A Recipe for Safe Food: ISO 22000 and HACCP - Qmii.com

FOOD SAFETY

A Recipe for Safe Food: ISO 22000 and HACCP by John G. Surak

F

ood safety experts insist that the U.S. food supply is one of the safest in the world. However, the Centers for Disease Control and Prevention (CDC) estimate that more than 76 million people get sick from food related illnesses each year.1 This results in more that 300,000

In 50 Words Or Less • Three recent major recalls highlight the importance of food safety, particularly in a global food chain. • ISO 22000 incorporates and strengthens the hazard analysis and critical control point system to create an effective food safety management system. • It is designed for the entire chain, starting with producers.

hospitalizations and 5,000 deaths. Recently, there have been several high profile food recalls. These incidents include three national recalls: spinach contaminated with a pathogenic strain of E. coli, peanut butter contaminated with Salmonella, and tainted pet food. In the spinach incident, 199 people in 28 states were infected. As a result, 141 individuals were hospitalized, 31 developed a type of kidney failure, and three died.2 When tainted peanut butter turned up on store shelves, 425 people were infected with Salmonella, and 71 of them were hospitalized. This contamination produced no known deaths.3 The tainted pet food recall began this May and involved a long list of both store and major brands containing melamine in product imported from China. The exact number of deaths is unknown, but it has been estimated that more than 20 pets died. It can be estimated that more than 1 billion meals are consumed each day in the United States, and each meal contains multiple opportunities to consume a food safety hazard like pathogenic bacteria. These statistics are further influenced by changes in the dietary patterns of Americans. They are consuming fresher and minimally prepared foods. The

QUALITY PROGRESS

I OCTOBER 2007 I 21

FOOD SAFETY FIGURE 1

Food Chain Food producers

typical preparation process for these foods might not remove or destroy all pathogens that could be present. In addition, the consolidation and globalization of the food industry has allowed Americans to consume these products year-round rather than in season. Thus, if there is a food safety incident, it will affect more consumers. As a result, serious questions are raised: • How can food supplies remain safe in a global environment? • How can the food system be improved? Ensuring safe food is a responsibility of everyone in the food chain. Food safety starts on the farm, continues with the food manufacturers and distributors, and ends with the consumer (see Figure 1).

Regulatory agencies

Suppliers Pesticides fertilizers and veterinary drugs

Food manufacturers

Ingredients and food additives

Wholesalers

Equipment

Distributors

Cleaning and sanitizing supplies

Retailers

Food service

Packing Other services

Consumers Adapted from ISO 22000:2005, Food Safety Management Systems—Requirements for Any Organization in the Food Chain, International Organization for Standardization, 2005.

incidents on manned space flights (see “HACCP in a Nutshell”). Hazard analysis and critical control point The original concept of HACCP consisted of (HACCP) is an effective tool to prevent food three principles:4 from being contaminated. HACCP is not a new 1. Identify and assess hazards associated with concept. The Pillsbury Co. developed it for food, from growing to marketing. NASA in the late 1950s to prevent food safety 2. Determine critical control points (CCPs) to control any hazard. 3. Establish a system to monitor CCPs. As various food safety practitioners implemented these concepts, HACCP evolved from the original three principles to five preliminary TABLE 1 Five Preliminary Steps steps and seven principles listed in Table 1 And Seven Principles of HACCP that are supported by prerequisite programs (PRPs) detailed in Table 2. Step Description The first U.S. HACCP standard was pubPreliminary step one Assemble the HACCP team. lished in 1989 by the National Advisory Preliminary step two Describe the product. Committee on the Microbiological Criteria Preliminary step three Identify intended use of the product. for Foods and was revised in 1992 and 1997. Preliminary step four Construct a flow diagram. In 1993, the Codex Alimentarius Commission Preliminary step five Conduct an on-site verification of the flow diagram. published the first international HACCP Principle one Conduct a hazard analysis. standard, which was revised in 1997. Principle two Determine critical control points (CCPs). Both of these are guidance standards, rather than auditable standards. They are Principle three Establish critical limits for CCPs. designed to help organizations implement Principle four Establish a monitoring system for CCPs. HACCP. Principle five Establish corrective actions. HACCP has been slowly incorporated into Principle six Establish verification procedures. the food safety system. In the early 1970s, the Principle seven Establish documentation and recordkeeping. Food and Drug Administration (FDA) incor-

HACCP

22

I OCTOBER 2007 I www.asq.org

porated HACCP principles into the regulations that govern the production of low acid canned foods. These regulations have successfully prevented outbreaks of foodborne disease caused by Clostridium botulinum toxin in commercially canned foods. In 1985, the Food Protection Committee of the National Academy of Sciences issued a report stating that HACCP was the most effective system for ensuring the safety of the food supply.5 As a result, U.S. regulatory agencies incorporated HACCP requirements into the regulations that govern the processing of red meats (primarily beef and pork), poultry (primarily chicken and turkey), fruit and vegetable juices, and seafood. As of Jan. 1, 2006, the European Union mandated all food manufacturing facilities that produce food for the European market to incorporate HACCP into their food safety systems. Starting in the 1990s, various customers in the food chain required their suppliers to have certified HACCP systems. Therefore, a number of countries, including Australia, Denmark, Germany, Ireland, the Netherlands and the United States, developed auditable national food safety management standards (FSMSs). In addition, some private organizations developed standards. The national and private standards provided auditable standards that could be used for third-party certifications. All of these

TABLE 2

Prerequisite Programs

Prerequisite programs (PRPs) provide the foundation for hazard analysis and critical control point (HACCP) to function. Food safety experts have found that well-functioning PRPs simplify and strengthen the HACCP plan. The PRPs are based on good manufacturing practices or good hygienic practices.1 PRPs include: • Facilities, including construction and layout of buildings, associated utilities, premises, workspace and employee facilities. • Supporting utilities including air, water and energy. • Supporting services including waste and sewage disposal. • Suitability of equipment and accessibility of equipment for cleaning and maintenance. • Management and control of purchased materials. • Prevention of cross contamination. • Cleaning and sanitizing. • Pest control. • Personal health and hygiene. • Environmental monitoring. • Chemical control. • Glass and hard plastic control. • Product trace and recall. • Complaint investigation. • Labeling. • Employee training and competencies. REFERENCE

1. V.N. Scott and K. E. Stevenson, HACCP—A Systematic Approach to Food Safety, Food Products Assn., 2006.

HACCP in a Nutshell Hazard analysis and critical control point (HACCP) is a food safety system designed to prevent biological, chemical and physical hazards in food. The process starts with identifying the food safety hazards most likely to occur in a specific food product manufactured by a specific process. Next, the food safety team determines the likelihood of occurrence of the hazard and its severity. Hazard analysis has the same roots as failure mode effects analysis. A strategy is developed to prevent the occurrence of the food hazards by controlling the environment and processes that keep food safe. The strategy is summarized in the HACCP plan. The success of a food safety management system depends on ensuring a safe environment to produce food, implementing a proper HACCP program and having management commitment to food safety and the HACCP approach. —J.S.

QUALITY PROGRESS

I OCTOBER 2007 I 23

FOOD SAFETY TABLE 3

standards and audit programs are similar but vary slightly .

Addition of ISO 22000 An international effort developed to harmonize the food safety standards into a single International Organization for Standardization (ISO) standard. ISO 22000— Food Safety Management Systems—Requirements for Any Organization in the Food Chain6 was published in 2005 (see Table 3). The standard defines a state-of-the-art FSMS as having the following characteristics: • Can be used by all organizations in the food chain. • Incorporates the five preliminary steps and seven principles of HACCP. • Provides an auditable standard that can be used as part of third-party certification. • Ensures that the process to control food safety is validated, verified, implemented, monitored and managed. • Focuses only on food safety. ISO 22000 strengthens the HACCP system in several ways. It is a management standard; therefore, it shares the following common elements with other management system standards: • Policy. • Planning. • Implementation and operation. • Performance assessment. • Improvement. • Management review. The standard is fully compatible with other ISO management system standards such as ISO 9001. However, there are differences between the two standards. The focus of ISO 9001 is quality, while the focus of ISO 22000 is food safety. ISO 22000 assumes a food product exists alongside a process to manufacture that product. This includes having an effective purchasing sys24

I OCTOBER 2007 I www.asq.org

General Structure of ISO 22000:2005

Element Description 4 Food safety management system 4.1 General requirements Documentation requirements: 4.2 • Control of documents • Control of records 5 Management responsibility 5.1 Management commitment 5.2 Food safety policy 5.3 Food safety management system planning 5.4 Responsibility and authority 5.5 Food safety team leader Communications 5.6 • External • Internal 5.7 Emergency preparedness and response Management review 5.8 • Review input • Review output 6 Resource management 6.1 Provision of resources Human resources 6.2 • Competence, awareness and training 6.3 Infrastructure 6.4 Work environment 7 Planning and realization of safe products 7.1 General 7.2 Prerequisite programs Preliminary steps to enable hazard analysis • Food safety team 7.3 • Product characteristics • Intended use • Flow diagrams, process steps and control measures • Hazard analysis • Hazard identification and determination of acceptable levels 7.4 • Hazard assessment • Selection and assessment of control measures 7.5 Establishing the operational prerequisite programs Establishing the hazard analysis and critical control point (HACCP) plan • Identification of critical control points 7.6 • Determination of critical limits for critical control points • System for the monitoring of critical control points • Actions when monitoring results exceed critical limits Updating of the preliminary information and documents specifying the 7.7 prerequisite programs and the HACCP plan 7.8 Verification planning 7.9 Traceability system Control of nonconformity • Corrections 7.10 • Corrective actions • Handling of potentially unsafe products • Withdrawals Validation, verification and improvement of the food safety management 8 system 8.1 General 8.2 Validation of control measure combinations 8.3 Control of monitoring and measuring Food safety management system (FSMS) verification • Internal audit 8.4 • Evaluation of individual verification results • Analysis of results of verification activities Improvement 8.5 • Continual improvement • Updating the FSMS

tem and a product quality assurance system. In addition, there are small differences in the organizational structure between the two standards. Other additions to ISO 22000 beyond ISO 9001 include: • No exclusions in the requirements are permitted. • The FSMS must conform to appropriate statutory and regulatory requirements. • The organization must demonstrate that food safety is supported by the business objectives. • The organization must develop an emergency preparedness procedure. • The infrastructure or prerequisite programs (PRPs) needed for a FSMS are defined in detail. These programs provide the environment for the production of safe food. • PRPs are recognized as being managed in different ways. For example, different protocols are needed to implement and maintain training and competencies, facilities, cleaning and sanitation, and personal hygiene. • Analysis for food safety hazards must be conducted as a part of the process for planning the safe realization of food production. • There is an assumption that it is possible for an unsafe product to enter the food chain; therefore, organizations must have recall or product withdrawal procedures. • The traceability system requires organizations to trace all ingredients and components for food products from the immediate suppliers through the manufacturing processes. In addition, it requires the traceability of end products to the immediate customers. • If the organization produces an unsafe product, the hazard must either be eliminated or reduced to an acceptable level before the product enters the food chain. • Concessions cannot be made if the product is unsafe or contains a food safety hazard. ISO 22000 does not have a requirement for a preventive action procedure. HACCP is inherently a system to prevent food safety hazards. However, ISO 22000 recognizes that new food hazards emerge and new technologies are developed to control food safety hazards. Therefore, ISO 22000 uses a systems approach (continual updating of the FSMS) to prevent new hazards from occurring in the food products. When compared with other food safety standards, ISO 22000 strengthens a number of the management related elements with the following: • The organization must first effectively plan for

Food Safety In the Home Most consumers believe the primary cause of foodborne illness is unsafe food handling practices in food processing plants or restaurants. In contrast, most food safety experts believe the biggest source of foodborne illness is unsafe food handling practices in the home. Therefore, food safety is also the responsibility of individuals who prepare food in the home. The Partnership for Food Safety Education is an association of industry, government and academia with a mission to educate the public on safe food handling practices. This partnership developed the Fight BAC (Fight Bacteria) program.1 Fight BAC consists of the following four principles: 1. Clean: Wash hands and food preparation surfaces often. 2. Separate: Do not create an environment in which potentially pathogenic bacteria can spread through cross contamination. 3. Cook: Cook all foods to the proper temperature. 4. Chill: Chill food quickly because cold temperatures slow the growth of all bacteria, including pathogenic bacteria. —J.S. REFERENCE

1. Partnership for Food Safety Education, Fight BAC program, www.fightbac.org.

QUALITY PROGRESS

I OCTOBER 2007 I 25

FOOD SAFETY

ASQ’s Food, Drug and Cosmetic Division ASQ’s 5,600-member Food, Drug and Cosmetic (FDC) Division published the new Certified HACCP [hazard analysis and critical control point] Auditor Handbook through ASQ Quality Press this spring. The division is also currently in the process of developing a new pharmaceutical certification called certified pharmaceutical good manufacturing compliance professional, or CPgmpCP. It also is working with other divisions on a risk management book. June M. Morita of Prospect Heights, IL, is chair of the division, and Diane G. Kulisek of Simi Valley, CA, is chair elect. The Midwest Conference on Feb. 20, 2008, is the FDC Division’s next major event. Additional information on the division, its activities and accomplishments can be found at www.asq.org/fdc/index.html. —Susan E. Daniels, editor at large

the realization of safe food and then implement the plans to ensure the production of safe food. • The standard requires that food safety be supported by the organization’s business objectives. • The standard defines the inputs and outputs to the senior management review process. • The standard strengthens the internal and external food safety communication requirements. • The standard requires the development of an emergency response procedure. • The standard requires that responsibilities of the food safety team leader (traditionally the HACCP coordinator) be expanded to include continual management of the FSMS, managing the food safety team and reporting to top management on the status of the FSMS. • The standard requires the training element be strengthened to include competencies. • The standard requires PRPs to be verified. • The standard formally accepts that an FSMS might not have a CCP. • The standard requires continual improvement and updating of the FSMS. ISO 22000 is designed to be used by any organi26

I OCTOBER 2007 I www.asq.org

zation in the food chain, including producers, suppliers, manufacturers, distributors, retailers and food service organizations.

Using Other ISO Standards ISO technical committee 34, which deals with food products, recognized the need to ensure a creditable certification process for FSMSs. Thus, technical committee 34 and the ISO Committee on Conformity Assessment developed a standard that defines the requirements of accreditation bodies, certification bodies and auditors that will be involved in the ISO 22000 certification process. On Feb. 15, 2007, ISO published TS 22003:2007, Food Safety Management Systems—Requirements for Bodies Providing Audit and Certification of FSMSs.7 The working group intends to use ISO 22003, ISO 170218 and ISO 190119 to define the fundamental principles for the accreditation, certification and auditing processes for ISO 22000 certification. ISO TS 22003 defines the specific competency requirements FSMS auditors must demonstrate in the following areas: • Management system audits. • Applicable laws and regulations. • HACCP and food safety, including the identification and evaluation of food safety

hazards linked to the supply chain. • Methods to determine, implement and manage control measures for HACCP plans and PRPs. • Knowledge of products, processes and practices in the food sectors they will audit. The food chain is quite diverse. Thus, different technical competencies are needed to conduct food safety audits. It will be unlikely any one auditor will be able to effectively demonstrate competency in all areas of the food chain.

Strengthening Food Safety The Institute of Medicine of the National Academy of Sciences10 convened a special committee to develop recommendations to Congress and the two national agencies that regulate the production of food: the FDA and the FDA’s Food Safety and Inspection Service. The recommendations include: • Food safety regulatory agencies must continue to emphasize prevention, reduction or elimination of foodborne disease hazards. • HACCP plans that are specific to a product and a processing line should be developed. • Statistical process control linked to continuous improvement must be a part of food safety regulations. The concept of continuous improvement is central to food safety. • Imported produce should follow the same good agricultural practices required for domestic produce. • Microbiological samples provide organizations and the regulatory agencies with a scorecard of performance. Future significant gains in the safety of the U.S. meat and poultry supply can be realized only by implementing more effective process control measures. • The U.S. food processing industry must move from an inspection based system to a process control based one to ensure the production of safe food. The report makes additional recommendations to improve the regulations governing the safety of seafood, dairy products, fruits and vegetables. In addition, it makes specific recommendations for improving the process used for disease surveillance and monitoring microbial contamination of food. U.S. consumers expect their food supply to be safe. ISO 22000 strengthens HACCP by linking the plan to PRPs and defining management’s responsibilities.

REFERENCES

1. Centers for Disease Control and Prevention (CDC), www.cdc.gov/foodsafety. 2. CDC, www.cdc.gov/ecoli/2006/september/updates/ 100606.htm. 3. CDC, www.cdc.gov/ncidod/dbmd/diseaseinfo/ salmonellosis_2007/outbreak_notice.htm. 4. V.N. Scott and K. E. Stevenson, HACCP—A Systematic Approach to Food Safety, Food Products Assn., 2006. 5. Ibid. 6. ISO 22000:2005—Food Safety Management Systems— Requirements for Any Organization in the Food Chain, ISO, 2005. 7. ISO TS 22003: 2007—Food Safety Management Systems— Requirements for Bodies Providing Audit and Certification of Food Safety Management Systems, ISO, 2007. 8. ISO/IEC 17021:2006—Conformity Assessment— Requirements for Bodies Providing Audit and Certification of Management Systems, ISO, 2006. 9. ISO 19011:2002, Guidelines for Quality and/or Environmental Management Systems Auditing, ISO, 2002. 10. National Academy of Sciences, Scientific Criteria to Ensure Safe Food, National Academies Press, 2003, www.nap.edu/catalog/10690.html?se_side. BIBLIOGRAPHY AND NOTE

ASQ Certified HACCP Auditor, www.asq.org/certification/ haccp-auditor/index.html. Food Safety Gateway, www.foodsafety.gov. This site provides links to food safety organizations.

JOHN G. SURAK is the principal of Surak and Associates, which provides consulting for food safety and quality management systems, designing and implementing process control systems, and implementing Six Sigma and business analytics systems. Surak is a fellow of ASQ and an ASQ certified quality engineer, manager of quality/organization excellence, quality auditor and HACCP auditor. He is the ASQ standards committee liaison from the Food, Drug and Cosmetics Division.

Please comment If you would like to comment on this article, please post your remarks on the Quality Progress Discussion Board at www.asq.org, or e-mail them to [email protected].

QUALITY PROGRESS

I OCTOBER 2007 I 27