Prerequisite Programs

Validation & Verification:

Two Essential Tools for HACCP Management
By Samuel Rognon Editors note: This is the first article in a 2-part series on HACCP Management tools. The series will continue in the May/ June 2009 issue of AIB Update. AIB International has conducted HACCP Accreditation audits for various industries for more than a decade and has trained thousands of students on HACCP Principles and Prerequisite Programs. During this time, AIB experts have kept abreast of food safety-related scientific developments, important product market failures at the global level, and legal trends in various countries. Additionally, theyve participated in specialized conferences on many current issues. Based on these experiences, the following conclusions are always most evident: Prerequisite Programs control the majority of food safety hazards. Curiously, it is the implementation of these Programs that is involved in the most frequent food safety breaches. HACCP should be based on food science. Many companies lack validation data or studies which demonstrate the scientific basis for their HACCP Plan. HACCP depends heavily on the human factor; therefore, its success is the direct result of the effectiveness of the training and education of personnel, and the verification of these activities. HACCP is a dynamic system that should be adapted to the frequent changes occurring in the industry; hence the importance of an effective and precise change management program, as well as periodic revalidation that takes place as often as the HACCP system calls for it. A true commitment to the HACCP system is vital to recognize that food safety not only protects the health of consumers, but also a brands reputation. This commitment can suffer if the beneficial effects of HACCP and its Prerequisites arent perceived, or if the programs are inefficiently managed. AIBs newly updated Advanced HACCP seminar aims to demonstrate these conclusions in 10 chapters, focusing on applying verification and validation in Prerequisite Programs in each step of the implementation of a HACCP system and in the respective process of bringing these programs and systems up to date.

6 MARCH/APRIL 2009 AIB UPDATE

MARCH/APRIL 2009 AIB UPDATE

Prerequisite Programs
COURSE INTRODUCTION. The HACCP system is recognized today as the best method to ensure food safety. It has evolved from a commercial advantage to a necessity for conducting business. Numerous market recalls due to food safety failures demonstrate that a lack of control in the production and handling of food products cannot be forgiven. The consequences of causing harm to consumer health can have a disastrous economic impact, and in the worst case scenario can result in bankruptcy, negative media coverage, and possibly prosecution of those legally responsible at the company. An impressive percentage of market failures occur when procedures exist but are not well understood by employees. When such events happen, a lack of effective verification of employee education and training is often revealed, leading to a discrepancy between what a manager believes happens on the plant floor and what actually takes place on the production lines. Other failures occur when people neglect to validate procedures, demonstrate their effectiveness or understand scientific aspects. Verification and validation have therefore become two fundamental tools for managing any quality system, and are rendered even more important when it comes to programs related to the control or elimination of consumer health hazards. They ensure that the programs are well designed, implemented, understood and supported. MANAGEMENT COMMITMENT. Achieving an unwavering commitment to food safety does not merely involve stating a mission, vision and policy, but rather assuring that upper and middle management truly believe in them and share the belief with their personnel. It must be clear that not just words are involved, but that supporting HACCP and the Prerequisite Programs is the primary responsibility of each and every position at the company, from the managerial to the operational level. In this manner, HACCP ceases to be just another assignment for the Quality Con8 MARCH/APRIL 2009 AIB UPDATE

Achieving an unwavering commitment to food safety does not merely involve stating a mission, vision and policy, but rather assuring that upper and middle management truly believe in them and share the belief with their personnel.

trol Department; instead, departments such as Production, Maintenance and Purchasing become wholly responsible for its implementation. In order to achieve this level of commitment, the HACCP Team should explain the real costs and the tangible and intangible benefits that upper management should be aware of prior to signing the HACCP Plan. For example, does management understand that Principle 5 of HACCP implies that all production that passes through a Critical Control Point (CCP) that has deviated from one of its Critical Limits should be reprocessed, destroyed or set aside for non-food use? Perhaps the risk posed by the release of such batches has not been illustrated in purely economic terms. There is a reason why HACCP uses the terms: hazard, risk, Critical Control Point and Critical Limit. The high risk that a food safety hazard presents to the consumer also represents a high risk for the brand. Much more important than any quality complaint or problem is the difference between quality and food safety: quality is negotiable, whereas food safety is not. Although it is true that internal indicators exist to measure the benefits of a HACCP system, in addition to the explicit and implicit demands of external clients, it is also true that there are ways of calculating the implications of a food safety complaint, media coverage of consumer death, a prosecution or market recall costs. In all of the aforementioned cases, it is difficult to reverse the impact on the companys reputation. EFFECTIVE TRAINING & EDUCATION. Training is not all that is involved in an employee program; but rather educating and developing skills. Educating involves explaining the mission of every employee, which is to detect whatever problems could put the health of the consumer and the brand in danger. How many times has routine become engrained at the expense of the mission, resulting in the accumulation of months of perfect records that dont reflect reality? The employee stops following procedures and simply writes down what the result

should be based on a mental predisposition that produces this expected result: falsified records which have been filled out hours prior to or following the monitoring, or records that have simply been neglected. Not only did this employee fail to understand the mission, but the company also failed by not detecting the lack of education and the lack of verification. The same thing happens with Prerequisite Programs when an employee correctly washes his hands, closes the door, applies the correct cleaning procedure, takes care of his uniform and his behavior but only in the presence of a supervisor or a visitor. He knows what he has to do and how to do it, but he does not know why he always has to do it well.

VERIFICATION
VERIFICATION & VALIDATION. Both of these concepts belong to Principle 6 of HACCP. Verification allows you to make sure that each employee is working in accordance with the procedures, and that he or she will continue doing so. In HACCP, this means that the employee is informed of the hazards related to the job, as well as the proper manner of controlling them, whether that is through Prerequisite Programs or Critical Control Points. From this premise is born the need to verify the correct implementation of all Operational Prerequisites1 (those which are essential for preventing the introduction of hazards) and the CCPs (process steps essential for controlling or eliminating an inevitable hazard). There are three ways of conducting the verification: a. Supervision. This is the verification that is normally carried out by the area supervisor. It consists of ensuring that employees follow their procedures. Frequent verification should be included in the area supervisors job description. Being a routine task, this activity is generally recorded only when a deviation is identified. b. In accordance with a pre-established frequency. A verifier, who may belong to any department, carries out this verification. At least one verifier should be identified for each Prerequisite Program and every CCP, and an explanation should be given regarding exactly what the verification consists of, as well as the frequency at which it is carried out; for example, once a week. The best time to

SYSTEM EVALUATION. By means of specific inspections and audits at each of the CCPs and Prerequisites, or of the entire system in general, AIB defines Inspections and Audits in the following way: An inspection is a thorough physical review of a food facility to assess what is actually happening in a facility at a moment in time. This snapshot gives a realistic assessment of conditions that can be both positive and negative for food processing. An inspection focuses on physical review. An audit is a systematic evaluation of food facility documentation to determine if Programs and related activities achieve planned expectations. An auditor looks at data over time to see if positive or negative trends are developing. An audit focuses on documentation review. In strictly HACCP terms, one can see a parallel between inspecting as a means of verification, and auditing as a tool of validation. Said another way, with the first you are assuring that the programs are being complied with as they are written, whereas the other demonstrates to you that the programs are at least effective and, if there are improvement indicators, efficient.

verify a record is at the beginning or the end of a shift, whereas the best time to verify the level of education and training of the personnel in charge of monitoring a CCP or Prerequisite Program is at any random moment, without warning. The idea is not to surprise the person and look for faults, but to be comforted in the notion that everyone knows their mission and can execute it. c. At least during annual internal audits. This, in some ways, is the verification of the entire system. It gives the facility the opportunity to revise all of the Operational Prerequisite Programs and CCPs at least once a year in order to ensure that the verifiers are carrying out their role thoroughly. In essence the verifier is verified. If the verifiers were effective throughout the whole year, serious findings should not be uncovered during an internal audit. With these three types of verification, the verifier should always aim to know the level of training and education of the personnel that are principally responsible for carrying out the correct controls, which might otherwise fail. Verifying in this sense is much more than just revising records which, in the majority of cases, are too perfect to be trusted without an accompanying onsite verification that reflects the reality on the floor. In very practical terms, verifying not only makes certain that the records are complete and reflective of what we said must happen, but it also indicates that employees really did what they wrote on the records. Validation consists of demonstrating (i.e., having evidence) that each program is capable of being effective if we comply with them. Validation gathers all of the necessary scientific, experimental and technical data together in order to demonstrate that no negligence took place. This data constitutes evidence of due diligence, in case the following question is asked: Did the company do everything possible to avoid consumer death? Furthermore, these two concepts, when appropriately applied, help to detect the cause of systemic failures and to improve the operational indicators.
MARCH/APRIL 2009 AIB UPDATE 9

Prerequisite Programs
Validation must be conducted before the program effective dates (Prerequisite Programs and CCPs), at least once a year, and every time that a change management mechanism causes a significant change to take place. in summary. To summarize: Validate: if we comply with the programs, they can be effective. Verify: we are complying with the programs. Validate + Verify = the programs are effective. of some part of the production process. It becomes very difficult to know how many products could have been contaminated. Even if it were feasible to identify the exact quantity of suspect products, what would you do with them? There are very few alternatives available; except in rare cases, there are no sampling plans that guarantee the acceptability of a product with respect to a contaminant. What will be analyzed? The presence of metallic particles? Indicators? Specific pathogens? If there is a possibility that biological contamination occurred, no one will of verification and validation should be adopted. But why wait until unacceptable and costly situations take place in order to achieve Prerequisite Program effectiveness? Now we turn to a review of these Programs significance in order to better understand how to verify and validate them. Prerequisite Programs are the basic conditions and procedures of a company related to the production of food that ensure the compliance of all legal requirements, including the GMPs and any Standard Sanitation Procedure that risk associated with a well defined hazard. In fact, the majority of market recalls are caused by the lack of control of a Prerequisite Program. For this reason, many of the health requirements should be considered non-negotiable, as is the case with critical limits. What is more, no CCP can be effective if the Preventive Programs are not effective. The majority of AIB auditors would say without a doubt that 80 to 100% of hazards are controlled by a Prerequisite Program. The rationale driving this conclusion is rarely recognized: that the effectiveness of to demonstrate that the program ensures food safety in situations of the highest level of potential contamination. Verification is later responsible for demonstrating that there is permanent compliance with the program. It should be validated that the preventive control measures for the water supply are effective, that the pipes and plumbing control system protect potable water from recontamination prior to use, and that interconnections between the clean and contaminated water systems are not generated. Often, validation consists of a microbiological analysis of indicators at various water usage points, including at least the farthest point in the pipe. There should be evidence that the IPM program allows for: u Controlling pest populations that are susceptible to transmitting food-borne diseases. This is typically confirmed with customer complaints and trend analysis for the monitoring of live or dead pests and indications of the presence of pests or damaged product. u Eventual pesticide applications that wont present chemical contamination hazards. Validation here consists of having the technical information of all the products used: labels with the active ingredient, dose, quantity and manner of application. In certain countries, this information is even controlled by the local government. Another example: In addition to the absence of food safety customer complaints, foreign material control programs can be validated by the number of rejects in the foreign material elimination devices, such as: objects caught in the filters; rejected in sifter tailings; retained by magnets; rejected by the metal detectors, X-rays, optical detectors, etc. The other fundamental Prerequisite Programs are managed in the same fashion. Validating to demonstrate that the control measures are correct and based on science, experience or regulations and verifying to demonstrate that the program is in compliance and that employees who have been educated will continue to comply with it. Among the common Operational Prerequisites are: Water Quality, Maintenance for Food Safety, Personnel Health and Hygiene, Chemical Control, Supplier Control, Transportation and Storage, Allergen Control, etc. The concept of validation also applies to Customer Complaint Programs, market recalls and traceability systems, and mock recalls. For example, the effectiveness of the traceability system can be measured in terms of the time it takes to carry out the exercise and the percentage that can be traced forward or backwards. As has been mentioned in the above definitions, validation is complemented by practical activities and verification systematics. These activities are essential for Prerequisite Programs. Even though it may appear repetitive, it is worth it to insist on the value of visual verification of the activities, not just the records that appear to indicate their compliance. Have the cleaning procedures been completed? Daily and nightly? Did anyone observe how the activities were carried out and match them to the procedures? The same applies for post maintenance cleaning; allergen cleaning; pesticide application; chemicals preparation; hand washing processes; anti-backflow systems in the pipes; correctly filling out receiving, production and shipping records with exact lot numbers; etc. This article series will continue in the next issue of AIB Update. The second article will address verification and validation of the implementation of the 7 HACCP principles. AIB
The author is an auditor and trainier for AIB International. (Endnotes) 1 Operational Prerequisite Programs are terms uses by the ISO 22000 Standard to define those programs that are essential for preventing the introduction of hazards. MARCH/APRIL 2009 AIB UPDATE 11

Verification and validation have become two fundamental tools for managing any quality system, and are rendered even more important when it comes to programs related to the control or elimination of consumer health hazards. They ensure that the programs are well designed, implemented, understood and supported.

PREREQUISITE PROGRAMS. When a HACCP Team is asked if any of the following situations has ever occurred, the majority answer: yes, sometimes more than once. Leaky roof above a product zone Hand washing stations that lack soap in sensitive areas Bird nest above finished product or packaging materials A missing allergen cleaning record No evidence that cleaning or sanitizing occurred after a maintenance job on a food contact surface An unidentifiable chemical compound container found in a processing area All of these situations have various aspects in common. They are real situations and in the majority of cases only one immediate, incomplete corrective action is taken. For example, covering the leak, supplying the dispensers with soap, removing the nest, or asking the supervisor if the allergen cleaning or the sanitizing that should happen after completing the maintenance job was really done (to which they reply: yes). However, these circumstances should be taken more seriously, since all of them could signify a dangerous contamination
10 MARCH/APRIL 2009 AIB UPDATE

know what to analyze. Finally, if there is a situation involving possible contamination, the retained lot(s) should probably be destroyed or reprocessed or used for a non-food purpose, as is the case when there is a deviation from a critical limit! In situations such as these, who has honestly opted to take such a radical decision as destroying products or conducting a market recall? Very few have, especially since a lot of money is put on the line when basic errors are committed. That being said, risky products leave the plant every day because people dont avoid basic errors. HACCP is an illusion if an incorruptible commitment to Prerequisites is not made. But the story does not stop here. Lets imagine that a company has retained and destroyed the suspect products. The news would no doubt make its way to the directors, who would not permit the same problem to happen twice, given the immense cost that the events represent. A root cause analysis would be carried out, and it would be discovered that a simple gap in the implementation of Prerequisite Programs was the problem. Finally, it would be agreed that these Programs should be reinforced, that preventive measures should be taken, and that tools

should ensure sanitary conditions in a food handling environment. In general, the Sanitation Prerequisite Programs prevent the introduction of any adulterant: those that affect the quality of the product, those that affect its legality, and those that possibly affect food safety. In HACCP, we are interested in those adulterants that are hazards. The remaining adulterants can be controlled by the GMPs and other general Perquisite Programs. The Prerequisites that are essential to controlling hazards are called Operational Prerequisite Programs in this text, an allusion to the terminology adopted by ISO 22000. If an Operational Prerequisite is essential to controlling hazards, then it is as important as any CCP. The difference is that a CCP is a process step characterized by one or various critical limits, while Operational Prerequisites are not process manufacturing steps but rather processing environment control programs, characterized by various conditions that should be monitored in such a way as to control multiple and, many times, vague sources of contamination. In a way, it is more difficult to control multiple sanitation conditions than a specific, measurable critical limit for the elimination of a

HACCP depends in large measure if not completely on Prerequisite Programs. In fact, certain companies have been able to validate a HACCP system without CCPs. Since the heart of HACCP is the analysis of hazards, companies should demonstrate that their Prerequisite Programs are capable of controlling hazards (validation data) and that the Programs are correctly implemented (effective verification). Consequently, all food facilities should test to see if their Prerequisite Programs are valid; for example: It should be demonstrated that the frequency and methods of cleaning and or sanitizing are adequate to achieve the level of physical, microbiological and chemical cleaning that would sufficiently avoid hazardous contamination by allergens, pests, pathogens or chemical residues. There are experimental, official and quick methods and techniques that exist to obtain said results. In general, these tests are done at a minimum of once per year, or in accordance with environmental changes, in the worst processing conditions (or simulating them) in order