Module 4 · Maintaining the system
Review triggers and change control
Lesson 13 of 15 · about 2 minutes
A HACCP plan describes a business at one moment, and businesses change. The law and Codex both deal with this. Article 5 says that when any modification is made in the product, process or any step, the operator must review the procedure and make any necessary changes. Codex says the system should be reviewed periodically, and whenever there is a significant change that could affect the hazards or control measures.
Codex gives examples: a new process, new ingredient, new product, new equipment and new scientific knowledge. In practice, add a new supplier, a recipe change, new packaging, a longer shelf life, a layout change, a change in capacity, a new group of users, and outsourcing a step. Also add events: an incident, a complaint, a recall, a repeated deviation, an audit finding, a worrying trend, or a change in law or guidance.
Neither the law nor Codex fixes how often a periodic review must take place. Decide this yourself, based on risk, and record it. A periodic review is still needed where a business has decided that no CCPs are needed, to check whether that has changed.
The best time to review a change is before it happens. Use a simple change control. Anyone proposing a change completes a short form. The team asks whether the change affects any hazard, control, limit, flow step, allergen or instruction. If it does, the plan is updated, staff are trained, and validation is repeated where necessary. Only then does the change go live. Codex says management should maintain the integrity of the food hygiene system when changes are planned and implemented.
In our example, the buyer finds cheaper mince from a new supplier. Under change control, the team checks the supplier's approval, specification, delivery temperature and allergen information. It finds that the new mince contains soya, which is a new allergen for the product. The label and allergen information are changed before the first delivery is used. Without change control, the first anyone might have known would be a customer's reaction.
Key points
- The law requires a review when anything changes
- Set and record your own periodic review frequency
- Review a change before it happens
- Repeat validation where the change makes it necessary
