Use of Hazard Analysis and Critical Control Points (HACCP) – Part 2: Determining Environmental Monitoring Locations


In the first part of a review of HACCP methodology (“Use of Hazard Analysis and Critical Control Points (HACCP) - Part 1: Assessing microbiological risks”) the application of HACCP as a tool for conducting microbiological risks assessments was discussed. This piece considered the approach taken to HACCP and the primary areas of microbiological concern to which the qualitative risk tool can be applied to.

This second example offers a case study of how HACCP can be applied to a practical setting: the identification of environmental monitoring locations, by considering, in the HACCP lexicon, monitoring locations as ‘critical control points’.

The selection of appropriate locations for environmental monitoring is a key aspect of any robust environmental monitoring program. If the locations are not in meaningful locations, the strength of the program is undermined. By ‘meaningful locations’ this means locations that reveal, through the data collected, an indication of potential product contamination. Contamination can arise through airborne deposition or by direct transfer, which signals the need for selecting locations that indicate this likelihood and the use of appropriate sampling methods to detect both airborne risks and surface risks (either fixed surfaces, on equipment, or on people). The HACCP approach provides a useful framework for such an assessment.

Applying HACCP to Environmental Monitoring

This article has made several references to microbial contamination, cleanrooms and environmental monitoring; this section looks in more detail as to how HACCP can be incorporated into the monitoring regime. The main focus is with location selection, which is based on the principles discussed earlier: assessing where contamination is likely to occur; how much contamination there is likely to be; and how easily this might be transferred into the product (31).

HACCP can be applied in this fashion by following a five-step process:

  • Planning;
  • Application of HACCP;
  • Running a baseline study;
  • Evaluating the environmental monitoring program;
  • Running the environmental monitoring program routinely.

Each of these stages is examined next:


Planning out the monitoring program is of importance. This should begin with a definition of the manufacturing process, including the start and end-point of the process. The product should also be described, together with its ingredients, pH and so on (with non-sterile products this can help when assessing the risk of microbial survival or pass-through to the next process stage, should microorganisms be transferred in). This task is made easier by breaking the process down into stages and examining each stage. Alternatively where processing takes place through a series of rooms, the process can be examined on a room-by-room basis (which is useful for producing environmental monitoring sampling plans).

Following this it should be decided what the environmental monitoring will ideally look like when executed. This feeds into considering the monitoring methods available and which will be used (such as air monitoring methods: settle plates, active air samplers, standard particle counters and biologic particle counters; surface methods: swabs and contact plates; and personnel monitoring, if required; to this can be added in-process material testing using viable count techniques, although this falls outside the scope of this article). Also part of planning is consideration of the timeline and the resources required: when will sampling be performed and by whom?

Application of HACCP

With applying the HACCP, the key steps are:

  1. Risk assessing the process to define each of the potential risks to environmental control. These could include, for example (32):

a. Areas adjacent to the cleanroom – these will contain a greater bioburden that the cleanroom itself.

b. Unfiltered air supply.

c. Cleanroom air – especially ease and pattern of airborne dispersal (33).

d. Surfaces – floors, walls, ceilings.

e. Personnel and cleanroom clothing, such as masks, gloves and gowns.

f. Machines.

g. Ancillary equipment.

h. Materials.

i. Containers.

j. Packaging.

Consideration needs to be given to dispersal mechanisms, such as airborne dispersal and contamination transfer, such as by tools or by people (34).

2. Assigning monitoring locations based on areas of highest risk.

3. Establishing the frequency at which monitoring will take place.

4. Reviewing the HACCP at a suitable frequency to assess whether it is still appropriate, e.g. have any changes to processing occurred that require an update?

With a pharmaceutical manufacturing facility, there will be a series of process steps. A process flow diagram should be constructed. This can begin with an overview diagram, as with figure 5, which uses an example of a tableting facility:




Figure 5: Example of an overview of a non-sterile tablet manufacturing process, for HACCP development. 

This can be then be broken down into a series of smaller diagrams, such as on a room by room basis. It is important that these diagrams and maps are accurate and regularly reviewed. With the smaller diagram things to establish include:

  • What happens in the room?
  • How does equipment enter the room?
  • How does equipment leave the room?
  • What path does equipment take?
  • What path does product take?
  • How does material enter the room?
  • How does waste leave the room?
  • Is product ever exposed?
  • Is anything stored in the room?
  • Is there a water source in the room?
  • Is the room a cold room, ambient or warm room?
  • How do personnel enter the room?
  • Do personnel enter and exit by the same rout or a different route?
  • What is the normal occupancy level in the room?
  • Where do personnel tend to congregate (e.g. near a desk or a control panel?)
  • How and when do cleaning personnel enter the room?
  • How long does the process run for?
  • Is any type of equipment likely to generate particles?
  • Does water ever end up on the floor?
  • Does the room contain a drain?
  • Does the room have a safety shower?
  • What is the frequency of cleaning and disinfection? (plus the effectiveness of these processes) (35)
  • Does the room contain difficult to clean areas? (such as small spaces, piping, conduits?)
  • Are there any airflow or air pattern concerns with the room, or areas that might accumulate contamination?

Each of these factors can help to identify the easily contaminated locations to make sure the obtained results really represent the state of the whole room and, where contamination transfer is a possibility, to help to determine appropriate sample monitoring locations (36). Contamination transfer is largely by air or by direct contact, as per Figure 6. 




Figure 6: Some contamination sources and routes of contamination (some of the items listed have been adapted from Sutton (37) and Sandle (38).

This is a dynamic process, understanding each step that occurs in a given room. The direction that each activity takes is of importance in order to understand the path (cleanest to dirtiest or dirtiest to cleanest); for instance, equipment coming into the room will be clean and equipment leaving the room will be dirty.

With people contamination can be spread through airborne deposition or by touching. Here high traffic areas like to be subject to microbial shedding. An area of concern will be with touch points (i.e., vectors of contamination, plus where there is both high traffic and potential personnel touching in close proximity to where product may be exposed.

When asking questions, other tools can help such as the Structured What-If Technique (SWIFT). This approach analyzes processes as a sequential series of acts and a structured brainstorming method along with guide words and prompts to identify risks (39).

For each of the above, an understanding of the control measures is also required. For example, with the question relating to equipment generated particles control measures may include room HEPA (high efficiency particulate air) or localized HEPA filtration; or running equipment when there is no open processing in place. The strength of the control measure will help to determine whether or not monitoring is required and, if monitoring is required, the relative criticality of that location.


To answer the various questions a grid can be constructed, as per Table 3, or there are electronic software packages that perform a similar function.


Room number:____________________

Product processed:_________________

Staff occupancy:__________________


Process step


Severity of hazard

Likelihood or hazard


Preventative measures for the hazard?


Does the step reduce the likelihood of the hazard to an acceptable level?


Could microbial contamination with the hazard exceed acceptable levels?


Will a subsequent process step eliminate the hazard or reduce it to an acceptable level?



Monitoring required (a CCP)





Yes / No


If No:

Yes / No


If No, go to ‘3’

Yes / No


If No, no further action (not a CCP)

If Yes, go to ‘4’

Yes / No


If Yes, no further action (not a CCP)

If No, go to ‘4’

Select appropriate monitoring method: air, surface, personnel





Is control necessary?

Yes / No

If No, no further action (not a CCP)

If Yes go to ‘2’






Table 3: Process step review and CCP assigning


Table 3 is a modification of figure 3 (above).


Once a need for monitoring (or a CCP) has been established, a second table can be used (Table 4) to evaluate what is required:


Process step and CCP identifier Monitoring limit (CFU or particle count) Monitoring method Location for monitoring Responsibility for monitoring Frequency of monitoring






Table 4: CCP breakdown


The use of a third table (Table 5) can help to establish what should happen should the monitoring location see an excursion or be part of an upward trend:


Process step and CCP identifier Risk to room Risk to product Identification of the excursion Control measures to address excursion Additional monitoring Measures to prevent reoccurrence





Table 5: CCP risk assessment and risk review 


Where critical control points are identified, these represent points in a process where controls should be measured and monitored, to ensure risk is not realized. This is an important point since both risk control and monitoring should be considered at each identified ‘critical control point.’


Limits, in this case microbial and particulate, should be set for each critical control point. The limit is the criterion that separates acceptability from unacceptability (e.g. target ranges or alert/action levels) for the control. Moreover, critical limits provide a framework beyond which the process step may be considered out of control.


Once each of the critical control points has been identified, agreed and a limit set, monitoring should commence. Monitoring becomes the activity of conducting a planned sequence of samples, and subsequent measurements, of the control parameters to assess whether a critical control point is under control.


This part of the process also leads to consideration of appropriate corrective actions to take, should samples at a critical control point be out of limits. While the actual response will vary according to the facility, corrective actions should consider:


Notification plan and requirement to initiate a deviation (if necessary).

Isolation and disposition of affected product (if necessary).

Determination and correction of the root cause.

A mechanism to bring the process back under control (such as increased cleaning, change of disinfectant etc.).

A mechanism to document the activities performed.


Baseline study


A baseline study is useful for assessing the types of microorganisms and range of counts before an environmental monitoring program is full evaluated (40). Such data can be used to go back and reassess the HACCP if necessary. Data can also inform as to the effectiveness of cleaning and disinfection, although this is not a substitute for a cleaning and disinfection field trial. 


The baseline study can provide cues in relation to the frequency of monitoring (assuming this is not already dictated by a GMP regulation). The frequency of monitoring will typically vary based on system capabilities (that is how often excursions are likely to occur or that there is a control breakdown) and criticality of the control (the relative risk to the product should an excursion occur).


Evaluating the program


Prior to adopting the ‘routine’ monitoring program, the effectiveness of environmental controls and the locations for detection can be assessed through an intensive evaluation, such as over ten days. This enables the user to assess whether the locations are suitable and whether the primary risk have been covered. This should form part of a documented verification process.



Routine environmental monitoring


The final stage is to run the ‘routine’ monitoring program according to a fixed schedule. Here individual sample excursions can be assessed by referring back to the original HACCP to help assess the risk. Although individual results can signal a risk aspects, more meaningful information is provided through trend analysis. Periodically, such as once per year, the trends can be used as part of the evaluation of the overall HACCP. In addition to this, the process should be reviewed to see if it continues to match the original HACCP and modifications made as necessary.




Risk assessment is very much part of pharmaceuticals and healthcare, with quality risk management embedded into ICH guidelines. Too often risk assessment is used retrospectively in response to a deviation. By applying more risk assessments prospectively, deviations are less likely to occur and, when they do, the impact will be better understood. Establishing a sound environmental monitoring program is one such example of applying risk assessment proactively (as illustrated here with sample site selection using HACCP).


A further benefit of HACCP is the collaborative process, which helps direct monitoring towards the most meaningful locations. The HACCP process involves teams drawn from different functions within the organization, thus allowing knowledge and resources to pooled. The general methodologies of HACCP are also similar to the principles used in qualification and validation, and the critical control points, are often the same as critical process parameters. This allows for several synergies with other aspects of pharmaceutical quality systems.


There are, nonetheless, some limitations with HACCP in that HACCP is also less useful for complex processes and it is less useful if the process is not well known (it assumes that users know their processes, rather than directing them to learn the processes as the HACCP is mapped out). These limitations aside, HACCP is a useful technique.


In terms of how useful HACCP can be this article has outlined environmental monitoring related applications, such as using HACCP to help determine monitoring locations. Through the examples provided, the application of HACCP can help to provide clarity to, and strength, to both new and established environmental monitoring programs. 




1. Sutton, S. (2010) The Environmental Monitoring Program In a GMP Environment," JGXP Compliance. 14(3):22-30

2. Sandle, T. (2016) Risk Assessment and Management for Healthcare Manufacturing: Practical Tips and Case Studies, PDA / DHI, Bethesda, MD, USA

3. Sandle, T. (2003) The use of a risk assessment in the pharmaceutical industry – the application of FMEA to a sterility testing isolator: a case study, European Journal of Parenteral and Pharmaceutical Sciences, 8(2): 43-49

4. MeiSuna, Y. and Ockerman, H. W. (2005) A review of the needs and current applications of hazard analysis and critical control point (HACCP) system in foodservice areas, Food Control, 16 (4): 325-332

5. Buchanan, J, Robert, L. and Whiting, RE. C.(1998) A means for linking HACCP plans and public health. Journal of Food Protection 62(7): 786-792

6. Bahr, N. J. (1997). System Safety Engineering and Risk Assessment: A Practical Approach (Chemical Engineering) (1st Ed.). London: Taylor & Francis Group, pp2-5

7. Okrent, D. (1980) Comment on Societal Risk, Science, 208 (4442): 372-375

8. Whyte, W. and Eaton, T. (2002) A cleanroom contamination control system. European Journal of Parenteral and Pharmaceutical Sciences, 7(2), pp. 55-61.

9. Sandle, T. (2006) Environmental monitoring risk assessment. Journal of GXP Compliance, 10 (2): 54-73

10. Whyte, W. and Eaton, T. (2015) Assessment of degree of risk from sources of microbial contamination in cleanrooms, 1: airborne, European Journal of Parenteral and Pharmaceutical Sciences, 20 (2): 52-62

11. Sandle, T. (2011): Risk Management in Pharmaceutical Microbiology. In Saghee, M.R., Sandle, T. and Tidswell, E.C. (Eds.) (2011): Microbiology and Sterility Assurance in Pharmaceuticals and Medical Devices, New Delhi: Business Horizons, pp553-588

12. ICH Q9. Quality Risk Management, International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, Geneva, Switzerland, 2006

13. O'Donnell, K. and Greene, A. (2006). A risk management solution designed to facilitate risk-based qualification, validation and change control activities within GMP and Pharmaceutical regulatory compliance environments in the EU, Parts I & II, Journal of GXP Compliance, 10 (4): 1-7

14. Javier. P. Peter, P. and  Quantick, C. (2001) Technical barriers to Hazard Analysis Critical Control Point (HACCP), Food Control, 12 (3): 165-173

15. Sandle, T. and Lamba, S. S. Effectively Incorporating Quality Risk Management into Quality Systems. In Saghee, M.R. (2012) Achieving Quality and Compliance Excellence in Pharmaceuticals: A Master Class GMP Guide, New Delhi: Business Horizons, pp89-128

16. Hulebak KL, Schlosser W. (2002) Hazard analysis and critical control point (HACCP) history and conceptual overview. Risk Anal  22:547–52

17. Gavin, A., and L.M. Wedding (1995) Canned Foods – Principles of Thermal Process Control, Acidification, and Container Closure Evaluation. National Food Processors Institute, Washington, D.C. p231

18. Zwietering, M. H. (2005) Risk assessment and risk management for safe foods: assessment needs inclusion of variability and uncertainty management needs discrete decisions, Int. J. Food Microbiol., 213: 118-123

19. Ashbolt, N. J. (2015) Microbial contamination of drinking water and human health from community water systems, Curr. Environ. Health Rep., 2 (1): 95-106

20. Annalaura, C., Giulia, D. and Stefano, C. (2013) The application of quality risk management to the bacterial endotoxins test: use of hazard analysis and critical control points, PDA J Pharm Sci Technol. 67(5):553-67

21. Jahnke, M. and Kühn, K.D. (2003) Use of the hazard analysis and critical control points (HACCP) risk assessment on a medical device for parenteral application, PDA J Pharm Sci Technol. 57(1):32-42

22. Sperber, W. H. and Stier, R. F. (2009). Happy 50th Birthday to HACCP: Retrospective and Prospective. Food Safety Magazine: 42, 44–46

23. FDA (2004) Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach. Food and Drug Administration, Bethesda, MD

24. WHO Application of Hazard Analysis and Critical Control Point (HACCP) methodology to pharmaceuticals, World Health Organization, Technical Report Series, No. 908, 2003, Annex 7, Geneva, Switzerland.

25. Zink McCullough, K. (2003) Bacterial Endotoxin Testing. In Dixon, A. M. (2007) Environmental Monitoring for Cleanrooms and Controlled Environments, CRC Press, Boca Raton, pp129-180

26. Barr, D. and Mantalvo, M. (2005) API Facilities. In Signore, A. A. and Jacobs, T. (Eds.) Good Design Practices for GMP Pharmaceutical Facilities, Taylor Francis, Boca Raton, pp313-356

27. Buchanan, R. L. (1990) HACCP: a re-emerging approach for food safety, Trends in Food Science Technology, 1: 104-106

28. Pietrowski, R.A. (2007) Risk Management and Microbiological Activity. In Denyer, S.P. and Baird, R.M. (Eds.) Guide to Microbiological Control in Pharmaceuticals and Medical Devices, CRC Press, Boca Raton, pp447-459

29. Clontz, L. (2009) Microbial Limits and Bioburden Tests: Validation Approaches for Global Requirements. CRC Press, Boca Raton, pp48-49

30. Jahnke, M. (1997) Use of the HACCP concept for the risk analysis of pharmaceutical processes, European Journal of Parenteral Science, 2: 113-117

31. Sandle, T. (2015): Aseptic Transfer Risk Assessment: A Case Study, Journal of Validation Technology, 21(1): 1-10

32. Swanson KM, Anderson JE. (2000) Industry perspectives on the use of microbial data for hazard analysis and critical control point validation and verification. J Food Prot 63:815–8

33. Ljungqvist B and Reinmüller B.(1995) Hazard analysis of airborne contamination in cleanrooms - application of a method of limitation of risks. PDA Journal of Pharmaceutical Science and Technology  49: 239–243

34. Reinmüller B. (1999) HACCP and microbiological risk assessment in aseptic production. The Nordic Journal of Contamination Control and Cleanroom Technology 28(1): 9–12

35. Sartain, E. and Polarine, J. (2011) Prevention of Microbial Contamination., Pharm Technol. 35(6):62-65, 2011

36. Ziegler, I., Borbély-Jakab, J., Sugó, L.., Kovács, R. J. (2017) Revision of Viable Environmental Monitoring in a Development Pilot Plant Based on Quality Risk Assessment: A Case Study, PDA J Pharm Sci Technol. 71(3):234-244

37. Sutton, S. V. (2012) The Contamination Control Plan in Facility Validation, Journal of Validation Technology; 18 (2): 42-47

38. Sandle, T. (2013). Contamination Control Risk Assessment. In Masden, R.E. and Moldenhauer, J. (Eds.) Contamination Control in Healthcare Product Manufacturing, Volume 1, DHI Publishing, River Grove: USA, pp423-474

39. Crawley F and Tyler B. (2003) Hazard identification methods. Rugby, UK: Institute of Chemical Engineers, pp1-15

40. Scott, V. N. (2005) How does industry validate elements of HACCP plans?, Food Control, 16 (6): 497-503


Product Added Successfully

This product has been added to your account and you can access it from your dashboard. As a member, you are entitled to a total of 0 products.

Do you want access to more of our products? Upgrade your membership now!

Your Product count is over the limit

Do you want access to more of our products? Upgrade your membership now!

Product added to cart successfully.

You can continue shopping or proceed to checkout.

Comments (1)


Post new comment

The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
  • Use to create page breaks.
Enter the characters shown in the image.
Validation Master Plan Download banner