18 replies to this topic

[OKBaking]

Hello all, 

 

I recently had an FDA audit, and the auditor said that because we rely on sanitation alone to prevent pathogen contamination in our RTE area, that our sanitation process should be a CCP. We weren't issued any NCs, it was more of "the next audit this is what we expect to see," so I thought I'd run it by you all to see if you have had any similar experiences. We are a USDA/FDA/SQF audited facility so for USDA we're using Listeria alt. 3 and sanitation records are crucial, but sanitation isn't considered a CCP for them according to our inspector. I've never heard a thing about it needing to be a CCP for SQF in all the audits I've undergone. 

 

Thank you!

[GMO]

I've been doing a lot of reading for US legislation recently and what I'm about to share might not be accurate, sometimes it's ridiculously prescriptive.  But if you go back to international HACCP standards, i.e. Codex, then sanitation is absolutely a prerequisite, albeit for US plants you would probably mush it together with the US legislation on preventive controls and call it a preventive control (but not a CCP).  

 

I would also argue your RTE area in itself and the controls on ingress and egress of that area are part of your pathogen control for it so if you start mandating sanitation as a CCP there's a bit of "where will it stop?"

 

If you want a reference though, the first question in the Codex Decision tree is:  "Can the significant hazard be controlled to an acceptable level at this step by prerequisite programs?"  So how is your FDA auditor claiming that answer is not true?

 

But I am going to bang the drum a little for FSMA here and preventive controls. I do think a combination of HACCP and HARPC/FSMA approaches is valid.  And in this case, I think sanitation is a perfect example.  So preventive controls need to have monitoring (normally your cleaning records and perhaps independent inspection by a supervisor?)  Validation (you should validate sanitation to ensure it's capable of reducing soil and bacterial presence to a safe level and removing allergens if relevant.)  You verify it (you do hygiene audits, swabbing, ideally you'd also track man hours on cleaning.)  Ideally you should do all that for prerequisites controlling significant hazards but outside of the US I'd say that practice is a little patchy from sites I've audited.

 

So I suppose my question is have you recorded all of that (whether you've called it a prerequisite or preventive control) and they're just hung up on terminology or have you got a gap in terms of how you validate and verify that as a prerequisite or preventive control?  If it's the latter, I agree with your auditor.  If it's semantics, s/he can bore off as they control you'd have in place is the same.

[Madam A. D-tor]

I am not into USDA/FDA/SQF, but based on my HACCP knowledge, I have always understood that a CCP is related to a product and not to an environment. So, you wrote that the contamination in your RTE area is only prevented by sanitation. I understand this as that the presence of pathogens in your RTE area is only prevented by sanitation. So related to the environment. In my opinion this can not be a CCP.

 

For the products in the RTE area, this statement is not true. To have a RTE product area, including hygiene sluice, protective clothing, hygiene requirements, procedures to open the pqackaging of raw materials, ingredients, cleaning and sanitation of reuseable packaging materials (e.g. crates), etc., is a way of preventing contaminations. All these measures are in my opinion considered Prerequisite Programs or Operational Prerequisite Programs. Sorry, I do not know the equavalent names in SQF or USDA/FDA.

[Scampi]

So you are saying you have no other controls in your food safety system where you've listed pathogens as the hazard?

 

Fundamentally, I hope that isn't what you're saying for RTE product(s)

 

"I recently had an FDA audit, and the auditor said that because we rely on sanitation alone to prevent pathogen contamination in our RTE area"

[OKBaking]

This echos my sentiments exactly. I chose not to fight him on the issue as no NCs were to be issued. I showed him our EM program with validations as well as verification of sanitation activities, pre-op inspections, operational inspections, GMP inspections, ATP and allergen test records as well as FG COAs on our products. We do everything by the book as far as recognizing, preventing, eliminating or controlling hazards. I recently took the updated PCQI training and based on that, I don't believe calling our sanitation a CCP is necessary. Thank you!

I've been doing a lot of reading for US legislation recently and what I'm about to share might not be accurate, sometimes it's ridiculously prescriptive.  But if you go back to international HACCP standards, i.e. Codex, then sanitation is absolutely a prerequisite, albeit for US plants you would probably mush it together with the US legislation on preventive controls and call it a preventive control (but not a CCP).  

 

I would also argue your RTE area in itself and the controls on ingress and egress of that area are part of your pathogen control for it so if you start mandating sanitation as a CCP there's a bit of "where will it stop?"

 

If you want a reference though, the first question in the Codex Decision tree is:  "Can the significant hazard be controlled to an acceptable level at this step by prerequisite programs?"  So how is your FDA auditor claiming that answer is not true?

 

But I am going to bang the drum a little for FSMA here and preventive controls. I do think a combination of HACCP and HARPC/FSMA approaches is valid.  And in this case, I think sanitation is a perfect example.  So preventive controls need to have monitoring (normally your cleaning records and perhaps independent inspection by a supervisor?)  Validation (you should validate sanitation to ensure it's capable of reducing soil and bacterial presence to a safe level and removing allergens if relevant.)  You verify it (you do hygiene audits, swabbing, ideally you'd also track man hours on cleaning.)  Ideally you should do all that for prerequisites controlling significant hazards but outside of the US I'd say that practice is a little patchy from sites I've audited.

 

So I suppose my question is have you recorded all of that (whether you've called it a prerequisite or preventive control) and they're just hung up on terminology or have you got a gap in terms of how you validate and verify that as a prerequisite or preventive control?  If it's the latter, I agree with your auditor.  If it's semantics, s/he can bore off as they control you'd have in place is the same.

[OKBaking]

We have multiple controls, including time, temperature, space, etc. The auditor found nothing wrong with what we're doing, he just didn't like that we don't call our sanitation steps a CCP. When I said, "we rely on sanitation alone," that was the way he phrased it because we don't use additives in or on our products or packaging to prevent pathogen growth after the kill step.

So you are saying you have no other controls in your food safety system where you've listed pathogens as the hazard?

 

Fundamentally, I hope that isn't what you're saying for RTE product(s)

 

"I recently had an FDA audit, and the auditor said that because we rely on sanitation alone to prevent pathogen contamination in our RTE area"

[Lynx42]

Are you sanitizing the product?  My understanding of HACCP is that a CCP is the critical step the product goes through to make it safe.  

Sanitizing would be a preventive control unless you are running food/ingredients through a sanitation process.  

 

I wonder when this auditor last (or if ever) took a HACCP course.  

[Madam A. D-tor]

So there is a kill step. Than I am sure that is the CCP.

[OKBaking]

No, you're 100% correct, we aren't sanitizing the product. The kill step and subsequent chilling are the main CCPs for this product. I have met some really good auditors, and some that leave me wondering why they are in the industry.....I just wanted to bounce this off you all to make sure I wasn't the problem, lol. 

 

Are you sanitizing the product?  My understanding of HACCP is that a CCP is the critical step the product goes through to make it safe.  

Sanitizing would be a preventive control unless you are running food/ingredients through a sanitation process.  

 

I wonder when this auditor last (or if ever) took a HACCP course.  

[kingstudruler1]

If im interpreting you & and finding correctly...... 

 

First, do you have a preventive controls plan and a HACCP plan?

 

USDA HACCP and FDA Preventive Controls are not the same.   We should be surprised that your SQF auditor didnt question this, yet I am not. 

 

For FDA,  you are requried to have a preventive controls plan.  One that "possibly" includes supply chain preventive controls, operational preventive controls (old CCP), sanitation preventive controls,  and allergen preventive controls.   Processes after kill step would most likely require a "Sanitation Preventive Control" as you and the auditor stated.   

 

It appears you got the "FSMA, were going to educate first audit".   Im surprised that the auditor refered to it as a "CCP".    That would be confusing and misleading.  

[OKBaking]

Hi, yes we have multiple HACCP plans and Preventive Controls Plans, as well as master Food Safety Plans. We will have a new SQF auditor this year so I'm looking forward to a fresh set of eyes. It certainly would be easier if agencies across the board used the same language, but I am feeling more aligned with the Preventive Controls way of doing things after the updated PCQI training I took because it's more in-depth than the language used by the USDA. For now, I maintain separate plans per entity, but I'd like to someday merge them if possible, for ease of maintenance. 

 

If im interpreting you & and finding correctly...... 

 

First, do you have a preventive controls plan and a HACCP plan?

 

USDA HACCP and FDA Preventive Controls are not the same.   We should be surprised that your SQF auditor didnt question this, yet I am not. 

 

For FDA,  you are requried to have a preventive controls plan.  One that "possibly" includes supply chain preventive controls, operational preventive controls (old CCP), sanitation preventive controls,  and allergen preventive controls.   Processes after kill step would most likely require a "Sanitation Preventive Control" as you and the auditor stated.   

 

It appears you got the "FSMA, were going to educate first audit".   Im surprised that the auditor refered to it as a "CCP".    That would be confusing and misleading.  

[GMO]

Just curious out of the previous two comments.  Do you not combine your HACCP and FSMA plans in the US?  If not isn't that a hell of a lot more work?

[kfromNE]

I wouldn't put it as a CCP like everyone else mentioned. If this does come as a finding the next time you have an audit - you can always fight it. 

 

I work in a FDA/USDA/SQF plant. We do separate HACCP/FSMA plans but the same SOPs though some SOPs are specific for USDA/FDA - it is called out then. If it's the same like CCPs - we call them CCP/PC.  Our food defense and crisis management is more robust for the USDA but they are obviously fine with this. For a cooling step - which vary between USDA/FDA - you can only follow one of them. 

 

How it was done with SQF requirements - not 100% sure. The person in charge of food safety in food manufacturing facilities at our corporate office used to be a SQF auditor. 

[kfromNE]

Just curious out of the previous two comments.  Do you not combine your HACCP and FSMA plans in the US?  If not isn't that a hell of a lot more work?

 

No. So when you are audited - you only show them what is required and not extra. Most of the time - it's pretty easy to separate. It's a copy and paste then add an extra step for USDA and say receiving meat items. Also call out the hazards for the meat item too. 

 

For our allergen in products -  I use the same document because they are ran interchangeably (soups). So it has the item, our internal code number, allergens and whether a FDA, USDA or Seafood item. Grouped by allergens. For us - very logical due to the amount of items we make - I've never had a problem. 

[kingstudruler1]

Hi, yes we have multiple HACCP plans and Preventive Controls Plans, as well as master Food Safety Plans. We will have a new SQF auditor this year so I'm looking forward to a fresh set of eyes. It certainly would be easier if agencies across the board used the same language, but I am feeling more aligned with the Preventive Controls way of doing things after the updated PCQI training I took because it's more in-depth than the language used by the USDA. For now, I maintain separate plans per entity, but I'd like to someday merge them if possible, for ease of maintenance. 

Ok good.  I was concerned for a sec.  

 

Not sure why FDA would refer to anything as a CCP.   Again, depending on your process,  I dont think its out of line for them to suggest the sanitation preventive control after the kill step. Ie - is there a risk that the equipment after the kill step has not been cleaned properly or could otherwise contaminate the product.  If so, a sanitation preventive control is needed / warranted.        

 

I feel sorry for those of you that are both USDA and FDA, seems like a uneccesary mess.   

Edited by kingstudruler1, 28 March 2025 - 06:00 PM.

[GMO]

No. So when you are audited - you only show them what is required and not extra. Most of the time - it's pretty easy to separate. It's a copy and paste then add an extra step for USDA and say receiving meat items. Also call out the hazards for the meat item too. 

 

For our allergen in products -  I use the same document because they are ran interchangeably (soups). So it has the item, our internal code number, allergens and whether a FDA, USDA or Seafood item. Grouped by allergens. For us - very logical due to the amount of items we make - I've never had a problem. 

 

Ok, going to start another thread on this one... because my mind is blown.

[OKBaking]

We also split our HACCP and FSMA. Our SOPs and SSOPs are the same across the board though. On those, because I need them to be consistent for our employees, I combined all required elements. I appreciate all the feedback!

 

I wouldn't put it as a CCP like everyone else mentioned. If this does come as a finding the next time you have an audit - you can always fight it. 

 

I work in a FDA/USDA/SQF plant. We do separate HACCP/FSMA plans but the same SOPs though some SOPs are specific for USDA/FDA - it is called out then. If it's the same like CCPs - we call them CCP/PC.  Our food defense and crisis management is more robust for the USDA but they are obviously fine with this. For a cooling step - which vary between USDA/FDA - you can only follow one of them. 

 

How it was done with SQF requirements - not 100% sure. The person in charge of food safety in food manufacturing facilities at our corporate office used to be a SQF auditor. 

[OKBaking]

I'm thinking this auditor may have been old school from before FSMA maybe.....our sanitation of the RTE area is a PC that's validated and is verified through both visual and ATP testing, every time before it's used. There's always a risk when you don't run 24/7 and the primary cleaning is done after the shift is over (running one shift, will be two in a couple months) so there's a time lapse between cleaning and sanitization, and when we use the line again. We use alcohol on the RTE lines after ATP testing and let it dry, even if the tests come back acceptable, because tests are just a representative sample. Thank you!

 

Ok good.  I was concerned for a sec.  

 

Not sure why FDA would refer to anything as a CCP.   Again, depending on your process,  I dont think its out of line for them to suggest the sanitation preventive control after the kill step. Ie - is there a risk that the equipment after the kill step has not been cleaned properly or could otherwise contaminate the product.  If so, a sanitation preventive control is needed / warranted.        

 

I feel sorry for those of you that are both USDA and FDA, seems like a uneccesary mess.   

[GMO]

I'm thinking this auditor may have been old school from before FSMA maybe.....our sanitation of the RTE area is a PC that's validated and is verified through both visual and ATP testing, every time before it's used. There's always a risk when you don't run 24/7 and the primary cleaning is done after the shift is over (running one shift, will be two in a couple months) so there's a time lapse between cleaning and sanitization, and when we use the line again. We use alcohol on the RTE lines after ATP testing and let it dry, even if the tests come back acceptable, because tests are just a representative sample. Thank you!

 

What a worrying state of affairs though that the FDA are allowing any auditor to not be conversant with current legislation?  

 

AND.. even if that is the cause, those of us who have written HACCP plans outside of the US in plants where we've not had to comply with FSMA still wouldn't have had this as a CCP...