HACCP vs Risk-Based Preventive Controls

With the upcoming changes in FDA requirements and FSMA, I thought I’d try to tackle the topic of risk assessments. In the latest supplemental notice of proposed rulemaking, the FDA calls the proposed rule “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls.” When I see that, I wonder how the terms hazard and risk compare and contrast. Are they the same? Do I need to create a follow-up program to my HACCP plan called the risk-based preventive controls?

What exactly is a risk assessment, and how does it differ from a hazard analysis? What does the FDA mean when it says a “risk-based preventive control?” Let’s break it down a bit further.

According to the “go-to resource” for all information—Wikipedia, the Codex Alimentarius of the World Health Organization explains a risk assessment to be: “A scientifically based process consisting of the following steps:

(i) hazard identification,

(ii) hazard characterization,

(iii) exposure assessment, and

(iv) risk characterization.”

However, this is actually part of a risk analysis, with risk analysis defined as “A process consisting of three components: risk management, risk assessment, and risk communication.”1 So do we have four things to do as part of our risk assessment and is that part of a bigger thing called a risk analysis?

For another definition, I looked to the National Advisory Committee on Microbiological Criteria for Foods (NACMCF). The NACMCF HACCP Guidelines of 1997 define a hazard analysis as: “The process of collecting and evaluating information on hazards associated with the food under consideration to decide which are significant and must be addressed in the HACCP plan.”2 Later, this same document states that a hazard analysis includes two stages: hazard identification and hazard evaluation.

Then, to add more confusion to the mix, in the most recent update to FSMA3, the proposed rule section 117.130, FDA compartmentalizes the hazard analysis into:

• Identify and evaluate reasonably foreseeable (think “reasonably likely to occur”).
• Evaluate the foreseeable hazards for probability and severity.
   

Additionally, FDA proposes using the term “significant hazard” that reflects a two-part analysis:

• Narrow the hazards to those that are reasonably foreseeable.
• Further narrow those hazards to those for which a reasonable person would establish controls to prevent or minimize the hazard.
  
   

Prevent Hazards & Risks.

So what are the differences and similarities between these, and how will your HACCP plan become a risk-based preventive controls program—according to FDA and FSMA?

There really is not much difference between a hazard analysis and risk-based preventive controls. In essence, I see them as the same thing. Both can be simple and intuitive. Both can be difficult and complicated. Before you drive to work, you balance the hazards involved and set a course to minimize any hazard. You bring your keys; you ensure you have enough gasoline; you drive at a reasonable speed; and you watch for bicyclists and pedestrians. This is pretty intuitive and very simplistic.

When you complete a hazard analysis (or risk analysis) for your HACCP plan, you have to include more complicated data. You have to include the temperature and time requirements needed to destroy your known pathogen(s); you have to understand the prevalence of those pathogens in your plant and in your food; and you have to present data to substantiate all that. When you drive to your office in San Diego, a hazard that is not reasonably likely to occur (NRLO) is snow and icy roads, so you don’t normally concern yourself with that. The decision about a hazard that may be NRLO in your food plant is based on facts and data, and those facts and data must be well understood during the analysis.

Either way, you are evaluating hazards or risks to determine if the hazard is significant and if actions need to be taken to prevent, eliminate, or reduce the risk to an acceptable level. It is still HACCP whether it is called a “risk-based preventive controls program” or HACCP. FDA is simply implementing HACCP for the segments of the food industry that did not already have mandated HACCP—with some new lingo added in.

My personal opinion is that Congress and the FDA included the term risk-based preventive controls because it is a political term showing what a HACCP plan does when properly implemented. It communicates to the public what we, as food safety and food quality practitioners, have known for a long time—our HACCP plans are risk based and really do prevent problems.

It is our job to construct our HACCP plan properly, with adequate breadth and depth to ensure that reasonably likely hazards are prevented.
 

Sources

1. https://en.wikipedia.org/wiki/Food_safety_risk_analysis.
2. http://www.fda.gov/Food/GuidanceRegulation/HACCP/ucm2006801.htm#guide.
3. DHS, FDA Docket No. FDA-20110N-0920 RIN 0910-AG36, Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food.