How the history of food safety shapes today's rules

A commitment to food safety certainly is not new. In fact, it was just this that led to the development of HACCP (Hazard Analysis, Critical Control Points) back in 1959. The scientists from the National Aeronautical and Space Agency (NASA), the Natick Army Laboratories and Pillsbury put their heads together to create a risk-based system to ensure food safety that became HACCP.

NASA, under the leadership of Dr. Paul LaChance, mandated that its contractors identify “critical failure areas” and eliminate them from the system. It also mandated that foods for the space program be pathogen free.

To ensure that these foods were safe, extensive testing was done, so much so that there was little product left. There had to be a better way, and HACCP was the answer. The processors identified significant microbiological hazards and established procedures to control the identified hazards.

These three groups established that finished testing was not the way to ensure the production of safe foods. The way to do so was to manage and control the processes, in other words, be proactive.

Pillsbury thought enough of the system that it adopted it company-wide and even became trainers for representatives of the Food and Drug Administration back in 1973.

HACCP received a big boost in 1985 in a report issued by the National Academy of Sciences entitled “An Evaluation of the Role of Microbiological Criteria for Foods and Ingredients.” The report stated that HACCP “provides a more specific and critical approach to the control of microbiological hazards than that achievable by traditional inspection and quality control procedures.”

The report also concluded that “testing of finished products was not an effective means of protecting the consumer and assuring the foods were free of microorganisms of public health significance,” a conclusion which some individuals and organizations still seem to be ignoring. Ironically, these conclusions were the same reached by the scientists from Natick, Pillsbury and NASA 25 years before.

The committee that developed this report remained in place and was renamed the National Advisory Committee for Microbiological Criteria for Foods (NACMCF). This committee first published basic principles for HACCP in 1989—principles that were revised in 1992 and 1997. The seven principles published in 1997 harmonized the NACMCF and the Codex Committee on Food Hygiene, which meant that the world agreed not only on the seven basic principles of HACCP, but the five preliminary steps.

HACCP expands throughout the world

From the mid-1980s with the publication of the National Academy of Sciences report, food processors began to adopt HACCP in earnest around the world. This was driven in part by regulations and through business pressures. The European Union mandated the program for all food processors to be completed by 2006. The United States established HACCP regulations for seafood in 1995, meat and poultry in 1996 and juice in 2001. The enactment of the seafood HACCP regulation had far-reaching consequences for HACCP as a system. By including the concept of prerequisite programs for HACCP in the regulation and implying that certain hazards could be controlled using these programs, the groundwork was set for ISO 22000 and the Preventive Controls Regulations.

But what really must be acknowledged is that a significant part of HACCP growth, especially in the US, was not driven by regulatory considerations, but by economics. Large processors, grocery chains and fast food/restaurant operations simply told their suppliers that food safety was now an essential element in the purchasing equation; no HACCP or food safety plan, no business for you.

The food industry had been utilizing third-party audit firms for years, but it was during this same period that the old GMP or sanitation audit morphed into the HACCP audit, an industry and its associated protocols that are still changing today.

It was also during this window that the US FDA showed that it supported the adoption of HACCP. This occurred even before the seafood and juice HACCP regulations were enacted. We can go back to 1971 with the adoption of the Low Acid Canned Food Regulations found in 21 CFR Part 113. These are an HACCP-based approach to addressing a specific food hazard: Clostridium botulinum. The proactive approach offered through HACCP was lauded by many experts.

“Our safety systems should be preventing problems rather than chasing the horses after they are out of the barn,” says former FDA Commissioner David Kessler. “HACCP is a system that will make that possible.”

In a 1990 publication, Dr. Fred Shank emphasized industry commitment and manufacturers’ knowledge of their own systems in building food safety programs.

“HACCP utilizes the manufacturer’s in-depth knowledge about his product and processing system,” he wrote. He then explained how such systems could be viewed by the FDA, which is similar to today’s Food Safety Modernization Act (FSMA). “Instead of relying on traditional inspections, our role in HACCP will be to review system parameters and operating procedures, to provide selective auditing of the system’s records, including verification by laboratory analysis, and provide for appropriate enforcement.”

This shows the FDA has long advocated HACCP as a proactive system for ensuring food safety and not “reactive” in nature as many have characterized HACCP to be.

The enactment of FSMA and supporting regulations

FSMA is an act of Congress and a law that requires regulations to ensure proper enforcement. Regulators thought the country could do better when it came to food safety, a perception reinforced by a number of incidents in the 1990s and early 2000s: Jack-in-the Box in 1993; Odwalla in 1996, which helped spawn the meat and poultry and juice HACCP regulations; melamine in imported dairy ingredients; and major outbreaks associated with peanuts and peanut butter in 2007 and 2009.

The 2009 peanut butter outbreak associated with the Peanut Corporation of America was a classic example of what not to do when it comes to protecting the public health. The end result was more than 700 illnesses, a few deaths and more than 400 other recalls. The company no longer exists, and company officers are serving prison time.

Now we have FSMA and Preventive Controls for the industry and for anyone shipping to the US. For now, very small companies might not have to comply with the regulations, but if their customers demand that they do so, they had better do it or risk survival.

The Foundational Rules for FSMA have been developed in the five years since the act was signed into law (see FSMA Foundational Rules). Addressing all of these issues is beyond the scope of this piece, but one issue that created a great deal of confusion was the utilization of the term Hazard Analysis, Risk-Based Preventive Controls (HARPC). After almost five years of waiting, the Preventive Controls Regulations found in 21 CFR Part 117 do not even mention the term HARPC nor does the class for Preventive Controls Qualified Individuals (PCQI).

However, let’s look at different elements that make up the preventive controls regulation and determine how easy or difficult compliance might be.

Determining potential hazards (hazard analysis)

Determining potential hazards is the first step in the preventive controls process and is defined in 21 CFR Part 135. Is this really different from what food processors have been doing in the past? Yes and no. The regulation states, “The hazard analysis must include an evaluation of the hazards identified in paragraph (b) of this section to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls.”

The regulation calls for operators to identify potential hazards and then determine the severity of each hazard and the likelihood of occurrence. This has not been specifically mandated in past HACCP regulations in the US, but it is not new. It has been an expectation in many of the different HACCP audits, the GFSI or Global Food Safety Initiative audit schemes and ISO 22000.

“Determining the hazards is more of witchcraft than it is a science,” says Cliff Coles of Clifford M. Coles Food Safety Consulting, Inc. “It requires an intimate knowledge of the product, the process, the history of the issues and perhaps even consumer complaints. It calls upon everyone in the organization to contribute to the ‘what if’ and ‘what is’ scenario. For those who have relied on third-party laboratories for the sense of security, now becomes the time to truly test the systems that are in place. Identifying the hazards is not a mere paper exercise; it requires hands-on, in-depth thinking and investigations.”

Many large companies have developed schemes to evaluate potential risks using likelihood of occurrence vs. severity of risk. This will obviously be a greater challenge to the smaller companies. But, if a small operator has developed, implemented and is maintaining a functioning food safety program, this next step should not be such a challenge, especially if it has been audited by a third party that has diligently evaluated its HACCP plan and associated hazard analyses. However, this is a common gap.

“The hazard analysis should be well documented and the related corrective actions be detailed enough that the processor can defend what they have done to auditors, regulators and clients,” Coles says. “The Hazard Analysis Worksheet that is used industry-wide is a nice tool, but really does not provide the depth necessary for a good program.”

He warns the Hazard Analysis Worksheet should be a document that is constantly reviewed and updated to accommodate any changes in the production line or facility. The FDA has issued warning letters to low-acid “healthy” juice manufacturers that relied only on high-pressure processing (HPP) and refrigeration as their preservation methods.

“First, the risk is with Clostridium botulinum, not so much with the non-spore forming pathogens. HPP is not a sporicidal process. Secondly, the processor has no control over how long a single-serve juice drink…will be kept out of refrigeration and what role that time lag can play in the growth of C. botulinum,” he explains. “By not determining the proper risks, FDA put a number of manufacturers in this category on notice. The same is happening with IQF vegetable manufacturers that believe that the blanch process is not a kill step. As evidenced by recent FDA recalls, the sentiment is that if you blanch, you had better do a good enough job to eliminate the pathogens and eliminate the reintroduction of the pathogen post-blanch. If a product is peroxidase enzyme negative as a result of the blanch process, it had better be pathogen free also.”

Verification of process preventive controls

In 117.160, the regulation states processors must validate the preventive controls put in place are “adequate to control the hazard as appropriate to the nature of the preventive control and its role in the facility’s food safety system.” The regulation then states that sanitation and allergen preventive controls need not be validated, so it is mandatory that all process preventive controls be properly validated. This means that any process employed by a processor to control a microorganism of public health significance must be properly validated, that is, shown to effectively control the identified hazard.

The low-acid canned food regulations specifically state that processes must be developed by a “competent processing authority to achieve commercial sterility.”

Perhaps the best example of this in the United States food industry today is the program developed by the Almond Board of California (ABC). In response to outbreaks of Salmonella associated with raw almonds in 2001 and 2004, the ABC has implemented programs to ensure that all almonds produced in California are properly processed.

“After the first outbreak, ABC initiated an industry survey to assess prevalence [levels and concentration] of Salmonella bacteria in raw almonds coming from the orchard,” says Tim Birmingham, technical director for the Almond Board of California. “In addition, ABC embarked on an industry-wide food safety program, starting with Good Agricultural Practices in the orchard. However, ABC recognized that GAPs, although necessary, were only a mitigation strategy and could not be relied upon alone to ensure safety.”

ABC determined to ensure food safety, controls needed to be implemented to eliminate the threat. These included a risk assessment on almonds, establishing resistance data for the target pathogen, determining a non-pathogenic surrogate, selecting competent process authorities to ensure all processes for almonds are properly validated and then reviewing said validation data using an expert panel.

“The Almond Board of California Technical Expert Review Panel [TERP]—consisting of food microbiologists, engineers and ex-regulatory personnel—review validations and make a determination as to whether or not the process and equipment are able to deliver a minimum 4-log reduction of Salmonella bacteria on almonds,” he says. “In addition to initial validation and TERP acceptance, ongoing auditing is conducted to ensure equipment is operating within the critical limits accepted by ABC TERP.”

Guidance documents, including good agriculture practices, sanitation, good manufacturing practices, pathogen environmental monitoring and others, are available to the ABC’s members on its website as well as in other forms.

Preventive controls for allergens and sanitation

The Preventive Controls regulation specifically states that preventive controls need to be established for allergens and for sanitation if potential risks are identified during the hazard analysis step. However, the controls for these elements need not be validated. This is contrary to the expectations in the GFSI audit schemes and in the ISO 22000 standard.

“Manufacturers of all foods and beverages need to employ comprehensive microbiological environmental monitoring programs in their facilities where food and beverages are being produced,” says Dr. Eddy Richter, Richter International. “These programs provide essential data to support [verify] that food and beverages are being produced in a wholesome and sanitary manner. Recent FDA warning letters [ice cream] and voluntary recalls [hummus] were a direct result of hazardous pathogens being discovered in the environment of food manufacturing facilities, not in finished product. Large retail customers as well as the federal government will no longer tolerate our nation’s food supply being produced in less than sanitary factories.”

The concept is an essential element of the seafood HACCP regulation, a concept that streamlined HACCP plan development and reduced the number of critical control points significantly. Prior to the enactment of the seafood HACCP regulation, HACCP plans often had 10, 15 or more critical control points. This number was reduced to between one and three in most cases.

Dr. John Surak, with Surak and Associates, further emphasizes that the centerpiece of the regulations is the food safety plan. He says the FDA requires the written Food Safety Plan to have the following:

Hazard analysis
Preventive controls
Monitoring
Corrective actions
Verification including validation
Associated records

“Preventive controls are developed from the hazard analysis and should address the identified food hazards,” he says. “The preventive controls are to be specific to the site, process and product.” Preventive controls, as dictated by the regulations, need to be established for the following:

Process preventive controls, including critical control points
Food allergen preventive controls, mandatory under specific circumstances
Sanitation preventive controls, mandatory under specific circumstances
Supply chain preventive controls, mandatory under specific circumstances

Surak, who served as the leader of the US delegation to the ISO committee that developed the ISO 22000 food safety standard, says the FDA approach is very similar to the ISO 22000 approach. In ISO 22000, the hazard analysis is used to develop a control strategy. In addition, the hazard analysis under ISO 22000 leads to the development of a control strategy, which is documented in either the HACCP plan or in the Operational Prerequisite program (OPRP). So, the CCPs in the ISO HACCP plan are the Process Preventive Controls under FSMA, whereas the OPRPs are equivalent to the food allergen preventive controls, allergen preventive controls and supply preventive controls.

PCQI training

The preventive controls qualified individual (PCQI) is defined in the regulations as “a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or is otherwise qualified through job experience to develop and apply a food safety system.”

“The Food Safety Preventive Controls Alliance [FSPCA] has developed the ‘standardized curriculum’ recognized by FDA to receive this training,” says Jenifer Kane of the International Food Protection Training Institute (IFPTI). “The program is based on collaboration among federal and state regulatory officials, academic food safety researchers and educators and US food industry representatives.”

The regulation requires every processing facility to have a trained resource person or PCQI who has completed specialized training. Kane says responsibilities of the PCQI include:

Preparation of the food safety plan
Validation of the preventive controls
Records review and
Reanalysis of the food safety plan.

Foreign supplier/supplier verification

Based on the hazard analysis, if a company is using ingredients or materials that are deemed potential risks, and there is no step to properly control said hazard, it must have a supplier verification program. This applies to not only products that are prepared, blended and assembled, but also things like salty snacks, such as potato chips, which are deemed a safe product by most, but the seasonings on the chips could be contaminated. (There was a major outbreak of Salmonellosis in Europe in 1995 attributed to potato chips seasoned with contaminated paprika.)

This rule may well be the most complex of all the requirements, especially for small companies, which might not have the resources to properly develop, document, implement and maintain such programs. Processors, might have to turn to outside groups to properly evaluate and maintain their suppliers and the ingredients that they supply. This program may include initial evaluations of materials plus ongoing verification of materials deemed hazardous and, therefore, subject to preventive controls.

Les Vaccarello, a consultant to the date industry, says the industry is doing a lot more to be in compliance.

“We felt that dates were safe and wholesome products. However, due to a combination of market pressures and the enactment of FSMA, the industry has changed,” he says. “Processors are moving forward to adopt the Global Food Safety Initiative [GFSI] audit schemes, the most popular being SQF and BRC at the moment.”

Additionally, the California Date Administration Committee/California Date Commission (CDAC/CDC) funded a study that clearly demonstrated certain varieties of dates not only did not support the growth of Salmonella, but were lethal to the pathogen. A similar study using date paste has shown similar results.

“We feel that the steps that the industry has taken have put us in a position where we can clearly show that our primary products, dates and date paste, are safe. And since these products are eaten and used in many cases without further processing [cold pressed bars], we can comply with the Supplier Verification provisions of the Preventive Controls regulation,” says Vaccarello.

This, as well as the example from the ABC, demonstrates that when industries come together, the potential for ensuring food safety becomes higher and, in the long run, less expensive for the industry in question.

The big question

Perhaps the biggest question in the minds of many food processors in the US and around the world is “How will this be enforced?” For guidance, the industry can look to how FDA has inspected regulated industries, such as seafood and juice. Insight can be gleaned from the guidance documents developed for those two industries. Also, processors should work closely with trade associations for insights into industry issues.

However, the industry will not know until investigations begin, so for now, the best advice is to read the regulations carefully and be ready to explain all programs and produce the necessary documentation to defend your position.

References:

International Organisation for Standardization, (2005), ISO 22000: Food safety Management systems — Requirements for any organization in the food chain, ISO, Geneva, Switzerland.

Shank, F.R., 1990, "The Safety of the Food Supply in the Nineties," J.Assoc.Food & Drug Officials, 54:4, 33.

Sperber, W.H. and Stier, R.F., (2009 – 2010), “Happy 50th Birthday to HACCP,” Food Safety Magazine, 15:6, 42 – 46, December – January.

United States Food & Drug Administration, 1989, Title 21, Code of Federal Regulations, Part 113 & 114, U.S. Government Printing Office, Washington, DC.

USFDA, Dept. of Health and Human Services, (1994), “Food and Safety Assurance Program; Development of Hazard Analysis Critical Control Points,” Proposed Rule, Federal Register, Vol.59:149,39888-39896, August 4.

United States Food & Drug Administration, (1995), “Procedures for the Safe and Sanitary Processing and Importing of Fish and Fishery Products,” Code of Federal Regulations, Title 21 Parts 123 & 1240, December 18.

United States Food & Drug Administration, (2001), “Hazard Analysis Critical Control Point: The Safe and Sanitary Processing and Importing of Juice,” Code of Federal Regulations, 21 CFR Part 120, Federal Register Vol: 66:13, 6137 - 6202.

United States Food & Drug Administration, (2015), Title 21, Code of Federal Regulations, Part 117, “Current Good Manufacturing Practice Hazard Analysis and Risk Based Preventive Controls for Human Food,” U.S. Government Printing Office, Washington, DC.