The news coverage of Hurricane Irene, which ravaged the East Coast of the United States this summer, provided good examples of why it is essential to build houses on a good foundation. Many of those people who built wisely still have a home, whereas those who built on the sand lost their homes. In a similar way, prerequisite programs (PRPs) are absolutely essential for ensuring food safety, as they form the base of a food safety program. Without well-designed and documented programs that are properly implemented and maintained, the chances that a company will have a recall or have their products cause illness or injury are significantly higher.

PRPs are an integral part of food safety standards and audit schemes the world over. ISO 22000, “Food safety management systems—Requirements for any organization in the food chain,” emphasizes the importance of PRPs and, in Section 3.8, defines them as follows:

“basic conditions and activities that are necessary to maintain a hygienic environment throughout the food chain (3.2) suitable for the production, handling and provision of safe end products (3.5) and safe food for human consumption.”

Food processors have three challenges when it comes to developing these programs:

• Developing and implementing effective programs
• Maintaining those programs once they have been implemented
• Ensuring that the programs are maintained and will stand up to auditor scrutiny

One would think that having effective programs would be adequate, but unfortunately, there are audit schemes that actually mandate how things shall be done instead of evaluating whether a processor’s system is effective. Point two is one that many people don’t think about. However, when one gets out into the field and looks at operations, one finds many beautifully designed and written programs that are simply not being followed in plant operations. Processors must do what they say, that is, what happens during operations must match the documented procedures.

Elements of Developing and Managing PRPs
When building PRPs, processors should incorporate the following elements:

• Responsibility
• Develop
• Document
• Implement
• Train
• Monitor and record
• Verify/audit
• Review and update

Let’s look at each of these elements, why they are important and what might be done to satisfy auditors.

Responsibility: The different areas where processors should establish PRPs may be seen in Table 1. To ensure that each area is properly managed, one person should have the responsibility for managing each program area. Responsibilities must be defined in the person’s job description, which must be signed by the individual indicating that he or she has accepted responsibility. This individual will need to not only ensure that the program is set up properly but will need to also manage the program on a day-to-day basis. One means available to processors to clearly show an auditor who is responsible for managing each area is to place all the PRP areas on a master list along with the name and department of the responsible person. The master list should have spaces to allow each manager to sign and date the form, demonstrating that they have accepted the responsibility. It is extremely important to have different people managing the different program areas. The master list is an extremely valuable communications tool. It was only a few years ago that the point man or woman for the sanitation or food safety audit was the quality assurance manager or supervisor. He or she coordinated with the auditor, took the auditor through the plant and provided almost all the information. Audits today are not only more complex, they are also more comprehensive. This means that even though the quality manager may still be the point person, he or she must do more, such as:

• Making sure that every operating group understands their role
• Ensuring that there are documented procedures
• Making sure that records are properly maintained
• Ensuring that their people have been trained on all procedures pertaining to quality and safety

Of course, part of responsibility is management commitment. ISO 22000 emphasizes this point in section 5.1, “Management commitment.”

“Top management shall provide evidence of its commitment to the development and implementation of the food safety management system and to continually improving its effectiveness by

a) showing food safety is supported by the business objectives of the organization,

b) communicating to the organization the importance of meeting the requirements of this International Standard, any statutory and regulatory requirements, as well as customer requirements relating to food safety,

c) establishing the food safety policy,

d) conducting management reviews, and

e) ensuring the availability of resources.”

Perhaps the most important element in this is the last point: “ensuring the availability of resources.” The commitment clearly demonstrates that management is willing to do what is necessary to ensure the production of safe and wholesome foods. Communication issues are important, but they can be hollow; companies may have wonderful food safety policies posted throughout the plant, but the operation simply has not made the commitments needed to meet those goals.

Develop and document: For each PRP area, it is imperative that the processor document how the program will be managed, carried out and monitored. In most cases, there will be two or three levels of documentation. There will be a general procedure that describes how the program shall be managed and the expectations. The second level of documentation would be work instructions. These incorporate the step-by-step procedures on how each task is accomplished, including how any monitoring will be done and any corrective actions that must be taken. The final level would be the forms used for monitoring. All of these documents and records should be created and managed through the company’s document control program. This ensures that they are written using proper formats, reflect what is being done and that the proper procedures and forms are being used. For example, let’s look at the cleaning and sanitation program. The general procedure would define expectations, the need to establish a master cleaning schedule, how cleaning procedures would be drafted, procedures for monitoring and procedures for verification that the work was properly conducted. There would be a range of work instructions that describe how each piece of equipment would be cleaned, how verification activities would be conducted (e.g., ATP swabs, microbial swabs, visual examinations) and how management would inspect equipment and sign off on whether the work was properly conducted. The procedures and work instructions must match the actual cleaning procedures. Writing one thing down and doing another is a sure means for losing points on an audit. The auditor or investigator will start thinking, “Well, if they are not doing what they say here, where else are they failing to follow procedures?” The result may be that he digs deeper to look for additional failings.

Implement and train: Having good documentation is only part of the equation. The documents and records must reflect what is actually happening in the processing operations. This is one real danger that processors, especially small ones, experience when they rely on outside agencies or consultants to write procedures for them. I have found this to be a greater problem in my work in developing countries. Processors do not have the in-house expertise to develop programs, so they hire a consulting firm. Unfortunately, some firms have put together templates (one size fits all, or so they think) and simply provide these to the operation. I saw such templates recently. Two plants had the same documents that even used the same numbering system. The only difference was the company logo pasted on the top of the documents. The procedures that had been drafted also did not reflect the actual procedures in the plant. The bigger issue, however, was that the companies assumed that once they had the procedures, they were done. They made no effort to implement (or modify the procedures) in their facility. As noted above, documented procedures need to mirror actual practices.

It is imperative that training and implementation go hand in hand. A processor must make the commitment to ensure that all workers and managers are trained (or educated) on all procedures. These efforts must also be properly documented. It is also a good idea to ensure that the training programs include a way to verify their efficacy. There are many ways to do this. Perhaps the easiest is to give tests, but when it comes to in-plant tasks such as equipment startup and operation or cleaning and sanitation, programs that demonstrate competency are often used. How this is done depends upon each operation. Never rely on simple verbal communication to train people. Training must always be done against the documented procedures or work instructions. The child’s parlor game in which one starts with a story and whispers it to the person next to him and so on around the table is a great example of why verbal training alone is ineffective. By the time the story reaches the last person at the table, it is always very different from what it was at the beginning.

One common mistake made by many companies when preparing for third-party audits is to update their procedures immediately before the audit. If an audit is being conducted on October 1, 2011, and the auditor sees procedures that have been written or revised on September 29, 2011, an obvious question to ask is, “Have you trained your workers on these new/revised procedures?” In most cases, the answer will be “No.” So it is essential to document or revise, implement and train all together. This must be treated as an integrated program, not as separate entities.

Monitor and record: Monitoring and record keeping are essential when it comes to providing evidence that procedures are being followed. The old adage “If it’s not written down, it never happened” has plagued more than one processor during visits by auditors or regulators. “But we do/did that” simply does not fly with these people without supporting documentation. The procedures that have been developed must describe how they are to be documented and should reference the forms to be used. How this is done must be part of the training programs and, of course, it is expected that each and every person responsible for monitoring Critical Control Points (CCPs) or operational PRPs (oPRPs) will be properly trained on how to carry out those tasks. This includes the principle monitors, the backups and backups to the backups. Again, it is a fair question for an auditor to ask, “Who does the monitoring if John Doe is not here? And has he/she been trained on the procedures?”

When monitoring events in the plant, operators must accurately record things at the time the activity occurred. Auditors are suspicious of what may be called perfect records, that is, records in which all information is recorded at precisely the top or bottom of the hour. That simply does not happen in the real world. Part of the monitoring and record-keeping equation is what to do in the event that an error is made. When a change is made, the erroneous entry should be lined out, the correct entry made and the change initialed and dated. Erasures, liquid paper and corrections tape should never be used (Figure 1). Such entries would be construed as falsifying records. One major change in the industry is the use of electronic records. If a company elects to go this route, they must ensure that changes cannot be made by unauthorized personnel. If an operator makes an erroneous entry, he or she cannot change it. The data entry systems usually allow for operators to make some kind of note that there was an error, however.

Verify/audit: Whereas monitoring is a real-time activity, verification occurs after the fact. The objective of verification is to make sure the system is working as designed. Many different elements make up verification. These include validation of oPRPs and CCPs, CCP verification activities such as calibration of monitoring devices, calibration record review, targeted sampling and testing, CCP record review and verification of PRPs and, finally, Hazard Analysis and Critical Control Points (HACCP) system verification or reassessment. The latter must include an evaluation of the PRPs and their efficacy. One gap that many HACCP plans have is a statement that describes how the reassessment should be done. (For an example of how such a statement might read, see “HACCP Plan Verification and Upkeep” below.)

There is an ongoing debate about whether all PRPs or only those deemed essential for ensuring food safety, the oPRPs, require validation. Most food safety professionals seem to favor the latter. Validating a cleaning procedure requires work, but it can be done fairly easily. However, how does a processor validate something like handwashing, training or pest control? In most food plants, workers must wash their hands at the start of the day, after morning break, after lunch, after an afternoon break, after a toilet break and any time they soil their hands or gloves; figure a minimum of six to eight times per day. Now multiply that by 100 workers. One simply cannot monitor that kind of activity. However, management can create an environment that encourages proper handwashing by ensuring that there are sufficient and conveniently located handwashing sinks. By ensuring that these are properly supplied with warm water, soap, towels or dryers and perhaps hand sanitizer, there is a good chance that a properly trained workforce will follow procedures. In addition, management must set an example by using these sinks and using them properly. It is also a good idea to talk about such issues during HACCP team meetings and prepare a risk assessment document. If an auditor asks or challenges a company with a question such as “How do you know handwashing is effective? Have you validated that activity?,” the risk assessment will show that the question has been addressed and it has been determined that validation is not quite possible.

Another element that must address PRPs of all types is the internal audit. Ideally, processors will subject each program to such an audit. These audits should be done independently by trained personnel; quality may audit production, warehousing will audit quality, purchasing will audit production and so on down the line. These persons may be trained in-house or an outside firm may be used. Training must be against the procedures that will be followed. The internal audit should be done to ensure the following:

• Procedures are being followed
• Documentation is being done at prescribed frequencies
• Training/education/competencies have been done and are up to date

The emphasis on adoption of one of the approved Global Food Safety Initiative audit schemes has underscored the importance of internal audits. Yet there will be operations that simply will not be able to meet the internal audit requirements. What does a small company with 15 or so employees who are cross-trained to work in different areas do? Independent audits simply will not be possible. This is another situation where an in-house assessment document can be used that clearly outlines the situation and describes how the program will be designed and organized. The bottom line is that auditors should evaluate how well systems are designed and managed—and their efficacy—not that a system fails to meet a normal expectation.

Review and update: The final area that processors need to develop is a management review program. Now, many companies hold regular management meetings with their team, but more often than not, these meetings do not satisfy the intent of the management review requirement. In part 5.8.1, ISO 22000 states that “Top management shall review the organization’s food safety management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing opportunities for improvement and the need for change to the food safety management system, including the food safety policy. Records of management reviews shall be maintained.” This activity must address the PRPs, especially those deemed essential for ensuring food safety. Ideally, every one of the individuals given responsibility for managing the PRPs should participate in the management review meeting. These meetings should evaluate each program and how well it is performing, develop protocols for improving the programs and allocate the necessary resources to make upgrades. Of course, there will likely be insufficient resources to do everything in every area. The management review should also look at all the planned improvements and prioritize the programs based on risk to the business. Food safety should have top priority. For example, if the person responsible for managing water quality reports that the company was downgraded in an audit because they did not have an adequate plumbing diagram (i.e., a diagram that clearly demonstrated no cross-connections between wastewater lines, sewage lines and potable water lines), then rectifying that issue might get top priority based on potential risk. It is also imperative that records of these meetings be maintained, especially those discussions that described how priorities were set.

Summary
PRPs are the foundation of food safety. Without well-developed PRPs that are properly documented, implemented and maintained, a processor risks serious problems. Most foodborne outbreaks are caused not by a breakdown or failure at CCPs, but by a failure of one or more PRPs. The word maintained is used for a reason. One cannot take these programs for granted. Following the steps outlined above when building a food safety management system should help ensure that the PRPs are properly developed and managed and will withstand the scrutiny of in-house quality staff, auditors and customers.

Richard F. Stier is a consulting food scientist with international experience in food safety (HACCP), plant sanitation, quality systems, process optimization, Good Manufacturing Practices compliance and microbiology. He is a member of the Institute of Food Technologists and an editorial adviser to Food Safety Magazine. He can be reached at rickstier4@aol.com.


SIDEBAR

HACCP Plan Verification and Upkeep
To comply with the basic principles of HACCP as described by the National Advisory Committee for Microbiological Criteria for Foods and the Codex Alimentarius’s “Recommended International Code of Practice General Principles of Food Hygiene,” CAC/RCP 1–1969, Rev. 4–2003, this plant shall verify their HACCP plan according to the following programs:

• The HACCP team shall meet at least once a year to verify that the current HACCP plan is effective.

• Records/minutes of all meetings shall be maintained.

• Records of any changes made to the current HACCP plans shall be maintained in a log as part of the HACCP plan. Changes shall be noted in the log and initialed by the HACCP team leader.

• Top management shall sign and date the management support page yearly following the HACCP team meetings.

• The HACCP team shall meet more frequently if needed. Actions that may prompt more frequent meetings include, but need not be limited to, the following:

• Foodborne outbreaks attributed to company products

• Foodborne outbreaks attributed to competitor’s products

• Customer complaints

• Major changes to the products or processes

• New technical information that may affect current food safety programs

• Regular or significant failure to meet established CCPs