You Have HACCP; You Need Preventative Controls: Can You Get from Here to There?

As the industry begins digging into the Preventive Controls draft rule, working to discover what it really means to them and what will need to be done for compliance, questions abound. Many of those we are hearing revolve around Preventive Controls vs. HACCP:

Are the Preventive Controls really just HACCP in disguise?

What are the differences?

I already have a HACCP plan – am I all set?

If I already have HACCP, can I build on that? How?

Or … do I have to start from scratch??=

The first thing we want to do is assure you that if you have a HACCP plan, or even if you just have GMPs in place, it is very unlikely that you will have to start from scratch. Think of Preventive Controls as HACCP on steroids.

The rule does reference HACCP quite a bit (847 times to be exact). In fact, in Section II. C., it states, “FDA tentatively concludes for several reasons that HACCP is the appropriate framework to reference in interpreting and implementing section 103 of FSMA.” It goes on to explain that a hazard analysis is the first step of HACCP, the analysis is key to an effective food safety system, and the central purpose of HACCP is the establishment of a system of preventive controls for the identified hazards. Additionally HACCP incorporates a process of hazard analysis, preventive controls, monitoring, corrective actions, verification, and record keeping … Sound familiar from FSMA?

However, it is important to remember that HACCP is still only “an appropriate framework to reference” for implementation of the new rule. So even if you have an existing plan, you will need to start with a new analysis based on the requirements and additional specifications of the new rule, as well as any changes in your operation. But much of the thinking you have done for your HACCP plan will still be used as you work through this new process.

For example, if you have a HACCP plan, you have determined risk and likelihood of biological, chemical, and physical hazards at each point in the process; analyzed your operation to identify CCPs; and specified critical limits for each. With Preventive Controls, you still need to identify the hazards—with the addition of radiological hazards; and you need to identify and implement preventive controls for these. In some cases, the preventive controls might be process controls that have CCPs, similar to HACCP. However, there might be some hazards for which the HACCP plan might have referred to “prerequisite programs.” This changes with the proposed rule. Any hazard that is “reasonably likely to occur” needs a designated preventive control. So to give you an example: if you have a refrigerated “wet” ready-to-eat (RTE) area, then Listeria monocytogenes is a hazard that you should consider reasonably likely to occur as an environmental contaminant. This is not strictly HACCP, but it is preventive control thinking – see the difference? If there is no “process control,” the preventive control could be a sanitation control or an allergen control program, or something else like a supplier control. Whatever the control, it needs to be specific to addressing the hazard, e.g., a “sanitation control” to address Listeria monocytogenes in a RTE facility is not just general sanitation. How will the sanitation program specifically reduce or eliminate the pathogen on product contact surfaces; how will you know if you are controlling that risk? This is the level of detail that FDA is expecting, and this is different from HACCP. Not all preventive controls (such as sanitation controls) have critical limits—that is another difference between preventive controls and HACCP.

A key difference between the two is that HACCP focuses more on what you will do, whereas Preventive Controls focus on how you will do it, through a science- and risk-based approach. It is part of what makes Preventive Controls more complex, and sometimes fuzzier, and thus less amenable to a simple check list or template. The expectation is that the preventive controls approach will require more thought and expertise—hence the requirement that the food safety plan be written by a qualified individual. With its identified CCPs and critical limits, such as time and temperature, HACCP is objective and verifiable. A preventive control, however, could be hygiene—which is a bit more difficult to measure. So instead of a specified limit, the control could be having accessible handwashing stations and policies—written policies, that is, which are checked and monitored and verified, with corrective action identified, and implemented when needed. Preventive Controls has expanded hazards to be controlled and elevated those of higher risk (those that are reasonably likely to occur) to needing a designated preventive control that will be subject to a greater level of scrutiny, rigor, and verification

So where do you start?

First, conduct a new hazard analysis of your products and processes, identifying any and all hazards which are reasonably foreseeable to occur and whittling that list down to those that are reasonably likely to occur. Any hazard that is reasonably likely to occur must have a preventive control toYou Have HACCP; You Need Preventive Controls: Can You Get from Here to There reduce or eliminate the hazard. When doing this, remember that proposed rules require you to think about biological, chemical, physical, and radiological hazards.

Then, remember that we said Preventive Controls are like HACCP on steroids. That is, the rule does not just leverage HACCP, preventive controls must also be derived from your other existing plans and policies, such as allergen management, sanitation, employee hygiene—as well as any other HACCP prerequisite programs, which are still critical, still expected, and still a part of good GMPs.

So the best place to start is to form a team to focus on this. Remember you need a “qualified individual” to have responsibility for the development of your food safety plan using the policies and standards you currently have in place as a starting point. A qualified individual is a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system.

Once your team is in place, gather together everything you have in writing, anywhere in your operation. You may want to add a brainstorming session to identify any “unwritten rules” that should be put into writing. Depending on how organized and consolidated your current policies are, you may have an easy task ahead, or it may take a bit of work to get it all pulled together.

Either way, you probably already have many of the elements, you will just need to gather them all together and see what you are missing. Then you will need to add updates from your new analysis and/or operational changes; ensure you include monitoring, verification, and corrective action; then cull and pull it all together into a single, written food safety plan. We will be writing a lot more in the near future on how to address these other points, and we continue to post white papers on our web site that will help you navigate all these new challenges.

So, the final answer is: No, you don’t need to start from scratch! But you do need to do some work. The bar is being raised, and while your current HACCP plan may serve as the cornerstone of your food safety plan, you need to build the rest of the structure to satisfy the proposed Preventive Controls Rule.