Peer Review Article | Open Access | Published >

Use of Hazard Analysis Critical Control Point (HACCP) methodology for biocontamination control: Assessing microbial risks and to determining environmental monitoring locations

Tim Sandle*, Monica Di Mattia** and Clare Leavy***, Bio Products Laboratory, UK | EJPPS | 254 (2020) | Cite this article | Click to download pdf

Back to Journals | Abstract | Introduction | References | Author Information


Quality Risk Management has been an essential feature relating to the manufacture of pharmaceutical and healthcare products for several decades, and its centrality is embedded in key regulatory documents, such as Annex 1 to EU GMP where risk assessment needs to be part of the overall biocontamination control strategy. While the message for constructing pro-active risk assessment sis clear, where the industry lacks direction is with case studies. This paper presents one risk assessment tool, and one which is perhaps best suited to microbiological assessments of pharmaceutical processes and presents a case study for its application. The tool discussed is Hazard Analysis and Critical Control Points (HACCP) and the application is with assessing microbiological risks and then establishing locations for environmental monitoring. The case study is a sterility testing isolator. The paper first discusses what HACCP is and how it can be applied in general, before demonstrating how HACCP can be deployed as a robust tool for constructing or reviewing an environmental monitoring regime.


The concept of Hazard Analysis and Critical Control Points (HACCP) methodology is a system that enables the production of safe products, be they pharmaceuticals or health care products and devices or, as with the origins of HACCP, food. HACCP is an example of a risk assessment tool, and the use of risk assessment, especially proactive risk assessment, is encouraged by regulators as part of Quality Risk Management philosophies (as set out in ICH Q9 among other documents issued by regulators like U.S. FDA and the European Medicines Agency).

The premise of HACCP is that through the thorough analysis of production processes, identification of all hazards that are likely to occur in the production establishment, the identification of critical points in the process at which these hazards may be introduced into product and therefore should be controlled, the establishment of critical limits for control at those points, the verification of these prescribed steps, and the methods by which the pharmaceutical or healthcare establishment and the quality departments can monitor how well process control through the HACCP plan is working (1).

While risk assessment is commonly discussed in relation to pharmaceuticals and healthcare, the adoption of risk tools and the execution of risk assessments is variable in terms of scope and with the quality of the risk assessments conducted. This can be the product of the wrong tool being applied (all too often this is a variant of FMEA – Failure Modes and Effects Analysis) or the wrong team being assembled or a failure to carefully map out the process.

Microbiological risk assessments do not always fit well with FMEA, since the approach does not easily permit the process flow to be mapped. Moreover, FMEA has an over-reliance upon detection and detection is used to mitigate the risk (given that the risk is expressed as numerical outcome – a risk priority number). Certainly, there are cases where detection may limit the implementation of effective risk controls or confuse the objective of the assessment (2). Detection should only be introduced once risks have been adequately controlled; this is especially important with microbiology given the limitations of environmental monitoring methods, as succinctly set out by Sutton (3) where the accuracy, precision, sensitivity, and limits of detection of monitoring methods is uncertain, , the variations with culture media types and incubation conditions, and the phenomenon within the environment of viable but non-culturable microorganisms.

Yet monitoring is still necessary, especially when looking for variations in trends. To aid the microbiologist there remains a dearth of case studies. This paper aims to help, in an incremental way, to fill this gap by demonstrating how HACCP can be used to assess an established environmental monitoring programme and to form part of the overall biocontamination control strategy. In this case, this is a sterility testing facility (a cleanroom containing two isolators). The HACCP approach helps to consider how materials and personnel enter and leave the cleanroom, and how the sterility test is conducted, in terms of risks and then how the appropriate control points (the environmental monitoring locations) are selected. While the case study is focused on a test common to sterile products manufacturing, the general approach will be of interest to those involved with non-sterile pharmaceutical manufacture as well. Of interest to all readers will be the way HACCP identifies priority hazards and allows establishing targeted control systems, thus putting focus mainly on preventive measures rather than on end-product testing.

Prior to presenting the case study, the paper provides a short history of HACCP and discusses the generalized approach for conducting a HACCP.

Short history of HACCP

The HACCP approach was developed during the late 1950s through a collaboration of food scientists and engineers working at three centres: The Pillsbury Company, the Natick Research Laboratories, and the National Aeronautics and Space Administration. The group’s aim was to design a system to assess the risks associated with food intended for the future manned space programme. The aim was to ensure that quality was built into the process at all stages (4, 5).

Later, in 1971, The Pillsbury Company presented the risk-based concept to the National Conference on Food Protection (this was a conference sponsored the Food and Drug Administration (FDA) together with the American Public Health Association). The concept was presented as HACCP, formed of three principles:

  • Identification and assessment of hazards associated with food from farm to fork;

  • Determination of the critical control points to control any identified hazard; and

  • Establishment of a system to monitor the critical control points.

Since then, various changes have been made to the HACCP approach and today, while the underlying philosophy remains the same, there is no ‘universal’ approach, although all HACCPs are founded on similar principles and stepwise approaches.

HACCP became an increasingly common tool for some food manufacturers in the U.S. to deploy when the FDA incorporated the concepts of HACCP into its low acid and acidified food regulations in 1974, which were a response to various incidents of poisoning resulting from Clostridium botulinum contamination in commercially canned food (6).

However, the use of HACCP did not take off widely during the 1970s; it was only following other instances of food contamination during 1980s that a renewed interest in HACCP occurred and the technique was adopted by several large food processing companies. In 1985, the U.S. National Research Council of the National Academy of Sciences published An Evaluation of the Role of Microbiological Criteria for Foods and Food Ingredients (7). This booklet strongly recommended that the food processing industry and governmental agencies use HACCP.

In terms of standardized approaches, in 1989 The U.S. National Advisory Committee on Microbiological Criteria for Foods (NACMCF) published the first HACCP document issued by a government agency (8). This was followed, in the same year, by the International Commission on Microbiological Specifications for Foods (ICMSF) issuing the publication Microorganisms in Foods 4: Application of the Hazard Analysis Critical Control Point (HACCP) System to Ensure Microbiological Safety and Quality (9).

The results of the 1989 are commonly referred to as "The Seven Principles." These principles continue to be used today, and which are: conducting a hazard analysis, determining critical control points (CCP), establishing critical limits, enacting procedures to monitor CCP's, taking corrective action, establishing verification procedures, record keeping and documentation procedures.

HACCP and the pharmaceutical and healthcare sectors: Summary of the literature

During the 1990s and 2000s the use of HACCP became applied, from the food industry, to parts of the pharmaceutical and healthcare sectors, in a similar way to FMEA (which is common to the engineering sector). This was part of the regulatory drive to embed quality into pharmaceutical production (10). It also reflected changes in thinking by pharmaceutical microbiologists. An HACCP programme shifts the focus of controls toward monitoring in-process preventive control measures. At the same time there is a diminished focus on monitoring the quality of the finished product, reflecting the limitations of many of the methods used for end product testing in terms of reliability (the sterility test being a case in point). Moreover, reliance on end-product testing is particularly inefficient and ineffective when a large sample size and high frequency of sampling is needed to provide statistically reliable data. This also tallied with the importance of assessing and preventing risks during processing, rather than simply hoping that the finished product would pass the end-product test.

There are various examples of HACCP’s application, such as assessing patient risks to medication (11); computer systems in GMP environments (12); water generation (13); and medical device manufacture (14). In terms of the application of HACCP to environmental monitoring, there have been few published case studies. A selection of those available, and which may assist the reader in terms of a wider review of the literature, is presented below is descending order:

  • Satyada and Sandle (15) “Rationale for the selection of microbial monitoring locations on personnel working in aseptic processing areas”. The authors use HACCP principles to assess what personnel do when working in aseptic processing areas in order to select environmental monitoring locations on the cleanroom gown.

  • McFarland (16) “Risk-Based Microbial Assessment Tool (R-MAT): A Novel Approach to Assessing Environmental and Critical Utilities Excursions”. The author demonstrates how a HACCP-style approach can assist in both determining the appropriate actions for addressing excursions and assist the organization in developing a proactive means of preventing excursions.

  • Ziegler et al (17): “Revision of Viable Environmental Monitoring in a Development Pilot Plant Based on Quality Risk Assessment: A Case Study”. The authors focused here on assessing the consequence of a high microbial load during the development of pilot plant phase GMP.

  • Sandle (18) “Aseptic Transfer Risk Assessment: A Case Study”. The author looks at the specific risks associated with transferring items between different grades of cleanrooms.

  • Sandle (19) “Current Methods and Approaches for Viral Clearance”. The author presents a case study of how HACCP can be used to eliminate viral risks from a pharmaceutical process.

  • Annalaura et al (20) “The application of quality risk management to the bacterial endotoxins test: use of hazard analysis and critical control points.” The authors show how HACCP can be used to manage an analytical process (the LAL test) and propose how to conduct the necessary steps to assess test problems.

  • Sandle (21) “Risk assessment and monitoring of cleanrooms”. The author looks at how the process mapping approach in HACCP can assist with the selecting of environmental monitoring locations

  • Sandle (22) “Application of Quality Risk Management To Set Viable Environmental Monitoring Frequencies in Biotechnology Processing and Support Areas”. The author uses HACCP-based risk assessment and risk filtering to determine appropriate frequencies for environmental monitoring

  • Singer (23) “A Strategy for Developing Robust Pharmaceutical Microbiological Control”. The author makes reference to the use of HACCP for environmental monitoring, although no specific examples are given.

  • Sandle (24) “Risk Management in Pharmaceutical Microbiology”. The author looks at the use of HACCP to create process flows and to detect suitable monitoring sample types and locations.

  • Bissett (25) “Developing decontamination strategies and monitoring tools”. The author examines decontamination from hand hygiene to sterilization of instruments and discuss how HACCP can be used to monitor and record practice, ensuring that consistent standards are achieved.

  • Sutton (3) “The Environmental Monitoring Programme In a GMP Environment”. The author discusses HACCP style approaches to orientating environmental monitoring locations to the points of greatest risk.

  • Bonan et al (26) “The application of hazard analysis and critical control points and risk management in the preparation of anti-cancer drugs”. The authors apply HACCP to the preparation of anti-cancer drugs, with the intention of identifying critical control points in the cancer chemotherapy process and to propose control measures and corrective actions to manage these processes.

  • Ashtekar (27) “Microbiological Risk Analysis”. This is an example of one of the best book chapters on the HACCP subject and its practical application to environmental monitoring.

  • Jahnke and Kuehn (14) “Use of the Hazard Analysis and Critical Control Points (HACCP) risk assessment on a medical device for parenteral application”. This builds on Janke’s 1997 paper, applying HACCP to a different pharmaceutical process.

  • Whyte and Eaton (28) “A cleanroom contamination control system”. The authors applying a modification of HACCP to aseptic processing, focusing on contamination transfer metrics.

  • Jahnke (29) “Use of the HACCP concept for the risk analysis of pharmaceutical manufacturing process.” This was one of the earliest examples of HACCP to provide an overview of a pharmaceutical production process, to determine monitoring points, with a particular focus on quality assurance of hygiene and other parameters influencing the quality of the product.

  • Isoard et al (30) “Biocontamination, European standardization and pharmaceutical industry.” The authors, in one of the first uses of HACCP for pharmaceuticals, look at using HACCP to identify biocontamination risks within a pharmaceutical processing area.

This paper, through the presentation of a new case study, helps add to the available literature on the application of HACCP for pharmaceuticals and healthcare in relation to microbiological monitoring

Generalized HACCP methodology

The objective of HACCP is main aim is to prevent known hazards and to reduce the risks that they will cause at specific points in the product. Hazards are classified as biological, chemical, or physical agents or operations that might cause illness or injury if not controlled (the focus in this paper is with the biological). It is useful to pause here and define the basic elements of ‘HACCP’:

Hazard: Any circumstance in the production, control and distribution of a pharmaceutical which can cause an adverse health effect.

Hazard Analysis: The process of collecting and evaluating information on hazards which should be addressed in the HACCP plan.

Critical Control Point (CCP): A step at which control can be applied and is essential to prevent or eliminate a pharmaceutical quality hazard or reduce it to an acceptable level

In context of this paper, HACCP is about examining microbial contamination and pinpointing the ways by which microbial contamination can be introduced or perpetuated throughout the process. A separate HACCP will be required for each room or process (where more than one room may be combined), this is because microbial hazards will be specific to each room of the facility and different microbial hazards will arise in relation to each step of the process being evaluated.

There are slight variations on how HACCP is implemented. A general approach to HACCP (based on the Canadian Food Inspection Agency) is (31):

Preliminary tasks:

a. Assemble HACCP team: When using HACCP analysis to determine the sampling locations in an environmental monitoring programme, a thorough knowledge of the process and area is required. For a HACCP team to work effectively, all team members need to understand the application of HACCP principles. For best results, the whole team should be trained using a practical training intervention that covers both theory and application of HACCP.

b. Describe the final product (or process stage of concern): A full description of the product and the process should be drawn up, including relevant quality information such as the composition, physical/chemical properties, temperatures, method of cleaning, process steps and so on.

c. Identify the products intended use,

d. Construct the process flow diagram: a flow chart provides a clear and simple visual representation of involved steps. A chart also facilitates understanding, explaining and systematically analysing complex processes/designs and associated risks.

e. Verify the flow diagram.

Implement the seven principles of HACCP:

  • Implement principle 1. Conduct a hazard analysis, focusing on microbial contamination risks. This is on viable organisms (bacteria and fungi) and their metabolic by-products, as applicable (such as endotoxin hazards in relation to pharmaceutical water systems). Contamination will be a risk in the air, in terms of dispersal, and on surfaces, especially when one object is transferred to another or where a person transfers contamination through touching.

Examples of things to look for include:

1. Personnel flow patterns, especially high traffic areas; changing rooms; airlocks and barriers between cleanrooms of different grades; points where transfer of people or materials happens; and proximity of personnel to critical activities, such as exposed product.

For example, areas adjacent to the cleanroom are likely to be more contaminated than the production cleanroom; the material airlock and personnel change areas will inevitably be contaminated by the activities going on in these areas and the contamination in the outside corridors and service areas may not be as well controlled.

2. Material, equipment, and product flow patterns.

Equipment represent another source. Machines can generate contamination by the movement of their constituent parts or they can function as secondary sources of contamination, from contaminants deposited on them from personnel.

3. Use of a given cleanroom, including processes that are conducted in the room and points of product exposure and transfer.

4. Frequency of cleaning and disinfection.

5. Presence of difficult to clean or disinfect surfaces.

6. Storage of supplies

7. Presence of drains and water sources in a room.

Assess the importance of these sources and if they are / are not hazards that need to be controlled. Examples include:

a) The amount of contamination on, or in, the source that is available for transfer.

b) Ease by which the contamination is dispersed or transferred.

c) The proximity of the source to the critical point where the product is exposed.

d) How easily the contamination can pass through the control method.

· Apply principle 2. Identify the Critical Control Points (CCPs).

A Critical Control Point (CCP) is a point where control can be applied and is assessed as being essential to prevent or eliminate a hazard or, alternatively, to reduce the hazard to an acceptable level. Here it is important to assess if there are sufficient controls in place to prevent (or reduce the likelihood) of the hazard from occurring.

This falls under the area of risk control, which is a decision-making activity designed to reduce and/or accept risks. The fundamental level its purpose is to reduce the risk to an acceptable level. During risk control activities the following key questions should be asked:

  • What can be done to reduce or eliminate risks?

  • What is the appropriate balance among benefits, risks and resources?

  • Are new risks introduced as a result of the identified risks being controlled?

CCPs represent points in a process where controls should be measured and monitored to ensure risk is not realized. That is, they are invariably the suitable points where environmental monitoring should take place. A point that does not require environmental monitoring is commonly referred to as a ‘control point’ as opposed to a ‘critical control point’. The differences here can be assessed using a decision tree, if required. For example, see figure 1 below:

In assessing a CCP, the following can be useful (Whyte and Eaton, 2002):

1. The amount of microbial contamination on, or in, the source in its uncontrolled state and available for transfer (by air or through contact);

2. The ease by which the contamination is dispersed or transferred;

3. The proximity of the source to the critical point where the product is exposed, or important operation is to be performed (like an aseptic activity);

4. How well the contamination is controlled.

· Employ principle 3. Establish critical limits.

Limits are either based on regulatory action levels or calculated based on a review of historical data.

· Implement principle 4. Establish CCP monitoring procedures.

This principle is about selecting appropriate methods for monitoring. It is also about the environmental monitoring programme as a whole. The programme should be sufficiently robust to detect loss of control at the CCP. For this assessment, the use of trend analysis is important. The frequency of environmental monitoring will vary based on system capabilities and criticality of the control, and hence it may need to be adjusted depending on data patterns. There are other risk tools available to help assess monitoring frequencies.

· Organize principle 5. Establish corrective action.

Specific corrective actions should be developed for each CCP in the environmental monitoring system in order to handle out-of-limits results, or upward trends, from monitoring limits if and when they occur.

· Institute principle 6. Establish verification procedures.

This means reviewing the HACCP regularly to see if it remains fit for purpose. The effectiveness of the environmental monitoring programme should be monitored by trending of resultant data and reassessment of hazards when necessary.

· Principle 7. Establish record keeping procedures.

This means having an SOP in place together with a data capture system, to assess the environmental monitoring data.

Sometimes an eighth principle is added, which is to ensure that personnel are trained and are cognizant in relation to the identified hazards.

Advantages and disadvantages of HACCP