Defining Prerequisite Programs In the HACCP Context
Prerequisite Programs (PRP) are, “practices and conditions needed prior to and during implementation of the HACCP plan that are essential for food safety and that provide basic environmental and operating conditions necessary for production of safe, wholesome food.” While not part of a HACCP plan per se, PRP are an essential component of the HACCP system. Prerequisite Programs differ from Critical Control Points (CCP) and Process Controls (PC) because CCP and PC control a food safety hazard reasonably likely to occur, while PRP may prevent a food safety hazard from occurring to begin with. Prerequisite Programs can vary by plant, but generally include procedures that, at a minimum, ensure compliance with current Good Manufacturing Practices (cGMP) and Sanitation Standard Operating Procedure (SSOP) requirements of FDA and USDA, respectively. Use of preventive PRP in HACCP-based systems is important so that hazards do not become “significant” in the first place. For USDA regulatory HACCP plans, supporting documentation must be maintained according to 9 CFR 417.5(a)(1). When PRP render a particular hazard “not reasonably likely to occur”, FSIS establishments must maintain scientific or technical support for the design of those PRP used in hazard analysis logic, and must collect in-plant validation data to support that the programs are effective as designed.
Validation vs. Verification
Both validation and verification are frequently used words in the context of food safety plans. Briefly to distinguish between the two (according to SQF Food Safety Fundamentals), “validations seek to prove that the intended result was achieved and that it actually worked.” “Verification seeks to prove that the control measure was done according to its design.” In other words, verification is proving that you did what you said that you would do, while validation is proving that it works.
Validation and USDA vs. FDA Jurisdiction
While USDHHS-FDA enforces Preventive Controls for Human Food (PCHF) requirements of the Food Safety Modernization Act and USDA-FSIS requires Hazard Analysis and Critical Control Points (HACCP) systems in their respective food safety programs, both systems necessarily need PRP in place to be successful. Descriptions can be found in 21 CFR 117(B) for FDA and 9 CFR 416 for USDA, respectively. Also, both Agencies have addressed validation in their respective food safety systems. For USDA, § 417.4 specifies that validation must occur initially (with an in-plant experiment) and on an ongoing basis (using routine data). In addition to validation of CCP and critical limits, monitoring, and record keeping, validation also encompasses review of the records generated by the HACCP system (including PRP) to ensure that the system is achieving the desired objectives. Under the FDA, on the other hand, you must validate all process preventive controls (i.e., CCP), but you do not need to validate food allergen, sanitation, recall plan, supply-chain, or other preventive controls. In truth, though, all validation should occur in a fashion similar to that required by USDA-FSIS for HACCP systems. Below, we outline the validation requirements for USDA-FSIS.
USDA-FSIS Validation Requirements
Scientific or technical support. The first step in validation is developing scientific or technical support. This support should be relevant to the actual process (i.e., should have relied on the same operating parameters) and show that the process prevents, eliminates or reduces to an acceptable level, the hazard requiring control. There are several acceptable methods for scientific validation, such as published processing guidelines (Directive 711.1 falls under this), peer-reviewed scientific or technical data or information (journal articles, graduate student theses, or information found in a textbook are examples of this type of information), expert advice from a process authority (though, in this case, expert advice needs to be in conjunction with published scientific data), a challenge or inoculated study, a pathogen modeling program, data gathered by the establishment in-plant, regulatory performance standards, or best practice guidelines. When evaluating scientific data, several parameters of the study must be considered to determine the appropriateness of using the data as technical support: the product studied, the hazard, the expected level of hazard reduction or prevention to be achieved, all critical operational parameters or conditions necessary, the processing steps that will achieve the specified reduction or prevention, and how these processing steps can be monitored. In terms of PRP, if a program is being applied at a specific step (such as an antimicrobial intervention), specific documentation should be kept on expected reductions, etc. When a PRP is comprised of multiple steps (such as a allergen control program), establishments may rely on scientific or technical support that contain best practices regarding the implementation of such programs.
Initial in-plant validation. Here, the plant must demonstrate not only that the HACCP system (i.e., CCP, any PRP used in HACCP logic, and the system in its entirety) is theoretically sound in its design, but also that the establishment can execute it as designed to reach the desired effect. If an establishment is using scientific data as support for the decision that a hazard is not reasonably likely to occur because of the implementation of PRP, all of the critical operational parameters should be incorporated into the PRP. If an establishment implements different critical operational parameters in the process from the scientific data, then the establishment should collect in-plant data demonstrating that the critical operational parameters that have been implemented can all be met and should also collect in-plant microbiological validation data or identify scientific support that contains microbiological data.
Ongoing Verification. Once a plant’s initial validation has occurred over the first 90 days of production (both scientific support AND in-plant validations), follow up validation of effective critical operational parameters should be conducted. If there are no changes in the HACCP system, ongoing verification is conducted, with an annual reassessment of the system. If there are changes to the HACCP system, the initial in-plant validation starts again.
BRC Validation
In BRC, validation is defined as, “obtaining evidence though the provision of objective evidence that a control or measure, if properly implemented, is capable of delivering a specific outcome.”[1] In the context of a BRC audit, documentation of verification can be evaluated under requirement group 2, the food safety plan. In clause 2.7.3, it states, “The HACCP food safety team shall consider the control measures necessary to prevent or eliminated a food safety hazard or reduce it to an acceptable level. Where the control is achieved through existing prerequisite programmes, this shall be stated and the adequacy of the programme to control the specific hazard validated. Consideration may be given to using more than one control measure.”
BRC specifically addresses PRP and the documentation of these programs in clause 2.2.1; “The site shall establish and maintain environmental and operational programmes necessary to create an environment suitable to produce safe and legal food products (prerequisite programmes).” The clause goes on to list 9 examples of PRP and then continues, “The control measures and monitoring procedures for the prerequisite programmes must be clearly documented and shall be included within the development and reviews of the HACCP.” Clause 2.12.1 states that ongoing verification (i.e., in theory, including validation) must occur with PRP, while 2.14.1 specifies when a PRP needs to be reviewed (annually and when a change occurs to the plan). For internal audits, PRP need to be included as per clause 3.4.1.
In requirement group 4, site standards, PRP should be considered when determining layout and product flow risk areas. Furthermore, when cleaning is a PRP, the specific hazard of concern, procedure, and frequency should all be validated with records maintained (4.11.3).
SQF Validation
In SQF, validation is defined as, “a system, which identifies, evaluates and controls hazards which are significant for food safety. Essentially validation as applied to control limits seeks to prove that the intended result was achieved and that it actually worked.”[2] While SFQ highlights ways to ensure that validation is performed, it does not have a specific clause addressing PRP as BRC does. Still, in section 2.5, SQF System Verification, clause 2.5.1.1 Validation and Effectiveness states, “the methods, responsibility and criteria for ensuring the effectiveness of all applicable elements of the SQF program shall be documented and implemented.” Taken literally, then, that section requires validation of all programs. Validation of allergen controls is the only Prerequisite Program specifically mentioned in SFQ. In reference to allergens, 2.8.1.5 states, “Based on risk assessment, procedures for validation and verification of the effectiveness of the cleaning and sanitation of areas and equipment in which allergens are used shall be effectively implemented.”
Conclusion
From FSIS to FDA and BRC to SQF, there is not consistency between requirements for validation of PRP. However, the FSIS guidance document concerning validation seems very robust and logical, and BRC through a clause requirement is clear on what is required for PRP validation. On the other hand, FDA for PCHF does not require validation on PRP or any preventive controls other than CCPs (i.e., process controls) and SQF only specifically addresses validation of one PRP (allergen control).
[1] BRC Global Food Safety Standard, Issue 7
[2] SFQ Food Safety Fundamentals Edition 8
