Since the passage of the Food Safety Modernization Act (FSMA) in 2011, there has been a need for a food safety plan that meets the preventive controls for human food and the typical Hazard Analysis and Critical Control Points (HACCP) requirements. Although there are similarities between these requirements, there are fundamental differences that must be fully understood to comply with both HACCP and Hazard Analysis and Risk-Based Preventive Controls (HARPC).

HACCP is a well-established set of principles for the control of food safety and continues to be a requirement in many countries around the world. Particularly where U.S. food facilities are producing food for export, businesses will continue to be required by local law in the countries in which the product is being sold, and by their customers, to comply with HACCP.

Initially, the requirements for HACCP and HARPC seem aimed at the same goals: Both are designed to prevent contamination and control food safety in the supply chain, and both require an Hazard Analysis to determine which elements of the process require control. However, important differences between the rules of the preventive controls regulations and the principles of HACCP make it difficult to meet both sets of requirements.

Many food businesses now face the task of adjusting their typical HACCP systems to meet the HARPC requirements. The requirements of the Preventive Controls rule are clear, but with limited guidance available on how to actually develop a combined HACCP/HARPC plan, this is not an easy undertaking.
   
Comparing HACCP Principles with HARPC
To establish how to combine a food safety system that meets the requirements for HACCP and HARPC, it is essential to understand the regulations for the Preventive Controls rule and HACCP principles.

HARPC can be broken down into eight main steps:

1.    Define the scope of the assessment

2.    Identify the hazards

3.    Carry out the Hazard Analysis

4.    Add Preventive Controls

5.    Implement monitoring systems

6.    Add corrective actions and corrections

7.    Verify the system

8.    Reanalyze the system

The key points from each of these steps have been evaluated below.

1. Define the Scope of the Assessment
Although the U.S. Food and Drug Administration (FDA) does not specifically state that a scope is required for the assessment, the agency has detailed the elements that would typically be captured in the scope of a food safety plan:

•    The Hazard Analysis must consider known inherent hazards and hazards that could “reasonably occur.”

•    The hazards from microbiological, chemical, radiological and physical sources must be included.

FDA also provides guidance as to the manifestation of these hazards:

•    They are inherent to the raw material or product.

•    They occur through error in the process.

•    They may be carried out deliberately for economic gain (for food safety only).

A typical HACCP plan would focus on the food safety errors that may occur during the processing of the product, and this remains a requirement for compliance with HARPC.

New: Economic Gain Hazards:
Hazards that may happen in rare cases, where food safety is put at risk due to fraudulent activity in the supply chain for economic gain, are new to a typical HACCP system and require specific knowledge and focus on the raw material supply chain.

The Global Food Safety Initiative (GFSI) is currently reviewing its benchmarking standard, with the aim of introducing requirements around economic gain, food fraud and food defense. The British Retail Consortium (BRC) Global Standard for Food Safety has already introduced a section into its standard that requires accredited food facilities to carry out a vulnerability assessment on their raw materials. To comply, however, the BRC standard requires the inclusion not just of food safety hazards but also those that would compromise the integrity of the product, such as quality or legal issues. FDA is clear that for HARPC, only food safety hazards due to economic gain should be included.

This means, for facilities accredited to the BRC Global Standard for Food Safety, or in the future, to any GFSI-recognized scheme once the GFSI has released its new benchmarking standard, food safety hazards will need to be included in their HARPC plan, plus an additional vulnerability assessment to manage integrity issues due to food fraud.

Ensuring the Scope Is Clear:
Ensuring that the system has a clear scope is essential to HACCP, and the scope must cover not only the elements of processing but also, for compliance with HARPC, the risks from the supply of raw materials and the inherent risks from those raw materials and the product.

Ensuring that those involved in the creation of the food safety system set out a clear scope is key to ensuring that the team assesses the pertinent hazards.

The scope should include the definition of the start and endpoints of the study, detailing what elements of the supply chain the food business is responsible for. FDA has stated that where a preventive control is required to ensure that the food is safe to consume, and this preventive control is not applied within the business’s control but at a later step in the supply chain, then the business in question must still take some responsibility to ensure that the preventive control is applied effectively. An example of this may be where raw meat is processed and packed raw for further cooking by another processor or by the consumer prior to consumption. Therefore, the scope can be used to provide clarity about the boundaries of responsibility and where preventive controls are applied at a later step.

Providing Knowledgeable & Experienced Resources:
Part of the scoping exercise should include consideration of the resources required to carry out the food safety assessment.

To conform to National Advisory Committee on Microbiological Criteria for Foods (NACMCF) and Codex Alimentarius guidance and standards, the system must be developed and implemented by a multidisciplinary team to ensure that the necessary experience and knowledge about the product and process is available to pinpoint the pertinent hazards.

FDA’s introduction of the term “Preventive Controls Qualified Individual” (PCQI) reiterates the importance of having the required experience and knowledge of the specific food safety principles relating to the product and processes available. The focus of FDA is that a PCQI must conduct or oversee the development and implementation of the plan. To comply with both elements, both approaches must be taken: a multi-disciplinary team including a PCQI, perhaps as the team leader.

The experience and knowledge of the PCQI is vital. This person can be qualified either by their experience or by training, but they must be able to extract the pertinent hazards from the information defined in the scope and be able to present the plan confidently and competently.

Prerequisites:
Within the scoping element of the system, prerequisites must be defined to comply with HACCP principles. Although FDA does not specifically talk about prerequisites, the agency expects the system to be underpinned by Good Manufacturing Practices (GMPs), which would generally be prerequisites. Prerequisites are the fundamental building blocks of any good manufacturing system; without these, any additional food safety controls that are applied will not be effectively supported.

FDA has improved the original GMPs to make them more robust; in addition, FDA has specified a number of prerequisite-type controls that would need to be included as part of an HARPC system, which are the following:

•    Process controls

•    Food allergen controls

•    Sanitation controls

•    Supply chain controls

•    Recall plan

A good food safety system should detail the prerequisites, including the GMPs, which support it. It is beneficial to use this list as a reference point to the procedures that provide the detail of these controls.

2 & 3. Identify the Hazards and Perform the Hazard Analysis
The hazard categories that must be assessed are aligned within the HACCP and HARPC requirements and must cover microbiological, physical, chemical (including allergenic) and radiological hazards.

The manifestation sources of the hazards that must be taken into consideration are the following:

•    The recipe or formulation (inherent product risks)

•    The ingredients (inherent risks and those from economic gain)

•    The intended use (and user) of the food

•    The product processes, including the equipment and tools used

•    The fabrication and facility environment

Inherent Hazards:
Typical HACCP requirements would not specifically state, as FDA has done, that hazards inherent to the raw materials and product must be included.

However, within HACCP, a product description is required that alludes to the fact that hazards from raw materials (through composition and country of origin) and the finished product (from the intrinsic risks and treatment of the product) should be included.

An inherent hazard is something that is characteristic of the ingredient, packaging or the finished product. Inherent hazards require a very specific and detailed knowledge of the microbiological, chemical, radiological and physical risks associated with the particular raw materials being used and the products being produced.

Examples of these may be:

•    Fragments of bone in meat, such as shredded duck

•    The risk of wheat in gluten-free coatings

•    Growth of Listeria monocytogenes in chilled, ready-to-eat sliced meat

•    Campylobacter spp. in raw chicken

•    Staphylococcus aureus in raw milk

Intended Use & User:
To comply with HACCP principles, in addition to the product description, the scope should include a description of the intended use and intended user. The purpose of this is very much in line with FDA’s intentions to ensure that the necessary information and understanding are channeled into the Hazard Analysis. By describing the product and what treatments and food safety hurdles make it safe, this focuses the team and the PCQI to take these specific elements into account.

Hazards that may be taken from the intended use or user may include cooking instructions for the consumer, if it is a raw meat product or consumption of the product by vulnerable groups, including those with allergies.

The Product Processes:
As with a conventional HACCP, the hazards applicable to the processing of the product must be included. This should include the assessment of any hazards that may arise from the equipment or tools used. Within an NACMCF or Codex Alimentarius HACCP system, a process flow diagram would be essential. FDA does not make reference to the use of a process flow diagram; however, it is sensible to assume that either a diagram or, for simple processes, a list of steps would be required to ensure that none were missed. For facilities working to HACCP principles, the need for a process flow diagram will remain.

Fabrication & Facility Environment:
FDA has made special reference to the risks associated within the environment, specifically around ready-to-eat products and contamination from pathogens such as L. monocytogenes. The process flow diagram can be used to aid this process. While walking the process steps, the team and PCQI should not only assess the food contact elements of the process but also look above and around the process step to establish if there are any environmental hazards that must be included. For example, where clean-as-you-go practices use wet cleaning, perhaps with pressurized water, there may be a risk of L. monocytogenes becoming airborne on water droplets, which may contaminate food contact surfaces. For nonfood contact glass, sensors above open product may need to be considered a risk in case of breakage.

Focusing the Hazards:
A typical HACCP system will include all the hazards that could possibly occur. These hazards would then be mitigated through the risk assessment, due to the controls in place, or the CCP decision tree would be used to determine that they are managed by the prerequisite programs. An HARPC plan requires a much more structured and focused approach to determining which of the hazards are pertinent and should be included in the assessment.

One major fundamental difference between the HACCP principles and the requirements for the Preventive Controls rule for HARPC is that the risk assessment for HACCP should be carried out taking into account any controls, and for HARPC, the risk assessment must be carried out in the absence of any controls.

The risk assessment for both systems requires the severity and likelihood (FDA terms this “occurrence”) of the hazard to be assessed to determine significance.

Because a HARPC system expects the likelihood of the hazard occurring to not take into account any of the controls that are currently in place, this will mean the number of significant food safety risks that are determined will be much higher than in a typical HACCP system. If all these significant hazards were then put through a CCP decision tree, the system would generate a large number of CCPs, which would be impractical and probably cause the system to be ineffective.

Therefore, it is vital that only the really pertinent hazards that could reasonably occur be highlighted for risk assessment. This way, the number of significant hazards generated that require preventive controls is focused on the control of the truly important food safety hazards.

4–6. Add Preventive Controls, Monitoring, Correction & Corrective Actions
A preventive control must prevent the hazard from occurring or provide positive confirmation that the hazard has, or has not, occurred. Where the hazard has occurred, procedures must be in place to correct the hazard to bring it back into control, plus control the affected nonconforming product so that it is not released as good product.

A preventive control requires criteria or critical limits to be applied. Critical limits are objective and based on validation. The validation must provide evidence that the critical limits control the hazard effectively. Preventive controls that may have critical limits are activities such as testing or minimum oxygen values in modified-atmosphere packing.

Where a critical limit cannot be applied, because the preventive control is more subjective, criteria should be applied and these criteria should be justified. The hazard of shards of bone in shredded duck, for example, may be controlled through the application of a preventive control where the ingredient is visually assessed for bones. A 100 percent manual check for bones would not be practical, so a proportion of the ingredient would need to be assessed. The quantity assessed per batch or per delivery would need to justified, and the pass criteria would also need to be set and justified, for example, one bone per set number of kg of product assessed.

All preventive controls will require a monitoring procedure that details the process of monitoring, the criteria or critical limits and the action that must be taken when the criteria or critical limits are not met. This can be produced in the form of a procedure, an instruction or a Standard Operating Procedure, depending on what works best for the facility and the preventive control. The key is to ensure that all the necessary information is documented and is set out in a way in which it can be easily understood and distributed to those involved.

From the preventive controls generated, there now needs to be a new type of assessment to determine which of the preventive controls must be classed as a CCP. Using a typical decision tree will not align, because essentially this will mean that the majority of the preventive controls will become CCPs. There needs to be a structured approach, and the key to applying such a system requires clarity of the difference between a preventive control and a CCP.

FDA defines a preventive control as “risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the Hazard Analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.”[1]

The above is more of a statement than a definition; however, the key elements can be extracted from it, which are that a preventive control significantly minimizes or prevents a hazard.

FDA refers to the definition of a CCP in the final rule, and this is in line with NACMCF and Codex Alimentarius, as “a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.”

Comparing the definitions, it can be established that both a preventive control and a CCP are designed to prevent a hazard from occurring; therefore, this is not the distinguishing factor. The distinguishing factor is:

•    A preventive control is one that significantly minimizes the hazard.

•    A CCP is a control that eliminates or reduces the hazard to an acceptable level.

7 & 8. Verify & Reanalyze the System
To ensure that the food system continues to be effective and meet the HACCP principles and Preventive Controls rule for HARPC, it needs to be continually reviewed.

The HACCP principles and HARPC requirements are aligned in their expectations of this. To ensure that the system is effectively maintained, verification activities and regular reviews must be carried out. Verification activities may include:

•    Checking and signing off that preventive controls records have been completed correctly

•    Testing of raw materials in process materials or finished product

•    Verifying the accuracy of monitoring or measuring equipment

•    Environmental testing, such as L. monocytogenes swabbing

•    Reviews, including trending and complaints

FDA has been very clear that part of the ongoing maintenance of the system must be to ensure that records are available to provide evidence that the system is effective. These records must document that verification and review activities are taking place.

Conclusions
In summary, there are parallels between the HACCP principles and the Preventive Controls rule for HARPC, but the key contradictions in the system make their amalgamation difficult. A detailed knowledge of both requirements is essential to ensuring that the system does not become confused or overly cumbersome.    

Kassy Marsh is an HACCP consultant. Contact her at kassy.marsh@techni-k.co.uk.

Reference
1. www.federalregister.gov/articles/2015/09/17/2015-21920/current-good-manufacturing-practice-hazard-analysis-and-risk-based-preventive-controls-for-human.