Part II Appendices4.11.5The cleanliness of equipment shall be checked before equipment is released back
4.11.7 Cleaning in place (CIP) Interpretation
Part II Appendic es
Additionally, the system may be fully automated or semi-automated.
CIP equipment is specialist, and therefore operator training is important. See section 7.1 for information on training.
Clause Requirements
4.11.7.1 All CIP equipment shall be designed and constructed to ensure effective operation. This shall include:
• validation confirming the correct design and operation of the system
• an up-to-date schematic diagram of the layout of the CIP system
• where rinse solutions are recovered and re-used, an assessment of the risk of cross- contamination (e.g. due to the re-introduction of an allergen or the existence of different production risk zones within the site).
Alterations or additions to the CIP system shall be authorised by a suitably competent individual before changes are made. A record of changes shall be maintained.
The system shall be revalidated at a frequency based on risk, and following any alteration or addition.
Interpretation Effective operation, maintenance and validation of CIP systems
Effective CIP starts with the design (e.g. designed by an approved equipment supplier – see section 4.6 for information regarding new equipment) and set-up of the system. The site will therefore need validation to confirm that the design, set-up and proposed operation of the system are suitable for the intended use. For example:
• knowledge of the layout of the pipework and the position of valves, spray balls and holding tanks is essential to ensure that the system will operate consistently and
effectively and that there are no dead spots or areas where cross-contamination between cleaning chemicals and product can occur
• correct design of the CIP system to ensure good coverage of cleaning solutions with suitable drainage to avoid pools of solutions; for example, the prevention of shadows caused by baffles or spray balls that have been incorrectly located
• assurance that the intended cleaning will be effective (e.g. that the food/products intended to be used on the equipment will be effectively removed during cleaning)
• consideration of the risk of potential contaminants (e.g. allergens) from previous products being re-introduced onto the equipment during the collection, recycling or re-use of solutions (e.g. rinse solutions). Where rinse solutions are recovered and re-used, there should be a specific risk assessment to prevent cross-contamination; for example, due to allergens or the existence of different production risk zones in the site. See clause 8.5.4 for the specific requirements for CIP systems operating in multiple production risk zones (e.g. high-risk and high-care areas). Confirmation of the correct design and set-up may be achieved by an inspection report (e.g. from the equipment manufacturer) or by separate documented validation.
A schematic plan or diagram should be provided by the supplier when the system is installed and must be updated whenever a change is made, including to software, equipment and operation of the system.
Part II Appendic es
Interpretation
continued Issues are most likely to occur where CIP systems are modified or extended. Therefore, controls must be in place to ensure that all changes (e.g. engineering modifications, changes to the programming or operation of the system, and changes to consumables such as the detergents used) are made only by a suitably trained and competent individual. This could be achieved by, for example:
• having a company policy that permits modifications only by the manufacturer of the equipment
• training engineering staff
• password-protecting the system with different levels of access to prevent unauthorised modifications to programme parameters or software.
Records of changes must be maintained.
The site should use risk assessment to determine suitable intervals for revalidation of the CIP system to ensure its continuing effectiveness. The CIP system will also require revalidation following any alterations or additions to ensure it continues to operate as expected.
4.11.7.2 Limits of acceptable and unacceptable performance for key process parameters shall be defined to ensure the removal of target hazards (e.g. soil, allergens, micro-organisms, spores).
At a minimum these parameters shall include:
• times for each stage
• detergent concentrations
• flow rate and pressure
• temperatures.
These shall be validated and records of the validation maintained.
Interpretation Operation of CIP equipment
The CIP process parameters and tolerances must be identified and limits of acceptable and unacceptable performance set, e.g. detergent concentrations and limits on permitted carry-over into post-rinse solutions. The actual values of acceptable and unacceptable performance will depend on the target hazards that the CIP cleaning is intended to remove and this in turn will depend on the product types being processed. Specific hazards may include, for example, soil, allergens and/or vegetative micro-organisms.
The Standard identifies minimum key parameters that need to be defined, and their limits must be validated to confirm effective removal of the identified hazards.
4.11.7.3 The CIP equipment shall be maintained by suitably trained staff to ensure effective cleaning is carried out. This shall include:
• routine checking of detergent concentrations
• monitoring of recovered post-rinse solutions for build-up of carry-over from the detergent tanks
• cleaning and inspection of filters, where fitted, at a defined frequency
• storing flexible hoses (where used) hygienically when not in use, and inspecting them at a defined frequency to ensure that they are in good condition.
Interpretation Maintenance of the CIP system
A planned maintenance programme must be in place to ensure all aspects of the CIP system are in good working order. At a minimum, this should include:
• monitoring detergent concentrations and post-rinse solutions
• inspection, cleaning and storage of filters and flexible hoses where they are part of the CIP system.
The frequency of maintaining the different aspects of the programme should be based on risk. For example, good practice normally includes ensuring detergent tanks are drained, cleaned and filled, with a log of these activities to confirm that they have been completed to schedule.
Monitoring and inspection may be undertaken by trained site staff (e.g. engineers) or carried out as part of a service agreement with the supplier or with the service company maintaining the system. A report of the inspection (that includes an overview of the scope of the
inspection, any recommendations for improvement, and confirmation or otherwise of the effectiveness of the system) should be kept.
4.11.7.4 CIP facilities, where used, shall be monitored at a defined frequency based on risk. This may include:
• monitoring of process parameters defined in clause 4.11.7.2
• ensuring correct connections, piping and settings are in place
• confirming the process is operating correctly (e.g. valves are opening/closing sequentially, spray balls are operating correctly)
• ensuring effective completion of the cleaning cycle
• monitoring for effective results, including draining where required.
Procedures shall define the action to be taken if monitoring indicates that processing is outside the defined limits.
Interpretation Monitoring of CIP
To ensure the ongoing effectiveness of the CIP system, it is important to routinely monitor the operation of the system at a predefined frequency. This will include checks of connections, piping and settings prior to starting the cleaning process and a post-cleaning confirmation of effective cleaning.
The frequency of monitoring should be based on risk and outlined in the procedures. This will include the actions necessary if monitoring indicates a result is outside of the defined limits. (Further details on corrective action procedures are in section 3.7).
Part II Appendic es
Risk-based environmental monitoring programmes shall be in place for relevant pathogens or spoilage organisms.
At a minimum, these shall include all production areas with open and/or ready-to-eat products.
Interpretation
The aim of the environmental monitoring programme is to develop a proactive, preventive monitoring programme that will identify and eliminate sources of environmental micro-organisms (e.g. pathogens and spoilage organisms) in production and open product areas of the site, and facilitate timely and effective corrective action in the event of a risk being identified (i.e. prevent the environmental micro-organisms from becoming the source of product contamination which could lead to non-conforming product, a customer complaint or other incidents).
An effective programme can, for example, be used to:
• confirm the effectiveness of cleaning and hygiene activities and identify any areas that require further activity
• prevent product contamination by acting as an ‘early warning’ – identifying potential contamination from the site facilities before they affect products.
The design and structure of this programme will depend on the nature of the products being handled and the potential hazards associated with them.
The requirements are expected to apply to all sites with:
• open product areas
• ready-to-eat products
• products that are both processed in open product areas and ready-to-eat.
Sites are not expected to ‘opt out’ of this requirement by determining that they have a low-risk product or environment; completion of a risk assessment (clause 4.11.8.1) should only be used to identify relevant hazards, suitable monitoring techniques and appropriate monitoring frequencies.
There are, however, a small number of products which are inherently safe from these contaminants (e.g. because the product’s intrinsic properties do not support the growth or survival of pathogens or spoilage organisms) and there is no opportunity for spoilage/pathogen contamination, and therefore an environmental monitoring programme may not be required. Where a site believes that this is not required, this belief must have a strong foundation in science and not be used to prevent good practices. Therefore it is expected that:
• all sites with high-risk, high-care or ambient high-care operations will have an environmental monitoring programme within the relevant open product areas
• environmental monitoring will be applicable to other products, as there have been a number of very high-profile food poisoning outbreaks associated with products not conventionally considered as high risk or high care (for example, cantaloupe melons, peanut butter, chocolate and milk powder), where environmental monitoring may have been effective in identifying an issue early. Similarly, shelf-life issues such as mould contamination of bakery products may be reduced by suitable monitoring.
Where a site believes environmental monitoring is not required due to the absence of risk from pathogens and spoilage organisms, the site must prove this absence of risk. As a minimum, the site will have a robust risk assessment which considers:
• both spoilage organisms and pathogens
• the complete product range at the site.
source demonstrating that pathogens cannot survive or grow.
Examples of products where risk assessment may establish that environmental monitoring is not required include:
• alcoholic beverages and vinegars with a sufficiently high level of alcohol or acid to prevent survival and growth
• salt and sugar in their dry ‘pure’ form
• edible oils with no added ingredients
• fully enclosed production. For example, at a specialist HPP (high-pressure processing) facility, where product is received packed, is processed in its packaging and leaves the site in the same packaging
• whole vegetables, sold unwashed.
Auditors will challenge the basis of any risk assessment to make sure this has properly considered likely issues and is demonstrably based on robust science.
The requirements for environmental monitoring indicate that the site’s environmental monitoring programme must be risk-based, therefore the food safety plan/HACCP may indicate risks that should be monitored. Risks may include pathogens and/or spoilage organisms (such as yeasts or moulds), and the site should consider whether it is more suitable to monitor the risk directly or via indicator organisms. Well-known examples of pathogens and spoilage organisms that may be applicable to a site’s environmental monitoring include:
• Listeria monocytogenes in ready-to-eat products, including those which are chilled and frozen. Alternatively, some sites monitor Listeria spp. and only examine the species if adverse positive results are obtained
• Salmonella and/or Enterobacteriaceae in dry environments where susceptible products are handled
• yeasts and/or moulds: these are widespread spoilage organisms which may be of greater relevance for some product types. For example, products such as jam are heated to a temperature that will kill many bacterial contaminants, are hot-filled, and have a low water activity and low oxygen content. Consequently, the risk of pathogen growth is limited. However, there are yeasts and moulds that can cause spoilage in these conditions, and therefore manufacturers must ensure that packaging, food contact surfaces and the environment are monitored to minimise the risk of contamination.
Clause Requirements
4.11.8.1 The design of the environmental monitoring programme shall be based on risk, and at a minimum include:
• sampling procedures
• identification of sample locations
• frequency of tests
• target organism(s) (e.g. pathogens, spoilage organisms and/or indicator organisms)
• test methods (e.g. settle plates, rapid testing and swabs)
• recording and evaluation of results.
The programme and its associated procedures shall be documented.
Interpretation Risk-based environmental monitoring programme
The programme must be based on risk assessment. At a minimum this will include:
• a sampling procedure. It is important to ensure that the sampling method does not inadvertently create false positives (e.g. by allowing post-sampling contamination or growth of organisms) or false negatives (e.g. by killing organisms in the sample before the test is completed). Sampling must be appropriate for the target organisms, test
Part II Appendic es
Interpretation
continued methods and locations sampled; techniques may include swabs, air sampling, water/liquid samples etc. The timing and intended purpose of the sampling are also important; for example, cleaning validation, or monitoring of the spread of an organism from a potential harbourage area
• identification of suitable test locations, taking into account:
• significance of the area or equipment in terms of the potential to affect food safety; for example, food contact surfaces, non-food contact areas which are in close proximity to open products, and non-food contact areas some distance away from open products (e.g.
floors, walls and drains)
• areas or parts of equipment that are difficult to clean and could harbour pathogens
• areas of the site or equipment which previously tested positive
• areas where scientific literature has identified a specific risk (e.g. drains)
• frequency of tests, taking into account:
• products that support the growth of pathogens. These require a greater frequency of testing than those that do not support growth
• locations with previous positive results or an upward trend towards an action level (clause 4.11.8.2). These are likely to require increased testing to confirm the effectiveness of the action taken
• target organisms. These may include specific pathogens that present a risk to the product or environment (e.g. Listeria spp in wet environments or Enterobacteriaceae in dry environments), specific spoilage organisms (e.g. yeast or mould) or hygiene indicator organisms (e.g. total plate count, total coliforms)
• test methods. Rapid on-site and laboratory tests are available, and sites should consider the requirements of section 5.6 when deciding which methods and/or laboratories to use. Where knowledge is not available on site, the site may need to obtain guidance; for example, from an accredited laboratory
• recording and evaluation of results. The significance of the results and any actions required must be considered (clause 4.11.8.2)
• reviews of any legal requirements in the country or region (e.g. relating to types of products, organisms of concern, or frequency or minimum number of tests). The auditor will expect to see the risk assessment and the subsequent plan along with testing protocols, procedures and evidence that the site is completing the plan to schedule.
A number of organisations have published guidelines for the development of environmental monitoring programmes, including, for example, the Codex Alimentarius ‘Guidelines on the application of general principles of food hygiene to the control of Listeria monocytogenes in foods’ (CXG 61-2007) – Annex 1.
4.11.8.2 Appropriate control or action limits shall be defined for the environmental monitoring programme.
The company shall document the corrective action to be taken when monitored results indicate a failure to meet a control limit, or when monitored results indicate an upward trend of positive results (i.e. a trend towards a control or action limit).
Interpretation Control or action limits
The site will need to establish appropriate control or action limits and the actions to be taken if these are exceeded or when there is a trend towards increasingly positive results.
The control limits and actions may be based on:
Interpretation
continued • the organism measured, its level and the location of the positive result
• when the testing was completed (e.g. was the sample taken pre- or post-cleaning?)
• any legal or customer limits.
In addition, many sites have found it useful to:
• identify a warning limit (i.e. a limit at a level which is not an exceedance of an action or critical limit, but which allows investigation prior to any exceedance occurring)
• use root cause analysis to establish preventive action (e.g. in the case of recurrence of pathogens at a set location).
4.11.8.3 The company shall review the environmental monitoring programme at least annually and whenever there are:
• changes in processing conditions, process flow or equipment which could impact the environmental monitoring programme
• new developments in scientific information (e.g. new pathogens of concern)
• failures of the programme to identify a significant issue (e.g. regulatory authority tests identifying positive results which the site programme did not)
• product failures (products with positive tests)
• consistently negative results (e.g. a site with a long history of negative results should review its programme to consider whether the correct parts of the factory are being tested, whether the testing is being conducted correctly, whether the tests are for the appropriate organisms, etc.).
Interpretation Review of the environmental monitoring programme
The review of the programme could be accomplished as part of the HACCP review or as a separate review process. The Standard lists several points which might prompt a review, including:
• changes in processing, as these could, for example, affect the ease of cleaning or susceptibility of products to contamination and therefore impact the environmental monitoring programme. For example, any changes to the cleaning procedures, including changes in cleaning frequency, cleaning chemicals or cleaning equipment used, may impact the cleanliness of equipment and facilities, and should therefore be considered as part of a review of the environmental monitoring procedures
• publication of new scientific information, such as the identification of a micro-organism not previously associated with a specific product type, information relating to the survival of a pathogen in specific environmental conditions, or any new information on new and emerging pathogens
• when independent testing (e.g. by a regulatory authority) identifies positives not previously identified by the site’s own tests
• when a positive test on a product implicates the effectiveness of the environmental monitoring programme; note that not all product failures indicate a failure in the effectiveness of the programme, but the site’s root cause analysis and corrective action (see section 3.7) should identify those where the environmental monitoring programme should be reviewed.
Part II Appendic es
Interpretation
continued • In most situations, negative results are seen as good news and lead to an assumption that all systems are operating correctly and within permitted parameters. However, if results are continuously and consistently negative and there is a long history of negative results, this may be indicative that the site should review its programme to consider whether the correct locations are being tested, in the correct way, for the correct organisms. The aim of the programme is, after all, to identify areas of concern.