Here's my over late addition to this discussion. While managing (Food Safety and Quality)at a coffee roasting facility; these are a summary of the key challenges I encountered with respect to HACCP. Now, remember your original post was in the context of FSMA. Therefore, I am communicating with a view to converting HACCP to HARPC because coffee will fall under FSMA and HARPC.
The food safety plan I inherited at hire was a HACCP plan according to Silliker who performed the GMP audits. However, it had no CCP's, only/GMP programs. The Silliker auditor told me a HACCP plan without CCP's was really a Food Safety Systems Management Plan. I believed him until later I learned it was one of those perennial points of contention. Now, years later in retrospect, it definitely should have had foreign matter, metal detection or x-ray as a CCP because anything 6mm or greater is a choking hazard. The caveat was that the facility sold some very finely ground coffee as an ingredient for chocolate, but he Plan stated that the coffee was sold for brewing only. Obviously this was a major faux pas in hazard analysis!
Coffee is sometimes processed on the rain forest floor and can have things like wire, bottle caps, even the toys the workers' children play with and the like. Debris was our most frequent customer complaint. Lots of broken coffee grinders when the burrs hit a chunk of debris. In the name of continuous improvement there should have been far better preventative controls. I discovered that the seives were in such poor condition, they probably added more metal debris than they extracted. Also, I discovered the magnet traps had lost most of their magnetism. Probably my most significant achievement there was to get new seives and neodynium magnets. I also now believe that some of the debris came not only from the raw coffee, but from the lack of preventative controls on repairs, preventative maintenance and intrusive maintenance activities. Oddly enough, my tracking and trending of debris incidence was highly correlated to specifically Colombian Coffee over coffee from any other world local.
The process of getting the coffee cherry fruit flesh off the bean and then drying the coffee can lead to various species of mold that contaminates the raw bean with mycotoxins like sterigmatocystin, OTA, and aflatoxin. Improperly dried coffee can also mold while enclosed in the sea-tainer or rail car or trailer. The coffee can be drenched in condensate! I think there needs to be very definite preventative controls for rejecting the coffee at this juncture. None of these mycotoxins are completely denatured during roasting. IMO, testing the lots of coffee ought to be a CCP under HACCP and a preventative control under HARPC. Some kind of validated sampling plan for test samples needs to be developed. As far as I can ascertain, the European import requirements are much more robust than in the US. Where do you suppose the coffee that Europe rejects for mycotoxins gets sold? In the two week period after giving notice I got approval to order a fluoroscope, but only because the client that put the facility on the map insisted as part of their audit findings CAPA.
I would also distrust how pesticides may have been used in close proximity to the beans in order to combat Indian Meal Moths and other pests, so pesticide residue testing may be in order. This might be one of those risks that you investigate by performing some initial rigorous testing and then later adjust in accord with the results.
Another little know practice that took me by surprise a few months into my tenure was that dark roasted coffee like French and Italian Roast is so hot when dumping it from the roaster, that it will catch fire unless water is dumped onto the coffee beans in the roaster just moments before the coffee is dumped out for cooling. For our process it amounted to about 10 gallons of water. There ought to be preventative controls for water safety.
Yet another discovery for me was the fact that the modified atmosphere gases used to flush oxygen from the bag when filling was from a nitrogen concentrating device that was on a concrete pad outside by the alley. Consideration needs to be given for preventative controls for both the purity of the air at the point of use and for the vulnerability of the MAP gases and related appliances for food defense.
The carboys, jerrycans and drums of artificial flavors used to flavor some coffees deserve considerations for preventative controls in a similar manner that one might give to the cleaning chemicals a facility uses for sanitation.
In the postings of this thread some mention was made of microbial testing. There may be some merit to validating the absence of the need to perform microbial testing, especially on lightly roasted coffees. On the other hand, there may be some merit to performing some finished product (post roast) microbial testing. In the case of this facility, it was yet another assumption that never should have been made.
The final issue I would bring up is that the process of grinding is a food defense "vulnerability" that at the very least requires a risk assessment for the defense of food plan.
With respect to FSMA, I am given to understand that the Sanitary Transport Rule will have NO exemptions for either USDA or FDA HACCP facilities as the other Rules do and that it will apply to rail cars as well as trailers and trucks. IMO I would plan on having specific contractual agreements with the entities "transporting" that address the condensation I spoke of above. You need to be able to reject the coffee at the port, rail car or trailer and put the onus on the supplier and transporter in the eventuality that condensate is not controlled.
Great pains were taken to assure the quality (taste) of the coffee through blind tasting by qualified panels and that the facility actually received the self-same coffee purchased from wherever in the world we first discovered it, but the assumption that the coffee was low risk because it would only be brewed in a coffee maker was a de facto excuse to dismiss responsibility for food safety concerns.