Once the flow diagram has been drawn and confirmed, the business is ready to look at where food safety could go wrong, and what can be done to prevent it.

This module covers steps 6, 7 and 8 of creating a HACCP system. You will learn how hazards are analysed, how the critical control points are found, and how critical limits are set to separate safe food from unsafe food.

As a reminder, a HACCP system follows twelve steps, which apply the seven principles of HACCP. Steps 6 to 12 apply the principles in order.

This module covers the first three principles:

• Principle 1, step 6: conduct a hazard analysis.
• Principle 2, step 7: determine the critical control points.
• Principle 3, step 8: establish critical limits.

Principles 4 to 7, on monitoring, corrective action, verification and records, are covered in the next module.

The hazard analysis is the first principle of HACCP, and usually the most complex part of developing the plan.

It identifies all the potential hazards that are likely to occur at each step, whether biological, chemical, physical or allergenic, and evaluates them.

Using the flow diagram, the team lists the hazards at each step. This shows which control measures are needed, whether one measure can control several hazards, and whether a single hazard needs more than one control.

For each step in the flow diagram, the team should:

• Identify the hazards that could occur at that step.
• Decide whether each one is physical, chemical, microbial or allergenic.
• Consider how likely the hazard is, and how serious the consequences could be.
• Decide which hazards must be eliminated or reduced to an acceptable level.
• Decide whether a prerequisite controls the hazard, or whether a critical control point is needed.
• Choose control measures to eliminate the hazard, reduce it, or design it out of the process.

Once the hazards at each step have been listed, the team decides how to control them. The aim is to eliminate each hazard, reduce it to an acceptable level, or design it out of the process altogether. Every control measure must be proportionate to the risk and practical for the business to carry out, day after day. A control that looks good on paper but cannot be followed during a busy shift will not protect anyone.

The flow diagram helps here. It shows where a single control measure, such as thorough cooking, can deal with several hazards at once, and where one hazard, such as an allergen, may need several controls at different stages, from storage to labelling. The team should weigh both the likelihood of each hazard and the severity of its consequences for consumers, especially vulnerable groups. All of this analysis, and the reasons for each decision, must be documented and kept available for inspection.

Determining the critical control points is principle 2. A critical control point, or CCP, is a step where control is essential to prevent or eliminate a hazard, or reduce it to a safe level.

At a CCP, losing control would lead to an unacceptable risk, so a critical limit is set, and if it is breached, corrective action must be taken immediately.

Too many CCPs make a system complicated and hard to run. Too few, and important hazards are missed. Decision trees help to get the balance right.

In a kitchen, common CCPs are steps where temperature controls the growth or survival of bacteria, such as:

• Cooking, where food must reach a safe core temperature, such as 75°C.
• Cooling, where cooked food must be chilled quickly.
• Cold storage, where fridges and freezers must keep food at the right temperature.
• Reheating and hot holding.

For example, when cooked chicken risotto is frozen for later use, freezer temperature is a control parameter. The HACCP team must determine whether the freezing or frozen-storage step is a critical control point.

A decision tree is a type of flow chart that helps the team decide whether a step is a critical control point, or whether the hazard is already controlled by the prerequisites.

It asks a series of simple yes or no questions about each hazard. The decision tree must be applied to every hazard identified, one at a time, and the results recorded.

The best-known example is the decision tree published by the Codex Alimentarius Commission.

For each hazard, at each step, the Codex decision tree asks:

• Do control measures exist for this hazard? If not, and control is needed for safety, the step or process must be changed.
• Is this step specifically designed to eliminate the hazard, or reduce it to an acceptable level? If yes, it is a CCP.
• Could contamination occur here, or increase to an unacceptable level? If not, it is not a CCP.
• Will a later step eliminate the hazard or reduce it to an acceptable level? If yes, this step is not a CCP. If no, it is a CCP.

Establishing critical limits is principle 3. A critical limit is the maximum or minimum value that must be met at a CCP to prevent, eliminate or reduce the hazard to an acceptable level.

The main reason for setting a critical limit is to establish the line between safe and unsafe products. Critical limits must be measurable, and can include:

• Times and temperatures.
• Use-by dates.
• Acidity, measured as pH, or water activity.
• The colour or texture of a food.

For a critical limit to be meaningful, it must:

• Be measurable, by an observation or a test.
• Relate to a specific control measure, at a specific CCP.
• Be a maximum or a minimum, not a range.

For example, a critical limit may be that the pH of a yoghurt must be no higher than 4.6, so that it is acidic enough to stop harmful bacteria from growing.

Results must be available straight away, so that corrective action can be taken before unsafe food moves on. Breaching a critical limit is called an unacceptable process deviation.

A critical limit marks the line between safe and unsafe production, so it must rest on solid ground. Every critical limit should be scientifically based and justifiable to an inspector, drawing on evidence and industry standards rather than habit. It must be measurable by an observation or a test, because a subjective judgement on its own, such as food looking cooked, is not sufficient. A critical limit is an absolute line that must not be crossed, not a target to aim near.

Just as important is the speed of the result. If a test takes days to come back, the food it was meant to protect may already have been sold and eaten. That is why the checks used at critical control points, such as core temperature readings, give an immediate answer. If a result shows that a critical limit has been exceeded, corrective action can begin straight away, before unsafe food leaves the control of the business and reaches a consumer.

Most businesses also set a target level, which is safely inside the critical limit. The gap between the target and the critical limit is the tolerance. It gives an early warning that the process is drifting towards danger.

For example, a fridge for raw meat may have a target of 3°C and a critical limit of 5°C, giving a tolerance of 2°C. If the fridge goes above 5°C, the critical limit has been breached, and corrective action must be taken immediately.