Dairy Science & Technology · Quality, Regulation & Dairy Business · also Food Safety and Quality Management, HACCP and Food Safety Systems
Prerequisite programmes, HACCP and the certified food safety systems dairy buyers and regulators require.
In the exams: ICAR AICE subject 35b Unit 1, subject 34 Unit 9 and subject 37 Unit 9; ICAR AIEEA-PG group 16 (ISO 9001 and ISO 22000)
Dairy food safety management is the set of programmes, plans and audited systems that keep milk and milk products safe from the farm tank to the consumer. Milk is an ideal growth medium for bacteria, it is drunk by infants, the elderly and the sick, and many dairy products are eaten without further cooking. A single failure at a pasteuriser, a cracked plate in a regenerator or a Listeria harbourage in a cheese brine room can make thousands of people ill. For that reason dairying was one of the first food industries to use time-temperature recording, flow diversion and laboratory verification, and today most dairy processors operate under a hazard analysis and critical control point (HACCP) plan inside a certified food safety management system.
This manual covers the prerequisite programmes on which HACCP rests, the seven HACCP principles and twelve Codex steps, worked HACCP plans for pasteurised milk, cheese, milk powder and ice cream, the management-system standards (ISO 22000, FSSC 22000, BRCGS Food Safety and SQF) and the GFSI benchmarking that makes them acceptable to retailers, the US preventive-controls rule, allergen management, food defence and food fraud, traceability and recall, internal and certification audit, and food safety culture. The general theory of HACCP and ISO 22000 is taught in the Food Technology subject food-safety-management-systems; sanitation and hygienic design in this track's cip-sanitation-hygienic-design; the flow diversion valve and holding tube in dairy-processing-equipment; legal limits and the Pasteurized Milk Ordinance in dairy-standards-law-worldwide; audit statistics and laboratory accreditation in dairy-quality-assurance-sqc; and the organisms themselves in dairy-pathogens-toxins. This manual gives short reminders of those topics and spends its words on how they apply in a milk plant.
Schemes and laws change. Scheme owners issue new versions every few years, and regulators revise criteria and limits. Where this manual names a version, read it as the version in force when the manual was written, and check the scheme owner's or regulator's current text before you rely on a clause number or a limit.
In examinations, this subject appears in the ICAR AICE-JRF/SRF papers (Food Safety and Quality, and the legal and quality units of Dairy Chemistry and Dairy Technology), in the ICAR AIEEA-PG Dairy Science and Dairy Technology papers (HACCP, ISO 9001 and ISO 22000, HACCP in fluid milk), in Food Safety Officer recruitment in India, and in professional routes such as FSSC 22000 auditor training, the US Preventive Controls Qualified Individual course and Grade A milk certification. Questions test whether a candidate can apply the HACCP logic to a dairy process, tell a prerequisite from a critical control point, and explain what an auditor or regulator expects to see.
Prerequisite programmes (PRPs) are the basic conditions and activities needed to keep a hygienic environment throughout the food chain. Codex calls them good hygiene practices (GHPs); US law calls the core of them current good manufacturing practice (CGMP); ISO 22000 calls them PRPs. Whatever the name, they are not specific to one hazard at one step. They control the general background: the building, water, air, pests, people, cleaning, maintenance, waste, and the handling of materials. HACCP assumes they are in place. A HACCP plan written for a plant with leaking roofs, untrained staff and no pest control will either list dozens of critical control points that cannot be managed or will quietly fail. The usual teaching rule is that PRPs come first, then HACCP is built on top of them.
The Codex General Principles of Food Hygiene (CXC 1-1969, revised in 2020) set out the GHPs that apply to all food businesses: design of establishments and equipment, training and competence, cleaning and disinfection, pest control, personal hygiene, control of operation, product information and consumer awareness, and transport. For dairy, Codex adds the Code of Hygienic Practice for Milk and Milk Products, which carries the hygiene principles from milk production on the farm through processing. ISO/TS 22002-1 gives a detailed PRP list for food manufacturing and is the PRP standard used with ISO 22000 in FSSC 22000 certification of dairy plants.
In a milk plant the PRPs that matter most are the following. Raw milk reception: clean tankers with wash records, sampling and rapid testing before unloading, and segregation of rejected loads. Water: potable water for product contact and cleaning, with separate identified systems for non-potable uses such as fire water or cooling. Cleaning and sanitation: validated cleaning-in-place (CIP) programmes for tanks, lines, heat exchangers and fillers, with clean-out-of-place for parts that cannot be cleaned in place; this is taught fully in cip-sanitation-hygienic-design. Hygienic design and maintenance: sanitary equipment, drainable lines, no dead legs, and maintenance work that does not leave swarf, lubricant or loose parts in product zones. Zoning: physical and procedural separation of raw and pasteurised areas, and of wet and dry areas in powder plants. Personnel hygiene: protective clothing, hand washing, footwear control and exclusion of ill workers. Pest control: proofing, monitoring stations and a contractor or trained person, with no baits inside open-product areas. Supplier approval for packaging, cultures, rennet, stabilisers and other ingredients. Chemical control: food-grade lubricants where contact is possible and safe storage of detergents and sanitisers. Glass and brittle plastic policy. Waste handling and drainage. Calibration of thermometers, recorders and scales.
Each PRP needs an owner, a written procedure, monitoring at a stated frequency, records, and a correction when it fails. Auditors look for the gap between the written procedure and what happens on the floor.
ISO 22000 recognises three levels of control. A PRP is general. An operational prerequisite programme (OPRP) is a control measure, identified by hazard analysis, that is needed to control a significant hazard but is managed by an action criterion and monitoring rather than a critical limit. A CCP is a step at which a control measure is applied with a measurable critical limit whose breach makes the product potentially unsafe. In a dairy, environmental monitoring for Listeria in a ready-to-eat area, allergen segregation and some reception tests are often run as OPRPs; pasteurisation is almost always a CCP. The choice is made in the hazard analysis and must be justified, not assumed from a template.
Take raw milk reception as an example. A rapid test for beta-lactam antibiotics on every tanker could be argued to be a CCP, because residues are a chemical hazard and pasteurisation does not remove them. Many plants instead treat reception testing as an OPRP or a PRP supported by farm controls, arguing that the hazard is managed mainly on the farm through withdrawal periods and that the test is a check on that control. Either view can be defended if the reasoning is written down and the control is monitored and recorded. The same debate applies to aflatoxin M1, which is controlled mainly through feed quality on the farm and is measured at intervals at the plant rather than on every load.
HACCP was developed in the 1960s by a food company working with the US space programme and the US Army laboratories to produce food for astronauts with near-zero risk of contamination. Instead of relying on testing the finished product, which can never test enough units to prove safety, it identifies where hazards enter or grow, picks the points where they can be controlled, and monitors those points continuously. The approach was presented publicly in 1971 and later adopted by Codex, by the US National Advisory Committee on Microbiological Criteria for Foods, and by food law in most countries. The general theory is taught in food-safety-management-systems; this chapter restates the sequence because every dairy plan follows it.
The key idea is preventive control. End-product testing has two weaknesses: sampling can never test enough units to find a low rate of contamination, and by the time the result arrives the product may already be on sale. A sample of a few packs from a large batch will usually miss a defect that affects one pack in a thousand. HACCP moves effort upstream, so that the plant knows a lot is safe because the controls were in place and the records show it, not because a few samples were negative.
Codex sets out twelve logical steps. The first five are preliminary. Step 1: assemble a multidisciplinary HACCP team with production, quality, engineering and microbiology knowledge, bringing in outside expertise where needed. Step 2: describe the product, including composition, physical and chemical properties such as pH and water activity, treatments, packaging, shelf life and storage and distribution conditions. Step 3: identify the intended use and the users, noting vulnerable groups such as infants. Step 4: construct a flow diagram covering every step from receipt of raw milk and ingredients to dispatch, including rework and recycle loops. Step 5: confirm the flow diagram on site, at all hours of operation.
Steps 6 to 12 are the seven principles. Principle 1: conduct a hazard analysis, listing biological, chemical and physical hazards at each step, judging their likelihood and severity, and identifying control measures. Principle 2: determine the critical control points. Principle 3: establish critical limits for each CCP, and validate them. Principle 4: establish a monitoring system for each CCP. Principle 5: establish corrective actions to be taken when monitoring shows a CCP is out of control. Principle 6: establish verification procedures, including validation of the plan, to confirm that HACCP is working. Principle 7: establish documentation and record keeping. The 2020 revision of the Codex text gives validation of control measures and critical limits more emphasis and treats the CCP decision tree as one tool among others rather than the only route.
Biological hazards in dairy include vegetative pathogens from the animal and the farm environment, such as Salmonella, pathogenic Escherichia coli including Shiga-toxin-producing strains, Campylobacter, Listeria monocytogenes, Staphylococcus aureus and its heat-stable enterotoxins, Brucella and Mycobacterium bovis where these diseases remain in herds, and Coxiella burnetii; spore formers such as Bacillus cereus and Clostridium botulinum; and Cronobacter in powdered infant formula. Chemical hazards include veterinary drug residues, especially antibiotics, aflatoxin M1 carried over from contaminated feed, pesticide and environmental contaminant residues, cleaning chemicals, and allergens from other ingredients. Physical hazards include metal from equipment wear, glass, hard plastic and stones in added ingredients. Many teaching texts also list radiological hazards for completeness, and the US rule names them explicitly.
The analysis must state why each hazard is or is not significant at each step. A hazard that is reasonably likely to occur and would cause harm needs a control measure. Write down the reasoning, because the auditor will ask for it.
Monitoring at a dairy CCP is usually continuous and automatic: a recorder-controller logs the holding temperature of every second of pasteurisation, and a metal detector rejects every contaminated pack. Corrective action has two parts: regain control of the process, and decide what to do with product made while control was lost. Records must show what was monitored, by whom and when, what went wrong and what was done. Verification includes reviewing records, calibrating instruments, testing product, and auditing. Without records there is no evidence the plan was followed.
Records should be completed at the time the activity is done, signed or electronically authenticated, and kept for a period at least as long as the shelf life of the product plus a margin, or as long as the law requires. Electronic systems for pasteuriser charts are now common and must be protected against alteration. A record that shows the same value every hour in the same handwriting is a warning sign to an auditor that monitoring is being filled in rather than done. Verification activities differ from monitoring: monitoring is the routine observation at the CCP, while verification is the periodic check that monitoring, corrective action and the plan itself are effective.
For market milk the critical step is pasteurisation. The classical standards are 63 °C for 30 minutes for batch holding and 72 °C for 15 seconds for high-temperature short-time (HTST) processing; national rules set the exact values and any higher values for cream, flavoured milk and mixes, so read them from the current legal text, as described in dairy-standards-law-worldwide. The CCP is the holding tube. Its critical limits are the minimum temperature at the end of the holding tube and the minimum holding time, which depends on the tube length and the flow rate of the fastest particle. Monitoring is by an indicating thermometer and a recorder-controller. The automatic control is the flow diversion valve, which sends milk below the set temperature back to the balance tank. A timing pump or flow controller fixes the maximum flow so that the holding time cannot fall below the limit. The construction of these parts is taught in dairy-processing-equipment.
Verification includes daily checks that the recording thermometer agrees with the indicating thermometer, regular tests that the flow diversion valve cuts in at the set temperature, checks of holding time, and the alkaline phosphatase test on finished product. Alkaline phosphatase is a natural milk enzyme slightly more heat resistant than the vegetative pathogens of concern, so its absence shows adequate heating; a positive result after correct pasteurisation can indicate raw milk mixing in or, in high-fat products, enzyme reactivation, which is why confirmatory methods exist.
After pasteurisation the hazards are recontamination and growth. Recontamination comes from leaking regenerator plates, where raw milk can pass into pasteurised milk if the pressure on the pasteurised side is not kept higher; from filler nozzles and the post-pasteurisation environment; and from poorly cleaned lines. These are controlled by pressure differential controls, by CIP and by environmental monitoring, often as OPRPs. Cold storage and distribution temperatures control growth.
Cheese made from pasteurised milk has pasteurisation as its main CCP. Cheese made from raw or thermised milk relies on a combination of controls: raw milk quality and herd health, active starter cultures that lower pH quickly, salt, reduced water activity and ripening time. In the US, cheese from unpasteurised milk must be held for at least 60 days at not less than about 2 °C before sale; this rule has been questioned because some pathogens survive it in some cheese types. The speed of acid development is a key control: a slow vat, caused by bacteriophage attack on the starter or by antibiotic residues in the milk, allows Staphylococcus aureus to grow and produce enterotoxin, which is not destroyed by later heating. Many plans therefore monitor pH at set times as a CCP or OPRP. Soft and smear-ripened cheeses and brined cheeses are prone to Listeria contamination after the make, so brine systems, ripening rooms, shelves and cutting and packing areas are covered by environmental monitoring.
In a powder plant the heat treatment of milk before evaporation is a CCP, but most outbreaks from powders have come from contamination after drying. Salmonella and Cronobacter survive for long periods in dry conditions. The controls are a high-hygiene zone around the dryer outlet, fluid-bed and packing, with filtered positive-pressure air, controlled entry, and dry cleaning, because water used in a dry area lets bacteria multiply. Environmental monitoring of the dry zone, with investigation of every positive, is central. Powdered infant formula is not sterile. Codex has a separate code of hygienic practice for powdered formulae for infants and young children, and these products carry the strictest controls because the consumers are the most vulnerable. Dry-blended ingredients added after heat treatment must be controlled through supplier approval and testing.
Wet cleaning in the dry zone is kept to planned occasions, followed by thorough drying and enhanced sampling before production restarts. Condensation in ducts and cracks in dryer walls have been sources of contamination; inspections of the dryer chamber and bag filters are part of the plan. The hazard analysis for infant formula must also cover ingredients such as vitamins, minerals and oils added by dry blending, the packaging gas and the cans or pouches, and the instructions for preparation, because reconstitution with water that is too cool and holding the prepared feed warm let bacteria multiply. Product is often held until environmental and finished-product results are known.
The ice cream mix is pasteurised, usually at higher temperature-time combinations than milk because of its sugar and solids; this is the CCP. Hazards that enter after pasteurisation are the main concern: inclusions such as nuts, fruit, cookie pieces and sauces added at the freezer; rework of returned or off-specification product; and the freezer and filler environment. Listeria has caused ice cream outbreaks because it can survive in cold, wet equipment and the product is not heated again. Rework must be traceable, held under control, and re-pasteurised where possible. Inclusions are also the main allergen hazard, so ice cream plans join HACCP with allergen management. Soft-serve machines in retail outlets need cleaning at stated intervals and are a known source of contamination.
The freezing step is not a kill step: freezing preserves bacteria rather than destroying them, so any Listeria that enters after pasteurisation survives in the product for its whole shelf life. Plans therefore pay close attention to the hygiene of ageing tanks, freezer barrels, fruit feeders and filler heads, and to the condition of door seals and drains in the freezer and hardening areas. Environmental monitoring in these areas follows the zone approach described for cheese and fluid milk.
ISO 22000 specifies requirements for a food safety management system for any organisation in the food chain. The 2018 edition uses the high-level structure shared with ISO 9001 and other management-system standards, so it has clauses on the context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. It describes two plan-do-check-act cycles: one for the management system as a whole and one, inside clause 8, for the operational planning and control of hazards. It brings together interactive communication along the food chain, system management, PRPs and HACCP principles.
In ISO 22000 the hazard analysis leads to a hazard control plan containing OPRPs and CCPs. Each control measure is assessed against criteria such as the likelihood of failure, the severity of consequence and whether it can be monitored, to decide whether it is managed as an OPRP or a CCP. Control measures must be validated before implementation. The standard also requires risk-based thinking about the management system itself, for example the risk of losing key staff or of a supplier failing. The general theory of ISO 22000 is taught in food-safety-management-systems.
ISO 22000 on its own is not recognised by the Global Food Safety Initiative, because it does not specify the PRPs in enough detail. FSSC 22000, owned by the Foundation FSSC, solves this by combining three parts: ISO 22000, the relevant sector PRP specification (ISO/TS 22002-1 for food manufacturing), and FSSC additional requirements. The additional requirements have covered matters such as management of services and purchased materials, product labelling, food defence, food fraud mitigation, logo use, allergen management, environmental monitoring, food safety culture, and quality control; the list changes with each version, so read the current scheme document. FSSC 22000 is GFSI-recognised and is widely used by large dairy processors and ingredient makers, partly because it is built on an ISO standard that their customers already know. Certification bodies must be accredited for the scheme, and audits include unannounced audits at a set frequency.
FSSC also publishes requirements for certification bodies, including auditor qualifications and audit durations, and keeps a public register of certified sites. Sector PRP specifications other than ISO/TS 22002-1 cover packaging manufacture, catering and other activities, so a company that makes both dairy products and its own packaging may need more than one.
A dairy implementing FSSC 22000 typically starts with a gap analysis against ISO/TS 22002-1, fixes the PRPs, then reworks its HACCP plan into an ISO 22000 hazard control plan. It must define the scope, for example liquid milk, fermented products and butter at one site, and keep documented information as required. Internal audits, management review and verification of the hazard control plan close the loop. A common weakness found by auditors is a hazard analysis copied from a template without justification of why a hazard is or is not significant at this plant.
The scope matters because certification covers only the products and processes named. A dairy that adds a new product line, such as a plant-based beverage made on shared equipment, must extend its hazard analysis and inform its certification body. Changes in suppliers, equipment or recipes should trigger a review of the hazard control plan under the plant's change-management procedure. Many sites find that the hardest parts of ISO 22000 are not the HACCP elements but the management-system clauses: documented objectives, competence records, management review and evaluation of the system's performance using data rather than impressions.
The Global Food Safety Initiative (GFSI) was launched in 2000 by retailers and manufacturers working through what became the Consumer Goods Forum. It does not certify anyone. It writes benchmarking requirements and recognises certification programmes that meet them. Its aim is 'once certified, accepted everywhere': a supplier certified to one recognised programme should not need separate audits from every retail customer. Recognised programmes for food manufacturing have included FSSC 22000, BRCGS Food Safety, SQF and IFS Food, among others; the list changes, so check the GFSI website. Many large retailers and food-service companies require their dairy suppliers to hold a GFSI-recognised certificate.
GFSI also supports capacity-building for small and less developed businesses through a global markets programme, which lets them work towards certification in stages. Benchmarking is repeated when GFSI revises its requirements, and a scheme owner must update its scheme to keep recognition, which is one reason scheme versions change every few years. Retailers may still carry out their own audits of high-risk suppliers, and certification does not transfer legal responsibility from the producer to the certification body.
The BRCGS Global Standard for Food Safety began as the British Retail Consortium standard in 1998 and is now owned by a separate company. Unlike ISO 22000, it is a prescriptive product-safety standard with detailed clauses on senior management commitment and food safety culture, the HACCP plan, the food safety and quality management system, site standards, product control, process control and personnel. Certain clauses are 'fundamental': failure against them prevents certification. Audits result in a grade based on the number and severity of non-conformities, with an unannounced audit option that can earn a higher grade. Non-conformities are classed as critical, major and minor. The standard is popular with dairies supplying retailers in the UK and with exporters to such retailers.
The standard places strong emphasis on site security, product authenticity, labelling and pack control, and on the visible commitment of senior management, who are expected to attend parts of the audit. Its requirements for high-risk and high-care zones, defined by the type of product and its intended consumers, map closely onto the dairy idea of separating raw and ready-to-eat areas.
The Safe Quality Food (SQF) programme is owned by the SQF Institute, a division of a US food industry association. It has separate codes for different sectors, including food manufacturing, and a separate quality code. Each certified site must appoint an SQF practitioner who is trained in HACCP and responsible for the system. SQF is widespread in North America and Australia. Like BRCGS, it is GFSI-recognised and its audits grade the site on non-conformities.
SQF certification is available at levels that build from food safety fundamentals to a full food safety code, so small dairies can begin with basic GMP and progress. The SQF code includes environmental monitoring, allergen management, food defence and food fraud requirements in line with GFSI benchmarking. Sites are scored on the audit, and the score determines the frequency of later audits. As with the other schemes, a site that fails to correct non-conformities within the set time can lose its certificate.
A dairy usually chooses a scheme because its main customers ask for it. Export dairies may need more than one. All of them rest on the same base: PRPs, HACCP, a management system, traceability, and management commitment. The differences are in structure, wording, grading and audit rules. A plant that has a working HACCP plan and real PRPs will find the transition from one scheme to another a matter of documentation; a plant that has paper systems only will find every scheme difficult.
The cost of certification includes the audit fee, the time of staff preparing for and attending the audit, and the capital spent fixing gaps. For a small dairy, a phased approach starting with basic GMP and HACCP compliance under national law, then moving to a recognised scheme when a major customer requires it, is common. Whatever the scheme, the certificate is only as good as the system behind it on the days the auditor is not present.
The US Food Safety Modernization Act (FSMA) of 2011 moved US food regulation from responding to outbreaks to preventing them. Its Preventive Controls for Human Food rule is codified in 21 CFR Part 117. Subpart B sets out current good manufacturing practice. Subpart C requires most registered food facilities to prepare and implement a written food safety plan based on hazard analysis and risk-based preventive controls. Subpart G requires a supply-chain programme where a hazard requiring control is controlled by a supplier. The rule is broader than HACCP: preventive controls include process controls, which resemble CCPs, but also food allergen controls, sanitation controls, supply-chain controls and a recall plan. Not all preventive controls need critical limits; the facility decides what monitoring, corrective action and verification each control needs.
Part 117 also contains exemptions and modified requirements for qualified facilities, which are very small businesses, and for certain low-risk activities on farms. A facility must reanalyse its food safety plan at least every three years and whenever there is a significant change, new information about a hazard, or a failure of a preventive control. Records required by the rule must be retained for at least two years.
The food safety plan must contain a written hazard analysis, preventive controls, a supply-chain programme where needed, a recall plan, and procedures for monitoring, corrective actions and verification. It must be prepared, or its preparation overseen, by a preventive controls qualified individual (PCQI): someone who has completed training under a standardised curriculum recognised by the FDA, such as the course developed by the Food Safety Preventive Controls Alliance, or who is qualified through job experience. The PCQI also oversees validation, review of records and reanalysis of the plan. Hazard analysis under the rule must consider biological, chemical (including radiological) and physical hazards, and must consider hazards that may be intentionally introduced for economic gain.
For a cheese plant, a typical plan might include pasteurisation or an equivalent as a process control, environmental monitoring and sanitation controls for Listeria in the ripening and packing areas, allergen controls if flavoured cheeses with nuts or other allergens are made, and supply-chain controls for ingredients such as spices that may carry Salmonella.
Fluid milk and many other Grade A dairy products in the US are made under the Grade A Pasteurized Milk Ordinance (PMO) and the cooperative federal-state programme run through the National Conference on Interstate Milk Shipments (NCIMS). Because that system already includes detailed process requirements, inspections and a voluntary HACCP alternative, the FDA chose to treat Grade A facilities operating under the PMO differently from other food facilities with respect to the hazard analysis and preventive-controls requirements, while the PMO itself was being brought into line. Non-Grade A dairy products, such as most cheeses and butter, fall under Part 117 in the usual way. The current position should be checked against FDA guidance, because it has been the subject of continuing work by FDA and NCIMS. Foreign dairy plants exporting to the US must meet equivalent requirements through the importer's Foreign Supplier Verification Programme.
For dairy students outside the US, the lesson is that a long-established sector-specific system and a newer general food safety law can overlap, and that regulators may decide to rely on the specific system where it gives equivalent protection.
Milk is itself one of the major food allergens in every regulatory list, so dairy products always carry an allergen declaration for milk. Cow's milk allergy, an immune reaction to milk proteins such as caseins and beta-lactoglobulin, is different from lactose intolerance, which is a deficiency of the enzyme lactase. A dairy plant must also manage the other allergens it handles: nuts, peanuts, egg, soy, wheat and other cereals containing gluten, and sesame are common in ice cream, flavoured milks, desserts and cheese products. Lists differ: the EU's labelling regulation lists fourteen allergens and their derivatives; the US list of major food allergens was extended to nine when sesame was added; other countries have their own lists. The label must follow the law of the market where the product is sold, which is covered in dairy-standards-law-worldwide.
Lactose-free milk is therefore not suitable for people with milk allergy, and plant-based products made on shared lines may contain traces of milk protein. Goat's and sheep's milk proteins cross-react with cow's milk proteins in many allergic people, so they are not safe alternatives.
Allergen management uses several layers. Supplier control: specifications and approval so that ingredients do not bring undeclared allergens. Receipt and storage: identification and segregation of allergen-containing materials, for example storage below rather than above non-allergen materials. Production scheduling: running allergen-free products before allergen-containing ones on shared lines. Validated cleaning: a cleaning procedure that has been shown, by testing, to remove the allergen from shared equipment, followed by routine verification. Rework control: rework containing an allergen goes only into the same product. Label control: checking that the correct label and packaging are used at every change of product, because wrong packaging is one of the commonest causes of allergen recalls. Training for everyone who handles allergens.
Validation of allergen cleaning is often done with specific immunological tests for the allergen of concern, such as tests for peanut or almond protein, taken from the hardest-to-clean parts of the line after cleaning. General protein swabs and ATP tests show that cleaning has happened but are not specific to the allergen; they are useful for routine verification once the cleaning procedure has been validated. Shared utensils, scoops and hoses are common routes of cross-contact in small plants and need colour coding or dedicated storage.
Statements such as 'may contain nuts' are voluntary in most countries and are not a substitute for good manufacturing practice. They should be used only after a risk assessment shows that cross-contact cannot be controlled. Overuse reduces their value to allergic consumers, who learn to ignore them. Some industry programmes use reference doses to decide when precautionary labelling is justified; where they are used, the method should be stated in the allergen risk assessment.
A dairy that adds a nut-containing ice cream to a shared line should first ask whether separate equipment, a separate production day, or validated cleaning can control cross-contact. Only if residual risk remains after those controls should a precautionary statement be considered. The decision and the evidence should be recorded in the allergen risk assessment and reviewed whenever recipes, equipment or suppliers change. Training of label-room and packing staff is part of the control, because the commonest failure is a correct label put on the wrong product at a changeover.
Food safety deals with accidental hazards. Food defence deals with deliberate attack intended to cause harm, such as tampering by a disgruntled employee or an act of terrorism. Food fraud deals with deliberate adulteration or misrepresentation for economic gain, such as diluting milk with water or adding a cheaper substance to raise apparent protein. The British Standards Institution publication PAS 96 popularised two assessment methods: threat assessment critical control point (TACCP) for malicious threats and vulnerability assessment critical control point (VACCP) for fraud. GFSI-recognised schemes now require both a food defence plan and a food fraud vulnerability assessment. In the US, FSMA's intentional adulteration rule, 21 CFR Part 121, requires larger facilities to write a food defence plan addressing actionable process steps.
The motive differs in each case. In food safety the hazard is unintended; in food defence the person wants to cause harm or disruption; in fraud the person wants money and usually wants the adulteration not to be noticed, which is why fraud can continue for a long time. Control methods also differ: HACCP looks at process steps, TACCP looks at people and access, and VACCP looks at materials and supply chains.
Milk is vulnerable to fraud because it is a liquid traded on composition, collected from many small suppliers, and paid for on fat and solids-not-fat or protein. Reported forms include adding water, then adding substances to restore density or apparent solids, such as sugar, starch, salt, urea or other nitrogen-rich compounds; adding neutralisers to hide acidity; adding detergents or vegetable fat to make 'synthetic' milk; substituting cheaper species' milk in products sold as buffalo, goat or sheep; and selling non-dairy fat as butter or ghee. The 2008 melamine incident in China, in which melamine was added to raw milk to raise its apparent protein content measured by nitrogen, made infant formula toxic, sickened very large numbers of infants and killed several. It is the classic case showing that a test measuring total nitrogen can be defeated and that fraud becomes a safety hazard. Ghee and butter are also adulterated with vegetable oils and animal body fats, which is why authenticity testing of milk fat is a long-standing part of dairy chemistry.
A vulnerability assessment looks at each raw material and asks: has fraud been reported, how easy is it, how easy to detect, what is the economic incentive, how complex is the supply chain, and how strong is the relationship with the supplier? Raw milk from many small collectors, skimmed milk powder bought on the spot market, and high-value products such as buffalo mozzarella and ghee usually score high. Mitigation includes approved suppliers, reception tests chosen for the likely adulterants, unannounced sampling, specifications, sealed tankers, and authenticity tests such as fatty acid profiles for foreign fat or species identification methods. For food defence, mitigation includes access control, staff screening, locked tank hatches and sample points, visitor control and security of the CIP chemical store. Reception testing methods are covered in dairy-analysis-instrumental. The assessment is reviewed when prices change sharply, when a new supplier is added, or when fraud is reported elsewhere in the sector, because the economic incentive for fraud rises when a commodity becomes scarce or expensive.
Traceability is the ability to follow a food through specified stages of production, processing and distribution. The minimum legal requirement in many systems, including EU general food law, is 'one step back, one step forward': each business must know from whom it received each input and to whom it supplied each product. Internal traceability links the two inside the plant. In a dairy this is harder than in many industries, because milk from many farms is pooled in tankers and silos, and products are made continuously from blends. Practical traceability therefore works by time window and batch: the silo that fed a pasteuriser between two times, the tankers that filled that silo, and the farms on those tanker routes. Records needed include tanker receipt and test results, silo fill and empty times, pasteuriser and filler run records, batch and lot codes on packs, and dispatch records. In the US, FSMA's food traceability rule requires additional records for foods on the FDA's Food Traceability List, which includes soft and semi-soft cheeses; its compliance date has been moved, so check the current FDA position.
A withdrawal removes product from the distribution chain before it reaches consumers; a recall also asks consumers to return or destroy product they have bought. Recall plans should name the recall team and contacts, describe how decisions are made, list how customers and the regulator are notified, set out how product is retrieved, segregated and disposed of, and describe how effectiveness is checked. In the US, recalls are classed by FDA: Class I where there is a reasonable probability of serious adverse health consequences or death, Class II where consequences are temporary or reversible or the probability of serious harm is remote, and Class III where the product is unlikely to cause adverse health consequences. Other countries use their own classifications.
A recall is a test of the whole system: traceability records, communication with customers, regulator relationships and stock control. Dairy recalls are often triggered by a positive pathogen result from finished-product or environmental testing, by an undeclared allergen from wrong packaging, by foreign matter complaints, or by a residue found in official sampling. Speed matters most for short shelf-life products such as pasteurised milk, where much of the product may already have been consumed before the recall begins.
Schemes require the traceability system to be tested at least annually, by tracing a batch back to its raw materials and forward to its customers within a set time, and by a mass balance that reconciles the quantity of raw material used with the quantity of product made, stocked and dispatched, allowing for known losses. A mass balance that does not close, for example 2,000 kg of a product unaccounted for, shows that records are incomplete and that a real recall might miss product.
A good mock recall is unannounced to the people who run it, starts from a real batch chosen by the auditor or manager, and is timed. It should include packaging and ingredient lots as well as milk, and should test the contact list by actually reaching key customers. The lessons, such as a missing record for rework or a customer contact who has left, are recorded and fixed.
Internal audits check whether the food safety system conforms to the plant's own procedures and to the standard, and whether it works. ISO 19011 gives guidance on auditing management systems: audit programmes, objectives, scope, criteria, competence of auditors, and the steps of planning, opening meeting, collecting evidence by interview, observation and records, evaluating findings, closing meeting and report. Auditors should not audit their own work. In a dairy, a good internal audit follows a product through the plant, for example from tanker receipt to dispatch of a batch of cheese, checking each record and talking to the people doing the work. The statistical side of audits and laboratory accreditation is covered in dairy-quality-assurance-sqc.
The audit programme should cover every part of the system at a planned frequency, with more frequent audits of high-risk areas and of areas with past findings. Findings from internal audits feed the management review and are tracked to closure in the same way as external findings.
A certification audit is carried out by an accredited certification body. For management-system certification such as FSSC 22000, certification bodies are accredited against ISO/IEC 17021-1, with sector requirements; for product-certification schemes such as BRCGS, against ISO/IEC 17065. The initial certification audit for management systems is usually in two stages: stage 1 reviews documents and readiness, stage 2 assesses implementation on site. Surveillance audits follow during the certificate cycle and recertification before it ends. Schemes include unannounced audits.
The certification body must be independent of the site and must not provide consultancy to the site it certifies. Audits sample the system; they do not check every record or every process, so a clean audit does not prove the absence of problems. Customers and regulators often ask to see the audit report as well as the certificate, because the report shows the findings and how they were closed. Certificates name the scope, the standard and the dates of validity, and many scheme owners publish searchable directories of certified sites.
Findings are graded. Schemes commonly use critical (an immediate food safety risk or a breach of law, or a serious failure of integrity), major (a substantial failure to meet a requirement) and minor (a partial failure that does not threaten the system). A critical finding usually leads to suspension or withdrawal of the certificate. For each non-conformity the site makes a correction, finds the root cause, and takes corrective action to prevent recurrence, with evidence submitted within the time the scheme sets. Root-cause tools such as five whys and cause-and-effect diagrams are used. Closing the finding without fixing the cause is the commonest reason the same finding returns at the next audit. For a dairy, a typical major finding might be an environmental monitoring programme with no zone 1 sampling in a ready-to-eat area, or a pasteuriser recorder that has not been checked against the indicating thermometer as the procedure requires. The corrective action would address why the gap arose, for example an untrained new technician or a procedure that did not say who was responsible, not only the missing check itself.
Food safety culture is the shared values, beliefs and norms that affect how people in an organisation think about and behave towards food safety. A plant can have excellent documents and still fail if people take short cuts when the line is behind, hide mistakes, or think food safety is the quality department's job. The idea was popularised in food by work in the US retail sector and by a GFSI position paper in 2018, and the 2020 revision of the Codex General Principles of Food Hygiene made management commitment and food safety culture part of the basic principles. Recent versions of BRCGS Food Safety and FSSC 22000 require sites to plan and measure their culture.
A food safety culture is not the same as a training programme or a poster campaign. It is seen in what people do when nobody is checking and when there is pressure to keep the line running.
GFSI's paper groups culture into dimensions: vision and mission, people, consistency, adaptability, and hazard and risk awareness. Measurement uses surveys of staff perceptions, interviews, observation of behaviour on the floor, and indicators such as near-miss reporting rates, training completion, and the time taken to close corrective actions. A rising rate of reported near misses can be a good sign, because it shows people are willing to report. Surveys alone can mislead, so auditors look for consistency between what managers say, what staff say and what the records show.
Results are most useful when they are broken down by department, shift and level, because a strong average can hide a weak night shift or a contractor group that does not feel part of the site. The site then sets objectives, acts, and measures again to see whether the actions worked. A culture plan that never changes from year to year is a sign that the measurement is not being used.
In a dairy, culture shows in small things: whether an operator stops the filler when a seal looks wrong; whether a night-shift supervisor accepts a tanker with a doubtful antibiotic test because the plant is short of milk; whether managers wear hairnets and wash hands when they walk the floor. Practical steps include leaders who visibly put safety before output, clear rules on who may stop production, recognition for reporting problems, training that explains why each control exists, and including food safety in performance reviews. Culture improves slowly and can be lost quickly, for example after a change of ownership or a cost-cutting programme. Contract workers, drivers and cleaning crews are part of the culture too and need the same induction and the same expectations as employees. Sharing the results of environmental monitoring and complaints with operators, rather than keeping them in the quality office, helps people see why their actions matter.
Learn the twelve steps and seven principles until you can apply them, not just list them. Take a simple process, such as HTST milk or set yoghurt, draw its flow diagram, list the hazards at each step and decide which control is a PRP, an OPRP or a CCP, with reasons. Know why pasteurisation is a CCP and how the flow diversion valve, recorder and timing pump make it controllable. Be able to calculate holding time and log reductions from stated values. During in-plant training, read the plant's HACCP plan and compare it with what you see on the floor; that comparison is what auditors do.
At five years you probably own part of the system: a HACCP plan, the environmental monitoring programme, supplier approval or internal audits. Typical decisions are whether a Listeria positive in a zone 2 site needs product hold, whether a reception test failure means a tanker is rejected, how to validate allergen cleaning on a shared ice cream line, and how to close an auditor's major non-conformity with a real root cause. You prepare for certification and customer audits, run mock recalls and train operators. Many practitioners take FSSC 22000 lead auditor or PCQI training at this stage.
At twenty-five years you are accountable for the food safety system across sites or a business: choosing certification schemes for export markets, deciding on capital spending for high-hygiene zones in a powder plant, leading recalls and speaking to regulators and media, and setting the food safety culture through your own behaviour. You balance cost and output pressure against safety and must be the person who stops shipment when needed. You also review supplier and co-packer systems and represent the company in industry and standards bodies.
At this level you shape the field: research on pathogen behaviour in dairy environments, validation of novel controls, predictive models for shelf life and growth, rapid detection and authenticity methods for fraud, and measurement of food safety culture. You teach postgraduate courses, supervise theses, set examination papers, and may serve on Codex, IDF, ISO or national committees that write the standards and codes dairies follow. You translate outbreak investigations into changes in guidance and help regulators judge new technologies. You also judge whether a proposed control is truly validated or only assumed, and you help industry interpret new scheme versions.
This manual describes structures and principles; it does not reproduce scheme clauses, which are copyrighted and revised often, or legal limits, which are in dairy-standards-law-worldwide. Version-specific details (current BRCGS issue, FSSC version, the FDA position on Grade A plants under Part 117, the FSMA traceability compliance date, GFSI-recognised scheme list) must be checked against the owners' current documents. Worked HACCP plans are teaching outlines, not validated plans for a particular plant. Environmental monitoring sampling frequencies, microbiological criteria for infant formula and reference doses for allergen labelling are not given.
Original practice questions written to the syllabus and pattern of the exams named in each question's examTags. They are not past papers and do not reproduce any board's questions. Where a question states a time, temperature, D-value or z-value, it is a stated assumption for the calculation, not a legal requirement; check current law and scheme documents.
These notes are free to read here, with no account.
What the Laisha app adds:
Free for ten days, then a subscription. We would rather write that here than have you find it later.