Beyond HACCP and Preventive Controls: Promoting True Risk-Based Thinking Tied to Public Health Outcomes
“Does this step require a preventive control?” This single box, found in most template hazard analyses, requires a yes or no answer. For all the food safety benefits that Hazard Analysis and Critical Control Points (HACCP) and preventive controls have brought us, maybe thinking of risk in a binary yes/no fashion has done us a disservice. Public health would be better served if companies put the most effort toward managing their greatest risks, deeply understanding the factors that contribute to the risk, allocating resources appropriately to prevent the risks and their root causes, and truly evaluating the effects of those efforts. This article continues the conversation around preventive, proactive approaches to managing food safety that began decades ago. While the conversation has conceptually evolved to promote risk-based thinking and risk-based preventive controls, these are premised on the assessment of risk, which takes skills and resources that may not always be available to each company. And interestingly, neither the U.S. Food and Drug Administration (FDA) Preventive Controls rule [technically called “Current Good Manufacturing Practices (GMPs), Hazard Analysis, and Risk-Based Preventive Controls for Human (or Animal) Food”] nor the FDA Produce Safety rule (technically called “Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption”) includes a definition of “risk.”
The concept and implementation of HACCP-based thinking was as revolutionary as the space age that it accompanied.1 The fundamental shift from a reactive system to a preventive one demonstrably improved food safety. Moving the industry away from testing food to determine safety and toward preventing contamination in the first place was monumental. Implementing a preventive approach requires a systematic evaluation of hazards, and associated risk, at each point in the supply chain. Food manufacturers (the first supply chain segment to voluntarily transition to HACCP) had to truly understand and be able to document their production practices and had to demonstrate their understanding of the various hazards—biological, chemical, and physical—that could be introduced or were expected to be controlled at each step. No longer was it sufficient to simply make a food and hope it wouldn’t hurt people. In many ways, HACCP spawned the food safety discipline. A properly done hazard analysis required the expertise of scientists who understood the various types of hazards, the severity of illness or injury should those hazards be associated with the food, and the likelihood that the hazards would occur. Thus, HACCP and its evolution to preventive controls have been hailed as promoting a risk-based approach to food safety.
But the HACCP approach has evolved from its original application to foods manufactured with a kill step to all kinds of products. This has sparked occasional controversy, since a CCP is “a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.”2 When we consider that there is zero tolerance, and therefore no acceptable level, for most major pathogens, we can eliminate the last part of the definition, resulting in a CCP that, by definition, prevents or eliminates a food safety hazard. This is a pretty black-and-white, yes/no kind of definition. Many types of foods, especially fresh fruits and vegetables, lack a true CCP. Thus, the “preventive controls” approach is a better fit. It recognizes that you don’t throw in the towel just because a production process does not have the yes/no opportunity to prevent or eliminate a hazard. In theory, it enables greater deliberation and should promote a deeper evaluation of risk and the flexibility to implement multiple preventive hurdles. But in practice, doing the hazard analysis and evaluation is often just another box to check.
With 60 years of experience in HACCP, and several years of preventive controls, are we where we need to be when it comes to producing safe food? Maybe it’s time to rethink preventive approaches to food safety. As they’re implemented today, are we effectively protecting public health? Or has filling out the hazard analysis become a paperwork exercise? Have we forgotten the word “analysis” in hazard analysis? Sometimes it seems that “hazard” and “risk” are used interchangeably, neglecting the need to do an analysis of the hazard. If our societal tolerance for risk is zero, then maybe this encourages a simplistic yes/no analysis of a hazard. Likelihood of occurrence and degree of severity are not as consequential when risk must be zero. However, cynicism aside, even a well-thought-out hazard analysis forces the food safety professional to choose one of two options when identifying whether a preventive control is needed: yes or no.
Arguably, the most important box on a typical hazard evaluation template is the “justification.” After a potential hazard is identified for a specific point in a process, does it warrant a CCP/preventive control? Why or why not? This rationale provides a golden opportunity for food safety professionals to communicate their thinking—be it to their successors in the company, to external audiences such as customers, auditors, and regulators, or to themselves as time passes and things change and they need to reevaluate whether the justification still holds true. Most food safety plans fall terribly short of providing a thoughtful, defensible justification. How often does the justification read “managed by GMPs” (when defending why a hazard does not require a CCP) or “previously associated with outbreaks” to indicate that a CCP or preventive control is needed? Some templates include individual scores for “likelihood” and “severity.” There may be a key that defines a score of one versus a score of five; the final score may be the addition of the two factors, or their multiplication, and may drive the user to a matrix that dictates if a CCP is needed based on the total score. But does this truly aid in the analysis of risk? In practice, I have not found this to be true, in part because despite the range of possible scores, the number ultimately is translated to one of two options: A preventive control is needed, or it is not.
When it comes to the growing and harvesting of produce, FDA has essentially done the hazard analysis and identified the preventive controls for farms (water, people, equipment/tools, facilities, biological soil amendments, and animals). The Produce Safety rule does not require growers to think through risks and determine the approaches to manage risk. Despite an overarching requirement to “take appropriate measures to minimize the risk…to covered produce, including those measures reasonably necessary to prevent the introduction of known or reasonably foreseeable hazards,” the regulatory requirement does more to encourage box checking than it does to encourage critical thinking. To the credit of the industry, most produce operations are audited against schemes that do require the analysis of hazards and identification of risk.
The Tie to Public Health Outcomes
An underrecognized factor in being able to evaluate risk is that currently risk is viewed only in the context of the operation performing the hazard analysis and creating or handling the food. The food safety staff person does not view risk from the consumer standpoint. Given the complexity of today’s supply chains, the risk to a consumer may be quite different from the risk of the product as it leaves an operation. Sure, most food safety plans do contain a statement about intended consumer use and may allude to product use and handling after leaving the farm or facility, but at present there is no practical way for an individual food company to evaluate risk to the consumer.
There are two terms that address this issue: the ALOP (which is sometimes called the “acceptable” level of protection but is better termed the “appropriate” level of protection to recognize that we should not be accepting of any food safety issues) and the FSO (food safety objective). The ALOP is consumer focused. Since risk of illness will never be zero, the ALOP is intended to establish the “appropriate” level of public health protection. This would require someone or some entity, generally a governmental body, to set a number or rate of illnesses within a population. In the U.S., the best examples of ALOPs are the “Healthy People” goals that are set each decade.3 The FSO backs this up one step, laying out the level and frequency of contamination in a food that would lead to the ALOP. This is where food safety professionals within the industry need to take over and determine what steps they need to take, individually and collectively, so as not to exceed the FSO.
Today, how many food safety professionals reference the Healthy People goals in their food safety plans? Not surprisingly, the Healthy People 2030 goals call out several hazard-produce pairings, such as leafy greens and a variety of pathogens, and the association of Salmonella with fruit and nuts. To what extent does the industry look beyond the outbreak headlines to understand more holistically the association between their food product and category and foodborne illness? How can we measure progress toward these public health goals? Foodborne illness rates provide the ultimate verification of our food safety systems. Other than this metric, it is difficult to measure prevention.
Alternatives to HACCP/Preventive Controls
There are other ways to view food safety management. At one end of the spectrum is finished product testing. Testing, particularly quantifying pathogen levels at the retail level, could inform progress to the FSO. However, in addition to the volume of food that would be wasted through this kind of testing, it is reactive and provides few if any clues as to where in the system advances are needed to improve outcomes. There is growing pressure to reintroduce testing as a means of lot acceptance. This would move us back in time, not forward. Trending test results over time can have value; using a Certificate of Analysis to prove that a product is “safe” does not. Yet, testing is a tangible, feel-good measure. Statistically, however, the better your preventive food safety system performs, the less likely you are to find the contaminant your system is set up to address.
At the other end of the spectrum is failure mode and effects analysis (FMEA). This approach isn’t new, not even for food safety.4 Over the past few years, several colleagues have mentioned this concept, which can focus either on the product design or on the process (irrespective of the product). Whether used for quality or food safety, it puts a slightly different, and arguably more deliberative and semiquantitative spin, on HACCP. As with HACCP, there is an evaluation of what could go wrong at each point in a process and an assignment of the likelihood and severity of the failure. FMEA also adds an opportunity to quantify the likelihood that the failure will be detected before the harmful effect is realized. Not only does the approach delve into the causes of the failure in a more overt way than HACCP does, but it also allows for greater differentiation and illustration of the spectrum of risks. Although there are still many ways to group and cluster types of risks, which could introduce elements of subjectivity into the analysis, it nevertheless provides a way to visualize and communicate areas where increased focus and resources are warranted.
Root-Cause Analysis
There is an old saying that if you don’t know history, you are doomed to repeat it. The same could be said about food safety issues. If the root cause(s) of a failure (even a potential hypothetical failure or a “near miss” achieved when a failure is detected prior to a negative outcome) is not adequately understood, it’s possible and perhaps likely that the failure will recur. Within a food safety plan, corrections and corrective actions need to be taken if a preventive control fails. These are supposed to ensure that changes are implemented that address an issue in the long term. This circumstance also prompts a reevaluation of the food safety plan in an attempt to understand if an adjustment, either to the hazard analysis or to identification or implementation of the preventive control, is needed.
Most companies keep a log of their corrective and preventive actions. The corrective actions include the action taken in the moment, generally the immediate steps to get the system back in control, and the evaluation and disposition of potentially affected product. The preventive actions are intended to be future looking, putting measures in place for long-term prevention. However, in practice, many times the preventive action is the catchall “retraining.” It may be more effective to develop preventive actions after thoroughly looking back in time to understand the true cause of the failure. This is a benefit to the FMEA approach, which encourages the proactive exploration of what could go wrong that would result in a failure. For produce production, root-cause analysis may require the consideration of factors beyond the farm’s immediate control. Although this can be overwhelming, ignorance is not always bliss. Solutions may be difficult to implement when a system-wide or community-wide approach is warranted, but food safety professionals should embrace the opportunity to engage in problem solving, not shy from it. The critical thinking needed to conduct a root-cause analysis should inform identification of effective preventive controls and facilitate the evaluation of an actual system failure.
Food Safety for the Future
The bottom line is this: Food safety is not formulaic. It requires skilled individuals to think critically about their food production systems. This includes consideration of factors that are in their control (easier for a facility) as well as factors that are outside their control (highly applicable to an outdoor growing environment). At the time someone is enjoying their food, what is the likelihood it will cause illness or injury? What is the role played by each company in that food’s supply chain? Which points in the supply chain need to devote the most resources to managing risk, and then, within that operation, what should be prioritized? It’s not clear that HACCP and risk-based preventive controls, in practice, promote this approach. In 2010, Bill Sperber and Rick Stier wrote the following:5
“Whatever the ultimate configuration of HACCP system details, it is comforting to note that the HACCP pioneers, beginning 50 years ago, established features of HACCP that have not changed. These are the following:
HACCP is a preventive system to control significant, identified hazards.
It functions by designing food safety into a product and controlling the process by which that product is produced.
It does not rely on product testing or lot acceptance criteria.
These features are the timeless essence of HACCP, serving as a permanent testament to the vision of the HACCP pioneers.”
Maybe we don’t need to replace HACCP. Maybe the current generation of food safety professionals simply needs to revisit history and recognize that the hazard analysis of HACCP was never intended to be a “check the box,” yes/no exercise but one much more deliberative. Regardless of the terms we use, food safety professionals at each point in the supply chain must have the knowledge and insight to differentiate hazards from risks, and focus resources in the areas that will have the greatest benefit to consumers. With better visibility through supply chains, increased integration and analysis of data through supply chains, and greater expectations around root-cause analysis, our food safety toolbox is growing. Let’s use these tools to focus resources in a truly risk-based way. When consumers eat food, whether that food is safe or not should not be a yes/no question. The answer should be yes.
References
An excellent history of HACCP is found at https://www.food-safety.com/articles/3874-happy-50th-birthday-to-haccp-retrospective-and-prospective.
https://health.gov/healthypeople/objectives-and-data/browse-objectives/foodborne-illness.
https://www.food-safety.com/articles/3874-happy-50th-birthday-to-haccp-retrospective-and-prospective.
Source: FoodSafety magazine
Author: Jennifer McEntire, Ph.D., is senior vice president of food safety & technology for the United Fresh Produce Association.
