HACCP for Cannabis: A Guide for Developing a Plan

By Radojka Barycki

Hazard Analysis and Critical Control Points (HACCP) is a systematic approach that evaluates hazards that may potentially be present in food products that can harm the consumer. The process used to manufacture the product is evaluated from raw material procurement, receiving and handling, to manufacturing, distribution and consumption of the finished product¹. The documented process is what is known as HACCP plan. Although HACCP was designed to evaluate hazards in foods, it can be used to assess or evaluate hazards that may potentially be present in cannabis consumable products (edibles and vaping) that can cause harm to the consumer.

HACCP plan development requires a systematic approach that covers 5 preliminary steps and 7 principles. A systematic approach means that each step must be followed as outlined. Skipping a step will result in a HACCP plan that most likely will be ineffective to control potential hazards in the product.

The 5 preliminary steps are:

Establish a HACCP team
Describe the product
Establish the intended use of the product
Develop a flow diagram
Verify the flow diagram

The 7 Principles are:

Conduct a hazard analysis
Identify the critical control points (CCPs)
Establish critical limits (CL)
Establish monitoring procedures
Establish corrective actions
Establish verification procedures
Establish records and record keeping procedures^1,2

It is important to mention that HACCP plans are supported by programs and procedures that establish the minimum operational and sanitary conditions to manufacture safe products. These programs and procedures are known as pre-requisite programs (PRP) or preventative controls^1,2.

A multidisciplinary team must be established in order to ensure that all inputs of the product manufacturing process are considered during the hazards analysis discussions. The description of the product and its intended use provides detail information on ingredients, primary packaging material, methods of distribution, chemical characteristics, labeling and if any consumer might be vulnerable to the consumption of the product. A verified flow diagram is an accurate representation of the different steps followed during the product manufacturing process and will be used to conduct a hazard analysis. An inaccurate flow diagram will set the stage for an inadequate HACCP plan. Therefore, it is important that the HACCP team members verify the flow diagram. Figure 1 is a flow diagram for a fictional infused apple juice manufacturing plan that I will be using as an example.

The hazard analysis is the backbone of the HACCP plan. There are two elements that must be considered when conducting the hazard analysis:

Identification of the hazard associated with the ingredient(s) and/or the product manufacturing steps. These hazards have been categorized as: Biological, chemical (including radiological) and physical. Biological, chemical and physical hazards should be considered for each ingredient, primary packaging and process step. Also, it is important that the team is specific as to what hazard they are referring to. I often find that biological hazards are identified as “pathogens” for example. The team has to be specific on which pathogen is of concern. For example, if you are processing apple juice, the pathogens of concern are pathogenic coli and Salmonella sp. However, if you are processing carrot juice, you need to add Clostridium botulinum as a biological hazard also. If the choice of method to eliminate the hazards is pasteurization for example, the processing temperature-time combinations will differ greatly when manufacturing the apple juice vs. the carrot juice as C. botulinum is an organism that can sporulate and, therefore, is harder to kill.
Characterization of the hazard. This implies determining the significance of the potential hazard based on the severity of the consequence if it is consumed and the likelihood of occurrence in the ingredient or process step. Only steps in the process that has significant hazards should be considered further.

In my professional experience, the hazard analysis is one of the most difficult steps to achieve because it requires the expertise of the multidisciplinary team and a lot of discussion to get to the conclusion of which hazard is significant. I find that a lot of teams get overwhelmed during this process because they consider that everything in the process may represent a hazard. So, when I am working with clients or providing training, I remind everyone that, in the bigger scheme of things, we can get stricken by a lighting in the middle of a thunderstorm. However, what will increase our chances would be whether we are close or not to a body of water for example. If I am swimming in the middle of a lake, I increase my chances to get stricken by the lighting. In comparison, if I am just sitting in my living room drinking a cup of coffee during the thunderstorm, the likelihood of being stricken by a lighting is a lot less. The same rationale should be applied when conducting the hazard analysis for manufactured products. You may have a hazard that will cause illness or death (high on the severity chart) but you also may have a program that mitigates the likelihood of introducing or having the hazard. The program will reduce the significance of the hazard to a level that may not need a critical control point to minimize or eliminate it.

Clear as mud, right? So, how would this look like on the infused apple juice example? Table 1 shows the hazard analysis for the ingredients. Tables 2 and 3 show the hazard analysis for the part of the process. In addition, I have identified the CCPs: Patulin testing and pasteurization. There is a tool called the CCP decision tree that is often used to determine the CCPs in the process.

Once we have the CCPs, we need to establish the critical limits to ensure that the hazard is controlled. These limits must be validated. In the case of Patulin, the FDA has done several studies and has established 50 ppm as the maximum limit. In the case of pasteurization, a validation study can be conducted in the juice by a 3^rd party laboratory. These studies typically are called thermal death studies (TDS) and provide the temperature and time combination to achieve the reduction of the pathogen(s) of concern to an acceptable level that they do not cause harm. In juice, the regulatory requirement is a 5-log reduction. So, let’s say that the TDS conducted in the infused apple juice determined that 165°F for 5 seconds is the critical limit for pasteurization. Note that the 5 seconds will be provided by the flow of the product through the holding tube of the pasteurizer. This is measured based on flow in gallons per minute.

Monitoring is essential to ensure that the critical limits are met. A monitoring plan that outlines what, how, when and who is responsible for the monitoring is required.

Ideally, the system should not fail. However, in a manufacturing environment, failures can happen. Therefore, it is important to pre-establish steps that will be taken to ensure that the product is not out of the control of the facility in the event of a deviation from the HACCP plan. These steps are called corrective actions and must be verified once they are completed. Corrective actions procedures must address the control of the product, investigation of the event, corrective actions taken so the deviation doesn’t reoccur and product disposition.

Table 4. HACCP Plan Summary

Verification activities ensure that the HACCP plan is being followed as written. Typically, verification is done by reviewing the records associated with the plan. These records include but are not limited to monitoring records, calibration records, corrective action records, and preventive maintenance records for equipment associated with the CCPs. Record review must be done within 7 working days of the record being produced.

Finally, establishing records and record keeping procedures is the last step on developing HACCP plans. Records must be kept in a dry and secure location.

Table 4 show the summary of the HACCP plan for the infused apple juice example.

For more information on how to develop a HACCP plan for your facility, read the resources below:

HACCP Principles and Application Guidelines – The National Advisory Committee on Microbiological Criteria for Foods (NACMCF)
ASTM D8250-19: Standard Practice for Applying a Hazard Analysis Critical Control Points (HACCP) Systems for Cannabis Consumable Products

March 2, 2020

Product Safety Hazards: Looking Beyond Food Safety in Cannabis

By Radojka Barycki

No Comments

I think that we need to start changing the terminology around the hazards associated with cannabis from food safety hazards to product safety hazards. These hazards have not only been associated with harmful effects for those that ingest cannabis infused products, but also for those that consume the cannabis products in other ways such as inhalation (vaping or smoking). So, when we refer to these hazards as food safety hazards, the immediate thought is edibles, which misleads cultivators, manufacturers and consumers to have a false sense of security around the safety of products that are consumed in other ways.

Food processing and sanitation — By standardizing and documenting safety procedures, manufacturers mitigate the risk of cannabis-specific concerns

There are several product safety hazards that have been associated with cannabis. These hazards can become a public health problem if not controlled as they could harm the consumer, regardless of the method of consumption.

Let’s take a look at the different types of hazards associated cannabis:

Biological Hazards refer to those microorganisms that can cause illness to the consumer of a product that contain them. They are not visible to the naked eye and are very dangerous when their metabolic by-products (toxins) are ingested or their spores are inhaled. The symptoms for illnesses caused by these microorganisms will vary. Consumers may experience gastrointestinal discomfort (vomiting, diarrhea), headaches, fever and other symptoms. The ingestion of these pathogens, allergens or their by-products may lead to death, if the illness is not treated on time or if the consumer of the product is immunocompromised. In addition, the inhalation of mold spores when smoking cannabis products, can lead to lung disease and death. Some of the biological hazards associated with cannabis are: Salmonella sp., E. coli, Clostridium botulinum, Aspergillus sp. and Penicillium sp.

Chemical Hazards refer to those chemicals that can be present in the plant or finished product due to human applications (pesticides), operational processes (extraction solvents and cleaning chemicals), soil properties (heavy metals), environmental contamination (radiological chemicals) or as a result of occurring naturally (mycotoxins and allergens). Consuming high concentrations of cleaning chemicals in a product can lead to a wide range of symptoms from mild rash, burning sensation in the oral-respiratory system, gastrointestinal discomfort or death. In addition, long term exposure to chemicals such as pesticides, heavy metals, radiological contaminants and mycotoxins may lead to the development of cancers.

Physical Hazards refer to those foreign materials that may be present in the plant or finished product. Foreign materials such as rocks, plastics or metals can cause harm to the consumer by chipping teeth or laceration of the mouth membranes (lips, inner cheeks, tong, esophagus, etc.) In the worst-case scenario, physical hazards may lead to choking, which can cause death due to asphyxiation.

These hazards can be prevented, eliminated or reduced to an acceptable level when foundational programs (Good Agricultural/Cultivation Practices, Good Manufacturing Practices, Allergen Management Program, Pest Control, etc.) are combined with a Food [Product] Safety Plan. These lead to a Food [Product] Safety Management System that is designed to keep consumers safe, regardless of the method of consumption.

December 30, 2019

Preparing Your Recall Strategies

By Radojka Barycki

No Comments

A product recall is the removal of a defective product from the market because it can cause harm to the consumer or place the manufacturer at risk of legal action.

Although a recall is not something that companies want to be related to, preparing for it is very critical and it is an important part of crisis management.Product recalls can cost companies million dollars in profit loss and civil damages. The company senior management and employees can also face criminal action, if the investigation shows negligent acts. The company will also face loss of reputation and the trust of its customers.

Although a recall is not something that companies want to be related to, preparing for it is very critical and it is an important part of crisis management.

There are several phases when preparing a recall strategy:

Planning Phase

During the planning phase, a recall plan is developed. A recall plan is the procedure that will be followed by an appointed company’s team during an actual recall. A good recall plan will have the following components:

Definitions of the type of products recalls. According to federal regulations, there are three types of recalls. The company should know what type of recall they are performing to understand the risk the consumer is facing.

A Recall Team. The recall team is the key stakeholders that are responsible for different processes within the company. A good recall team will be multidisciplinary. A multidisciplinary team is a group of people that have different responsibilities within the manufacturing site (i.e. Receiving Manager, QA Manager, etc.) and/or outside (i.e. Legal Counsel, Public Relations, etc.)

A description of the recall team member’s responsibilities must be outlined. A recall coordinator and a backup should be assigned to ensure that there is one person organizing all activities during the recall.

A Communication Plan. It is important that only the appointed person that has the responsibility of external communications (i.e. media, regulators, customers, key stakeholders, etc.). In addition, there should be only one person appointed to handle all the communication within the team (internal communications.)

Documents to be used during the recall are:
- Communication documents: Letters to customers, regulators and media must be drafted and kept on hand for use during the crisis.
- Forms that will be used to keep track of product inventory on hand (still in the site), product being returned and product being destroyed.

A Traceability Procedure should be in place to ensure that materials used in the manufacturing of the finished good can be traced from the time of the delivery to the facility and throughout the product manufacturing process. In addition, traceability must also be provided for finished goods from the manufacturing site to its first point of distribution. This is known as traceability one step back (materials used) and one step forward (first point of distribution.)
A plant tagged with a barcode and date for tracking

A description of (or reference to) product quarantine (product hold) procedures that must be followed to ensure that the product that is still at the site do not leave the facility.

Product Destruction The company must outline (or reference) how product will be destroyed during a recall process.

Implementation Phase

There are three processes that need to be followed when implementing the recall plan:

Training: The recall team must be trained on their roles and responsibilities. Employees working at the site will be receiving directives from the appointed recall team members. It is also important that they are aware about the recall plan and understand the importance of urgency during the situation.
Exercise: It is important that the company doesn’t wait until the incident occurs to ensure that everyone in the team understands their roles and responsibilities during the recall. Therefore, annual testing of the procedure is imperative. This implies creating a “mock recall” situation and providing the information to the team to evaluate if they fully understand their role and responsibilities. This also allows the testing of the traceability protocols and systems that have been put in place by the site. Ensure that the team understands that this is an exercise and not an actual recall. You don’t want the team members going through the emotions that an actual recall gives. However, stress the importance of their participation during this exercise. You do not communicate to customers, media or regulators during a recall exercise.
Execution: This is the actual recall and full implementation of the plan. During the actual recall, you communicate to the regulators, customers and media. The company must also conduct daily recall effectiveness checks by using the forms developed for tracking product inventory, recovery and destruction.
Identify root cause and implement corrective actions. Root cause(s) will be identified during the recall process by analyzing the information resulting from the investigation of the incident. Regulatory agencies will actively participate in the discussion for identifying in the implementation of corrective actions.

Improvement Phase

The recall team should always meet after the recall exercise or the actual recall incident. The team must evaluate what positive or negative outcomes resulted from the process. If there are gaps identified, these need to be closed, so the process is improved.

November 5, 2018

Food Safety Planning for Cannabis Companies

By Radojka Barycki

No Comments

Food safety incidents can be prevented. However, prevention requires planning, which requires the effort of everyone in a company to create a culture of quality and food safety. How exactly do you plan for food safety? Food safety planning implies the building of a food safety management system. Food safety management systems allow for an efficient management of hazards that may be present in the food by the development and implementation of pre-requisite programs (PRPs) and a food safety plan, while supported by management commitment. So, let’s take a closer look at each of these building blocks:Radojka Barycki will lead a plenary session titled, “Cannabis: A Compliance Revolution” at the 2018 Food Safety Consortium | Learn More

Management Commitment

The development and implementation of a food safety management system requires financial, equipment, and technically sound personnel in order to be successful and sustainable. The management team of any cannabis product manufacturer must be committed to food safety, so the needed resources to develop and implement a food safety management system are provided. Management commitment creates a culture within the operation that supports, sustains and continuously improves food safety.

Pre-Requisite Programs (PRPs)

Pre-requisite programs are procedures that establish the minimal operations conditions to produce safe and quality products. Pre-requisite programs are the foundation of food safety and must be developed and implemented prior to creating a food safety plan. They keep potential hazards from becoming serious enough to adversely impact the safety of products produced. Pre-requisite programs include but are not limited to:

Document Control
Supplier Verification Programs
Raw Material Receiving (ingredients, processing aids and packaging)
Good Manufacturing Practices (GMPs)
Preventative Maintenance (PM) Program
Calibration Program
Integrated Pest Management (IPM)
Environmental Monitoring Programs (EMPs)
Water Management Programs (WMPs)
Allergen Management Program
Standard Sanitation Operating Procedures (SSOPs)
Standard Operating Procedures (SOPs)
Storage and Transportation Procedures
Crisis Management
Traceability
Recall
Record keeping
Waste Management
Training

Food Safety Plan (FSP)As you can see, food safety planning requires the development and implementation of a lot of programs.

A food safety plan is a documented systematic approach that follows the Codex Alimentarius HACCP Principles to identify, prevent and minimize to an acceptable level or control hazards that may be present in food and that can cause an illness or injure the consumer. The first step in this systematic approach is the formation of a food safety team, which main responsibility is to identify the scope of the food safety plan and to oversee all of the activities associated with the plan (e.g. monitoring, verification, validation, etc.) After the food safety team is formed, the steps outlined below are followed in order (systematically):

Product Description
Product Intended Use
Development of the flow diagram
Verification of the flow diagram
Conduct a Hazard Analysis
Identify Critical Control Points (CCPs) or Preventive Controls
Establish Critical Limits
Monitor Critical Limits
Establish Corrective Actions
Establish Verification Procedures
Establish Record Keeping Procedures

As you can see, food safety planning requires the development and implementation of a lot of programs. Therefore, I highly recommend that you hire a food safety consultant that can guide you through this process.

August 23, 2018

Documentation: Are You Prepared?

By Radojka Barycki

No Comments

Documents play a key role in the world of regulations and global standards. Documents tell a story on programs development, implementation and verification during an inspection or audit. Documents are used as evidence to determine conformance to the law or standard. However, do you know what kind of documents may be reviewed during a regulatory inspection or a food safety audit? Are you prepared to show that the implementation of regulatory requirements or a standard is done efficiently at your facility?

Inspectors and auditors will look for compliance either to regulations or to a standard criterion. Regulations and standards require that documentation is controlled, secured and stored in an area where they cannot deteriorate. Therefore, writing a Document Management Program (DMP) will help a business owner ensure consistency in meeting this and other requirements.Radojka Barycki will host a a plenary session titled, “Cannabis: A Compliance Revolution” at the 2018 Food Safety Consortium | Learn More

A well-developed and implemented DMP provides control over documents by providing a number sequence and revision status to the document. In addition, ownership for development, review and distribution of the documents are assigned to specific individuals within the company to ensure that there are no inconsistencies in the program. Documents must also have the name of the company in addition to a space to write the date when the record is generated. It is recommended to include the address if there are multiple operational sites within the same company.

There are different types of documents that serve as support to the operations:

Program: A written document indicating how a business will execute its activities. When it comes to the food industry, this is a written document that indicates how quality, food safety and business activities are controlled.
Procedures: General actions conducted in a certain order. Standard Operational Procedures (SOPs) allow the employee to know what to do in general. For example, a truck receiving procedure only tells the employee what the expected conditions are when receiving a truck (cleanliness, temperature, etc.) However, it doesn’t tell the employee how to look for the expected conditions at the time of the truck arrival.
Work Instructions: Detailed actions conducted in a certain order. For example, truck inspection work instruction tells the employee what steps are to be followed to perform the inspection.
Forms: Documents used to record activities being performed.
Work Aids: are documents that provide additional information that is important to perform the job and can be used as a quick reference when performing the required activities within the job.

Are you prepared to face document requirements now and in the future?

The inspectors and auditors base their role on the following saying: “Say what you do. Do what you say. Prove it!” The programs say what the company do. The procedures, work instructions and work aids provide information on implementation (Do what you say) and the forms become records that are evidence (prove) that the company is following their own written processes.

Regulatory requirements for cannabis vary from state to state. In general, an inspector may ask a cannabis business to provide the following documentation during an inspection:

Business License(s)
Product Traceability Programs and Documents
Product Testing (Certificate of Analysis – COAs)
Certification Documents (applicable mainly to cannabis testing labs)
Proof of Destruction (if product needs to be destroyed due to non-compliance)
Training Documents (competency evidence)
Security Programs

As different states legalize cannabis, new regulatory requirements are being developed and modeled after the pharma, agriculture and food industries. In addition, standards will be in place that will provide more consistency to industry practices at a global level. The pharma, agriculture and food industries base their operations and product safety in programs such as cGMPs, GAPs, HACCP-based Food Safety Management Systems and Quality Management Systems. Documents required during an inspection or audit are related to:

Good Agricultural Practices (GAPs)
Current Good Manufacturing Practices (cGMPs)
Food Safety Plan Documents
Ingredient and Processing Aids Receiving
Ingredient and Processing Aids Storage
Operational Programs (Product Processing)
Final Product Storage
Final Product Transportation
Defense Program
Traceability Program
Training Program
Document Management Program

In the always evolving cannabis industry, are you prepared to face document requirements now and in the future?

July 17, 2018

Food Safety: Do You Know What Is In Your Water?

By Radojka Barycki

No Comments

Water is essential for life and it is an important part of agriculture and food manufacturing. Water has many uses in the cannabis industry. Among the most common uses are irrigation, ingredient/product processing and cleaning processes.

Water can be the carrier of pathogenic microorganisms and chemicals that can be transferred to food through agriculture and manufacturing practices. Poor quality water may have a negative impact in food processing and potentially on public health. Therefore, development and implementation of risk management plans that ensure the safety of water through the controls of hazardous constituents is essential to maintain the safety of agricultural and manufactured food or cannabis products.

Chemicals can enter the water stream through several sources such as storm water, direct discharge into fields and city water treatment plans.Although there no current regulations regarding the water used in cannabis cultivation and processing, it is highly recommended that the industry uses potable water as standard practice. Potable water is water that is safe for drinking and therefore for use in agriculture and food manufacturing. In the United States, the Environmental Protection Agency (EPA) sets the standards for water systems under the Safe Drinking Water Act (SDWA.)The regulations include the mandatory levels defined as Maximum Contaminant Levels (MCLs) for each contaminant that can be found in water. Federal Drinking Water Standards are organized into six groups: Microorganisms, Disinfectants, Disinfection Byproducts, Inorganic Chemicals, Organic Chemicals and Radionuclides. The agriculture and food manufacturing industry use the SDWA as a standard to determine water potability. Therefore, water testing forms part of their routine programs. Sampling points for water sources are identified, and samples are taken and sent to a reputable laboratory to determine its quality and safety.

Microbiological Testing

Petri dish containing the fungus Aspergillus flavus.
Photo courtesy of USDA ARS & Peggy Greb.

Determining the safety of the water through microbiological testing is very important. Pathogens of concern such as E. coli, Salmonella, Cryptosporidium parvum and Cyclospora sp. can be transmitted to food through water. These pathogens have been known to be lethal to humans, especially when a consumer’s immune system is compromised (e.g. cancer patients, elderly, etc.) If your water source is well, the local state agency may come to your facility and test the water regularly for indicator organisms such as coliforms. If the levels are outside the limit, a warning will be given to your company. If your water source is the city, regular testing at the facility for indicator microorganisms is recommended. In each case, an action plan must be in place if results are unfavorable to ensure that only potable water is used in the operations.

Chemical Testing (Disinfectants, Disinfection Byproducts, Inorganic Chemicals, Organic Chemicals and Radionuclides)

Chemicals can enter the water stream through several sources such as storm water, direct discharge into fields and city water treatment plans. Although, there are several regulations governing the discharge of chemicals into storm water, fields and even into city water treatment plants, it is important that you test your incoming water for these chemicals on a regular basis. In addition, it is important that a risk assessment of your water source is conducted since you may be at a higher risk for certain components that require testing. For example, if your manufacturing facility is near an agricultural area, pesticides may enter the surface water (lakes, streams, and rivers) or the aquifer (ground water) through absorption into the ground or pollution. In this case, you may be at higher risk for Tetrahalomethanes (THMs), which are a byproduct of pesticides. Therefore, you should increase the testing for these components in comparison to other less likely to occur chemicals in this situation. Also, if your agriculture operation is near a nuclear plant, then radionuclides may become a higher risk than any of the other components.

Finally, in addition to the implementation of risk management plans to ensure the safety of water, it is highly recommended that companies working in food manufacturing facilities become familiar with their water source to ensure adequate supply to carry on their operations, which is one of the requirements under the 21 CFR 117. Subpart B – Current Good Manufacturing Practices (cGMPs) for food manufacturers under the Preventive Controls for Human Foods Rule that was enacted under the Food Safety Modernization Act in 2015. Also, adequate supply is part of the Good Agricultural Practices (GAP) The EPA has created a program that allows you to conduct a risk assessment on your water source. This program is called Source Water Protection. It has six steps that are followed to develop a plan that not only protect sourcing but also ensures safety by identifying threats for the water supply. These six steps are:

Delineate the Source Water Protection Area (SWPA): In this step a map of the land area that could contribute pollutants to the water is created. States are required to create these maps, so you should check with local and/or state offices for these.
Inventory known and potential sources of contamination: Operations within the area may contribute contaminants into the water source. States usually delineates these operations in their maps as part of their efforts to ensure public safety. Some examples of operations that may contribute to contaminants into the water are: landfill, mining operations, nuclear plants, residential septic systems, golf courses, etc. When looking at these maps, be sure that you verify the identified sources by conducting your own survey. Some agencies may not have the resources to update the maps on a regular basis.
Determine the susceptibility of the Public Water Source (PWS) to contaminate sources or activities within the SWPA: This is basically a risk assessment. In here you will characterize the risk based on the severity of the threat and the likelihood of the source water contamination. There are risk matrices that are used as tools for this purpose.
Notify the public about threats identified in the contaminant source inventory and what they mean to the PWS: Create a communication plan to make the State and local agencies aware of any findings or accidents in your operation that may lead to contamination of the PWS.
Implement management measures to prevent, reduce or eliminate risks to your water supply: Once risks are characterized, a plan must be developed and implemented to keep risks under control and ensure the safety of your water.
Develop contingency planning strategies that address water supply contamination or service interruption emergencies: OSHA requires you to have an Emergency Preparedness Plan (EPP). This plans outlines what to do in case of an emergency to ensure the safety of the people working in the operation and the continuity of the business. This same approach should be taken when it comes to water supply. The main questions to ask are: a) What would we do if we find out the water has been contaminated? b) What plan is in place to keep the business running while ensure the safety of the products? c) How can we get the operation back up and running on site once the water source is re-stablished?

The main goal of all these programs is having safe water for the operations while keeping continuity of the business in case of water contamination.