Tech Talk

How Applying the Principles of HACCP Can Make You a Better Auditor

Whenever I carry out an audit, I come away with two nagging questions in my head – “Did I give enough time and attention to those things which are most important?” and “Did I really communicate my concerns effectively to the auditees and are they motivated to make improvements and act on my recommendations?”. Any audit is by definition a sampling exercise – we cannot see everything and challenge everything because we simply don’t have the time. We must use that precious time to focus on those things that really matter. In short, we must apply the principles of RISK ASSESSMENT, and apply them to all facets of the audit…

• The planning of the audit
• The allocation of time and attention to the various activities to be audited
• The assessment of the severity of observations
• The way we communicate that severity to the auditee

There are numerous risk assessment procedures that can be used by the auditor to ensure that he/she concentrates on those activities which are most important to assure product quality and safety. Perhaps the most commonly used is Failure Mode Effect Analysis (FMEA), whereby potential hazards (things that can go wrong) are identified and the RISK associated with them is quantified by analysing and giving a score to…

• The SEVERITY of the hazard
• The probability of OCCURRENCE of the hazard
• The probability of DETECTION of the hazard should it occur

By multiplying together the scores for severity, occurrence and detection (or perhaps more correctly, non-detection) we can obtain an overall score for the risk associated with the hazard and this can then be used to rank risks associated with any activity. We can use this risk ranking to determine how much time and effort we should spend when auditing this activity and assessing whether the risks, as we see them, are under adequate control.

FMEA is a very useful risk assessment tool, but when auditing I prefer a derivative of FMEA called Hazard Analysis and Critical Control Points (HACCP).

What is HACCP?

HACCP has its origins in the food industry. It was developed in the 1960s by the Pillsbury food company, in collaboration with the US Army and NASA as part of a project to develop foods for the American space programme, and in particular to minimise the microbiological risks associated with those foods – no-one wants to suffer from food poisoning in a space suit! HACCP proved to be a great success and has become the process of choice for the assessment and control of microbiological risks in the food industry. But don’t be fooled into thinking that HACCP is only useful for assessing microbiological risk and is applicable only to foods. I and many others have used the principles of HACCP to assess diverse risks in the pharmaceutical and biotech industries – and it works!

In its simplest form, HACCP involves a series of 7 linked steps…

1. Definition of the product and the process
2. Identification of potential hazards and potential control measures
3. Determination of critical control points (CCPs)
4. Establishment of critical limits for each CCP
5. Establishment of a monitoring system for each CCP
6. Implementation of a corrective action plan to re-establish control when necessary
7. Establishment of verification procedures to demonstrate compliance

It is the identification of so-called critical control points (CCPs) and all the steps that follow on from there which make HACCP such a unique and valuable tool, both in terms of controlling risk and as an aid to auditing.

Look at each of the 7 steps in a little more detail - download the article pdf.