Food Science & Technology · Packaging, Safety, Quality & Regulation · also HACCP, Food Safety Management, Food Safety Systems and Auditing, FSMS
Building, running and auditing a food safety management system: prerequisite programmes and good manufacturing practice, the seven HACCP principles applied in depth, preventive controls, ISO 22000 and the GFSI-benchmarked certification schemes, food defence, food safety culture, traceability and recall, and auditing practice.
In the exams: GATE XE-G Section 3 (HACCP); ICAR AICE 35.a Unit 4 and 35.b Unit 1; core of FSSAI FoSTaC, FSPCA PCQI, BRCGS, SQF and lead-auditor courses
A food safety management system is the organised set of practices, procedures, records and responsibilities by which a food business makes sure that what it sells is safe. Its core is hazard analysis and critical control point (HACCP), a method that identifies the hazards that matter in a particular product and process and puts controls where they are most effective. Around HACCP sit the prerequisite programmes, the good hygiene and manufacturing practices that keep the basic environment under control, and around both sits the management system: commitment from leadership, trained people, documented procedures, verification, review and continual improvement.
The subject matters because almost every food business in the world now has to show that it manages food safety. Codex Alimentarius sets the international reference in its General Principles of Food Hygiene. National laws require HACCP-based systems: the European Union for all food business operators beyond primary production, the United States through its HACCP rules for meat, seafood and juice and the preventive controls rules of the Food Safety Modernization Act, and India through the Schedule 4 hygiene requirements of the Food Safety and Standards licensing regulations. Retailers and brand owners go further and ask suppliers for certification to a scheme benchmarked by the Global Food Safety Initiative.
The subject is examined in GATE XE-G Section 3, which names HACCP, in the ICAR AICE-JRF/SRF 35.a and 35.b syllabi, and in Food Safety Officer recruitment. It is also the content of the industry credentials that most food technologists earn after graduation: the FSSAI FoSTaC supervisor training, the US Preventive Controls Qualified Individual course, scheme practitioner courses and lead-auditor courses. Examiners ask for the seven principles and twelve steps in order, the difference between a CCP and an operational prerequisite programme, between validation and verification and between a correction and a corrective action, and they set short cases in which the student must find the weak point in a plan. Microbiological hazards, criteria and sampling are taught in food-microbiology, and chemical hazards and allergens in detail in food-toxicology-contaminants-allergens; this subject uses them.
Good manufacturing practice (GMP) and good hygiene practice (GHP) are the basic conditions and activities needed to produce safe and suitable food. The terms overlap: GMP is the usual term in manufacturing and in US law, where 21 CFR Part 117 Subpart B sets current good manufacturing practice for human food; GHP is the Codex term. Both describe the same territory: the site and buildings, equipment, water, cleaning and sanitation, pest control, personal hygiene, health of workers, storage, transport, training and the control of incoming materials.
GMP is not specific to one hazard. It lowers the background level of contamination so that the specific controls of HACCP can work. A heat process designed to give a 5-log reduction of Salmonella fails if raw material arrives with an unusually high load, or if the cooked product is recontaminated by condensate dripping from a dirty ceiling. Most food-borne outbreaks traced back to processing show a failure of a basic practice, such as cleaning, separation of raw and cooked, or a sick worker handling food, rather than an unknown hazard.
The legal form differs by country. In India, Schedule 4 of the Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations, 2011 sets general hygienic and sanitary practices for all food businesses, with additional parts for specific sectors such as milk, meat and catering. In the European Union, Regulation (EC) No 852/2004 sets general hygiene requirements, and in the United States the Food Code, a model adopted by states, applies to retail and food service. Requirements are similar in substance but differ in detail, so a plant exporting to several markets must meet each one.
People are both a source of contamination and the main control. Personal hygiene rules cover hand washing at defined moments (entering the production area, after using the toilet, after handling raw material or waste), clean protective clothing, hair and beard covering, no jewellery or loose items, no eating or smoking in production areas, and covered wounds with detectable dressings. Workers with diarrhoea, vomiting, jaundice, fever with sore throat or infected skin lesions must report them and be excluded from handling open food, and staff return only after the period the plant's procedure sets.
Zoning separates areas by risk. In a ready-to-eat plant, a high-risk or high-care area, after the final kill step, has restricted entry, a changing room with barrier, dedicated clothing and footwear, positive air pressure and separate equipment, so that cooked product is not recontaminated by raw material or by people and equipment from raw areas. Colour coding of utensils, one-way flows of product, people, air and waste, and physical separation reinforce the zones.
Sanitation means cleaning to remove soil and sanitising to reduce microorganisms on cleaned surfaces. Cleaning and sanitation are written as sanitation standard operating procedures (SSOPs) stating what is cleaned, how, with which chemical at which concentration and temperature, how often, by whom, and how effectiveness is checked. US seafood HACCP rules list eight key sanitation conditions that are a useful checklist anywhere: safety of water, condition and cleanliness of food-contact surfaces, prevention of cross-contamination, hand washing and toilet facilities, protection from adulterants, labelling and storage of toxic compounds, employee health, and exclusion of pests. Effectiveness is verified by visual inspection, ATP swabs and microbiological swabs, as described in food-microbiology.
Pest control relies first on exclusion: sealed buildings, screened openings, closed doors, no harbourage outside the walls and good housekeeping inside. Monitoring uses traps and bait stations on a site plan, inspected at set intervals, with trends recorded. Rodenticide baits are not used inside production areas where they could contaminate food; mechanical traps and insect light traps are used instead, and insect light traps are placed so that they do not attract insects towards open product. Most plants contract a pest-control company but remain responsible for the results.
Water used as an ingredient, for cleaning food-contact surfaces or for making ice must be potable to the national drinking-water standard, and steam that contacts food must be made from potable water with suitable boiler chemicals. Plants test water microbiologically at a set frequency, keep a plan of the pipework that separates potable from non-potable water, and protect against back-siphonage. Compressed air that contacts food is filtered.
Planned preventive maintenance keeps equipment in a condition that does not contaminate food: lubricants suitable for incidental food contact, control of tools and spare parts so that nothing is left in the line, a hygiene clearance after maintenance before production restarts, and calibration of monitoring instruments such as thermometers, pressure gauges and metal detectors against traceable standards. Glass, brittle plastic and wood are restricted or controlled by a register and regular inspection, and a written procedure says what happens when glass breaks near open product.
A prerequisite programme (PRP) is a basic condition or activity needed to maintain a hygienic environment throughout the food chain, suitable for producing safe food. PRPs are general: they apply across the site and to all products, are not specific to one hazard at one step, and are usually controlled by routine procedures rather than by monitoring against a critical limit. HACCP assumes that PRPs are in place. A HACCP study done in a plant with poor PRPs ends with far too many critical control points, because every step then seems to need special control, and a plan with too many CCPs is weak, since staff cannot give each one the attention it needs.
ISO 22000 requires an organisation to select and implement PRPs appropriate to its part of the food chain, and refers to sector technical specifications. The ISO/TS 22002 series gives detailed PRPs for each sector: part 1 for food manufacturing, with other parts for catering, farming, packaging manufacture, transport and storage, and feed. Codex calls the same body of practice good hygiene practices, and some schemes use other names, so a student should recognise the content rather than rely on the label.
ISO/TS 22002-1 for food manufacturing lists the elements a plant must address. They are: construction and layout of buildings; layout of premises and workspace; utilities, meaning water, air and energy; waste disposal; suitability, cleaning and maintenance of equipment; management of purchased materials, including supplier approval and checks at receipt; measures to prevent cross-contamination, both microbiological and physical, and allergen control; cleaning and sanitising; pest control; personnel hygiene and employee facilities; rework; product recall procedures; warehousing; product information and consumer awareness; and food defence, biovigilance and bioterrorism.
Several of these elements carry most of the weight in practice. Supplier approval decides what hazards enter the plant; a plant that buys spices without verifying supplier controls has imported a Salmonella risk that its own process may not remove. Rework, the re-use of product that has left the normal flow, is a classic source of allergen cross-contact and of loss of traceability, so it must be identified, stored separately, used only in compatible products and recorded. Storage must keep raw and ready-to-eat products, chemicals and allergens apart, and control temperature and stock rotation, usually first expired, first out.
Each PRP needs a documented procedure, a responsible person, a frequency, records and a verification activity. Auditors judge PRPs by walking the floor: condensate dripping over an open line, a broken door seal, or a cleaning chemical in an unlabelled bottle are findings regardless of what the paperwork says.
The Codex General Principles of Food Hygiene (CXC 1-1969) are the international foundation for hygiene law and for HACCP. The text was substantially revised in 2020. It now has two chapters. Chapter one covers good hygiene practices: primary production, establishment design and facilities, training and competence, maintenance, cleaning, disinfection and pest control, personal hygiene, control of operation, product information and consumer awareness, and transport. Chapter two covers the HACCP system and guidelines for its application.
The 2020 revision made several changes that examiners ask about. It introduced the idea that management commitment and a positive food safety culture are foundations of a food hygiene system. It explained that some GHPs need greater attention than others, because they have a greater impact on safety, for example cleaning of a slicer used for ready-to-eat meat, and that these may be monitored and verified more closely without becoming CCPs. It added explicit material on allergen management, linked to the separate Codex code of practice on allergen management. And it rewrote the HACCP principles to place validation of control measures explicitly in principle 6.
The principles apply throughout the food chain, from primary production to the consumer, and to all food business operators regardless of size, but Codex expects application to be flexible for small and less developed businesses: the controls must be effective, but documentation can be simpler, and generic HACCP guidance prepared by authorities or trade associations can be used.
The principles assign responsibilities. Food business operators must apply GHPs and, where appropriate, HACCP, and must ensure that staff are competent. Competent authorities must decide how the principles are applied, set requirements and check compliance. Consumers have a role in following instructions for handling and preparation, which is why product information and labelling form part of the code.
Definitions matter because exam questions turn on them. A hazard is a biological, chemical or physical agent in food with the potential to cause an adverse health effect; allergens are included as chemical hazards. A significant hazard is one identified by hazard analysis as reasonably likely to occur at an unacceptable level without control, and whose control is essential given the intended use of the food. A control measure is any action or activity that can be used to prevent or eliminate a hazard or reduce it to an acceptable level. A critical control point is a step at which a control measure or measures, essential to control a significant hazard, are applied in a HACCP system. A critical limit is a criterion, observable or measurable, relating to a control measure at a CCP, which separates acceptability from unacceptability of the food. Monitoring is the act of conducting a planned sequence of observations or measurements of control parameters to assess whether a CCP is under control. Validation is obtaining evidence that a control measure or combination, if properly implemented, is capable of controlling the hazard to a specified outcome. Verification is the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended.
HACCP was developed in the 1960s by the Pillsbury Company with the US National Aeronautics and Space Administration and the US Army Natick laboratories to make food for astronauts with near-certain safety, since end-product testing would have consumed most of the product. It was presented publicly in 1971 and adopted first for low-acid canned foods. Its logic is preventive: control the process at the points that matter instead of testing the finished product.
Codex sets out twelve steps. The first five are preliminary: assemble the HACCP team and identify the scope; describe the product; identify the intended use and users; construct a flow diagram; and confirm the flow diagram on site. Steps six to twelve apply the seven principles: list all potential hazards, conduct a hazard analysis and consider control measures (principle 1); determine the CCPs (principle 2); establish validated critical limits for each CCP (principle 3); establish a monitoring system for each CCP (principle 4); establish corrective actions (principle 5); validate the HACCP plan and then establish verification procedures (principle 6); and establish documentation and record keeping (principle 7).
The HACCP team should be multidisciplinary: production, quality, engineering, sanitation and, where needed, outside experts such as a microbiologist, with a trained leader and senior management support. The scope states which product, process and part of the chain the study covers, and which hazard types are included.
The product description records everything that affects safety: composition, including allergens; physical and chemical characteristics such as aw, pH, salt and preservatives; processing such as heat treatment, freezing, smoking or packaging under modified atmosphere; packaging; shelf life and storage conditions; and distribution. Intended use states how the consumer will use the product, for example ready-to-eat or to be cooked, and whether vulnerable groups such as infants, the elderly or hospital patients are likely consumers, since that raises the significance of some hazards.
The flow diagram shows every step from receipt of raw materials to dispatch, including inputs, rework, recycling, waste, and delays or holding steps. The team then walks the line during operation and corrects the diagram, because an unconfirmed diagram misses the real steps where hazards arise: the bucket used to move product between lines, the night-shift short cut, the temporary storage room.
For each step, the team lists the biological, chemical (including allergens and radiological agents) and physical hazards that may be introduced, increased or controlled there, then decides which are significant. Significance is judged from two things: the likelihood of occurrence in the absence of control and the severity of the adverse health effect. Many plants use a simple matrix, scoring each on a scale such as 1 to 4 and multiplying, with a threshold above which the hazard is significant; the scale and threshold are the team's choice and must be justified. A hazard can be significant at one plant and not another, depending on raw materials, process and intended use. Evidence comes from scientific literature, outbreak history, regulatory guidance, complaint and test data, and supplier information.
For each significant hazard the team identifies control measures. One hazard may need several control measures, as when Listeria in cooked ham is controlled by cooking, by post-cook hygiene and by a shelf-life limit, and one control measure may control several hazards, as cooking controls Salmonella, Listeria and STEC together. Hazard analysis should also consider the acceptable level of each hazard in the final product, taking account of regulatory limits, food safety objectives and the intended use. The output is a hazard analysis table that records the hazard, its cause, likelihood, severity, significance, justification and control measures. This record is often the weakest part of a HACCP plan in audits, because teams copy generic lists instead of analysing their own process.
A critical control point is a step at which control is essential to prevent or eliminate a significant hazard or reduce it to an acceptable level, and where loss of control would not be corrected at a later step. Typical CCPs are cooking, pasteurisation and retorting for pathogens; chilling where growth of a pathogen is the hazard; acidification of a low-acid food; metal detection or X-ray inspection for physical hazards; and label checks where an undeclared allergen is the hazard.
Codex gives a decision tree as a tool, not a rule. Its questions ask, in effect: do control measures exist for the hazard at this step; is the step specifically designed to eliminate the hazard or reduce it to an acceptable level; could contamination occur or increase to unacceptable levels here; and will a subsequent step eliminate or reduce it. If a later step will control the hazard, the present step is not a CCP for that hazard. For example, Salmonella introduced with raw chicken at receipt is not controlled by a CCP at receipt, because cooking later is designed to eliminate it; the cooking step is the CCP. Where a significant hazard is identified at a step and no control measure exists there or later, the product or process must be changed.
Plants differ in how many CCPs they have, but a well-designed plan usually has few. Too many CCPs often show that PRPs or operational prerequisite programmes are being confused with CCPs.
A critical limit is a measurable or observable criterion at a CCP that separates acceptable from unacceptable product. It must be specific, such as a minimum core temperature and time, a maximum pH, a minimum salt concentration, a maximum conveyor speed in a continuous oven, or the detection of a test piece of a stated size and material by a metal detector. Critical limits are set from scientific evidence, regulations, guidance or validation studies and must be validated to show that, when met, they control the hazard to the acceptable level.
Examples show the range. High-temperature short-time pasteurisation of milk is commonly specified as 72 °C for 15 seconds, with US rules using 161 °F (71.7 °C) for 15 seconds. The US Food Code gives 74 °C (165 °F) for an instant as a cooking temperature for poultry, while UK guidance commonly uses 70 °C for 2 minutes or equivalent combinations. Hot-holding and cooling limits differ between codes; the US Food Code requires cooked food to cool from 57 °C to 21 °C within 2 hours and to 5 °C or below within a further 4 hours. Such limits must always be checked in the code that applies.
Plants often set an operating limit, a tighter target than the critical limit, so that drift can be corrected before the critical limit is breached. Adjusting the process when an operating limit is crossed is a process adjustment, not a corrective action.
Monitoring is the planned sequence of observations or measurements that shows whether a CCP is under control and produces the record used later in verification. A monitoring procedure states what is measured, how, how often, and by whom. Continuous monitoring, such as a temperature chart recorder on a pasteuriser with an automatic flow diversion valve, is preferred where possible. Where monitoring is not continuous, its frequency must be high enough to detect loss of control in time to isolate the affected product, because all product made since the last acceptable check is suspect when a deviation is found.
Monitoring methods must give rapid results. Microbiological tests are usually too slow to monitor a CCP; physical and chemical measurements such as temperature, time, pH, aw and flow rate are used instead, and microbiological testing is used in verification. Monitoring staff must be trained, know the critical limit and know what to do when it is not met. Records of monitoring are signed or electronically authenticated by the person doing it and reviewed by a responsible person. A metal detector check, for instance, records the time, the test pieces passed through, whether each was rejected, and the person's signature; if a check fails, product since the last good check is held and re-inspected.
When monitoring shows that a critical limit has not been met, corrective actions must be taken. Codex requires that they ensure the CCP is brought back under control, that product affected by the deviation is identified, isolated and its disposition decided, and that the deviation and actions are recorded. Corrective actions should be written in advance in the HACCP plan for each CCP, so that operators do not improvise.
Two terms are separated in many standards. A correction is the action to eliminate a detected nonconformity, such as reprocessing or destroying the affected batch and restoring the oven temperature. A corrective action is the action to eliminate the cause of the nonconformity and prevent recurrence, such as replacing a failing thermostat, changing a maintenance schedule or retraining operators, and it rests on root cause analysis. Tools for root cause analysis include asking why repeatedly (the five whys) and cause-and-effect (fishbone) diagrams. Disposition of affected product depends on risk: it may be reprocessed by a validated process, diverted to a use where the hazard is controlled, or destroyed. Under-processed product is never released on the basis of a negative test alone, because testing cannot prove the absence of a hazard in a lot.
Validation answers whether the plan can work; verification answers whether it is working. Validation obtains evidence that a control measure or combination, properly implemented, can control the hazard to the specified outcome. It is done before a plan is implemented and repeated when the product, process, equipment or scientific knowledge changes. Evidence comes from scientific literature, regulatory guidance, process lethality calculations, challenge or inoculation studies, heat penetration studies in the actual product and packaging, and historical data. The Codex Guidelines for the Validation of Food Safety Control Measures (CXG 69-2008) describe the approaches.
Verification uses methods, procedures, tests and evaluations other than monitoring to check that the system is operating as intended. Typical verification activities are review of monitoring and corrective action records by a responsible person; calibration of monitoring instruments; direct observation of monitoring being done; microbiological testing of product and environment; internal audits; and periodic review of the whole plan. Verification frequency is set according to risk. Many plants treat a daily review and signing of CCP records as the core verification, with a full review of the HACCP plan at least annually and whenever something changes. Verification that finds repeated deviations or hidden weaknesses feeds back into hazard analysis and, if needed, revalidation.
Principle 7 requires documentation and record keeping appropriate to the nature and size of the business. Documents describe the system: the scope, team, product descriptions, flow diagrams, hazard analysis, the HACCP plan with its CCPs, critical limits, monitoring, corrective actions and verification, and the PRP procedures. Records show that it ran: monitoring records, deviation and corrective action records, verification records, calibration records, training records and changes to the plan.
Records must be accurate, made at the time of the activity, legible, signed and kept for a defined period, often at least the shelf life of the product plus a margin, or as law requires. Falsifying records, such as filling in temperatures after the fact, is a serious failure, both because it hides loss of control and because it destroys the trust on which audits and inspections depend. Electronic records must be protected against unauthorised change. A small business can keep records simply, on pre-printed forms or in a notebook, provided they show that the critical controls were applied.
ISO 22000 recognises that some control measures for significant hazards do not fit the CCP model. An operational prerequisite programme (OPRP) is a control measure or combination of control measures applied to prevent or reduce a significant food safety hazard to an acceptable level, where an action criterion and measurement or observation enable effective control of the process or product. A CCP, by contrast, has a measurable critical limit and is a step where loss of control has an immediate consequence that must be corrected.
ISO 22000:2018 asks the organisation to assess each control measure against criteria such as its effect on the hazard, the feasibility of monitoring it in time, its place in the system relative to other controls, the likelihood and severity of failure, and whether it is specifically designed to control the hazard. The result determines whether the measure is managed as a CCP or as an OPRP. Both are written in the hazard control plan, which ISO 22000:2018 introduced as the combined HACCP and OPRP plan. Typical OPRPs include enhanced cleaning of slicers in a ready-to-eat area, a sieve or magnet whose condition is checked at the end of each shift, separation and scheduling of allergen-containing products, and environmental hygiene in high-care zones. If an OPRP's action criterion is not met, the organisation must evaluate the affected product and take action, but the response is set by the plan rather than being an automatic hold of everything since the last check.
The US Food Safety Modernization Act, signed in January 2011, shifted US food law from responding to contamination towards preventing it. The Preventive Controls for Human Food rule, finalised in 2015 in 21 CFR Part 117, requires most facilities that manufacture, process, pack or hold human food to have a written food safety plan prepared or overseen by a Preventive Controls Qualified Individual (PCQI), who has completed standardised training or is otherwise qualified by experience.
The food safety plan contains a hazard analysis and the preventive controls for each hazard requiring a preventive control. The rule names several types: process controls, which include but are not limited to CCPs; food allergen controls, covering cross-contact and labelling; sanitation controls, for example environmental hygiene to prevent recontamination of ready-to-eat foods with environmental pathogens; supply-chain controls, where a raw material hazard is controlled by the supplier; and a recall plan. Preventive controls have monitoring, corrections and corrective actions, and verification, including validation of process controls. The approach is wider than classical HACCP because it extends formal, risk-based control beyond CCPs, much as ISO 22000 does with OPRPs. Juice, seafood and meat and poultry remain under their own HACCP rules.
ISO 22000 specifies requirements for a food safety management system for any organisation in the food chain, from feed producers and farms to processors, transporters, retailers and packaging suppliers. It was first published in 2005 and revised in 2018. The 2018 edition follows the high-level structure common to ISO management system standards, which makes it easier to integrate with ISO 9001 for quality and ISO 14001 for environment. Its ten clauses are: scope; normative references; terms and definitions; context of the organisation; leadership; planning; support; operation; performance evaluation; and improvement.
The standard combines interactive communication along the food chain, system management, prerequisite programmes and HACCP principles. Clause 4 requires the organisation to understand internal and external issues and the needs of interested parties, and to define the scope of the system. Clause 5 requires top management to show leadership and commitment, set a food safety policy and assign roles, including a food safety team leader. Clause 6 covers actions to address risks and opportunities at the organisational level and the setting of food safety objectives. Clause 7 covers resources, competence, awareness, communication and documented information. Clause 8, operation, holds the food-specific core: PRPs, traceability, emergency preparedness, hazard control, the hazard control plan, control of monitoring and measuring, verification, and control of nonconforming product. Clauses 9 and 10 cover internal audit, management review, nonconformity and corrective action, and continual improvement.
ISO 22000:2018 distinguishes two kinds of risk. Organisational risk, addressed in clause 6, concerns threats and opportunities for the management system and the business, such as loss of a key supplier, new legislation or staff turnover. Operational risk, in clause 8, is the food safety hazard analysis of HACCP, concerned with hazards to the consumer. The standard deliberately keeps the two separate, so that business risk thinking does not dilute hazard analysis.
The standard also describes two plan-do-check-act (PDCA) cycles that operate inside one another. The outer cycle is the management system: plan the system, run it, evaluate its performance and improve it. The inner cycle is operational planning and control in clause 8: plan hazard control, implement it, verify it and update it. Management review links the two by considering the results of verification, audits, complaints, incidents and changes.
Certification to ISO 22000 alone is not benchmarked by GFSI, because ISO 22000 refers to PRPs only in general terms. Adding the sector PRP specification and additional requirements turns it into FSSC 22000, which is benchmarked. Accredited certification bodies certifying food safety management systems work to ISO/IEC 17021-1 and ISO 22003-1.
The Global Food Safety Initiative (GFSI) was launched in 2000 by retailers and manufacturers, now organised in the Consumer Goods Forum, after a series of food scares had led each retailer to audit its suppliers to its own standard. Suppliers faced many overlapping audits. GFSI does not write a certification standard or certify anyone. It publishes benchmarking requirements, and certification programme owners whose schemes meet them are recognised. Retailers who support GFSI then accept certification to any recognised scheme, following the principle of once certified, accepted everywhere.
Benchmarking requirements cover the management system, good practices for the relevant sector (manufacturing, primary production, storage and distribution, packaging and others), and HACCP, as well as the governance of the scheme and the competence of its auditors. Over successive versions GFSI has added food safety culture, food fraud vulnerability assessment, food defence, environmental monitoring, and unannounced audits. Recognised schemes have included FSSC 22000, the BRCGS standards, SQF, IFS Food and others; the list changes, so the GFSI website is the reference.
FSSC 22000 is owned by Foundation FSSC. A certified site meets three sets of requirements: ISO 22000, the sector PRP technical specification such as ISO/TS 22002-1, and the FSSC additional requirements, which cover topics such as management of services and purchased materials, product labelling, food defence, food fraud mitigation, logo use, allergen management, environmental monitoring, food safety and quality culture, and equipment management. Because it is built on ISO 22000, it suits organisations that already use ISO management systems. The certification cycle is three years, with a certification audit followed by annual surveillance audits and a recertification audit, and at least one audit in the cycle is unannounced.
The BRCGS Global Standard for Food Safety originated in 1998 with British retailers and is widely required by UK and many other retailers. It is prescriptive: clauses state what must be in place, and some are fundamental clauses, such as senior management commitment, the HACCP plan, internal audits, management of suppliers, corrective and preventive action, traceability, layout and product flow, housekeeping and hygiene, allergen management, control of operations, labelling and training; failure of a fundamental clause prevents certification. Sites are graded on the number and severity of nonconformities, and can choose announced or unannounced audit programmes.
SQF (Safe Quality Food) is owned by the SQF Institute, a division of the US Food Industry Association. It offers codes by sector, with a Food Safety Code that is GFSI-benchmarked, a separate Quality Code, and a Fundamentals programme for small or developing businesses. Each site names an SQF practitioner responsible for the system. Scheme editions and issue numbers change every few years, so practitioners work to the current version published by the owner.
Food safety protects against unintentional contamination. Food defence protects against intentional adulteration intended to cause harm, whether by a disgruntled employee, an activist, a criminal seeking extortion or a terrorist. Food fraud is intentional adulteration or misrepresentation for economic gain, such as diluting, substituting or mislabelling food. The three differ in motive, and so in the methods used to assess and control them, though they share some controls such as access control and supplier approval.
Food fraud becomes a safety issue when the adulterant is harmful. In 2008, melamine was added to milk in China to inflate its apparent protein content measured by nitrogen analysis, and infants fed contaminated formula developed kidney stones; several died. In 2013, horse meat was found in products sold as beef in Europe, a fraud without a direct safety hazard that nonetheless damaged trust and led to new controls. Industrial dyes such as Sudan dyes in chilli powder and lead chromate added to turmeric to brighten its colour are further examples. Food fraud vulnerability assessment considers the history of fraud for each raw material, economic drivers such as price rises and shortages, the complexity and opacity of the supply chain, the ease of adulteration, and the existing detection and supplier controls.
Food defence planning starts with a vulnerability assessment of each step in the process. A widely used British approach, threat assessment critical control point (TACCP), published in the PAS 96 guidance, applies a HACCP-like logic to threats, and the companion vulnerability assessment critical control point (VACCP) applies it to food fraud. The US Intentional Adulteration rule under FSMA (21 CFR Part 121) requires larger facilities to prepare a food defence plan. Its vulnerability assessment considers three elements at each point, step or procedure: the potential public health impact if a contaminant were added; the degree of physical access to the product; and the ability of an attacker to contaminate the product successfully. FDA identified key activity types that are often vulnerable: bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities.
Mitigation strategies reduce vulnerability at actionable process steps. They include access control by badges, locks and visitor escort; tamper-evident seals on tankers, ingredient containers and finished packs; locking and monitoring of ingredient rooms and silos; two-person rules for sensitive operations; background checks where lawful; CCTV; and staff awareness so that anyone notices and reports unusual behaviour. As with HACCP, strategies need monitoring, corrective actions and verification, and the plan is reviewed at least every few years and when something changes.
Food safety culture is the shared values, beliefs and norms that affect mind-set and behaviour toward food safety in and throughout an organisation. A plant can have excellent documents and still fail if staff believe that output matters more than hygiene, that reporting a problem will get them blamed, or that rules are for auditors. Investigations of major outbreaks repeatedly find that someone knew about the problem and either did not speak up or was not heard.
GFSI's 2018 position paper described food safety culture in five dimensions: vision and mission; people; consistency; adaptability; and hazard and risk awareness. The 2020 Codex revision names management commitment to a positive food safety culture as a foundation of food hygiene, listing elements such as commitment of management and all personnel, leadership that sets the right direction and engages staff, awareness of the importance of food hygiene by all, open and clear communication, and the availability of sufficient resources. GFSI-benchmarked schemes now require sites to have a plan for developing and maintaining food safety culture, and BRCGS has included a culture clause since its eighth issue.
Culture is built by what leaders do more than by what they say. Visible leadership on the floor, decisions that put safety before output when the two conflict, resources for training and maintenance, recognition of people who report problems, and consistent consequences for deliberate violations all shape it. Training is necessary but not sufficient; it must be followed by coaching, supervision and feedback, in the workers' own languages and suited to their literacy.
Measurement uses several sources together: anonymous perception surveys of staff at all levels, observation of behaviour on the floor, interviews and focus groups, and performance indicators such as near-miss reporting rates, timeliness of corrective actions, repeat audit findings, and hygiene compliance from observation. A rise in reported near misses can be a sign of improving culture rather than worsening safety, because people feel safe to speak. Results feed a culture plan with objectives, actions and review at management review, in the same plan-do-check-act loop as the rest of the system.
Traceability is the ability to follow the movement of a food through specified stages of production, processing and distribution. The minimum legal model in many countries is one step back and one step forward: a business must be able to identify who supplied each input and to whom it supplied each product. The European Union made this a general obligation for food and feed businesses in Article 18 of Regulation (EC) No 178/2002. Internal traceability links incoming lots to outgoing lots through the records of processing, including rework and blending, which is where links are most often lost.
The US Food Traceability Rule under section 204 of FSMA, finalised in 2022, requires firms handling foods on a Food Traceability List, such as leafy greens, fresh-cut fruit and vegetables, shell eggs, soft cheeses and finfish, to keep key data elements for critical tracking events such as harvesting, cooling, initial packing, shipping, receiving and transformation, linked by traceability lot codes, and to provide records to FDA quickly when asked. Its compliance date has been extended, so the current FDA position must be checked.
Traceability is tested by a trace exercise or mock recall: choose a finished lot, identify all its inputs and all its customers, and reconcile quantities by mass balance. If 10,000 units were produced and records show 9,200 shipped, 650 in stock and 100 destroyed, 9,950 are accounted for, 99.5 per cent; schemes set targets for the time taken and the proportion reconciled, and unexplained gaps must be investigated.
A withdrawal removes product from the supply chain before it reaches consumers, or for a reason that does not involve a safety risk, such as a quality defect. A recall retrieves product that has reached, or may have reached, consumers because it is unsafe or may be unsafe, and usually involves public notification. Terms differ: in the United States a market withdrawal is a removal for a minor violation not subject to legal action, while recalls are classified by FDA as Class I, where there is a reasonable probability that use will cause serious adverse health consequences or death; Class II, where use may cause temporary or medically reversible effects or the probability of serious effects is remote; and Class III, where use is not likely to cause adverse health consequences. In India, the Food Safety and Standards (Food Recall Procedure) Regulations, 2017 set out the obligations and require a recall plan.
A recall plan names the recall team and its contact details, criteria for deciding on a recall, steps for notifying authorities, customers and consumers, procedures for retrieving, segregating and disposing of product, communication templates, and the method of judging effectiveness, such as effectiveness checks with customers. The plan is tested at least annually. Undeclared allergens and Listeria are among the commonest causes of recalls in several high-income countries, so allergen management and environmental monitoring are closely tied to recall prevention. After every recall, root cause analysis and corrective action complete the cycle.
Food allergens are proteins that cause immune-mediated reactions in sensitised people, from mild symptoms to fatal anaphylaxis; the mechanisms and individual allergens are taught in food-toxicology-contaminants-allergens. For a food business, the hazard is the presence of an allergen that the consumer does not expect, either because it was not declared on the label or because of cross-contact, the unintended transfer of an allergen into a product that should not contain it. No cooking step removes it, so control rests on prevention.
Which allergens must be declared depends on the market. The European Union lists fourteen in Regulation (EU) No 1169/2011; the United States has nine major food allergens since sesame was added from 2023; Codex and India publish their own lists. A product exported to several markets must meet each list. The Codex Code of Practice on Food Allergen Management for Food Business Operators (CXC 80-2020) sets out the international approach.
An allergen management programme starts with an allergen map: which allergens are present on site, in which raw materials, on which lines, at which steps, and in which finished products. Controls then follow the route of the allergen. At purchasing, suppliers declare allergens and cross-contact risks in specifications and must notify changes. At receipt and storage, allergen-containing materials are labelled, stored separately or below non-allergen materials, and handled with dedicated or colour-coded utensils. In production, the main tools are dedicated lines or equipment where possible, scheduling allergen-free and lower-allergen products before allergen-containing ones, validated cleaning between products, control of rework so that it goes only into products containing the same allergens, and control of airborne dust in powder handling.
Cleaning between allergen and non-allergen runs must be validated to show that it removes the allergen to an acceptable level, usually by allergen-specific tests such as ELISA or lateral flow devices on surfaces, rinse water and the first product after changeover, and then verified routinely. Labelling controls are as important as cleaning, because the commonest cause of allergen recalls is a wrong label or the wrong product in a pack: label approval against the recipe, checks at the start of each run and at each label or packaging change, and removal of obsolete labels. Precautionary allergen labelling, such as a 'may contain' statement, should be used only after risk assessment shows a cross-contact risk that cannot be controlled, not as a substitute for control. Staff training, from purchasing to the packing line, and a procedure for handling allergen-related complaints complete the programme.
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it to determine the extent to which audit criteria are fulfilled. ISO 19011 gives guidelines for auditing management systems. First-party audits are internal audits by the organisation of itself; second-party audits are by a customer of its supplier, or by the organisation of its own suppliers; third-party audits are by an independent certification body against a published standard, leading to certification. Regulatory inspections are a separate activity with legal powers.
An audit follows a sequence: planning, including the scope, criteria, team and schedule; an opening meeting; collection of evidence by interview, observation of activities and review of records; evaluation of findings against criteria; a closing meeting at which nonconformities are presented; the report; and follow-up of corrective actions. Auditors sample, because they cannot check everything. A vertical audit follows one product or batch through every relevant process and record, from raw material receipt to dispatch; a horizontal audit checks one requirement across many areas. Trace exercises during an audit combine both. Objective evidence must be verifiable: a statement by a manager that cleaning is always done is not evidence; a signed cleaning record, an observed clean line and a swab result are.
Third-party certification of a food safety management system usually starts with a stage 1 audit, which reviews documentation and readiness, followed by a stage 2 audit on site that evaluates implementation and effectiveness. Certification is granted for a cycle, commonly three years, with surveillance audits each year and a recertification audit before the cycle ends. Certification bodies are accredited by national accreditation bodies to ISO/IEC 17021-1 and, for food safety management systems, ISO 22003-1, and must use auditors competent in the relevant food sector. GFSI-recognised schemes add rules on audit duration, unannounced audits and auditor qualification.
Findings are graded. Definitions vary by scheme, but in general a major nonconformity is a failure that affects the ability of the system to achieve its intended results, such as absence of a required element, a breakdown of control at a CCP, or a situation that presents a food safety risk; a minor nonconformity is a lapse that does not by itself undermine the system. Some schemes add a critical grade for an immediate food safety risk or a legal breach, which suspends certification. The audited organisation must make a correction, find the root cause and take corrective action within the time the scheme allows, and submit evidence that the certification body reviews. Internal auditors need the same skills as external ones: knowledge of the standard and the process, independence from the area audited, and the ability to write clear, evidence-based findings that management can act on.
A student uses this subject to learn the language of every food factory: PRP, CCP, OPRP, critical limit, monitoring, correction, corrective action, validation and verification, and the order of Codex's twelve steps. The best preparation is to take one familiar product, such as pasteurised milk, cooked ham or a bakery item, and write its product description, flow diagram, hazard analysis and HACCP plan, then defend each CCP with the decision tree. That exercise answers most exam questions and is the first thing an interviewer for a quality role asks about.
Five years into a quality or production role, a technologist leads the HACCP team, updates the hazard analysis when a recipe or line changes, reviews CCP records daily, investigates deviations and complaints with root cause analysis, runs allergen changeover validation and label checks, organises mock recalls, conducts internal audits and hosts customer and certification audits. The same person trains operators and supervisors, often as the site's certified practitioner or PCQI, and is the one who decides whether a batch is held.
A head of food safety or technical director with twenty-five years' experience sets the policy and structure of the system across several sites and markets, chooses the certification schemes customers require, allocates resources, leads crisis management and recalls, and reports food safety performance and culture to the board. Such a person negotiates with regulators and retailers, judges when a new process needs revalidation, and makes the hard decisions when safety and commercial pressure conflict, which is where culture is really set.
A researcher at this level studies how food safety management systems perform rather than how they are written: whether certification predicts fewer incidents, how food safety culture can be measured validly, how risk-based verification frequencies should be set, how small businesses in low- and middle-income countries can apply HACCP flexibly, and how digital records, sensors and data analytics can support real-time verification. Such work joins food science with management science, behavioural science and regulation.
This manual describes the structure and principles of the schemes but does not reproduce clause-by-clause requirements of the current FSSC 22000, BRCGS or SQF editions, which change every few years and are available from the scheme owners. Critical limits are given only as examples from named codes; a plant must take them from its own legal requirements and validation. Detailed microbiological criteria and environmental monitoring methods are in food-microbiology, and allergen biology in food-toxicology-contaminants-allergens. Quality management (ISO 9001), laboratory accreditation (ISO/IEC 17025) and regulatory enforcement are taught in separate subjects. The current compliance date of the US Food Traceability Rule should be checked with FDA.
Original practice questions written to the syllabus and pattern of the exams named in each question's examTags. They are not past papers and do not reproduce any board's questions.
These notes are free to read here, with no account.
What the Laisha app adds:
Free for ten days, then a subscription. We would rather write that here than have you find it later.