The Preventive Controls Rule: HACCP in Disguise or Is There More To It?

Print this Article | Send to Colleague

As the industry begins to digest and discover what the Preventive Controls draft rule really means to them and what will need to be done for compliance, questions abound. The proposed rule, it is coming to be seen, has myriad gaps, complexities, and ambiguities that cause more questions than understanding. Many we are hearing revolve around Preventive Controls vs. HACCP, such as the following: 

• Are the Preventive Controls really just HACCP in disguise?
• What are the differences?
• If I already have HACCP, can I build on that? How?
• Or ... Do I have to start from scratch??

The first thing we want to do is assure you that if you have a HACCP plan, or even if you just have GMPs in place, it is unlikely that you will have to start from scratch. Think of Preventive Controls as HACCP on steroids. Whether you are a canning operation, manufacturer of frozen foods or produce olive oil, the proposed Preventive Controls Rule requires facilities that are required to register with FDA to prepare, implement and document comprehensive and very detailed food safety plans. 

So what should be in a food safety plan?
First, these food safety plans must be facility - not corporate - specific and be based on the hazards associated with the specific products produced in each facility.  They must be based on risks that are "reasonably likely to occur" (RLTO). Below is an outline of the food safety plan requirements that will apply to all facilities covered by this rule:

Identify Hazards RLTO:  If you have a HACCP plan, you have determined risk and likelihood of biological, chemical, physical hazards at each point in the process; analyzed your operation to identify CCPs; and specified critical limits for each. With Preventative Controls, you still need to identify the hazards that are RLTO—with the addition of radiological hazards; and you need to identify and implement preventive controls for each.

Determine Preventive Controls:  Any hazard that is RLTO needs a designated preventive control. If there is no "process control," the preventive control could be a sanitation control, an allergen control program, or a supplier control. Whatever the control, it needs to be specific to addressing the hazard. For example, you would identify a specific sanitation control to address Listeria monocytogenes in a ready-to-eat facility; not just general sanitation. This is the level of detail FDA is expecting, and this is different from HACCP. It is important to note not all preventive controls (such as sanitation controls) have critical limits. This is another difference between preventive controls and HACCP.

Corrective Actions: Every preventive control needs an associated set of corrective actions. Each preventive control must identify what a facility should do if the control is found to not work or something goes wrong. If a preventive control proves ineffective and a corrective action was not anticipated and included in the plan, it needs to be added to the plan after implementation in that instance and this triggers a reanalysis of the food safety plan. 

Monitoring: You must establish and implement written procedures to monitor each preventive control. Your plan needs to include: 1) How a preventive control is monitored; 2) Where the monitoring occurs; 3) How the monitoring is recorded; and 4) Who is responsible for monitoring.  Monitoring records must be kept real-time and actual measurements (vs. checkboxes for example) must be recorded.

Verification: Each facility must verify the essential elements of its food safety plan, such as the adequacy, implementation and monitoring of its preventive controls. Preventive controls must be validated by a "qualified individual," (a person with specified experience, training and education requirements not yet clearly defined by FDA.)  Verification must include ensuring monitoring records are completed, deviations recorded and corrective actions are undertaken.

Reanalysis:  The food safety plan must be reanalyzed at least once every three years by the qualified individual. Even if the reanalysis shows that nothing has changed, a facility must document that the reanalysis was conducted. There are several other things that can trigger a reanalysis sooner than the three years corrective actions must be specified. For example, if something unexpected happens and an unanticipated corrective action is taken, or if a preventive control is found to be ineffective. 

Conclusion
Let’s face it. The Proposed Preventive Controls Rule is complicated, even to determine whether it applies to you or not. There are many exemptions under the rule that may place you in, out or subject to modified requirements.  The best advice is to stay in front. Start now. Do what you can to start complying. If you think parts of the proposed rule should not apply to your industry/processing sector, file comments with FDA. The comment period was just extended again until late November when the Foreign Supplier Verification Program and Third Party Certification Rules were released on July 26.  By starting now you will be in good shape to comply by the time the rule becomes final and effective.

Article written by: Melanie Neumann, J.D., M.S., Senior Director, Food & Import Safety, Leavitt Partners Global Food Safety Solutions

Back to In the View Homepage