Proving food safety is a monumental challenge, if not an impossibility. However, with the appropriate tools and techniques one can confirm, with a high degree of statistical confidence, the effectiveness of a preventive control for reducing a specified hazard to an acceptable level or concentration that is consistent with achieving public health objectives.

The idea of the food safety objective (FSO) is relatively new. It was first introduced by the International Commission on Microbiological Specifications for Foods (ICMFS) in 2002 and then by the Codex Alimentarius Commission in 2004.¹ The concept has not been in existence as long as HACCP or the principles of process validation. Fundamentally, the FSO concept "…translates public health risk into a definable goal: A specified maximum frequency and/or concentration of a hazard in a food at the time of consumption, which is deemed to provide an appropriate level of health protection (ALOP)."¹ This approach enables food safety scientists to both define and meet a specific FSO by the application of the principles of HACCP and process validation procedures. The FSOs, then, are the pre-determined specifications or acceptance criteria by which the success of the validation procedure is objectively measured. The FSOs also provide a scientific basis that allows industry to select and implement measures that control the hazards (Critical Control Points) of concern in a specific food or food processing operation.

Likewise, this concept enables regulators to better develop and implement inspection procedures to assess the adequacy of control measures implemented by industry, and to quantify the equivalence of inspection procedures in different countries.^1,2 Thus, the practical value of using the FSO concept is that it offers flexibility of operation. It does not prescribe the preventive control measures or how an operation achieves compliance; rather, it defines the goal.^1,2 The U.S. Food and Drug Administration's (FDA's) Juice HACCP Regulations are a perfect example of the flexibility offered by the FSO. The agency established an accepted level of health protection (ALOP) (5 log₁₀ reduction of E. coli), but it did not mandate the method for its attainment.³ Remember, however, that the method of attainment (the preventive control) must be validated. In this case, the FSO can serve as the predetermined specification (or the objective measure) for confirming food safety assurance.

According to the 2011 Food Safety Modernization Act (FSMA), "Preventive controls are reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would reasonably employ to significantly reduce or minimize the hazard identified in the hazard analysis, and that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis."⁴ In the years since the passage of FSMA, there has been an ongoing and often robust discussion about the concept of a preventive control. The truth is that preventive control is not a novel concept in the context of food safety. On the contrary, the idea for preventive control has long been recognized as a fundamental tenet and an underpinning principle of modern food safety science.

For more than 60 years, the Hazard Analysis and Critical Control Point (HACCP) system for process control and food safety assurance, for example, was predicated on the ideas of risk assessment and preventive control.⁵ Likewise, the former GMP regulations [(21 CFR 110.80(b)(2)(3)], since 1986, have enshrined in FDA law the notion that provided preventive measures will preclude the outgrowth of undesirable microorganisms in the production and processing of foods intended for human consumption. Those regulations list measures like thermal processing, acidification, water activity control, pasteurization, and irradiation as examples of preventive control measures.

The low-acid canned food regulation, since 1973, has codified the many requirements necessary for the effective use of thermal processing as an aegis against the formation of deadly botulinum neurotoxin in this potentially hazardous class of products. As a direct result or outcome of the low-acid canned foods regulations, the incidence of death, worldwide, attributed to botulism in commercially processed canned food is nearly nonexistent. Between 1990 and 2000, 160 foodborne botulism events affected 263 people in the U.S., representing an annual incidence rate of 0.1 per million. The vast majority of these incidents involved noncommercial (home-prepared) food products.⁶ Yet, with a long history of use, the defining principle undergirding the idea of preventive control seems to not have been fully appreciated and embraced by the industry. This is one reason for the renewed emphasis on preventive controls by FDA as codified in FSMA regulations.

What is new about preventive controls in FSMA is the requirement for validation. When a preventive control measure for an identified food safety hazard is defined in the context of a food safety plan, that control measure must be validated. This aspect of the FSMA presents a more difficult and challenging subject for both FDA and the food processing industry. Until the passage of FSMA, FDA did not have a standardized, codified definition for validation. It is interesting to note that in FDA's original writing of part 110 (title 21) of the Code of Federal Regulations—Current Good Manufacturing Practice In Manufacturing, Packing, or Holding Human Food—the word 'validate' or 'validation' is never used. This concept was not codified in any of the food safety regulations under the Center for Food Safety and Applied Nutrition's (CFSAN's) purview. By contrast, FDA's medical devices division has published an official definition for validation since the 1980s. Many food safety practitioners, prior to 2011, have relied on this definition for guidance in the design and execution of validation protocols and related procedures.

Validation

The definition for validation from FDA's medical devices division reads, "Validation is the process of establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its pre-determined specifications for quality and food safety."⁷ The new FSMA definition for validation reads somewhat differently: "Validation means obtaining and evaluating scientific and technical evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards."⁸ The bedrock principle supporting validation is the requirement for proving a process or procedure capable of delivering against a pre-determined, specified outcome with a high degree of statistical certainty and reproducibility. Interestingly, FDA's current definition appears to be missing these fundamental prerequisites of validation.

Much like FDA, the Codex Alimentarius of the World Health Organization (WHO) also did not have a codified definition for validation until 2013. The Codex definition closely resembles the earlier (1980s) version from FDA's medical devices division. The Codex definition speaks to both capability and controlling the hazard to a specified outcome.⁹

The purpose of validation, in the final analysis, is confirmation of food safety assurance corresponding with an established and accepted level of risk. "Judging food safety is judging acceptability of risk."¹⁰ It can be logically concluded that the aim of validation is to demonstrate that a preventive control measure will reduce the identified food safety threat to an acceptable level or concentration, thereby allowing the food's consumption without incurring an excessive risk of injury, morbidity, or mortality.¹⁰ The concept of a predetermined specification (output) is an essential, fundamental element of validation. Validation is also the link that connects the FSO concept with preventive control schemes, such as HACCP or HARPC. The following diagram, while not mathematical in the literal sense, proposes a relationship between the elements of process validation (IQ + PQ + OQ), critical control points (CCP), performance objectives (PO), the FSO concept, and ALOP. A more detailed discussion of these relationships is presented in subsequent paragraphs.

∑ (IQ + PQ + OQ) → CCP → PO ≤ FSO = ALOP

Public Health Protections and the FSO

Establishing an FSO for a specific hazard requires risk evaluation of the public health threat associated with the specific hazard in a food. The risk assessment may be derived by advice from a few specialists, by larger expert panels, or by conducting a quantitative risk assessment.¹¹ For example, an expert panel might conclude that an exposure rate of one case in 1 million people, for substance X, at a concentration of 1 ppb per 50-gram serving, is the threshold for its safety in a particular food. This threshold is frequently referred to as the ALOP. The ALOP is an excellent means of communicating the relative risk, but it is a difficult measure by which to judge the efficacy of food manufacturing and control processes. Consequently, at the process and control level, the ALOP has little real value.¹¹ By contrast, the FSO concept translates the ALOP to a definable goal, such as performance objectives (PO) and performance criteria (PC). The PO describes and delimits how a process is to work,¹¹ whereas performance criteria are the objective measures used for confirming that the process is actually working.¹¹ For example, the PO might describe the functioning of a CCP, and the PC would correspond to the critical limits assigned to that particular CCP.

The term FSO is applicable to situations where either a concentration of a hazard is set (e.g., less than 100 cfu of L. monocytogenes per gram of ready-to-eat food) or where a frequency is expressed (e.g., less than one per hundred (100 ml) servings of fresh apple cider contains Salmonella).² In a 2005 paper,² Marcel Zwietering provides a compelling example on converting an established ALOP for L. monocytogenes in raw milk cheese (one death per 1 million per year) to an FSO ≤ 2 log₁₀ cfu/gram of the viable organism in the cheese at the point of consumption.² Therefore, hypothetically, assuming an [H₀] = 6 log₁₀/cfu/gram, then a thermal process of 71.5 °C for 30 seconds might be used as an effective preventive control. In another paper, the authors provide an insightful discussion on the application of the FSO concept to thermally processed canned foods.¹²

The FSO concept can be described by the following equation:^1,2,11

[H₀] – ∑ R + ∑ I ≤ FSO

Where:

[H₀] = Initial concentration of the identified hazard

∑R = Effect of the specified process in reducing the concentration of the hazard

∑I = Denotes any incipient increase in the hazard during processing and handling

Note that each factor of the equation is expressed in log₁₀ units.

Definitions and the correct representation of units is of considerable importance when communicating an FSO. Zwietering has offered the following significant observations in this regard:²

• To avoid misunderstanding, one should always clearly distinguish between concentration and dose, and it is important to report units in the correct way: concentration (organisms per gram) or dose (organisms per serving; for example, 100 g, which differs by a factor of 100).
• One should clearly define the endpoint and the corresponding or appropriate units of risk: whether it is infection, illness, or death (endpoint), and the population that is considered. Whether risk is measured as health outcome per consuming occasion, year, or lifetime exposure is of large importance. This seems obvious, but in many publications the unit is not given; therefore, much more emphasis on the correct reporting is necessary. Reporting of a number without defining the ''case,'' the population on which it is based, and the time frame is of no use.

“The Food Safety Objective concept supports the longstanding rudimentary tenet of food safety assurance—that food safety is a product- and process-specific activity.”

The FSO concept is also compatible with the foundational precepts of process validation. Moreover, the concept supports the longstanding rudimentary tenet of food safety assurance—that food safety is a product- and process-specific activity.

HACCP, the much-heralded food safety and process control strategy, first codified by FDA regulations in 1986, is predicated on the idea of identifying and validating a CCP in a food manufacturing process. The CCP is also the preventive control measure. To be effective, the CCP must have a quantifiable level of effectiveness relative to the specific hazard. This level of effectiveness is referred to as the CCP's critical limit. In other words, the preventive control associated with the CCP must be capable of reducing the identified hazard to a level that is consistent with public health protection (ALOP). For example, FDA's juice HACCP regulations have identified as the critical limit a 5 log₁₀ reduction of E. coli in juice products.³ Thus, the CCP and its attendant preventive control measure must operate at a minimum level of efficacy that will ensure attainment of this specified performance outcome.

HACCP is based on the principle of risk reduction and confirmation (with a high degree of confidence) that the CCP is capable of mitigating the identified threat to food safety. The effectiveness of the CCP is determined by the efficacy of the device, procedure, or process to which the critical limit is assigned. A sieve, for example, will preclude only dangerous extraneous materials when the size and geometry of that hazardous material is greater than the diameter of the individual holes in the body of the sieve. Why, then, given the potential effectiveness of HACCP as a process control strategy for assuring safe food, has FDA moved away from this system in favor of what the agency is now calling Hazard Analysis Risk Assessment and Preventive Controls (HARPC)?

This is an intriguing question. There does not appear to be, in a material sense, any substantive difference between the two food safety strategies. After all, risk assessment (hazard analysis) and prevention are the hallmarks of the HACCP system. It has been suggested that FDA may have sought to "rebrand" HACCP in order to promote other aspects of FSMA. Important among these distinctions between HACCP and HARPC is mandatory validation of preventive control measures. Since 1986, with the update of the current GMP regulations, many companies embraced HACCP on a voluntary basis. Due to the voluntary adoption of HACCP, however, the systems were developed in isolation and absent a compulsory regulatory review. The plans were developed subject to each company's interpretation of the HACCP process and often guided by the arbitrary standards of myriad HACCP certification schemes. Experience further suggests that many companies developed food safety plans, but only a few of these companies actually implemented the HACCP system. Hence, HACCP was reduced to several pages of paper, held in so many binders, and found only in the quality control manager's office. There was little to no evidence for the existence of HACCP on the production floor. Rebranding of HACCP as HARPC appears to have been viewed, by FDA, as a strategy to standardize and further regulate HACCP across the food industry. Meanwhile, Codex and other regulatory agencies external to the U.S. have maintained their commitment to the development and implementation of HACCP.

Process Validation

Validation of preventive control measure(s) is the preeminent and distinguishing feature of FSMA legislation. Validation can also be a major challenge and a source of great confusion for both industry and the regulatory agency. Certainly, it is the most demanding in terms of both scientific rigor and resources. When properly executed, validation considers the impact of an entire process in achieving the specified food safety outcome. The Kellogg's logic model¹³ is a simple but eloquent way of dissecting the rudimentary elements of a food process. The basic components of that model include input, activity, and output. Most, if not all, processes have these elements or sequential steps in common (Figure 1).

Input is the place in the process where the risks are concentrated. Involved here, for example, are sensitive raw materials, additives, ingredients, and packaging. The risks associated with the input are normally transferred, unabated, to the next step in the process. The activity step is intended, by design, to reduce the risk to an acceptable level that is consistent with public health expectations. Thus, the output of that process, when the activity step is properly applied and controlled, should be food that is safe for human consumption.

This entire paradigm is valid only when the activity phase of the process is capable of attenuating the original concentration of the inbound hazards to safe and acceptable levels. In other words, the activity phase would have been the subject of a deliberate, science-based study that has confirmed (again, with a high degree of confidence) that it is effective in controlling the identified food safety hazard. The science-based study would have considered both the inbound risk (input) and any residual risk remaining in the output of the process. Conducting and assessing the capability of the activity phase (preventive control) requires that three separate assessments or qualifications are initiated: installation qualification (IQ), operational qualification (OQ), and process qualification (PQ). For example, when a new high-pressure processing (HPP) machine that is intended for use as a post-process decontamination step in deli meat is installed, the IQ, OQ, and PQ assessments would be performed prior to using the HPP device in production. These qualification processes are the fundamental phases of process validation:

• IQ: Establishing confidence that process equipment and ancillary systems are capable of consistently operating within established limits and tolerances
• OQ: Establishing confidence that the process is effective and reproducible
• PQ: Establishing confidence, through appropriate testing, that the finished product produced by a specified process meets all predetermined release requirements for functionality and safety.

It might also be inferred, then, that ∑ (IQ + OQ + PQ) = – ∑ R + ∑ I = PO ≤ FSO. This relationship represents the endpoint in quantifying the preventive capacity of the process and the attainment of the predetermined specification for food safety, which is the ultimate aim of the validation process. To be effective, the preventive control capacity of a CCP must yield a residual level of risk in the output of the process that is less than or equal to the threat level specified by the FSO.

FDA's Low Acid Canned Foods Regulations, for example, include specifications and other requirements for each of these three elements. The regulation codified in 21 CFR 113.40 provides in-depth discussion of both IQ and OQ criteria for retort operations in the context of thermal processing. Likewise, these regulations elaborate PQ requirement at 21 CFR 108.35 and 21 CFR 113.81 of the LACF regulations.

The concentration of the initial threat or risk is represented in the equation as [H₀], which correspond to accumulated risk associated with the input to the process. The activity phase of the process represents the CCP and its associated preventive control measure(s). These are represented by – ∑ R + ∑ I in the equation, where R equals the reduction capacity of the control measure and I allows for the possibility of an incipient increase in the threat, occurring during the interval required for the application of the control measure(s). The output of the process represents food that is fit for human consumption and corresponds with a PO or FSO that is less than the ALOP for food safety.

FDA has understood and long advocated process control as the means for achieving food safety assurance. The three points below eloquently state the agency's position. Point 3 is especially compelling in this regard. Dr. Deming noted the same truth when he said, "Test and inspect your processes, not your finished products."¹⁴

1. Safety, quality, and effectiveness must be designed and built into the product
2. Safety cannot be inspected or tested into the finished product
3. Each step of the manufacturing process must be controlled to maximize the probability that the finished product meets all safety, quality, and design specifications.

Food safety assurance derives in great measure from the systematic use of highly controlled manufacturing processes, where the nature of the food safety risk is identified and characterized and, furthermore, that the preventive control measure for its mitigation has been investigated and confirmed capable of reducing the risk to acceptable levels. Ultimately, the preventive control must be validated. To be clear, validation is a process- and product-specific activity. Validating a thermal process for an acidified food, for example, is inherently different than validating a thermal process for a low-acid food product. Likewise, validating a pulsed electric field (PEF) process for carrot juice will differ from the validation of the same juice when using HPP. Validation is a complicated and multifaceted activity that requires the skills of many. To be effective, the validation team must be multidisciplinary. To assist industry in sorting the tedium of developing validation protocols and procedures, FDA is preparing a guidance document that aims to assist with those processes.¹⁵

Absent a preventive control, the process will proportionally transmit the initial risk across the expanse of the process. It will manifest in the output of that process at an unacceptable level and exceed the protective capacity specified by the FSO (Figure 2). In this type of process, there is no palladium (UCL) to prevent the manifestation of the harmful effects in the finished product. This is an example of a process that is incompatible with achieving food safety. Said in more simplistic terms, "bad stuff in equals bad stuff out."

Figure 3 shows a process diagram with a preventive control measure inserted between the input [H₀] and the output of the process. The control measure attenuates the concentration of the hazard in the output so that it is less than the specified FSO and ALOP. Confirmation of the preventive control measure's capability relative to the hazard is expressed as a PO, and this measure should not exceed the specified FSO. The focus of process validation is on the PO, the predetermined specification for food safety assurance.

When a barrier is erected in the process that has been specifically designed to preclude the transmission of the hazard, it is called a preventive control. The barrier will be relied on to attenuate the identified threat to such an extent that the risk of the output (food) will not jeopardize the public health. The effectiveness of the preventive control must be validated to confirm its capability and reliability with respect to the identified hazard. The results of a properly executed validation process are control limits, CCPs, process control parameters, specifications, and other information that are essential for process verification (Figure 4). Without these guiderails, it is impossible to verify the capability or performance of a process to the degree that is needed for food safety assurance. Validation must always proceed verification.

The renewed focus on validation and preventive controls by FDA and FSMA regulations are laudable. Moreover, it is the right thing to do. The emphasis and requirement for validating preventive controls identified in the food safety plan is essential for protecting public health. Validation is a science-based, process-focused procedure that seeks to understand the installation, operation, and performance of the control measure, relative to the reduction of the identified hazard or threat to food safety.¹⁹

It is essential to understand "the process" and the nexus between the input to the process (original concentration of the threat [H₀]) and the capability of the preventive control measure (– ∑ R + ∑ I) to reduce the threat, in the output of that process, to a level that is consistent with public health expectation. In other words, the attainment of the FSO is the primary goal of validation, which seeks to confirm, with a high degree of confidence, that the preventive control is both reliable and capable. Deming has called this a "stable process" (Figure 5).¹⁴ It is only a stable process that is compatible with food safety assurance. An unreliable, unstable food manufacturing process will ultimately result in the manufacture of foods that contain defects that may ultimately imperil public health.¹⁷

Judging food safety is judging acceptability of risk. Accordingly, food safety assurance is a risk-based process. Risk assessment is the foundation for both HACCP and HARPC. Understanding and qualifying risk are essential first steps in the development of a rational food safety plan. The FSO concept uses its [H₀] to convey the concentration of the hazard at the start of the process. The preventive control measure must then anticipate the magnitude of the hazard, if it is to be an effective barrier to its transmission across the process and into the finished food. The hazard reduction capacity of the preventive control is expressed as– ∑ R + ∑ I, where R is the effect of the reduction capacity of the process and I is the incipient increase in the hazard occurring during the application of the process. Risk assessment is a science-based activity that requires skill, training, and experience. Moreover, it is an activity that should not be undertaken by any one individual. The plant's quality control/quality assurance leader should not be held solely accountable for conducting a risk assessment. A cross-functional team must be convened for this purpose.

Food safety assurance derives from manufacturing processes that are highly controlled and regulated. Recall, then, that ALOP is of little value at the point of process control. The FSO or PO are better measures, in terms of food safety assurance, for assessing process control capability. These measures can also be validated. Achieving food safety demands superb and complete understanding of manufacturing processes, particularly their IQ, OQ, and PQ performance against predetermined specifications for food safety. Testing the finished product for food safety adds no value; at that point it is too late—the food is either good or bad,^14,17,18 safe or unsafe, and no amount of product testing will alter the truth of this sapient observation.

Judging food safety demands an objective arbiter. The measures by which those judgements are made must be based on sound science and properly validated.²⁰ Otherwise, catastrophic process failures may occur, posing a very real potential for harm to public health. Information is never a substitute for illumination. An ALOP is information. Validation is the illumination of process capability, and POs, CCPs and FSOs are its signposts of success.

References

1. Gorris, L. M. "Food Safety Objective: An Integral Part of Food Chain Management." Food Control 16, no. 9 (November 2005) 801–809. https://www.sciencedirect.com/science/article/abs/pii/S0956713504002609.
2. Zwietering, M. "Practical Considerations on Food Safety Objectives." Food Control 15, no. 9 (November 2005): 817–823. https://www.sciencedirect.com/science/article/abs/pii/S0956713504002622.
3. Code of Federal Regulations. FDA. "Hazard Analysis and Critical Control Point (HACCP) Systems." 21 CFR 120. 2002. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-120?toc=1.
4. FDA. "Full text of the Food Safety Modernization Act (FSMA)." Current as of December 13, 2017. https://www.fda.gov/food/food-safety-modernization-act-fsma/full-text-food-safety-modernization-act-fsma.
5. Weinroth, M. D., A. D. Belk and K. E. Belk. "History, Development, and Current Status of Food Safety Systems Worldwide." Animal Frontiers 8, no. 4 (2018): 9–15. https://doi.org/10.1093/af/vfy016.
6. Sobel, J., et al. "Foodborne Botulism in the United States, 1990–2000." Emerging Infectious Diseases 10, no. 9 (2004): 1606–1611. https://pubmed.ncbi.nlm.nih.gov/15498163/.
7. FDA. Guideline on General Principles of Process Validation. May 1987. https://variation.com/wp-content/uploads/guidance/FDA-Process-Validation-Guidance-1987.pdf.
8. FDA. "Food Safety Modernization Act." Public Law 111–353. January 4, 2011. https://www.govinfo.gov/content/pkg/PLAW-111publ353/pdf/PLAW-111publ353.pdf.
9. Codex Alimentarius. CAC/GL 69–2008. "Guidelines for the Validation of Food Safety Control Measures." 2008. https://www.fao.org/input/download/standards/11022/CXG_069e.pdf.
10. Keener, L. IFT Nonthermal Processing Division. Division Lecture, 2019 IFT Annual Meeting, Chicago, Illinois.
11. Boisrobert, C.E., et al. Ensuring Global Food Safety—Exploring Global Harmonization. "Chapter 4: A Simplified Guide to Understanding and Using Food Safety Objectives and Performance Objectives." International Commission on Microbiological Specifications for Foods. Elsevier, 2009.
12. Anderson, N., et al. "Food Safety Objective Approach for Controlling Clostridium Botulinum Growth and Toxin Production in Commercially Sterile Foods." Journal of Food Protection 74, no. 11 (November 2011): 1956–1989. https://pubmed.ncbi.nlm.nih.gov/22054200/.
13. W. K. Kellogg Foundation. "Simple Logic Model." 2004.
14. Deming, E. W. Out of the Crisis. Cambridge, Massachusetts: MIT Press, 2000.
15. Anderson, N. "FDA Regulations and Process Validation Considerations." https://www.nifa.usda.gov/sites/default/files/resource/Overview%20of%20FDA%20Regulations%20and%20Process%20Validation%20Considerations.pdf.
16. Cyleon, E., et al., "Guidance on Validation of Lethal Control Measures for Foodborne Pathogens in Food." Comprehensive Reviews in Food Science and Food Safety 20, no. 3 (May 7, 2021): 2825–2881. https://ift.onlinelibrary.wiley.com/doi/full/10.1111/1541-4337.12746.
17. Deming, E. W. The New Economics for Industry, Government, Education. 2nd Edition. Cambridge, Massachusetts: MIT Press, 2000.
18. Keener, L. "Ex Ante or Ex Post Food Safety Strategies: Process Validation versus Inspection and Testing." Food Safety Magazine June/July 2011. https://www.food-safety.com/articles/3843-ex-ante-or-ex-post-food-safety-strategies-process-validation-versus-inspection-and-testing.
19. Keener, L. "Validation of Novel Food Processing Technologies." Symposium on Validating Nonthermal Technologies. Cornell University, October 2017.
20. Koutchma, T. and L. Keener. General Principles and Approaches of Food Process Validation. Elsevier, 2022. https://www.sciencedirect.com/science/article/pii/B9780128158883000063?via%3Dihub.