Critical limits and monitoring design

Step 8 asks for validated critical limits for each CCP. A critical limit is a criterion, observable or measurable, relating to a control measure at a CCP, which separates acceptability from unacceptability of the food.

Limits may use temperature, time, moisture level, pH, water activity, available chlorine, contact time, conveyor belt speed, viscosity, conductance or flow rate. They may also be observable, such as a pump setting or the correct label. More than one parameter may be needed, as with time and temperature in a heat treatment.

Set the limit at the real safety line. Codex says a deviation from a critical limit indicates that it is likely that unsafe food has been produced. A limit is not a quality target. Many businesses also set a stricter operating target, so that they can adjust the process before the limit is reached.

Write the limit for the worst case. '75°C for 30 seconds' is not complete. Where is it measured? In which item? For the pies, the limit is applied at the centre of the thickest part of the filling in the largest kettle batch.

Some limits come from law or guidance. In England, Wales and Northern Ireland, chilled food has a legal maximum of 8°C, with an aim of 5°C or below. In Scotland no number is fixed in law. Food must be kept in a fridge or cool ventilated place, and FSS recommends 5°C or below. Hot holding is 63°C or above in England, Wales and Northern Ireland, and above 63°C in Scotland. The FSA gives cooking equivalents of 75°C for 30 seconds, 80°C for 6 seconds and 70°C for 2 minutes.

Others you must set yourself. Food should be cooled as quickly as possible, ideally within 90 minutes. A plan needs a specific limit based on evidence from your own largest batch and equipment.

Step 9 asks for a monitoring system for each CCP. Monitoring is the scheduled measurement or observation at a CCP relative to its critical limits. It should be able to detect a deviation, and be timely enough to allow the affected product to be isolated and evaluated.

Design it by answering four questions. What is measured? How is it measured, with which equipment and method? When, or how often? Who does it, and who deputises when they are away? For the pies, the cook checks the core temperature of each batch with a calibrated probe at the end of cooking and records it.

Frequency is a risk decision. Codex says monitoring should be continuous where possible. Time and temperature often can be. Moisture and preservative levels cannot, and observable limits rarely are. If monitoring is not continuous, it should be frequent enough to ensure, as far as possible, that the limit has been met, and to limit the product affected by a deviation.

Think of the gap between checks as product at risk. If you monitor hourly, up to an hour of production may have to be held if a check fails. If you cannot isolate that much, check more often. Also consider how fast a failure can happen. Temperature can fall rapidly during pasteurisation, but may rise only gradually in cold storage.

Physical and chemical measurements are usually preferred to microbiological testing, because they are quick and can often indicate control of microbial hazards.

Include people in the design. Those who monitor should know what to do when action is needed. Data should be evaluated by a designated person with the knowledge and authority to carry out corrective actions. Records should be signed or initialled by the person monitoring, and should show the result and timing.

Consider what happens when systems fail. An automatic alarm is useless if nobody responds at 3am. Test alarms, and decide who responds. Plan for a probe that fails, an absent checker and a broken data logger. Where a trend moves towards a deviation, make adjustments before it occurs.