Critique this FSMA/ SQF Food Safety Plan
I am trying to create a FSMA/ HACCP combined plan that would work for GFSI (SQF) while still meeting FSMA requirements/ terminology. After spending some time on it, my brain now feels more confused than when I started! :helpplease: Can all you experts out there critique my attached current format, and provide feedback on whether you think it meets the requirements of both?
What we have grasped/ applied: PRPs are programs to minimize low risk hazards, Preventative Control to minimize significant hazards, And CCP to eliminate significant hazards. We’ve also decided that any step that does not have a PC can’t be a CCP.
I am struggling with a few things:
1) The risk significance of a step not aligning with FSMAs need for a preventative control. EX- Supply Chain PC: For chocolate, our SCPC is approved supplier/ and COAs upon receipt. For our flavorings (like mint oil) they are considered low risk for growth, however we currently still put them through our approved supplier program. In the plan, if Approved Supplier is a PC for chocolate, would that automatically make Approved supplier a PC for flavoring (or all other ingredients) since we apply it to it already? or would we now state that approved supplier is a PRP even though they are the same program doing the same thing?
2) When trying to apply a decision tree “Is the hazard managed by the prerequisite programmes?” is now a more difficult question- does it now incldue PCs? Does it still make sense/ need to use a decision tree?
Also any thoughts on the format/ general workings of the plan welcomed and appreciated! :ejut: As background we are a chocolate based confectionary company (do not make chocolate in house), who flavors/ adds additions for each product. Primarily hand made, except for two manually controlled depositer. All our products have milk/ soy in them- only allergen in one is pretzel. We pack into pre-printed tins.
Thanks in advance!
Attached Files
Hi Krparker,
In your example you have identified a hazard with Chocolate (lets say Micro - Salmonella) which is not present in mint oil.
I don't want to get too hung up about PRPs and PC here but my view would be that supplier assurance/approval would be a prerequisite.
For your chocolate you want a control measure that meets the requirements of FSMA:
117.130 Hazard analysis.
b Hazard identification.
The hazard identification must consider:
(1) Known or reasonably foreseeable hazards that include:
(i) Biological hazards, including microbiological hazards such as parasites, environmental pathogens, and other pathogens;
c Hazard evaluation.
(1)
(i) The hazard analysis must include an evaluation of the hazards identified in paragraph (b) of this section to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls.
117.135 Preventive controls.
(a)
(1) You must identify and implement preventive controls to provide assurances that any hazards requiring a preventive control will be significantly minimized or prevented
In this case the preventive controls would be a combination of chocolate being purchased from an approved supplier and receipt of a COA for the batch in question stating Salmonella is absent in 25g (you could also possibly add internal micro testing or include this in verification).
Regarding your question about the decision tree, I suggest you refer to these examples:
APPENDIX E
Example I of a CCP Decision Tree
APPENDIX F
Example II of a CCP Decision Tree
Kind regards,
Tony
Basically, from my understanding of FSMA versus SQF so long as you are complying with all requirements for SQF you are complying with FSMA.
Hi all,
After checking FSMA guide, just published some weeks ago by FDA, I'm not sure of how to identify CCP. From the moment that FDA maintains every step of HACCP Codex Alimentarius, but decision tree is not named. Perhaps they intended that is not necessary?
Actually, they will introduce several points in their guidance, that usually are identify as CCP (dehydration, heat treatment...). So, perhaps, that identification could be more based on industry knowledge...
The HARPC does not use the terminology "CCP" and instead uses "controls". There are four categories of controls:
- Process Controls (these would typically be your CCP's)
- Allergen Controls
- Supplier Controls
- Sanitation Controls
If there is risk in your facility, process, or product(s) that "requires a control" to prevent or eliminate a hazard then it falls under one of those categories above. If it doesn't apply then it simply falls under GMP's. If it is a control then you have to validate and verify using as much science as possible to back up the effectiveness of your control method. Regulatory standards are a great resources for this, but studies work as well.
An example of something that is likely a GMP is pest control. This is typically effectively controlled through GMP's such as your PCO service visits, personnel GMP's, handling of ingredients and product, and handling of waste.
A process control would be something like pasteurization, baking, drying, pH control (safety), metal detection, x-ray, etc.
A supplier control would be anything where you put the onus on the supplier to control a hazard in an ingredient you use. A perfect example of this would be a supplier providing you with a pasteurized milk/dairy product. You put the onus of the supplier having an effective process control. With that, you now need to verify and validate that your supplier has a control in place for the hazard. You don't have to verify or validate their control, that's on them, but you have to ensure they have a control in place.
It is an odd way to think about it given HACCP has been drilled into the industry for the past two and a half decades.
Hi all,
After checking FSMA guide, just published some weeks ago by FDA, I'm not sure of how to identify CCP. From the moment that FDA maintains every step of HACCP Codex Alimentarius, but decision tree is not named. Perhaps they intended that is not necessary?
Actually, they will introduce several points in their guidance, that usually are identify as CCP (dehydration, heat treatment...). So, perhaps, that identification could be more based on industry knowledge...
Thank you rmills06 for your answer.
But, I don't see this "new" approach from FDA is so different to HACCP. Now, working with HACCP, we have prerequistes instead of Preventive Controls (perhaps could it be equivalent to CP as they are explained by IFS?), but I think they are the same:
- Allegens control.
- Cleaning and sanitizing.
- Suppliers approval.
So, what's the difference? Before FMSA, If you could control some hazard with prerequisites, you would not include them in HACCP Hazard Analysis. But, after FSMA, we would need to revover that hazards?
Different and the same. The main difference is with a typical pre-requisite program in a HACCP plan you are not required (unless under a GFSI auditing standard) to verify or validate the pre-requisite programs. You are required to only verify and validate your CCP's.
Under FSMA, if you have any of the four types of controls in place you are required to both validate and verify them. You must re-validate every 3 years or if there is a "change" that takes place which affects the controls.
So, the terminology is quite different and the application in terms of "pre-requisite" programs, but aside from that it is more or less the same. If you are in the US and an FDA auditor is in your facility you will have to be somewhat fluent in the terminology.
Thank you rmills06 for your answer.
But, I don't see this "new" approach from FDA is so different to HACCP. Now, working with HACCP, we have prerequistes instead of Preventive Controls (perhaps could it be equivalent to CP as they are explained by IFS?), but I think they are the same:
- Allegens control.
- Cleaning and sanitizing.
- Suppliers approval.
So, what's the difference? Before FMSA, If you could control some hazard with prerequisites, you would not include them in HACCP Hazard Analysis. But, after FSMA, we would need to revover that hazards?
Hi rmills,
There are perhaps some exceptions to the items mentioned as requiring validation (and verification also?) ?, eg item 12 in attached list.
BRC-FSMA Self-Assessment Tool.doc 124KB 247 downloads
Anything that can be considered under a "GMP" and not as a control does not require verification or validation under the FSMA. So, defining what falls under a GMP or a control is obviously quite important. This is what can be open to interpretation where one facility process may have something like pest control under a GMP, but another facility or process would have it as a control such as supplier control or sanitation control.
Hi rmills,
There are perhaps some exceptions to the items mentioned as requiring validation (and verification also?) ?, eg item 12 in attached list.
Hi rmills,
I deduce you are terminology differentiating between "GMP" and "sanitation control"
The attachment (section 12) I posted seems to imply that the latter (et al) may not require validation. "GMP", per se, seems not mentioned in this context.
But i am for sure no FSMA expert so may be misinterpreting BRC. (TBH the BRC text implies further subtleties as to whether validation is required or not but these may perhaps disappear in practice).
Thanks Charles for clarifying. I was mixing up the terminology. The "controls" must be verified, but the sanitation, allergen, and supply chain control DO NOT require validation. The process control requires validation.
The other difference of HARPC versus HACCP is all the controls must be monitored and documented parameters and values that identify frequency of compliance. Basically, this means if you have a sanitation control you would need to document how you are monitoring the control, what parameters you are using, and what values you are using to ensure compliance of that control. So, your compliance monitoring could be meeting target values for time, temperature, chemical concentration, flow rate, inspection of equipment after sanitation, ATP swabbing after sanitation etc.
This is why with any plant that is currently under BRC of SQF you basically comply with the current rule. The only real difference is the terminology and the formatting of the food safety plan (no long a HACCP plan under the FSMA Preventive Control rule).
I hope this helps.
As I get more free time, after our initial SQF audit next week, I'll provide some more insight and resources on this rule. I have a lot of information from the course I took. Unfortunately time has been a high value commodity for me recently so I haven't had time to digest it all. Hopefully, by the end of this year I'll be able to provide a lot of information that others can use to understand the rule more clearly.
As you can see...even right now I'm confusing myself. :silly:
Hi Ryan,
Thanks for above. I'm only too grateful that i don't need to be directly involved with FSMA. I foresee a potpourri of problems in the early stages.
Based on yr recent Posts and my own Family experiences, I suspect both Time and Sleep are currently at a premium ! :smile: :thumbup:
Sleep? :rofl2:
FYI...I found this article that compares HACCP to FSMA and the noted differences in terminology and requirements. It does a much better job than I explained.
I recently attended a "certified" FDA training class for Preventive Controls (which is seemingly replacing the HARPC acronym originally used by the FDA). I apologize if this has already been posted, but a great resource for developing a PC plan (especially is there is an existing HACCP plan in place) is the following FSPCA training document:
https://www.ifsh.iit...2_Watermark.pdf
This is the exact training manual used during my three day certified class (which was actually very informative - we happened to have FDA personnel taking the class so that they could learn about the specifics of PC's and PCQI's; we ended up getting a lot of additional information from them :happydance: )