that prevents the growth of surviving foodborne pathogens and those that contaminate product post- heating. Cleaning and disinfecting of equipment, such as a slicing machine, used in contact with cooked foods are crucial for minimizing contamination. Other companies avoid CCPs by claiming that corrective actions will be taken at subsequent operations that are out of their control without taking action to minimize the hazards or without warning the recipient. Thus, these operations for the examples given are CCPs for which there must be critical limits, monitoring and corrective actions.

Certain rules should be used to select and/or evaluate a CCP that is concerned with disease control. These are:

1. There is a high or moderate risk of a disease outcome resulting from failure of an operation to prevent or minimize contamination, kill microorganisms of concern, or inhibit significantly or delay growth of bacteria or molds of concern. Low-risk situations do not call for CCPs. The hazards must be reasonably expected to occur.

2. Actions are taken that either eliminate, exclude, prevent, significantly minimize, reduce or delay a hazard or several hazards. The hazard(s) may have been introduced from ingredients, at the operation under consideration, or at preceding operations.

3. Criteria for control or critical limits have been established and preventive or control measures carried out at this operation. More than one operation may be involved in the control of a hazard, and more than one hazard may be affected at any one critical control point. Some hazards may be controlled by the criteria, but others may not; this must be understood.

4. Effective procedures are used to monitor the CCP to determine whether food safety criteria (i.e., disease prevention and control) are met or critical limits satisfied.

5. The CCP is monitored during, just after, or occasionally just before the operation, as applicable to the process or situation. (Ideally, the monitoring is continuous and automatically adjusted to maintain control or to exclude or divert unacceptable product, but this is not always feasible.)

6. Prompt corrective actions are taken when criteria are not met. CCPs usually are at operations that have contributed to the source and spread of contaminants or to survival and/or propagation of pathogens or toxins and where effective control actions can be taken (Table 1).

Criteria for prevention or control must be chosen for each CCP selected. These often are specified in public health or food control agency regulations, but these may be too general or not applicable for the food or operation under consideration and, therefore, need modification. If, as an example of an elimination CCP, a pork product is being processed, the published regulation may be aimed at the destruction of trichinellae. If the hazards under consideration also include large populations of salmonellae and yersiniae, which are more heat resistant than parasites and common contaminants of pork, then time-temperature exposures must be increased over that stated in the regulation. Furthermore, temperature values often given in codes usually apply to moist foods only. These values are insufficient for killing large populations of the same pathogenic bacteria for which the criterion was set if the foods have a low water activity because of drying, evaporation during heating, addition of solutes, or other forms of processing that lower water activity. These are just a few examples of possible situations that allow survival of foodborne pathogens during heating when using criteria that is not designed for the identified hazards associated with the foods and processes. Thus, processes must be designed to eliminate or significantly reduce contaminants at the operation designated as an elimination-type CCP. Additionally, a processor or preparer may choose a criterion that is more stringent as a target value.

The purpose of a prevention-type CCP should be the prevention of germination of surviving spores and the growth and proliferation of the resulting vegetative cells and other bacteria introduced after a heat or other lethal process. Regarding hot holding, for example, a minimal temperature of 130F/54.4C, which is lower than those commonly specified in foodservice codes (140F/ 60C), can suffice as a bacterial growth prevention-type CCP with a few degrees as a safety factor. Some foodborne pathogenic bacteria, such as Listeria monocytogenes, Clostridium botulinium type E and Aeromonas hydrophila, can multiply at temperatures below those (45F/7C, 41F/5C) commonly specified in food codes. Refrigerated storage can delay but not prevent their multiplication; this is an example of a delay-type CCP Therefore, either lower temperature criteria or time of storage must be used as a critical limit or take, but be aware of, the risks. Hence, the critical limit may differ from published code requirements, but they must be effective for its intended purpose of eliminating, excluding, prevention/delaying further development, minimizing opportunities for contamination, and/or reducing the amount of contamination, as applicable to the hazard and processing/preparation situation.

Frank L. Bryan, Ph.D., M.P.H., is president of Food Safety Consultation and Training, in Lithonia, GA, which specializes in HACCP system development, including conducting HACCP system evaluations in food processing plants, foodservice establishments and food markets, identifying CCPs, and recommending control criteria and monitoring and verification procedures. Internationally known for his work in food safety, Bryan served as a scientist director at the Centers for Disease Control and Prevention, Public Health Service from 1956-1985, where he focused on foodborne disease epidemiology, control and training, and was an active member of the International Commission on Microbiological Specifications for Foods from 1974-1996. He can be reached at

1. Bauman, H.E. The HACCP concept and microbiology hazard categories. Food Technol. (28), p. 30. 1974.
2. Bryan, F.L. Microbiological food hazards today—based on epidemiological information. Food Technol. (28), p. 52. 1974.
3. Ito, K. Microbiological criteria CCPs in canned foods. Food Technol. (38), p. 16. 1974.
4. Kaufmann, FL. and R.C. Schaffner. Hazard analysis, critical control points and good manufacturing practices regulations (sanitation) in food plant inspections. Proc. IV lnt. Cong. Food Sci Technol., pp. 402-407. 1974.
5. Proceedings of the 1971 National Conference on Food Protection. Edited by G.J. Kupchik, et al. U.S. Department of Health Education and Welfare, Washington, DC. 1971.
6. ICMSF. Microorganisms Th Foods 4, Application of the Hazard Analysis Critical Control Point (HACCP) System to Ensure Microbiological Safety and Quality Blackwell Scientific Publications, Ltd., Oxford. 1988.
7. Subcommittee on Microbiological Criteria, Committee on Food Protection, Food and Nutrition Board, National Research Council. An Evaluation of the Role of Microbiological Criteria for Foods and Food Ingredients. National Academy Press, Washington, DC. 1985.
8. Peterson, AC., and R.K. Gunnerson. Microbiological critical control points in frozen foods. Food Technol. (28), p. 37. 1974.
9. Simonsen, B., et al. Prevention and control of food-borne salmonellosis through application of hazard analysis critical control point (HACCP). Intern. J. Food Micro., (4), pp. 227-247. 1987.
10. World Health Organization/International Commission on Microbiological Specifications for Foods. Report of WHO/ICMSF Meeting of Hazard Analysis: Critical Control Point System Th Food Hygiene (VPH/82.27). p. 16. 1982.
11. Bryan, FL. Teaching HACCP techniques to food processors and regulatory officials. Dairy Food Environ. Sanitat. (11), p.562. 1991.
12. Bryan, EL. Hazard Analysis Critical Control Point Evaluations: A Guide to Identifying Hazards and Assessing Risks Associated with Food Preparation and Storage. World Health Organization, Geneva. 1992.
13. Moy, G., et al. Application of HACCP to food manufacturing: Some considerations on harmonization through training. Food Control (5). 1994.
14. WHO. Application of the Hazard Analysis Critical Control Point (HACCP) System for the Improvement of Food Safety; WHO-Sponsored Case Studies on Food Prepared in Homes, at Street Vending Operations, and in Cottage Industries. 1993.
15. WHO. Report of the WHO Consultation on Hazard Analysis Critical Control Point Training (WHO/FNU/F0593.2). World Health Organization, Geneva. March 17-19, 1993.
16. WHO. Training Considerations for the Application of the Hazard analysis Critical Control Point System to Food Processing and Manufacturing (WHO/FNU/F0S93.3). World Health Organization, Geneva. 1993.
17. NACMCF. Hazard analysis and CCP system. Int. J. Food Micro., pp. 1-23. 1992.
18. Bryan, F.L. Hazard analysis critical control point approach to food safety: past, present and future. J. Env. Health, (61). pp. 9-14. 1999.
19. Codex Alimentarius Commission. Guidelines for the Application of the Hazard Analysis Critical Control Point (HACCP) System. (FAQ, Rome. p. 40. 1993.)
20. Codex Alimentarius Commission. Report of the Twenty-Ninth Session of the Codex Committee on Food Hygiene. Washington, DC, October 1996. (FAO, Rome, pp. 21-40. 1997.) 21. NACMCF. Hazard Analysis and Critical Control Point Principles and Application Guidelines. (source unlisted). p. 35. 1997.
22. Loken, J.K. The HACCP Food Safety Manual. John Wiley & Sons, New York. 1995.
23. Corlett, D.A., Jr. HACCP User’s Manual. Aspen Publishing. Gaithersburg, MD. 1998.
24. Jouve, J-L. Good manufacturing practice, HACCP, and quality systems. In The Microbiological Safety and Quality of Food, Vol. II. B.M. Lund, et al, eds. Aspen Publishing. Gaithersburg, MD. 2000.
25. Bryan, FL. Factors that contribute to outbreaks of foodborne disease. J. Food Prot. (41), p.816. 1978.
26. Bryan, FL. Hazard analysis critical control point approach: epidemiologic rationale and application to foodservice operations. J. Environ. Health (44), pp. 7-14. 1981.
27. Bryan, FL. Risks associated with practices, procedures and processes that lead to outbreaks of foodborne diseases. J. Food Prot. (51), p.663. 1988.
28. Roberts, D. Factors contributing to outbreaks of food poisoning in England and Wales 1970-1979. J. Hyg. (89), p.491. 1982.
29. Todd, E.C.D. Factors that contribute for foodborne disease in Canada, 1973-1977. J. Food. Prot. (46), p. 737. 1983.
30. Weingold, S.F., et al. Use of foodborne disease data for HACCP risk assessment. J. Food Prot., (57), pp. 820-830. 1994.
31. ILSI-Europe. A Simple Guide to Understanding and Applying the Hazard Analysis Critical Control Point Concept. International Life Science Institute Press, Brussels. p. 12. 1993.
32. Mayes, T. Simple users’ guide to the hazard analysis critical control point concept for the control of food microbiological safety. Food Control (3), p. 14. 1992.
33. Tompkin, R.B. HACCP in the meat and poultry industry. Food Control (5), p. 153. 1994.
34. Tompkin, RB. The hazard analysis critical control point (HACCP) system. Proceedings of Texas A&M University’s Center for Food Safety and the International Meat and Poultry HACCP Alliance Symposium. Texas A&M. 1995.
35. Bryan, FL. Another decision tree approach for identification of critical control points. J. Food Prot. (59), p. 1242. 1996.
36. Bryan, FL., et al. Procedures to Implement the Hazard Analysis Critical Control Point System. IAMFES, Ames, IA. p.72. 1991.
37. Sperber, W.H., et al. The role of prerequisite programs in managing a HACCP system. Dairy Food Environ. Sanitat (18), p.418. 1998.