In this post we’ll go through the requirements to comply with both the FSMA preventive control rule and also BRC Food Safety. So you if are a BRC certified site, you know what you need to add to your current HACCP system to comply with the preventive control rule. This is a big post with a lot of information so – to download a PDF print-friendly version you can sign up and get it here…
As we’ve discussed in previous posts, at first glance the HACCP and HARPC systems seem very similar, however implementing the intricacies of adhering to both standards is proving to be a little trickier. I’ve highlighted the elements of your HACCP system that will need amending and also I’ve worked through the differences between a CCP and a preventive control.
To enable ease of reading – you can follow each element of the items covered by blocks of colour – see the example below:
CODEX/NACMCF: No comparable requirements
PREVENTIVE RULE: No comparable requirements
BRC: 2.0 Fundamental
The company shall have a fully implemented and effective food safety plan based on Codex Alimentarius HACCP principles.
To comply with the BRC sites must have a food safety plan based on the Codex principles. Therefore, as long as the system adheres to Codex – sites will comply with section 2 of the BRC. This means, as we’ve discussed before, that the Codex principles must be the base standard and then the HARPC requirements need to be built on top of it.
CODEX/NACMCF: Preparatory stages 1 – Assemble the team
- ideally should be multi-disciplinary
- can use outside expert help
- should define the scope
- start and end points
- hazards to be considered
PREVENTIVE RULE: No comparable requirements
BRC: The HACCP Team
2.1.1 The HACCP plan shall be developed and managed by a multi-disciplinary food safety team that includes those responsible for quality/technical, production operations, engineering and other relevant functions. The team leader shall have an in-depth knowledge of HACCP and be able to demonstrate competence and experience. The team members shall have specific knowledge of HACCP and relevant knowledge of product, process and associated hazards. In the event of the site not having appropriate in-house knowledge, external expertise may be used, but day-to-day management of the food safety system shall remain the responsibility of the company
2.1.2 The scope of each HACCP plan, including the products and processes covered, shall be defined.
COMPARISON: A HACCP team is required, which meets all of the BRC requirements:
- defined team leader
Points to note:
1. The competency of the team leader and the team to meet BRC will need to be able to demonstrate an understanding of HACCP and codex principles.
2. The requirement for HARPC training is not totally clear yet for the preventive rule, but the team needs to be able to demonstrate an understanding of food safety of their relevant product area.
3. The team members will need to include departments such as procurement and buying, as hazards relating to the inherent risks from the raw material need to be included, plus food fraud in the supply chain
FDA have not stated that a defined scope is part of the requirements. However, it would be sensible to scope out what is and is not to be included, plus to comply with BRC it is a must, to:
- define the product
- define the start and end points of the study
Note: The scope to cover HARPC will need to be wider than the typical HACCP required by the BRC. It will need to cover processes outside the manufacturing process, such as raw material procedure (to cover inherent risks of the raw materials), NPD processes including artwork generation and also any controls that occur after the product leaves site, which make the product as it is consumed safe.
CODEX/NACMCF:Pre-requsite Programmes (PRP’s)
Codex states that the HACCP plan must be based good hygienic practises, which it defines as pre-requisite programmes.
PREVENTIVE RULE: No comparable requirements
2.2.1 The site shall establish and maintain environmental and operational programmes necessary to create an environment suitable to produce safe and legal food products (prerequisite programmes). As a guide these may include the following, although this is not an exhaustive list:
- cleaning and sanitising
- pest control
- maintenance programmes for equipment and buildings
- personal hygiene requirements
- staff training
- transportation arrangements
- processes to prevent cross-contamination
- allergen controls.
The control measures and monitoring procedures for the prerequisite programmes must be clearly documented and shall be included within the development and reviews of the HACCP.
COMPARISON: In order to comply with the BRC there needs to be no change here. Pre-requisites are still going to be a really important part of the system.
Remember pre-requisite controls are site wide controls, which are not specific to a particular process step.
In a typical HACCP plan, choosing which pre-requisites to include is key, because where a pre-requisite does not exist the control will more than likely become a CCP. There must be a documented procedure and associated records where appropriate, to ensure that pre-requisite controls are effectively managed.
CODEX/NACMCF: Preparatory stages 2- Preparatory stages 2 – Describe the product/ describe the food and its distribution
Relevant safety information about the product should include:
- intrinsics such as aw, pH etc.
- treatments which reduce, eliminate or hold microbial levels, such as cooking, freezing etc.
- storage conditions
- distribution methods
PREVENTIVE RULE: No comparable requirements
BRC: Describe the product
2.3.1 A full description for each product or group of products shall be developed, which includes all relevant information on food safety. As a guide, this may include the following, although this is not an exhaustive list:
- composition (e.g. raw materials, ingredients, allergens, recipe)
- origin of ingredients
- physical or chemical properties that impact food safety (e.g. pH, aw)
- treatment and processing (e.g. cooking, cooling)
- packaging system (e.g. modified atmosphere, vacuum)
- storage and distribution conditions (e.g. chilled, ambient)
- target safe shelf life under prescribed storage and usage conditions.
2.3.2 All relevant information needed to conduct the hazard analysis shall be collected, maintained, documented and updated. The company will ensure that the HACCP plan is based on comprehensive information sources, which are referenced and available on request. As a guide, this may include the following, although this is not an exhaustive list:
- the latest scientific literature
- historical and known hazards associated with specific food products
- relevant codes of practice
- recognised guidelines
- food safety legislation relevant for the production and sale of products
- customer requirements.
COMPARISON: Again, to comply with BRC a full product description as stated in the standard.
The information sources that have been used during the creation of the HACCP study must be listed. This isn’t a requirement of the FDA, but clearly the FSMA Preventive Rule should be in the list.
CODEX/NACMCF: Preparatory stages 3 – Identify the intended use/describe the intended use and customers of the food
This should include:
- who the product is produced for (the customer)
- the expected uses by the customer
- who the product is not suitable for
PREVENTIVE RULE: No comparable requirements
BRC: Intended Use
2.4.1 The intended use of the product by the customer, and any known alternative use, shall be described, defining the consumer target groups, including the suitability of the product for vulnerable groups of the population (e.g. infants, elderly, allergy sufferers).
COMPARISON: Although the preventive rule does not require a description of the intended use or customer, it is essential to understand this – so having to document it, will ensure that the team is clear and therefore any associated hazards are included in the assessment.
The preventive rule allows preventive controls to be applied outside the company’s control, such as cooking a raw product either by a further manufacturer or a customer. Therefore, it is implied that intended use, instructions for use and the intended customer are required.
CODEX/NACMCF: Preparatory stages 4 -Construct flow diagram/ develop a flow diagram which describes the product
- The process flow should cover all steps in the manufacturing process of the product, in line with the scope (start and end points)
Preparatory stages 5 – On-site confirmation of flow diagram
Walk the process flow, confirming the steps
PREVENTIVE RULE: No comparable requirements
BRC: Flow Diagram
2.5.1 A flow diagram shall be prepared to cover each product, product category or process. This shall set out all aspects of the food process operation within the HACCP scope, from raw material receipt through to processing, storage and distribution. As a guide, this should include the following, although this is not an exhaustive list:
- plan of premises and equipment layout
- raw materials including introduction of utilities and other contact materials (e.g. water, packaging)
- sequence and interaction of all process steps
- outsourced processes and subcontracted work
- potential for process delay
- rework and recycling
- low-risk/high-risk/high-care area segregation
- finished products, intermediate/semi-processed products, by-products and waste.
2.6.1 The HACCP food safety team shall verify the accuracy of the flow diagrams by on-site audit and challenge at least annually. Daily and seasonal variations shall be considered and evaluated. Records of verified flow diagrams shall be maintained.
COMPARISON: The preventive rule needs you to include hazards which are inherent to the raw material and also those that may be due to food fraud (for economic gain). Therefore, the typical flow diagram which begins at raw material intake may not start early enough in the process. Either all of the inherent raw material and food fraud hazards would need to be listed at the point of intake, or the flow diagram would start earlier at the point of procurement.
For me, this is a really interesting point. In my opinion a typical HACCP which is driven by a manufacturing process flow chart is one of the outdated aspects of HACCP. There are so many processes that impact on the safety of the product, that do not occur during the manufacturing process. For example, in the UK there are a high number of recalls due to the product packaging not having the correct allergens listed – this could either be due to the fact that they have packed the wrong product in the wrong pack (which is a manufacturing hazard) or because the artwork for the product is incorrect (which is a process outside the manufacturing process).
By not being restricted by a typical HACCP process flow, I can see the benefits in being able to widen the scope and include key non-manufacturing points, such as new product development, specification generation and artwork.
CODEX/NACMCF: Codex principle 1 – Hazard analysis
- List the potential hazards
- carry out hazard analysis of severity and likelihood
- consider control measures (not monitors)
1.Define the scope of the assessment
Food safety hazard analysis must consider:
- Known inherent hazards
- hazards which could ‘reasonably occur’
The hazards categories that must be considered are:
- Chemical, including radiological
The hazards may be caused because
- they are inherent to the raw material or product
- they occur through error during the process
- be carried out deliberately for economic gain (for food safety only)
2. Identify the hazards
Sources of hazards to be considered are:
- the environmental (FDA specifically quote pathogens from the environment which may contaminated ready-to-eat foods)
- the recipe or formulation
- Ingredients (inherent risks)
- the manufacturing process
- the fabrication of the facility
- the equipment used
- the tools used
- the intended use of the food
3. Carry out hazard analysis
The analysis must include: severity and likelihood (FDA terms this probability of occurence) in the absence of preventive controls.
BRC: Hazard Analysis (Codex Principle 1)
2.7.1 The HACCP food safety team shall identify and record all the potential hazards that are reasonably expected to occur at each step in relation to product, process and facilities. This shall include hazards present in raw materials, those introduced during the process or surviving the process steps, and allergen risks (refer to clause 5.3). It shall also take account of the preceding and following steps in the process chain.
2.7.2 The HACCP food safety team shall conduct a hazard analysis to identify hazards which need to be prevented, eliminated or reduced to acceptable levels. Consideration shall be given to the following:
- likely occurrence of hazard
- severity of the effects on consumer safety
- vulnerability of those exposed
- survival and multiplication of micro-organisms of specific concern to the product
- presence or production of toxins, chemicals or foreign bodies
- contamination of raw materials, intermediate/semi-processed product, or finished product.
- Where elimination of the hazard is not practical, justification for acceptable levels of the hazard in the finished product shall be determined and documented.
Scope: If you comply with the BRC, in order to comply with HARPC you’ll need to widen the scope of the hazards assessed to include:
- Inherent risks in the raw materials (this is implied but not always covered in a typical HACCP)
- Economic gain hazards
The BRC need both of the above elements covering, however they wouldn’t normally be covered as part of the HACCP, but would sit as separate documents, being:
- A raw material risk assessment
- A raw material vulnerability assessment
Your BRC auditor won’t mind where the assessment is done, as long as it meets the requirement of 220.127.116.11 for the raw material risk assessment and 5.4.2 for your vulnerability assessment. Plus your vulnerability assessment for BRC must cover quality and legal threats, not just the food safety ones as specified by the preventive rule.
Using a severity and likelihood assessment for raw material risk assessment makes sense to me, so I can see it being amalgamated into the HACCP/HARPC plan, with no problem.
Hazard Analysis: As we said last time, there is a major difference in the way the hazard analysis is carried out. The likelihood (or probability as the FDA call it), but be carried out without the controls taken into consideration. Not a problem for BRC, as long as your documented method for carrying out the assessment explains this. The problem comes later, when you have a huge number of significant hazards to deal with!
However, to me, a vulnerability assessment is assessing threats, rather than hazards. So the scope of the assessment is different. I would keep the vulnerability assessment separate to the HACCP/HARPC plan – especially given that the FDA are announcing the final requirements of the intentional adulteration rule in May this year, which is also threat based. Therefore the economic gain assessment and the intentional adulteration assessment can be done as one.
CODEX/NACMCF: Codex principle 2 – Determine CCPs
Using a CCP decision tree
PREVENTIVE RULE: Add preventive controls
To control each of the significant hazards, preventive controls must be applied.
The FDA advise that these will include measures such as (these are examples, not an exhaustive list):
- process controls
- food allergen controls
- sanitisation controls
- supply-chain controls
- recall plan
BRC: Determine CCPs (Codex Principle 2)
2.8.1 For each hazard that requires control, control points shall be reviewed to identify those that are critical. This requires a logical approach and may be facilitated by use of a decision tree.
Critical control points (CCPs) shall be those control points which are required in order to prevent or eliminate a food safety hazard or reduce it to an acceptable level.
If a hazard is identified at a step where control is necessary for safety but the control does not exist, the product or process shall be modified at that step, or at an earlier step, to provide a control measure.
COMPARISON: Preventive Controls
Any hazard that comes out of the assessment as significant needs to have a preventive control added. Therefore significant hazard = preventive control.
Here it is important to think about what is the one thing, which will prevent this hazard from occurring. Don’t be tempted, as we would normally with HACCP, to put down all the controls you can think of. For example sometimes we would say a control for a hazard in HACCP is ‘training’ or ‘supervision’, when we really know that doesn’t actually ‘control’ the hazard, it’s just an added benefit. I like this about HARPC, I find there are lot of rules in HACCP which are applied, when actually we all know that they don’t add any value, we’re just kidding ourselves. Here we can do that, because if we do we’re going to end up with a massive amount of preventive controls which are totally unmanageable.
Now we’ve two levels of control sorted:
- Hazards which are not significant = managed by PRP controls
- Hazards which are significant = managed as preventive controls
So, next we need to work out, which out of the preventive controls we have – are CCPs. In order to do this we need to be really clear about what the difference between a preventive control and a CCP is.
The FDA defines a CCP as “a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.” (This is consistent with Codex and NACMCF)
The FDA defines a preventive control as “risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.”
Personally I think this is more of a statement or an explanation than a definition, so I’ve boiled it down to make it a bit easier to understand, so it now becomes: “Procedures, practices, and processes to significantly minimize or prevent the hazard.” So now we have definitions that we can compare:
- CCP = “a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.”
- PC = “Procedures, practices, and processes to significantly minimize or prevent the hazard.”
So, exacting the important parts from both definitions, you can compare:
CCP = prevent or eliminate a hazard / PC = minimize or prevent a hazard. Both prevent the hazard, so that’s not the difference.
There are 2 very slight differences that I can see:
- A PC minimizes, whereas a CCP eliminates
- A CCP is “where control can be applied”
So, a CCP is the point where the hazard is eliminated and it can be positively confirmed as being eliminated – as a control, in the true sense of the word (from HACCP) can be applied. The typical CCP decision tree does not need to be used, I’ve checked this with BRC and they have confirmed this is why clause 2.8.1 is written as it is:
“This requires a logical approach and may be facilitated by use of a decision tree. “ Note the use of the word ‘may’. It does however, state a logical approach, so a method for determining the CCPs from the PCs would need to be documented.
CODEX/NACMCF: Codex principle 3 – Establish critical limits for each CCP
- Define the critical limits that will control the CCP
- Validate the critical limits
PREVENTIVE RULE: No comparable requirements
BRC: Establish Critical Limits (Codex Principle 3)
2.9.1 For each CCP, the appropriate critical limits shall be defined in order to identify clearly whether the process is in or out of control. Critical limits shall be:
- measurable wherever possible (e.g. time, temperature, pH)
- supported by clear guidance or examples where measures are subjective (e.g. photographs).
2.9.2 The HACCP food safety team shall validate each CCP. Documented evidence shall show that the control measures selected and critical limits identified are capable of consistently controlling the hazard to the specified acceptable level.
COMPARISON: Now we should have preventive controls and CCPs. The CCPs should have critical limits, as they will be controls in the true sense (not checks for example).
The preventive controls however, may not have critical limits, but would require pass and fail criteria to be applied, even though the application of these may be more subjective.
- Where critical limits are applied, these should be validated.
- Where criteria are applied instead, then these should be justified.
CODEX/NACMCF: Codex principle 4 – Establish a monitoring system for each CCP
Establish a monitoring system for each CCP
- Define how the CCP will be monitored using the critical limits
- Set frequency of monitoring
- Records to be verified on completion
PREVENTIVE RULE: Implement monitoring systems
For each preventive control required to manage a significant hazard, a monitoring procedure must be created and implemented, which includes:
- Completion of records
BRC: Establish Monitoring (Codex Principle 4)
2.10.1 A monitoring procedure shall be established for each CCP to ensure compliance with critical limits. The monitoring system shall be able to detect loss of control of CCPs and wherever possible provide information in time for corrective action to be taken. As a guide, consideration may be given to the following, although this is not an exhaustive list:
- on-line measurement
- off-line measurement
- continuous measurement (e.g. thermographs, pH meters etc.). Where discontinuous measurement is used, the system shall ensure that the sample taken is representative of the batch of product.
2.10.2 Records associated with the monitoring of each CCP shall include the date, time and result of measurement and shall be signed by the person responsible for the monitoring and verified, when appropriate, by an authorised person. Where records are in electronic form there shall be evidence that records have been checked and verified.
COMPARISON: Monitoring procedures and records will now be required for CCPs and PCs. CCP records will need to verified through a second sign off. For both PCs and CCPs the frequency of the monitoring is important.
The BRC expects the frequency of monitoring to be such, so that corrective action can be taken if needed, prior to the product being out of the sites control.
Although not specifically required by BRC, the FDA expects a similar principle to be applied to PCs.
CODEX/NACMCF: Codex principle 5 – Establish corrective actions
Define what steps must be taken where monitoring shows deviation to the critical limits
PREVENTIVE RULE: Add corrective actions and corrections
A procedure must be created and implemented for each preventive control, which covers:
- where the monitoring procedure highlights a problem
- where the monitoring procedure has not been adhered to
BRC: Establish Corrective Actions (Codex Principle 5)
2.11.1 The HACCP food safety team shall specify and document the corrective action to be taken when monitored results indicate a failure to meet a control limit, or when monitored results indicate a trend towards loss of control. This shall include the action to be taken by nominated personnel with regard to any products that have been manufactured during the period when the process was out of control.
COMPARISON: Corrective actions are required for both CCPs and PCs.
In section 2 of the BRC corrective actions are only required for CCPs. However, clause 3.7.1 (corrective and preventive actions) requires all procedures within the quality management system to have corrective and preventive actions defined. Therefore, it is sensible to assume that the BRC would expect preventive control procedures to have corrective and preventive actions detailed.
CODEX/NACMCF: Codex principle 6 – Establish verification procedures
- Define the verification activities
- Review of the plan
PREVENTIVE RULE: Verify the system
FDA state that verification must be implemented to show that the preventive controls are working. Verification would include activities such as:
- checking and signing off that preventive control records have completed and completed correctly
- testing of raw materials, in process materials or finished product
- verifying the accuracy of monitoring or measuring equipment
- environmental testing
- reviews, including trending e.g. complaints
BRC: Establish Verification Procedures (Codex Principle 6)
2.12.1 Procedures of verification shall be established to confirm that the HACCP plan, including controls managed by prerequisite programmes, continues to be effective. Examples of verification activities include:
- internal audits
- review of records where acceptable limits have been exceeded
- review of complaints by enforcement authorities or customers
- review of incidents of product withdrawal or recall.
- Results of verification shall be recorded and communicated to the HACCP food safety team.
COMPARISON: The BRC requirements fulfill the preventive rule as long as a combined HACCP and HARPC plan is routinely verified, meaning that preventive controls and CCPs are assessed.
CODEX/NACMCF: Codex principle 7 – Establish documentation and record keeping
To be able to provide evidence that the system is under control
PREVENTIVE RULE: FSMA now expects food facilities to have records to prove that protection measures have been applied and adhered to and these must be available on request of an audit.
Reanalyse the system
The hazard analysis must be reviewed every 3 years as a minimum. It must also be reviewed when:
- there is a significant change which may change the hazards which affect the food
- new information regarding food safety is received
- a preventive control is found to be ineffective
Where the FDA say ‘where a preventive control is found to be ineffective’, they do not mean each time a preventive control monitor highlights a problem, or where a monitoring procedure has not been adhered to – but when it is realised that an existing preventive control does not control the hazard highlighted.
BRC: Documentation & Record Keeping (Codex Principle 7)
2.13.1 Documentation and record keeping shall be sufficient to enable the site to verify that the HACCP controls, including controls managed by prerequisite programmes, are in place and maintained.
2.14.1 The HACCP food safety team shall review the HACCP plan and prerequisite programmes at least annually and prior to any changes which may affect product safety. As a guide, these may include the following, although this is not an exhaustive list:
- change in raw materials or supplier of raw materials
- change in ingredients/recipe
- change in processing conditions, process flow or equipment
- change in packaging, storage or distribution conditions
- change in consumer use
- emergence of a new risk (e.g. known adulteration of an ingredient)
- following a recall
- new developments in scientific information associated with ingredients, process or product.
- Appropriate changes resulting from the review shall be incorporated into the HACCP plan and/or
- Pre-requisite programmes, fully documented and validation recorded.
COMPARISON: As long as the BRC is adhered to and the requirements are extended to preventive controls as well as CCPs, this will comply for both the documentation, recording keeping and review sections.
REFERENCES: NACMCF HACCP Principles (National Advisory Committee on Microbiological Criteria For Foods), Codex Alimentarius Food Hygiene Fourth Edition, BRC Global Standards for Food Safety version 7.