The basic principles of Hazard Analysis and Critical Control Points (HACCP) have been recognized since the 1970s, and more formal programs have been continually evolving since then. Regulatory agencies in the United States [U.S. Food and Drug Administration (FDA) and U.S. Department of Agriculture (USDA)] and Canada (Canadian Food Inspection Agency) have each issued their own set of HACCP regulations. Each system follows the concepts of the standard seven principles of HACCP, at times with the use of different terms. At the heart of any HACCP or food safety plan are the documented control measures, which are based on the Hazard Analysis.  

Control Measure Concepts in North America
The USDA Food Safety Inspection Service HACCP regulation[1] was the first rule published on HACCP in the United States and requires the use of CCPs to control hazards reasonably likely to occur that were identified during the Hazard Analysis. Prerequisite programs (PRPs) are defined as written procedures that describe specific activities of a plant that can be used to support decisions made in the Hazard Analysis. PRPs do not control food safety hazards. Good Manufacturing Practices (GMPs) or Sanitation Standard Operating Procedures (SSOPs) are examples of PRPs.[2,3] While PRPs are not considered a sufficient control measure for an identified food safety hazard, these programs are considered support for hazards being considered not reasonably likely to occur, and as a justification for not adding a potential hazard to an HACCP plan.

FDA has promulgated three regulations relating to HACCP and food safety, commonly referred to as Juice HACCP,[4] Seafood HACCP[5] and the Preventive Controls rule.[6] Under Juice HACCP, the regulated facility is required to implement control measures for all hazards deemed reasonably likely to occur that were identified during the Hazard Analysis. Control measures can be CCPs or SSOPs. Good Agricultural Practices (GAPs) and Current GMPs (CGMPs) are not considered to be control measures. Seafood HACCP provisions are nearly identical to those in Juice HACCP, except that instead of “control measure,” the term “preventive measure” is used. CCPs and SSOPs are the required preventive measures for all hazards deemed reasonably likely to occur that were identified during Hazard Analysis.

The Preventive Controls rule is the first regulation that introduces the concept of “preventive controls,” which are defined as “(i) Controls at CCPs, if there are any CCPs, or (ii) Controls, other than those at CCPs, that are also appropriate for food safety.” This rule does not require use of the terms CCPs, operational PRPs (OPRPs) or PRPs, but rather any control that is appropriate for food safety is considered a preventive control. Decisions on how to choose, verify and validate controls other than CCPs can be difficult, especially for smaller companies. Various terms have been coined to describe controls other than CCPs, such as OPRPs, “specific PRPs” and the more traditional terms PRPs and “universal PRPs.”

The Safe Food for Canadians Act[7] refers to the use of the Canadian Food Safety Enhancement Program Manual 2014-07-01. Prior to the publication of this act, HACCP systems in Canada were similar to those in the U.S., and Canadian HACCP systems were early adopters of the use of PRPs as control measures in the first edition of the Canadian Food Safety Enhancement Program Manual.[8]

Using Decision Trees to Determine the Type of Preventive Control
An Internet search for “HACCP decision trees” will result in a hundred types of decision trees, but all of them have common elements, and many relate back to the decision tree listed by Codex Alimentarius.[9] This is often referred to simply as the Codex Decision Tree (Figure 1). To use this decision tree to decide whether a particular preventive control measure should be a CCP at a process step, there are certain pieces of information needed: the process steps where control measures may be applied, the potential control measures, the effectiveness of the control measures and the contamination potential of the product after control steps have been applied. The output from this tree is either that the process step is a CCP or the process step is not a CCP. If the process step is not a CCP, then the assumption is made that the process step does not need to be a preventive measure at all, or that it may need to become a PRP or SSOP. Figure 2 is a similar decision tree suggested in the Seafood HACCP guidance,[10] with fewer questions but similar outputs.

Figure 3 is another modified decision tree from Campden BRI[11] that starts with the question about whether the identified hazard is managed by PRPs and stops the process immediately if the answer is yes. This decision tree could possibly be used for USDA, Juice HACCP and Seafood HACCP plans, but would not be practical for facilities regulated under the FDA Preventive Controls rule. While these trees can be very helpful for determining CCPs, they are not as useful when a facility has “preventive controls other than CCPs” in their HACCP system for certain identified hazards. These preventive controls may still be necessary for food safety but will not meet the criteria for a CCP in these other trees. For those situations, modified Codex decision trees could be more helpful. Figure 4 shows modified trees that allow for the possibility of OPRPs in the decision-making process.


Using Other Tools to Determine the Type of Preventive Control
Another commonly used tool to aid with the determination of type of preventive control is a risk matrix. Typical risk matrices used in the Hazard Analysis combine severity rankings with likelihood of occurrence rankings for a given hazard. Examples are 3 × 3 and 5 × 5 matrices.

Ratings for a 3 × 3 matrix could look like this:

Use of the 3 × 3 matrix is illustrated in Figure 5.[12] Hazards rated as 1–3 (indicated in green in the figure) are managed by PRPs, hazards rated as 4–6 (indicated in yellow in the figure) are managed by OPRPs, a combination of OPRPs or CCPs, and hazards rated as 9 (indicated in red in the figure) are managed by CCPs.


Ratings for a 5 × 5 matrix could look like this:

Use of the 5 × 5 matrix is illustrated in Figure 6. Hazards rated in green are managed by PRPs, hazards rated in yellow are managed by OPRPs or a combination of OPRPs, and hazards rated in red are managed by a combination of OPRPs or CCPs.


Summary
Hazard Analysis for food safety is a complex process and is different for every type of food product and food manufacturing facility. It is easy to get caught up in predetermined schemes and rely on published guidance. Those tools, while an excellent starting point, should not be used “straight from the page” but adapted to each unique manufacturing facility scenario. Employing a combination of expert knowledge, use of decision trees and use of risk matrices is the most effective means of arriving at solid Hazard Analysis and preventive control decisions.    

Bala Kottapalli, Ph.D., CQE, is Senior Principal Microbiologist, Food Safety & Microbiology at Conagra.

Loralyn H. Ledenbach is Principal Scientist at The Kraft Heinz Company.

References
1. Federal Register, 9 C.F.R. Part 417. January 1, 2012.
2. GMA. HACCP — A Systematic Approach to Food Safety: A Comprehensive Manual for Developing and Implementing a Hazard Analysis and Critical Control Point Plan, 5th ed. (2014).
3. NACMCF. 1998. “Hazard Analysis and Critical Control Point Principles and Application Guidelines.” J Food Prot 61:762–775.
4. Federal Register, 21 C.F.R. Part 120. January 19, 2001.
5. Federal Register, 21 C.F.R. Part 123. December 19, 1995.
6. Federal Register, 21 C.F.R. Part 117. September 17, 2015.
7. Safe Food for Canadians Act S.C. 2012, c.24.
8. Canadian Food Inspection Agency. Food Safety Enhancement Program Implementation Manual, Volumes 1 and 2 (Ottawa: Government of Canada, 1993).
9. Codex Alimentarius Commission. 2003. “Hazard Analysis and Critical Control Point (HACCP) System and Guidelines for its Application,” Annex to CAC/RCP 1-1969 (Rev. 4-2003).
10. Fish and Fishery Products Hazards and Controls Guidance, 4th ed. (Department of Health and Human Services, Public Health Service, FDA Center for Food Safety and Applied Nutrition, Office of Food Safety, 2011).
11. Campden BRI. Guideline 42, HACCP — A Practical Guide, 5th ed. (2015).
12. CCP/OPPR Decision Tree. 2009. Coca-Cola Company and Michigan State University; www.fskntraining.org, licensed under CC-BY-SA.