18 replies to this topic

[FedAl-Div]

Dear friends

I'm preparing the training material (mostly about ISO 22000) including Hazard Analysis and categorization of control measures.

I'm going to evaluate each hazard at every process step if there is any control measure against this hazard.

Severity 1...3 points, Likelihood 1...3 points, Reduction at next stages 1...3 points.

Risk = Severity * Likelihood / Reduction * 100%. Each assessed stage will have a percent value of Risk relatively the hazard from 0 to 100%.

 

The question: which risk percentage you'd recommended for each control measures category?

For example

0...20 % means PRP (7.2.3 ISO 22000), 21...50% OPRP (7.5 ISO 22000), 51...90 means CCP plan HACCP (7.6 ISO 22000), 91 and more - recommendation to improve the process.

 

The method should be applicable for all production sectors.

[Gourav]

This can not be answered. there are no set answers for this. Do your own Hazard analysis, assess your own processes, the surrounding environment, your suppliers, and then decide upon the CCPs and other control measures.

Thanks

Gourav

[FedAl-Div]

Thank you, Gourav. I believe it is possible to present influence of environment as system of numbers. Some my clients have done it.

The Percent of Risk at the current process step depends on this environment and determinate degree of control (PRP, OPRP, CCP) required.

[Charles Chew]

Hi Fed-Al Div,

 

I have a question. If you have determined a potential hazard and have assessed it as "SEVERE" enough to have adverse health impact to consumers but the likelihood of occurrence is "LOW" - would you consider this a CP or CCP?

 

If you consider this step a CP (noting that hazard is severe BUT not likely to happen) - then in the event of a loss of the control measure, we may just have some seriously health-compromised consumers;

 

If you consider this step a CCP (noting that the likelihood of occurrence is "Low" - then you probably have an overkill in your control measure.

[Charles.C]

Dear FedAl-Div,

 

Frankly, I don’t see the necessity of using a divisor as per yr formula. Yr equation without it (w/wo the multiplier 100) becomes a conventional risk assessment type formula. This format  has been used in iso22000 via a cross-matrix to differentiate  oprp/ccps although perhaps with the addition of other criteria also.

 

For iso22000, the prps are nowadays more typically self-defined, eg via the standard’s own text / PAS220, not on the basis of risk per se, although the latter method is not unknown as an additional criterion albeit with the same caveat as mentioned in next paragraph..

 

Any specific choice of cut-off points in a risk matrix is inevitably subjective as implied by previous posts. An analogous situation arises in some approaches for  ccp selection in traditional haccp.

 

Rgds / Charles.C

[FedAl-Div]

I'd say  that this approach is classical risk assessment and decision tree but defined in digits as a combination.

E.g. the step contains serious harm (3 point), low likelihood (1 point) and there are some stages for significant reduction of the hazard after current step (3 point). We will have 1 * 3 / 3 / 9 * 100% = 11% at this step, that can be control by PRP.

If it is the final step to control this hazard the reduction is 1: 1 * 3 / 1 / 9 * 100% = 33% - OPRP, I think

Note " / 9" - is for mathematical only.

Likelihood depends on previous steps. If the hazard comes from raw materials it should be higher at the beginning and less at the and (after filtration, pasteurization etc.). Severity of each hazard is a constant at all steps.

See possible combination of assessment results attached. All such models are subjective and this one is not worse.

Attached Files

•  Risk matrix forum.xlsx   9.73KB   291 downloads

[Charles.C]

Dear FedAl-Div,

 

The use of digits in Risk Assessment is, of course, not unusual, however your interpretations of haccp-related fundamentals appear highly atypical based on my experience of, for example, current USA and European viewpoints, but perhaps they constitute  the norms in Russia ?.

 

Regardless, I certainly agree that you are free to define yr own approach to food safety, as long as the specific content does not have to be aligned with any particular international standard. Ultimately, I guess it’s the result that counts although the ease of implementation is presumably also relevant.

 

For iso22000, I guess an auditor would only be interested if the approach is compatible with the textual standard. If the auditor  is only familiar with the Codex, NACMCF formats, you can probably expect a somewhat prolonged conversation.

 

Rgds / Charles.C

[FedAl-Div]

This "digital approach" was planed by me as an interpretation of traditional HACCP standards. I found it in a company which I was certifying against ISO 22000. Generally I am FSSC 22000 lead auditor / trainer and I must not say which companies of TOP10 visited, because I tell about my individual vision and future implementation as consultant.

For a long time we demonstrated classical HACCP at our training, but I found that method requires to many actions and also not every time we can decide Yes/No going by "tree". "Digital" one lets to set not so strict answers like1.5, 2.5, 1.75 etc.

At the moment I have 3 consulting clients which had been FSSC 22000 certified by different DNV auditors from Europe without any notes related this approach. All the documented explanation were presented.

Initially HACCP had been based on FMEA that was a digital method itself. Here is not any Russian specific or appropriate national requirements. The most of companies use the "tree" method.

[Charles.C]

Dear FedAl-Div,

 

OK, I think I get the idea now.

 

I think you will find that yr logic/procedure is basically equivalent to a  “portion” of that proposed here by Modarres /  Bennii in 2008 which additionally include other aspects of the famous (a-g) criteria listed in the iso22000 standard. In fact Charlorne posted an even simpler format which, from memory, ignored the risk factor associated with the step location. All these approaches have been employed in the literature although frequently not in the English language. All seem to have been auditorially accepted.

 

Based on some posts on this forum, I think some auditors have long ago given up on understanding or worrying about the philosophical niceties of the iso22000/iso22004 standard-guidelines regarding the differentiation of ccp/oprps. It appears that any logical, haccp-based,  procedure will be accepted, particularly if  similar to a Codex tree. And why not ? As they say, “subjective” is the Name of the Game.

 

Rgds / Charles.C

[Tony-C]

Dear friends

I'm preparing the training material (mostly about ISO 22000) including Hazard Analysis and categorization of control measures.

I'm going to evaluate each hazard at every process step if there is any control measure against this hazard.

Severity 1...3 points, Likelihood 1...3 points, Reduction at next stages 1...3 points.

Risk = Severity * Likelihood / Reduction * 100%. Each assessed stage will have a percent value of Risk relatively the hazard from 0 to 100%.

 

The question: which risk percentage you'd recommended for each control measures category?

For example

0...20 % means PRP (7.2.3 ISO 22000), 21...50% OPRP (7.5 ISO 22000), 51...90 means CCP plan HACCP (7.6 ISO 22000), 91 and more - recommendation to improve the process.

 

The method should be applicable for all production sectors.

 

The assessment you are describing corresponds to ISO 22000 Clause 7.4.3 Hazard assessment:

'A hazard assessment shall be conducted to determine….whether its elimination or reduction to acceptable levels is essential …. and whether its control is needed to enable the defined acceptable levels to be met.'

 

I believe that simplest method of categorising is to regard hazards that score less than 9 as not significant and that they are to be managed by prerequisite programmes. Significant hazards which have scored 9 are then subject to assessment and are going to be either controlled at critical control points identified in the HACCP plan or by Operational Prerequisite Programmes as per ISO 22000 Clause 7.4.4 Selection and assessment of control measures:

 

'Based on the hazard assessment of 7.4.3, an appropriate combination of control measures shall be selected which is capable of preventing, eliminating or reducing these food safety hazards to defined acceptable levels…………… The control measures selected shall be categorized as to whether they need to be managed through operational PRP(s) or by the HACCP plan.

The selection and categorization shall be carried out using a logical approach that includes assessments with regard to the following:

a) its effect on identified food safety hazards relative to the strictness applied;

b) its feasibility for monitoring (e.g. ability to be monitored in a timely manner to enable immediate corrections);

c) its place within the system relative to other control measures;

d) the likelihood of failure in the functioning of a control measure or significant processing variability;

e) the severity of the consequence(s) in the case of failure in its functioning;

f) whether the control measure is specifically established and applied to eliminate or significantly reduce the level of hazard(s);

g) synergistic effects

 

Control measures categorized as belonging to the HACCP plan shall be implemented in accordance with 7.6. Other control measures shall be implemented as operational PRPs according to 7.5.'

 

When categorising I would consider the above then use the traditional decision tree. In using this method significant hazards scoring 9 (or 100% in your scoring system) which are not controlled at critical control points identified in the HACCP plan are controlled by Operational Prerequisite Programmes.

 

Regards,

 

Tony

[Charles.C]

Dear FedAl-Div,

 

Sorry, I forgot to mention that in the M/B procedures mentioned in post #9, an "effectiveness" of control measures on significant hazards of approx >= 80 66% was used to separate ccps from oprps. (prps were determined from a preliminary screening/risk score [ risk not > 40% theoretical maximum]).

 

I also noticed that yr interpretation of likelihood is not fully consistent with that given in ISO22004, eg -

 

"when evaluating the probability of hazard occurrence, consideration should be given to steps preceding and following the specified operation ........"

(7.4.3)

 

@Tony  "When categorising I would consider the above then use the traditional decision tree."

I found this statement slightly obscure . What do you mean by "consider the above" ?

 

Rgds / Charles.C

[FedAl-Div]

OK, 40%+ OPRP, and 66%+ CCP

Any other opinion?

 

And if we have 100% is it CCP, or to hazardous situation requiring to implement additional measures?

[Charles.C]

OK, 40%+ OPRP, and 66%+ CCP

Any other opinion?

 

And if we have 100% is it CCP, or to hazardous situation requiring to implement additional measures?

 

Maybe my post not precise enough.

 

method for selecting prps (1st stage) separate to that for ccp/oprps (2nd stage)

 

1st stage, hazard risk > 40% > significant hazard, otherwise > prp.

 

2nd stage (applied to sig.hazards only), control measure effectiveness > 66% >ccp, otherwise oprp.

 

But I agree with you that the total work involved in this procedure is not small. That's why people like quick trees or shortened versions of above.

 

Bennii's methodology is here if you wish to compare (and check my numbers!) -

http://www.ifsqn.com...ion/#entry19765

 

Rgds / Charles.C

[Charles Chew]

Hazard Analysis is becoming more like a rocket science project?

[SriramB]

Hi FedAl-Div,

 

I do not have lot of consulting background etc and am used to RA in very similar processes/products, but think  that anyone who reads the standard, and draws up a Decision tree to help categorising Controls, that manage significant hazards as PRP, oPRP and CCP, ( 'correctly' as the standard intended) , quickly understands that, from an 'hierarchy of importance' PRP=oPRP=CCP, for the relevance of that particular FS.

 

For e.g. : In a simple process where sandwiches are made and packed, a pest control program may be critical to mitigate the risk of salmonella  from pest dropping. the severity of the contamination would be high and as this is a manual and open operation the probability of pests ( if there is no Pest Control Program) will be reasonably moderate or high.

 

So If the Pest Control Program is considered an important control, and scores high on the numerical RA matrix, would it be a CCP? ( It is not a Point, but a wholistic program..so difficult to pin it as a CCPoint...)

 

Numerical matrix seems good to get an objective feedback of the actual significance of a hazard, but the categorization of the control that reduces the risk, is (IMO), as ISO22000 defines better suited taking into account 'where' the control sits, i.e., in the FSP as a "point' in the process (CCP) or a important sub-program ( part of the suporting programs)(oPRP) Or as a complete supporting program ( PRP).

 

But, like I said , I havent had a chance to look at the details and read up the links set out by the moderators and yourself , so these are just my first impressions. So to answer the quetsion you put up in your thread - I would not try to use a numerical % rating to categorize controls to conform to ISO22000...

 

Rdgs

sriramB

[FedAl-Div]

Hello SriramB

Lets try my method for the situation you told.

Step: NA (because valid for each one, may be assessed generally)

Hazard: Salmonella from pest dropping

Severity: 3 (really high, not other opinions can be)

Likelihood: 1 (if it is normal production there must not be pests (rodents+insects)

Control at later steps: 1 (could been find or decreased)

Risk = (3*1/1)/9*100% = 33% that means PRP according to one of previous post.

 

In case of more or less (high or medium) likelihood of pest contamination 3 or 2 points, the Risk is 66% and more. But this situation (ineffective pest control program) is Major nonconformity itself and requires to implement corrective actions to decrease likelihood to 1 point and 33% risk.

 

 

 

 

[SriramB]

Hi FedAl-Div,

 

I am very intrigued now as I think I do not have the fundamentals, and I should understand more before I decide. Let me try another scenario and if you could pls recalculate:

 

In a Juice Plant with good Pest Program ( decided as above to be a PRP), the pasteurizer is the final control to reduce "salmonella" in the Juice ( either by contamination of the juice at batching or supplier). After pasteurization the process has no further controls to reduce the risk. ( e.g. no preservatives etc).

 

how would you score this here:

 

Step: Pasturization

Hazard: Salmonella from contamination during batching/handling

Severity: 3 (really high, not other opinions can be)

Likelihood: 1 (maybe 1 if all PRP are working)

Control at later steps: 1 (No further reduction )

Risk = (3*1/1)/9*100% = 33% that means PRP according to one of previous post.

 

 

In the risk matrix it appears that if the likelihood is not significant ( i.e. 2 or 3) then the control does not become a CCP. But, as per your previous example, if the Likehood is not 1, that means some of the PRP are not working well, so that being a major NC needs correction...

 

I confess, I do not have stats ackground and presume the formula has lots of science behind it, but I do not know what the significance of '9' is ( is it to weight the scores..).  Is there some background info I need to read? If a numerical apporach can consistently help my team to categorize  according to the spirit of the standard, i would be delighted, and hence want to pursue this thread.

 

Thanks for your patience.

 

Sriramb

[FedAl-Div]

Hi my friend SriramB.

This example we are processing the raw animal materials. It can contain Salmonella, with likelihood 2 or 3. We can set also 2.5

That will give us 66% minimum.

If we are making sandwich of ready to eat components - no Salmonella should be basically.

 

It is very good to taste this approach, thank you

[Tony-C]

@Tony  "When categorising I would consider the above then use the traditional decision tree."

I found this statement slightly obscure . What do you mean by "consider the above" ?

 

Rgds / Charles.C

 

Hi Charles,

 

For significant hazards consider Clause 7.4.4 Selection and assessment of control measures a) - g) then use the decision tree.

 

Regards,

 

Tony