Verification, audits and trend analysis

Verification means applying methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended. It answers the question: is it working as planned? UK law says verification procedures must be carried out regularly.

Codex gives these examples: reviewing monitoring records; reviewing corrective action records, including deviations, product disposition and root cause analysis; calibrating or checking instruments; observing that control measures are carried out in line with the plan; sampling and testing products; sampling and testing the environment, such as for Listeria; and reviewing the HACCP system through internal or third-party audits.

Verification should be carried out by someone other than the person responsible for monitoring and corrective actions. Where some activities cannot be done in-house, they should be done by external experts or qualified third parties. The frequency should be enough to confirm that the system is working effectively. Set out who does what, and how often, in a verification schedule.

Testing has its place, but know what it can and cannot show. A sample tells you about that sample. Hazards are rarely spread evenly through a batch, so a negative result does not prove that all the food is safe. FSA guidance on less than thoroughly cooked burgers makes this point directly. Use testing to verify the system. Do not use it in place of control.

An audit is a planned, independent check of whether the system is being followed and whether it works. It may be internal, carried out by a customer, or carried out by a third party. The FSA audits approved meat establishments in England, Wales and Northern Ireland.

Plan audits on a schedule, based on risk. Auditors should not audit their own work. Agree the scope, gather evidence, record findings clearly, agree actions with owners and dates, and then check that each action is closed and has worked. Report the results to senior management.

Go beyond the paperwork. A strong technique is to trace one batch. Choose a finished product and follow it backwards through its records: dispatch, labelling, cooling, cooking, ingredients, supplier. Then compare the records with what you see. Watch a check being done. Ask staff what they would do if a reading failed. Ask to see a probe being tested.

Look for signs that records are not real. Warning signs include identical readings day after day, a week of entries in the same pen, records completed before the time they describe, missing calibration, and no deviations in months. A fridge that reads exactly 3°C at every check for a month deserves a question. There may be a good reason, but you should find out.

Verification should include a comprehensive review of the system, such as a reanalysis or an audit, periodically or when changes occur. Codex says this review should confirm that the appropriate significant hazards have been identified, that control measures and critical limits are adequate, that monitoring and verification are occurring in line with the plan and are capable of identifying deviations, and that corrective actions are appropriate for the deviations that occurred.

Trend analysis turns records into information. A single record shows one moment. A trend shows where the system is heading. Codex says corrective actions should be reviewed periodically to identify trends, and that process adjustments should be made when monitoring shows a trend towards a deviation.

Useful data includes CCP readings, deviations, near misses, complaints, test results, calibration drift, audit findings and supplier failures. Simple methods work well. Plot a chiller temperature on a chart over time. Count deviations by month, then split them by shift, product, line or supplier. Look for the few causes that account for most of the problems.

In our example, the team counted six cooling deviations in three months. Five were on Mondays. Ordering patterns meant that Monday was the heaviest production day and the chiller was overloaded. No single record showed this, but the count did. SFBB uses a simpler version of the same idea. Its four-weekly review asks a business to look back and find persistent problems.

Agree in advance what level of change will trigger action, and who is told. Report simple measures to senior management.

Be careful with targets. A goal of 'zero deviations' sounds good, but it can teach people to hide problems. If deviations are punished, the numbers will fall and the risk will not. Reward finding and fixing problems.