Over the past 12-14 months, I've taken over the implementation of GMPs and the overall Food Safety Plan at a small-to-midsize coffee roaster in the Midwest USA.
One of my biggest challenges has been understanding supplier approval/verification, and how it applies to green coffee. We are NOT an importer ourselves, but work with 8-12 different midsize American importers of green coffee. We source Specialty Coffee exclusively; however, the origins are drastically varied, from East Africa to Southeast Asia to a dozen countries in Central and South America.
In discussions with one of our larger suppliers, I was told that the FSVP rule for green coffee importers was practically non-existent, as the food product is technically controlled downstream (by us) as far as microbiological concerns; when it came to mycotoxins, there appears to be no actual regulatory limit within the US for coffee. Additionally, no one in our industry appears to know anything or be asking anything about pesticide residues. Our supplier suggested that they are therefore not responsible for any kind of FSVP requirement as of yet.
My questions is: would a HACCP plan be required, if the "cook step" is something that the product literally has to go through regardless, in order to be sold as roasted coffee? If so, would I actually need to verify the monitoring of that "cook step" for each batch? A coffee that has not reached the appropriate roasting temp (typically in excess of 300 degrees Fahrenheit) or the correct amount of time (anywhere from 12-18 minutes) will not appear properly roasted, or if it did, would not meet its taste profile during quality (sensory) checks.
Whether or not HACCP for coffee roasting would require active verification of roasting temps, what about the overall HAPRC regulations? Generally, roasted coffee is low risk for contamination hazards, because it will normally (9/10 times) be brewed with near-boiling water, and also there is no real history of micro concerns.
I do routine swabs for salmonella in processing areas, but not on Zone 1 equipment, since that would necessitate precautionary holds. I don't think much more is necessary, but can't find anything more concrete, source-wise, to validate my position (unlike, say, the thermal processed acidified Chai products our sister company does, which I also supervise, and which has clear FDA guidelines re: acidification, temperature, etc., and we have our process authority letter,etc.).
Am I just being paranoid, or amI missing something in regards to the coffee roasting and packaging process? We have GMPs, we have Sanitation, Chemical, and Allergen controls (which I'm aiming to strengthen), but is there anything else I should worry about?