Re-analyzing Hazards & Assessing Risk

By Lisa Lupo

The dates are well past for all food facilities, except those defined as very small, to be in compliance with FSMA’s Preventive Controls rule. This means you have Food Safety Plan in place that, as detailed by FDA in its guidance, “includes an analysis of hazards and risk-based preventive controls to minimize or prevent the identified hazards.” So, you can now get back to business as usual and focus on producing food rather than fulfilling rules, knowing that you’re done with that. Right?

“No,” said Melanie Neumann, president of Neumann Risk Services, and EVP and general counsel of Matrix Sciences. “The race has just started. There is an ongoing expectation to keep the plan updated.”

In addition to conducting a reanalysis of your Food Safety Plan (FSP) at least once every three years, FSMA requires that food facilities reanalyze the plan or portions thereof based on certain triggers, such as the incorporation of a new ingredient or process, the event of a recall, etc. “Ergo: when there is a new risk,” Neumann said. “The strategy, or high-level message is to always come back to the reanalysis trigger. Put the question into a CAPA (corrective and preventive action) analysis, asking, ‘Does this trigger a reanalysis of my Food Safety Plan?’”

Such reanalysis can be beneficial regardless of triggers, particularly if the FSP was developed quickly to bring the plant into compliance. For example, Neumann said, look at the hazards and risks of new ingredients by asking what you may not have thought about in the initial FSP.

Broaden your team, reaching out to areas such as R&D, production, and purchasing if you did not initially include them. Bring the food safety and quality team to the table sooner to do a “quick and dirty assessment” as to whether a new risk assessment is needed for a new product. For example, does it include a new ingredient? Does it contain an allergen? Is the supplier already vetted for another ingredient? If not, could we buy it from a supplier we already use?

“Often food safety and quality don’t get a chance to be part of it because they weren’t invited to the new product development party early enough,” she said. “Taking on a brand new supplier is code for a brand new risk.”

Will Daniels, president of the Produce Division at IEH Laboratories and Consulting Group doesn’t see a lot of difference between FSMA’s Preventive Controls and HACCP with respect to hazard analysis and risk assessment, as companies still need to regularly conduct a hazard analysis that includes the risk assessment. “For many food categories, like produce, the government has helped to determine the risks so there is no debate on what we need to guard against,” he said. “The risk assessment is still up to the operator on what they use to assess risk and where they draw the line for control.”

As to requirements, however, the Preventive Controls process requires controls related to food allergens, sanitation, and suppliers, in addition to what is included under HACCP, said Clare Narrod, director, Risk Analysis/Impact Evaluation Programs, Joint Institute for Food Safety and Applied Nutrition, University of Maryland. “It was recognized under the rule that some controls will not have precise critical limits, and companies would thus need to set parameters and values that they would monitor and make corrections to reduce the risk and/or take correction actions,” she said.

CONDUCT A HAZARD ANALYSIS. With an objective to identify hazards, identify causes, and determine risks, the hazard analysis leads to the identification of critical control points where essential control processes are needed to prevent a foodborne hazard from occurring, Narrod explained. On the other hand, she said, “A risk analysis is based on risk assessments and the application of risk management and risk communication principles and metrics.”

The probability that a sequence of events will take place is determined to assess the level of harm a food safety hazard will cause; then the probability and consequence information is combined to characterize the risk. The analysis usually is done in an iterative manner, she added.

One of the simplest ways to organize your process for conducting a hazard analysis and risk assessment is through a flow chart. “Create a flow chart of your process including each process step, transfers, re-work, and inputs used,” Daniels said. From the flow chart, create a step-by-step hazard analysis, being sure to include all ingredients. Then, he said, “Perform a risk assessment for each hazard you identified using historical information, consumer complaint information, in-house monitoring, and guidelines provided by the government or trade associations.”

It is important to ensure you consider all factors because, Daniels said, “You can get very confused and miss risks or hazards if you are not meticulous in the flow chart.” Be sure to verify the flow by walking the process with a few sets of eyes, he added. “If you are organized and take one step/hazard at a time, you can reduce the opportunity for confusion or missing something.”

When you need to conduct a full reanalysis of your Food Safety Plan, Neumann recommends that you include the following five steps:

1. Ensure you haveappropriately trained individuals — preventive controls qualified individuals (PCQI) and qualified individuals (QI) — to be able to perform a robust hazard analysis and build the plan.
2. Identify the foods and ingredients and their intended uses. “We’re seeing a lot of recalls and issues of reasonably unforeseen and unintended use by consumers, so you have to control for that risk,” she said.
3. Identify and assess the hazards, including those that are emerging or trending that have occurred in other facilities or aspects of your industry sector. And, she said, “You need to show your work. It’s sixth grade math class all over again.” You need to justify why you did or did not elevate something as a hazard.
4. Identify the appropriate preventive controls. “You need to have at least one preventive control for each hazard that requires a preventive control,” Neumann said.
5. Ensure you are conducting appropriate monitoring and verification.

THE RISK ASSESSMENT. Narrod explained the risk assessment process, which can be quantitative or qualitative, as involving four steps defined by CODEX as:

1. Hazard identification. The identification of biological, chemical, and physical agents capable of causing adverse health effects and which may be present in a particular food or group of foods.
2. Hazard characterization. The qualitative and/or quantitative evaluation of the nature of the adverse health effect associated with biological, chemical, and physical agents, which may be present in food. If data are available, dose-response assessments should be performed.
3. Exposure assessment. The qualitative or quantitative evaluation of the likely intake of the biological, chemical, or physical agents via food as well as exposure to other sources if relevant.
4. Risk characterization. The qualitative and/or quantitative estimation, including attendant uncertainty, of the probability of the occurrence and severity of known or potential adverse health effects in a given population based on hazard identification, hazard characterization, and exposure assessment.

Food facilities can use the information collected under the Preventive Controls Rule to develop risk assessment models themselves, hire a consultant, or use a tool that has built-in features, such as FDA-iRISK tool, Narrod said. (See FDA’s iRISK Tool for more information.)

Additionally, Narrod said, “The complexity of the analysis increases with the number of agents and classes of food being considered and differences in the susceptibility of populations.” Typically, analysts think of six levels based on increasing complexity, moving from the simplest, a single agent in multiple food classes; to a single class of agents in single, then multiple food classes; to multiple classes of agents in a single food, single food class, and multiple food classes.

“When one goes beyond a single class of hazards, the greatest challenge is finding a single metric that can be used to compare risk with different characteristics and understand the public health consequence,” she said. Increasingly, analysts are using the disability adjusted life-year (DALY) tool, which looks at years of healthy life lost due to illness and death for consideration of comparative risks. The iRisk software allows for comparative risk assessment and uses DALYs as an end point to do risk-risk evaluations, she said.

Building food-risk scenarios to simulate food-safety issues also enables a facility to ask “what if” questions, see how changing a process or an input might affect public health risk for different products and for different populations of interest, and see how changes might affect their risk-ranking. “These scenarios can help producers fully understand the risks as well as help to justify their conclusions,” Daniels said.

WHAT’S NEXT? The risk assessment highlights the criticality of the hazard analysis and will provide the answer to the next steps. “It will either rise up to the level of a preventive control or you will have knocked it out as a hazard able to be adequately controlled through the GMP/PCP (preventive control plan) process,” Neumann said.

But once the assessment is made, be sure it is vetted with colleagues from other departments and perhaps an outside resource to ensure you have addressed all the potential risks, Daniels said. “Don’t do this in a silo. Once the plan has been vetted and agreed upon, implement the controls you have determined necessary, validate them, and verify frequently to ensure control.”

“Everything pivots around the hazard analysis; it is an ongoing, iterative process,” Neumann said. “It’s all about that word in the regulation: the reanalysis requirement.”

The author is Editor of QA magazine. She can be reached at llupo@gie.net.