Principle 6, Verification, as defined in the harmonized Hazard Analysis and Critical Control Points (HACCP) principles from Codex Alimentarius[1] and the National Advisory Committee for Microbiological Criteria for Foods (NACMCF),[2,3] may be the most complicated HACCP principle. From audits that we have conducted, this is the one principle that many companies do not quite seem to grasp. Significant gaps in food safety management systems (FSMS) are often found when one examines how different processors define verification activities even among companies with “certified” HACCP plans.
The National Food Processors Association (now now Grocery Manufacturers Association) felt that the concepts of verification and validation were complex enough that they developed a two-day workshop with an accompanying text that focused on these topics. “HACCP: Verification and Validation” was taught as an advanced HACCP workshop for persons who had preferably completed the three-day program that focuses on basic concepts and implementation.
The concept of verification is a late addition to HACCP. The original principles did not include verification activities (Table 1). Verification as a principle first appeared in the seven principles published in 1989 by the NACMCF.
The Role of Verification
In the past 20 years, verification activities have been expanded, definitions have been modified and expectations have increased, even though principle 6 reads “Establish verification procedures.” In the original concept of verification, validation is classified as a subcomponent, making things difficult since, in other areas of the quality and food safety field, experts define validation and verification as separate activities.
The basic role of verification is to ensure that the FSMS or HACCP plan is functioning as designed and is effective. Gombas and Stevenson[5] state that “Verification is to the HACCP plan what monitoring is to the critical control point (CCP).” Thus, CCPs look at individual points in the system and verification looks at the entire food safety system, including the HACCP plan, prerequisite programs (PRPs) and other system components.
PRPs are defined as the foundation for HACCP in the harmonized Codex Food Hygiene document, the NACMCF document and ISO 22000.[6] PRPs can be compared to the old Sunday school parable that talks of the wise man who built his house upon the rock and the foolish man who built his house upon the sand. The “house”—in this case, the food safety program—with the strong foundation is more likely to do its job, protecting public health. Additionally, there should be a program to verify that the PRPs are effective.
In 2008, the Codex Alimentarius Commission adopted a new position with regard to validation and verification.[7] Codex recognized that validation and verification were separate activities in developing food safety control measures. Codex now uses the following definitions for validation, monitoring and verification:
• Validation is “obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome.”
• Monitoring is “the act of conducting a planned sequence of observations or measurements of control parameters to assess whether a control measure is under control.”
• Verification is “the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended.”
This change aligns Codex more closely with the ISO definitions for validation and verification, which may be seen in Sidebar 1.
Elements of Verification Activities
When establishing a program to verify that the FSMS is working, food processors must develop, document, implement and maintain a program that encompasses three major elements:
• HACCP plan
• PRPs
• Other components of the FSMS
Table 2 shows the detailed components of these elements.
ISO 22000 requires verification of the FSMS and includes development of a plan for the verification activities. This plan defines the purpose, methods, frequencies and responsibilities for the verification activities. Verification ensures the following:
• PRPs are implemented and effective
• Input to hazard analysis is updated
• Operational PRPs and the HACCP plan are implemented and effective
• Other procedures for the FSMS are implemented and updated
ISO 22000 requires an evaluation of individual verification results to ensure that the food processor is following the planned activities for the FSMS. If not, then actions need to be taken to bring the FSMS back into compliance. In addition, ISO 22000 requires an analysis of the results of verification activities. This analysis is conducted to provide a picture of the FSMS’s overall system performance. The results of the analysis provide input needed for improving and strengthening the FSMS.
These requirements strengthen older HACCP requirements. For example, the U.S. Food and Drug Administration’s HACCP regulations for seafood state, “Each processor shall verify that the HACCP system is being implemented according to design.”
The regulation further stipulates, “Each processor shall validate that the HACCP plan is adequate to control food hazards that are reasonably likely to occur; this validation shall occur at least once within 12 months after implementation and at least annually thereafter or whenever any changes in the process occur that could affect the hazard analysis or alter the HACCP plan in any way.”
Verifying PRPs and CCPs
Many processors may understand that verification of CCPs and PRPs is essential to food safety, but there are others who simply do not fully comprehend how this should be done. There are four major types of verification activities:
• A non-audit review of documents. An example is reviewing CCP records to ensure that a specific lot of product complies with the HACCP plan.
• Conducting various measurements and assessment activities to ensure a PRP or the product is operating within defined parameters. An example is to collect environmental microbial swabs to ensure that the cleaning and sanitizing program is compliant with internal specifications, and to measure the microbial parameters of products.
• Conducting various assessments to determine if other components of the FSMS are operating within defined parameters. Examples include determining if training is effective, conducting mock recalls or ensuring that measurement equipment is properly calibrated.
• Internal and external audits. The function of audits is to provide an unbiased assessment of the FSMS.
.jpg)
The first step is in developing a verification program is to determine all of the processes that need to be verified (see Table 2). Next, a verification plan needs to be developed for each part of the FSMS. Table 3 provides an example of part of a verification plan.
Additional Activities
Microbial checks: Statistical process control (SPC) provides a powerful tool for analyzing data trends. SPC presents data in a graphical format that allows for rapid and easy interpretation of negative trends. Such an analysis may lead to the modification of current PRPs, especially since actions that raise total microbial counts may contribute to increases in pathogens. Once this is done, actions can be taken to reduce both aerobic plate count levels as well as minimize the risk of producing potentially unsafe products.
Receiving: Although many food safety experts recommend against it, there are processors who have identified receiving as a CCP. The CCP mandates that a certificate of analysis (COA) be received for each lot that is delivered. Receiving procedures must describe how the products are to be received and how the COA results are to be reviewed and interpreted. This is necessary to ensure that the values reported in the COA are within established specifications and critical limits. If the COA indicates that the lot in question does not meet specifications, the lot must be rejected since, by definition of a CCP, a product that is in violation of a critical limit must be considered a potentially hazardous product.
If the COA is not received with the load, the processor has two options: reject the load or accept it provisionally and place it on hold pending receipt and analysis of the COA. In addition to a review of the COA upon receipt of the load, the plant must also establish a procedure to verify that the process of monitoring the COAs is being done according to the documented receiving procedure. This verification activity must be done on a regular schedule. If an ingredient is new or its hazard potential is high, verification activities should be conducted monthly or more frequently.
Metal detection: In this day and age, most food processors utilize metal detectors, unless the package is metallized. How many HACCP teams have taken the time to validate that the detection system really works? The equipment manufacturer’s representatives will set up the system and program it, but it is the processor’s responsibility to validate the metal detection equipment in the plant using its own product (Sidebar 2).
In addition, the metal detector must be properly verified to ensure its effectiveness. Most plants do verification checks at the start of a production lot and periodically throughout the production run. This entails passing the standards through the detector and confirming that the metal detector recognizes each standard on the first pass. If the detector does not recognize the standard on the first pass, corrective actions need to be taken to first place “on hold” all product that was scanned since the previous good calibration check, and then take appropriate actions to bring the metal detector into specification. All product placed on hold must be rescreened through a properly operating metal detector. This can be done either on-line or off-line.
Other problems start when different products are run through a single metal detector on the same day. Many times, a calibration check is done when a new product run is begun, and adjustments are made to ensure the proper sensitivity. However, is there a verification procedure to check the last package of the previous product to ensure that the metal detector remained in calibration throughout the first run? Another problem occurs when the final product does not end exactly at the end of the shift. A metal detection procedure may state that checks are made every 2 hours; however, a production shift may have to be extended for 30 minutes to finish production. When was the last calibration check conducted? Was the calibration check done at the official end of the shift or at the actual end of production?
Conclusions
A FSMS is only as strong as its weakest link. It is critical that both corporate headquarters and all of a company’s processing plants have a strong verification program. This facilitates identification of the weakest links and development of strategies to strengthen those links. This systematic strategy continually improves the FSMS.
Read the sidebars "ISO 22000 Definitions of Validation and Verification" and "Validation of Metal Detection".
Richard F. Stier is a consulting food scientist with international experience in food safety (HACCP), GMP compliance and food microbiology. He is a member of the Institute of Food Technologists and an editorial advisor to Food Safety Magazine. He can be reached at rickstier4@aol.com.
John G. Surak, Ph.D., is the principal of Surak and Associates and provides consulting for food safety and quality management systems, auditing management systems and implementing Six Sigma. He serves as an editorial advisor to Food Safety Magazine. He can be reached at jgsurak@yahoo.com; www.stratecon-intl.com/jsurak.html.
References:
1. Codex Alimentarius Commission. 2003. Recommended International Code of Practices, General Principles of Food Hygiene, CAC/RCP-1-1969, Rev. 4.
2. The National Advisory Committee on Microbiological Criteria for Food (NACMCF). 1992. Hazard Analysis and Critical Control Point System. Washington, DC: U.S. Dept. of Agriculture, Food Safety and Inspection Service.
3. The National Advisory Committee on Microbiological Criteria for Food (NACMCF). 1997. Hazard Analysis and Critical Control Point Principles and Application. Washington, DC: U.S. Dept. of Agriculture, Food Safety and Inspection Service.
4. The Pillsbury Company. 1973. Food Safety through Hazard Analysis Critical Control Point System, Contract No. FDA 72-59, Research and Development Department. Minneapolis, MN: The Pillsbury Company.
5. Gombas, D. E. and Stevenson, K. E. 2000. HACCP Verification and Validation. Washington, DC: Food Processors Institute.
6. International Organization for Standardization. 2009. ISO 22002-1 Prerequisite programmes on food safety – Part 1 Food manufacturing. Geneva, Switzerland: ISO.
7. Codex Alimentarius. 2008. Guideline for the Validation of Food Safety Control Measures, CAC/GL 69.
8. International Organization for Standardization. 2005. ISO 22000: Food Safety Management Systems – Requirements for any organization in the food chain. Geneva, Switzerland: ISO.
ISO 22000 Definitions of Validation and Verification
Validation consists of a combination of tools used to ensure the total food safety management system is working to evaluate food safety data prior to release of the product through either internal or external audits.
Verification comprises a series of planned activities that are designed 1) to determine whether the food safety management system is operating properly; 2) to show where the food safety management system needs improvement; 3) to identify data for trends to determine whether the process is weakening and take corrective action before a food safety problem arises; and 4) to identify areas to focus on during the internal audit and to provide evidence that corrective actions are effective.
Most metal detectors can be described as a tunnel with a conveyor. Validation data should ensure that the equipment can detect metal of the appropriate size at different locations on the belt, and at different locations in or around the package. For example, if a 50-lb. sack of flour is to be tested, the system could be validated by testing the standards at the leading edge, the tailing edge, on top of and under the bag.
This needs to be done for each product type. The validation protocol might even require that the standards be inserted into the bag at different locations. Multiple tests—a minimum of 10—should be done at each location. The people doing the validation study must also confirm that the settings remain the same throughout the test. The result should be the determination of where to place the test wands during calibration checks in the course of normal production. The location needs to be the spot where the magnetometer receives the weakest signal. Isn’t that a lot of work? Yes, but a rigorous test protocol such as this will provide confidence that the system works properly.
