How to develop a Food Safety Plan that’s compliant with FDA Preventive Controls & HACCP requirements

I have just taught another FSPCA course (Human Food) in Western Canada. FSPCA Preventive Controls for Human Food is the standardized food safety curriculum that is recognized by the FDA. Under the Food Safety Modernization Act (FSMA), companies that manufacture, process, pack and hold food products for consumption in the United States must now comply with the preventive controls for human food regulation. Compliance started last September for small businesses registered with FDA. The value of the FSPCA course is that it grants participants a “preventive control qualified individual” (PCQI) certificate. Under the new US food safety requirements, a PCQI must conduct or oversee the development, implementation and maintenance of a food safety plan.

Update your current HACCP Plan to meet the Preventive Controls Requirements

FSPCA course participants all tend to ask the same question at the end of the course. How can I update my current HACCP plan and meet the Preventive Controls (PC) requirements? FDA doesn’t define the specific format of a food safety plan but model plan examples are provided as part of FSPCA course materials. In addition, the FSPCA training manual states that “if you currently have a HACCP plan, it likely will be the part that addresses hazard analysis and process preventive controls. The hazard analysis may need adjustments to identify allergen, sanitation, supply chain and potentially other preventive controls in addition to those addressed in a traditional HACCP plan.” While allergen, supply-chain and sanitation preventive controls are not Critical Control Points (CCPs), as they do not control a specific processing action, the FSPCA training manual adds that “the company should determine the best language to communicate the needs to the people performing the tasks involved in managing the control. Focus on what must be done to control the hazard, rather than what a specific step is called.”

On the topic of combining the two food safety plans, a few articles have been published online that offer a various approaches and options (see the end of this post for resources).^{1, 2} This blog post attempts to provide additional pointers.

While some companies have opted to maintain two separate plans (a Codex HACCP plan and a FDA-compliant Food Safety Plan mirrored on FSPCA model plan examples), lack of resources and a need to avoid task redundancy will call for one document to be maintained that can easily meet customer needs and regulatory expectations.

Hazard Analysis                 

The Hazard Analysis is a common requirement of a HACCP and FDA Preventive Control Plan or “PC Plan”. However, there are clear differences and the FDA requirements is broader in scope. Under the typical PC plan, the hazard identification considers the hazards naturally present in the food, (or “inherent” hazards), the hazards that may be unintentionally introduced, but also those introduced for economic gain. Furthermore, radiological hazards must be investigated under the chemical hazard category. Radioactive isotopes such as strontium-96, iodine-131 and cesium-137 are examples of radiological hazards that may be found in food and water.

Under a PC plan, the following hazards must be assessed:

• B = Biological hazards including bacteria, viruses, parasites, and environmental pathogens
• C = Chemical hazards, including radiological hazards, food allergens, substances such as pesticides and drug residues, natural toxins, decomposition, and unapproved food or color additives
• P = Physical hazards include potentially harmful extraneous matter that may cause choking, injury or other adverse health effects

For companies working under HACCP and transitioning to Preventive Controls, the need to address all hazard types must be addressed to achieve compliance. The traditional HACCP plan does not address radiological and food-fraud related hazards.

Hazards requiring Preventive Controls

The definition of a “hazard requiring one or more Preventive Controls” is a known or reasonably foreseeable hazard (biological, chemical including radiological, or physical), which is significant for food safety. These significant hazards, in the absence of a control, result in “serious adverse health consequences or death to humans or animals,” also known as SAHCODHA hazards. When a serious food incident is reported that involves a SAHCODHA hazard, a mandatory submission into the Reportable Food Registry (RFR) is required.³ The RFR fifth annual report⁴ is a useful reference as it highlights past food safety incidents. For Year 5, biological and chemical hazards (Listeria monocytogenes and undeclared allergens) constitute the greatest number of reports. The detail of statistics is as follows:

• Listeria monocytogenes found in RTE salad products (180 reports).
• Listeria monocytogenes in stone fruits, including peaches (43 reports).
• Undeclared milk in frozen popsicles (27 reports).

Companies who maintain HACCP plans determine significant, risk-based hazards that are controlled at Critical Points in the process to ensure food safety.⁵ “Hazards addressed under the HACCP system must be of such a nature that their prevention, elimination or reduction to acceptable levels is essential to the production of safe foods. Hazards of a low probability of occurrence and a low severity should not be addressed under the HACCP system.” The Critical Control Points (CCPs) can be determined using a decision tree which identifies the latest point in the process at which controls can be applied. The CCP determination also takes into consideration existing Control Points (CPs) that are documented as part of GMP and pre-requisite programs. A CCP is required when existing controls are not adequate to address critical risks.

Preventive Controls vs. Critical Control Points

Under Preventive Controls, a risk assessment is performed, which identifies the severity of the hazard and the probability of occurrence. A documented justification is provided as to why the risk level warrants a Preventive Control. A determination of where the control is applied along the process is also performed. While the PC Plan relies on a foundation of GMP and pre-requisite programs, the identification of preventive controls doesn’t explicitly consider existing controls under these programs.

While Codex HACCP and the Preventive Control regulation use different terminology to describe control steps, the objectives are the same. Critical controls must be preventive and risk-based and are designed to prevent illness and injury. Your PC Plan and HACCP plan both focus on the most important controls in your food safety system. Therefore, it should not matter if, in your Food Safety Plan, you refer to a Preventive Control as a Critical Control Point.

Supply Chain, Sanitation, Allergen and Process controls

While the 7 HACCP principles are prescriptive, so are the 4 categories of Preventive Controls. The preventive controls derive from a comprehensive hazard analysis. A scientific understanding of safe food manufacturing, processing, packaging or holding is critical in order to develop a complete and robust food safety plan. PCQIs and their teams must also consider the 4 types of preventive controls when developing their food safety plan which makes for a more directed evaluation.

As the slide below suggests, Supply-chain Controls, Allergen Controls and Sanitation Controls are located at the interface of pre-requisite programs and the Food Safety Plan. They may be elevated from Control Points under pre-requisites to Preventive Controls based on the result of the hazard analysis. Companies working under HACCP should consider reviewing their current sanitation, allergen and supply-chain (vendor-related) controls to determine whether they are designed to protect against SAHCODHA hazards. This assessment will be food, process and facility specific.

Supply-chain programs represent the biggest change brought by the Preventive Control regulation. HACCP has traditionally not specifically focused on supplier risk management. In the past few years, industry has stressed the importance of strong vendor approval programs, including foreign supplier programs. This change of focus has been felt in the increasingly strict vendor requirements of global food safety standards. Businesses that maintain HACCP plans now need to consider the specificity of their supply chain to perform a precise analysis of risks related to incoming materials, transportation, vendors, and country-of-origin.

FDA Preventive Controls & HACCP Requirements Summarized

In summary, compliance to the FDA Preventive Controls for human food regulations necessitates broadening the scope of HACCP, to include the assessment of radiological and food-fraud related hazards. In addition, the HACCP team should focus on the company’s existing sanitation, supply-chain and allergen controls to determine whether they should be controlled as part of the Food Safety Plan. Lastly, hazards associated with incoming materials must also consider other supply-chain risks. The format of the food safety plan and the terminology used to describe process steps is not specified in the regulation but food safety requirements must be met. As a side note, PCQIs and their teams may need to update their existing food safety plan to meet FDA record-keeping requirements and prescribed frequencies for plan verification and reassessment.

Let Sirocco develop your food safety plan and provide PCQI training to you and your team.

*this article reflects the views of Sirocco and does not constitute legal advice

References:

1. What to do now to mitigate from HACCP to HARPC
2. The need for a combined HACCP and HARPC plan
3. Reportable Food Registry (RFR)
4. Reportable Food Registry Fifth Annual Report
5. The Hazard Analysis and Critical Control Point (HACCP) System