 |
||||||||||||||
21 Octobre 2019 | ||
|
||||||||||||||
What provisional impacts at operational level ? |
||||
|
As version 2 of the ISO 22000 standard has been published for almost a year, it seems the moment is appropriate to consider the impacts of this new version on Food Safety control measures at operational level. We already covered risk management principles in ExarisInfo n°69 through the development of the ISO 9001:2015 standard as well as in ExarisInfo n°76 which presented the future changes in the 2018 version of the ISO 22000 standard. It is confirmed that the standard faced difficulties “digesting” the "HLS structure" required by ISO 9001. Eventually it chose a so-called "dual PDCA" approach introduced in ExarisInfo n°78, with two levels of risk management as a result: the first one focuses on the organization and control of the system (context, process approach, stakeholders, risks and opportunities), the second focuses on operational control (Prerequisite Programs, CCP, OPRP...). With regards to the first level, we keep regretting that the standard only paves the way to the "process approach" without fully embarking it. This creates a risk of difference in interpretation over the long term between those who wish to fully embrace this concept (from an ISO 9001 perspective) and those who do not perceive the added value for that. We choose here to focus on the second level - operational risk management - already covered in ExarisInfo n°2 when we discussed about the thorny subject (even then !) of the distinction between a CCP and an oPRP... | ||
1. Prerequisite Programs (PRP): a confirmed role |
||||
|
The standard has somewhat changed its approach regarding Prerequisite Programs, which version 2018 defines as (§3.35) "Basic conditions and activities that are necessary within the organization and throughout the food chain to maintain food safety", while in version 2005 the PRPs allowed "to maintain a hygienic environment throughout the food chain (...)". The scope of the Prerequisite Programs is therefore explicitly extended beyond sole good hygiene practices. It shall also be noticed that the new version of the standard requires the organization to take into consideration "a) the applicable part of the ISO/TS 22002 series". This change is likely to have a significant impact on the certification strategy of companies that did not yet chose FSSC22000 scheme but limited themselves to ISO 22000 certification only: if a technical specification of the ISO/TS 22002 series exists for the concerned business sector, this strategy will need to be reconsidered... In addition, the documentation requirements for PRPs have been reinforced since a correction has been made: “documented information shall specify the selection (…) of the PRP(s)”, while previous version made it a recommendation (“should specify”). In addition, where the 2005 version only required verification of PRPs, version 2018 includes the possibility to “monitor” PRPs "if applicable" beyond verification... Finally, it is now clearly established that Prerequisite Programs are not (no longer) considered as "control measures" in the strict meaning of ISO 22000:2018, defined as (§3.8) "Action or activity that is essential to prevent a significant food safety hazard, or reduce it to an acceptable level" and determined on the basis of hazard analysis. Only CCPs and OPRPs now meet this definition. PRPs can still be considered as broad mitigation measures established before the hazard analysis. Then the standard requires hazard analysis (to identify significant hazards) regardless of control measures (which the analysis is specifically intended to determine) but not without considering PRPs !.... | ||
2. Categorization of control measures: CCP / OPRP |
||||
|
Version 2018 still requires to categorize control measures as CCP or OPRP. A minor modification was made to definition of a CCP (§3.11): "Step in the process at which control measure(s) is (are) applied to prevent or reduce a significant food safety hazard to an acceptable level, and defined critical limit(s) and measurement enable the application of corrections." An oPRP (§3.30) is now defined as : “Control measure or combination of control measures applied to prevent or reduce a significant food safety hazard to an acceptable level, and where an action criterion and a measurement or observation enable effective control of the process and/or product.” The explicit link between an oPRP and a PRP that existed in the 2005 version (oPRP: "a PRP identified by hazard analysis as essential (...)") has disappeared but the standard does not forbid this link to be maintained. The new definition - which was supposed to bring clarification - no longer really defines the nature of an oPRP compared to a CCP: the CCP is a "step at which a control measure..." / The oPRP is a “control measure” without an explicit connection to a PRP. Therefore, on this basis the CCP could be a "step at which an oPRP..." provided that the monitoring of this oPRP is “measured” and not “observed” (in which case this trick no longer works!). It seems that instead of providing clarification these changes may on the contrary complicate practical implementation. However a gap has been filled: the 2005 version required monitoring of oPRPs but did not give any name to the monitoring limits, which are now called "action criteria" (§3.2): "measurable or observable specification for monitoring of an OPRP". Nevertheless, this definition adds an ambiguous distinction between the action criterion associated with an oPRP and the critical limit associated with CCP (§3.12) defined as a "measurable value that separates acceptability from unacceptability". The notion of “measurable” for a critical limit and “measurable or observable” for an action criterion may introduce a methodological distortion, such as the temptation to "downgrade" a CCP to an oPRP considering that for the former when a critical limit is exceeded or not reached concerned products shall be handled as potentially unsafe, which is not systematically the case for the latter when an action criterion is not satisfied or not reached.... Finally, ISO 22000:2018 still requires a logical approach to classify control measures into CCP/oPRP without requiring or proposing a decision tree. We have therefore taken the opportunity to further simplify our proposal by reducing this logical sequence to 3 key questions that we believe are sufficient (fig. 1). | ||
3. Operational consequences |
||||
|
From an operational control point of view, this new version does not provide any real clarification about the categorization of control measures between CCP and oPRP. Nevertheless, it will be necessary to remain vigilant as regards to the risk of "downgrading" a CCP to an oPRP (e.g. a sieve) under the pretext that the associated critical limit (e.g. visual control of the sieve’s integrity) is not measurable, even though this control measure fulfils the definition of a CCP (the sieve is indeed a step in the process and in principle its visual control could be associated with the measurement of mesh size !) and that it has always been identified and managed as such in HACCP plans and in shopfloor communication... as well as for a magnet CCP that would become an oPRP under the pretext that monitoring is not continuous... It shall be kept in mind that monitoring (§3.27) is the action of “conducting a planned sequence of observations or measurements to assess whether a process is operating as intended" and that this definition has never integrated and still does not integrate the notion of continuous / discontinuous ! The monitoring frequency should ensure that: (§8.9.4) "The organism (...) retains products that have been identified as potentially unsafe under its control". These operational changes shall surely not lead to decreasing food safety control level delivered by food businesses! This would result in a loss of credibility for the standard, particularly in relation to other certification standards such as IFS or BRC. | ||
Conclusion |
||||
|
Like any standard ISO 22000:2018 is the result of a consensus that may give the impression for some it went too far and for others it did not sufficiently succeed in integrating process approach into FSMS or in clarifying the CCP / oPRP categorization issue. Any normative change offers a new challenge and new opportunities to companies: it is therefore vital to remain pragmatic, efficient and highly operational, not to get lost in “expert debates” and not to lose sight of the main objective, which is to control consumers safety. The major challenge remains unambiguous communication at shopfloor level about control measures to be implemented, related controls and methods for managing non conform results... Feel free to contact us to move forward together on this topic. | ||
 | ||
 |
Si?ge social |
T?l. +33 (0)9 51 19 32 12 |
