Environmental monitoring is an important part of a biocontamination control strategy in a pharmaceutical or healthcare organization. Monitoring is undertaken in order to assess if controlled areas are operating as designed and to assess the risk of microorganisms to pharmaceutical products, in terms of contamination transfer (1). Monitoring data is assessed against assigned limits (or frequencies) and by assessing the collected data over time in the form of trend analysis. Importantly, environmental monitoring is used to confirm that sufficient controls are in place; in itself it cannot be used as a substitute for control.
There are several aspects to environmental monitoring and each aspect must be described in an environmental monitoring program; such elements include method selection, determining frequencies of monitoring, locations for sampling, selection of culture media, choice of data analysis tools and so on. This article looks at one of these aspects: determining the locations for monitoring and here a risk assessment tool can be applied for this purpose: Hazard Analysis and Critical Control Point (HACCP).
For pharmaceuticals and healthcare there are a myriad of different risk assessment tools available (2), some of which are of more use than others (and of these more useful approaches, some are easier to understand and implement). The foremost risk assessment tool in pharmaceuticals appears to be Failure Modes and Effects Analysis (FMEA). While FMEA has many uses, especially for deconstructing equipment to try and to detect points of failure (‘failure modes’) (3) it is perhaps less suited for following a process flow. This is where HACCP has its advantages. Unlike FMEA, which uses risk scoring based on an ordinal number concept, HACCP is a qualitative risk assessment tool.
HACCP is a risk assessment approach, originating in the food industry that can be used to assess physical, chemical, and biological hazards (4). HACCP is designed in such as way so that the potential hazards, or points of potential failure (or in the case of environmental monitoring – contamination) that can occur are identified. Hence HACCP is a pro-active tool, consisting of a preventive approach to identify hazards throughout a process (5).
The locations where potential hazards can occur are, within the HACCP lexicography, known as Critical Control Points (CCPs). At these identified points actions can be taken to reduce or eliminate the risk of the hazards being realized. HACCP involves focusing on where the most important control points in a process are and, where risks remain, undertaking monitoring. Once these monitoring locations are established critical limits are to be set. The monitoring to critical limits enables the process to be verified as being in control (or not). The output is a documented plan to control these scenarios.
This article discusses the concept of risk and the basis of HACCP. A follow up article (part B) looks at an example of environmental monitoring location determination using HACCP methodology.
Risks, microbiology and the pharmaceutical environment
Risks relate to a situation, event or scenario where a recognized hazard may result in harm. Often the term risk, as the outcome of an assessment, is confused with the word hazard; whereas, risk is the expression of a hazard. A hazard is the potential source of harm, and one that either exists or does not exist (it is the assessment of risk that quantifies or qualifies a hazard) (6). Some hazards are capable of causing more harm than others (different degrees of severity). Hazards exist everywhere but this does not mean they are a problematic risk; most hazards are dormant, with the potential to cause harm but requiring a particular set of circumstances to do so. Hence as well as potential severity, risk assessment also needs to be account for the probability of a hazard causing harm. When probability becomes reality, the hazard causes an incident. Another way to think of a hazard is stored energy waiting to be released.
Thus risk and hazard form the following relationship (7):
Risk = Hazard x Vulnerability (or severity)
Capacity (or likelihood)
So risk is an expression of the probability that a given hazard will cause harm. Here a hazard will pose low risk if the likelihood of its exposure is minimized or a higher risk is the exposure cannot be minimized (8).
In essence what is of concern with hazards are the consequences. Consequences shape risks, based on the potential severity of the hazard and the likelihood or probability that the hazard will cause something to occur. Not all of these risk outcomes are equal and one risk can be compared another or against a benchmark: expressed qualitatively, as low, medium or high; or semi-quantitatively as a number and ranked in order.
Although HACCP uses these ‘assessments’ of risk in terms of severity (‘how bad could the hazard be?’) and likelihood (‘how likely is the hazard to occur?’) it does not address these through a scoring or ranking system, but rather through the use of decision trees or flow diagrams.
This can give HACCP an advantage over FMEA since the ranking in FMEA can be somewhat artificial, in terms of one risk being seen as greater than another, and when the risk assessment itself has been based on poor science. Moreover, with microbiology most risk assessments boil down to (9):
a) How much contamination is there (bioburden or specific microbial species of concern)?
b) What happens if bioburden gets into the product?
c) What are the chances of this happening? (The transfer coefficient)?
Or to put this a different way, the context of cleanrooms and microbial contamination, the basis of risks relate to (10):
- The concentration and source of microorganisms;
- The areas where product is exposed;
- The ease by which microorganisms can be dispersed and the possibility of these getting into the product.
In addressing this for a HACCP assessment, some degree of interpretation is required. Here we can express these terms as. Starting with likelihood (or probability), in Table 1:
Table 1: Assessing probability
Improbable likelihood of occurrence
Quite unlikely to occur
Failure is likely
Failure happens on most occasions
And moving onto severity, in Table 2:
Table 2: Expressing severity
Almost no impact
Impact has no impact upon microbial risk
Microorganisms could affect process or product
Product quality will be adversely affected
Direct risk to patient safety
The above tables represent just one means to describe probability and severity. The definitions should be adapted for different processes, taking into account potential bioburden and objectionable organisms, as well as for sterile or non-sterile processing. Once defined these allow for the identification of hazards, the assessment of risks, and then attempts to manage the risks through process design and controls.
Before risks can be managed they need to be assessed, which is the role of risk management (11). Two important points to remember for any risk assessment approach are that, first, there is no such thing as ‘zero risk’ and therefore a decision is required as to what is ‘acceptable risk’. Secondly, risk assessment is not an exact science - different people will have a different perspective on the same hazard.
In ICH Q9 three key definitions are outlined (12). These help to contextualize what is meant by 'risks':
- Risk: “The combination of the probability of occurrence of harm and the severity of that harm”,
- Harm: “Damage to health, including the damage that can occur from loss of product quality or availability”,
- Hazard: “The potential source of harm”.
When carrying out a risk assessment, it is important that assessments (13):
- Are based on systematic identifications of possible risk factors, such as: what will cause the device to failure? Or where could contamination be introduced?;
- Take full account of current scientific knowledge. For this a multi-disciplinary team is useful, including engineers, production staff and microbiologists. Care needs to be taken to ensure that the team members are trained in HACCP since technical barriers, plus practices, attitudes and perceptions, can negatively affect the understanding of the HACCP concept and hence the proper and effective implementation and maintenance of the HACCP principles (14);
- Use factual evidence to reach conclusions;
- Identify all reasonably expected risks-simply and clearly;
- Weigh up any risk mitigations;
- Be documented in a format that can be inspected;
- Contain an objective risk mitigation plan.
Risk management and risk assessment principles should be applied as early as possible during the design of pharmaceutical processes, either directly to the process or for the elements that support the process, from incoming materials to the fabric within which processing takes place (such as a cleanroom). The incorporation of risk management at this stage meets Quality by Design expectations (15). Once a risk has been identified an attempt can be made to mitigate the risk should it be deemed unacceptable (ICH Q9 advises that the proportion of effort should be commensurable with the risk). Where a risk of concern cannot be entirely eliminated a sound detection system is required. Detection should not only be sensitive enough to signal the presence of a risk, it should also be in the right place.
With cleanroom and controlled environment operations detection methods can be divided into physical measurements (such as pressure differentials, airflows, air changes and so on) and biological measurements (the detection of microbial contamination through the environmental monitoring program. This exemplifies a problem with microbiological monitoring: invariably the sample size is too small; the methods are insufficiently sensitive; and, with culture based techniques, the results obtained too long after the event. This means there cannot be an over-reliance upon detection in signaling potential harm. Nevertheless, monitoring can assist with retrospective reviews and historical data and trend analysis are very useful for establishing process controls. Here HACCP is an appropriate tool for the task of monitoring location determination.
What is HACCP?
HACCP was developed during the 1960s and it grew out of a collaboration between NASA, a food company (the Pillsbury Company) and the US Army Natick Laboratories (16). The objective was to provide a zero-defect food supply for the astronauts. HACCP was probably derived from an early form of Failure Mode Analysis (17). There are two key components of HACCP:
- Hazard Analysis: Determining what microbiological, physical, or chemical risks are associated with a process.
For hazard analysis, this involves the collection of information relevant to the risk assessment in relation to potential hazards. Arguably, the most difficult area to assess is biological variability (18).
- Control Point: Any point, step or procedure at which a biological, physical or chemical factor can be controlled.
- Critical Control Point: A point, step, or procedure at which control can be applied and where control is essential to prevent the hazard from occurring (or to minimize the risk).
This can be simplified as:
- Plan – what needs to be done to maintain product and write it down.
- Do – what has been planned to be done to maintain product safety.
- Check – that what is being done is what was planned to be done in order to maintain product and write down what was checked and when.
- Act – to correct any product safety concerns and write down what has been done about the problem and when.
The advantage of using such a HACCP approach for contamination control is that it allows the user to (19):
- Define where microbiological contamination could occur and,
- Effectively determine the best controls and monitoring methods in relation to the contamination.
HACCP can be also integrated with other tools, such as fishbone diagram and flowcharting (20). HACCP also fits in with the Process Analytical Technology paradigm, whereby process controls (surveillance) have gained increased importance to complete the quality profile, supplementing traditional post-process product testing (21).
There are different variants of HACCP (22). This article primarily considers a modification of the HACCP method called the ‘Lifecycle Approach’. The approach adopted is similar to that contained in the FDA "Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach" (23). This approach recommends that the following factors are noted when undertaking HACCP analysis in pharmaceutical manufacturing:
- Facility and room design,
- Aseptic processing lines (design and maintenance),
- Process: flow charts and layout,
- HVAC and utilities,
- Media fills trials,
- Disinfection practices,
- Deviations and environmental controls and trends.
HACCP comes with its own language and phrases. Some of the key terms are:
- Control: To take all necessary actions to ensure and maintain compliance with criteria established in the HACCP plan.
- Control measure: Any action and activity that can be used to prevent or eliminate a hazard or reduce it to an acceptable level.
- Corrective action: Any action to be taken when the results of monitoring at the CCP indicate a loss of control.
- Critical Control Point (CCP): A step at which control can be applied and is essential to prevent or eliminate a hazard or reduce it to an acceptable level.
- Critical limit: A criterion which separates acceptability from unacceptability.
- Deviation: Failure to meet a critical limit.
- Flow diagram: A systematic representation of the sequence of steps or operations used in the production or manufacture of a particular process.
- HACCP: A system which identifies, evaluates, and controls hazards which are significant for food safety.
- HACCP plan: A document prepared in accordance with the principles of HACCP to ensure control of hazards which are significant are under consideration.
- Hazard: A biological, chemical or physical agent in, or condition of, food with the potential to cause an adverse health effect.
- Hazard analysis: The process of collecting and evaluating information on hazards and conditions leading to their presence to decide which are significant for food safety and therefore should be addressed in the HACCP plan.
- Monitor: The act of conducting a planned sequence of observations or measurements of control parameters to assess whether a CCP is under control.
- Step: A point, procedure, operation or stage in the process including raw materials, from primary production to final consumption.
- Validation: Obtaining evidence that the elements of the HACCP plan are effective.
- Verification: The application of methods, procedures, tests and other evaluations, in addition to monitoring to determine compliance with the HACCP plan.
This chapter proceeds to consider the main elements of HACCP.
The principles of HACCP
HACCP consists of four phases and seven principles, based on WHO Technical Report Series, No. 908, 2003, Annex 7 (24). The phases are:
- Preliminary activities, such as forming a team and developing the scope.
- Identification of the hazards that are reasonably likely to occur.
- Identification of parameters and circumstances that need to be controlled to prevent hazards from occurring (and which are linked to critical control points).
- Monitoring the success (or otherwise) of the HACCP process.
In general HACCP involves an assessment of the following conditions. These are known in much of the food industry literature as ‘the seven pillars’ (or ‘seven principles’), which are (25):
- Conduct a hazard analysis;
- Determine critical control points;
- Establish critical limits;
- Establish a system to monitor each critical control point;
- Establish corrective actions to be taken when each critical control point has an excursion or goes out of control;
- Establish a process to ensure that the HACCP is working correctly;
- Establish a documentation system.
Each of these seven principles is expanded upon below:
(1) Conducting a hazard analysis. This involves listing all potential hazards associated with each step, conducting a hazard analysis, and considering any measures to control the identified hazards.
Examples include of hazards applicable to HACCP include:
- Areas adjacent to clean room / Isolator (e.g. airlocks, changing rooms),
- Air supply,
- Room air,
- Water (especially ingredient water).
These are best considered via flow charts. Flow charts are useful for:
- Defining and analyzing processes;
- For building a step-by-step picture of the process for analysis, discussion, or communication; and,
- To define, standardize or find areas for improvement in a process.
For this process flows are useful, for example, see Figure 1 below:
Figure 1: Generalized HACCP Process Flow Chart
The risks identified through the construction of a flow chart will vary. An example of a process mapping flow chart is shown (Figure 2) with the safety of active pharmaceutical ingredients (APIs) considered. Here the nature of the material will be important, as will environmental controls, upon safety requirements.
Figure 2: Using a flow chart to consider the safety aspects of handling APIs (based on Barr and Mantalvo (26).
Methods used to control these hazards include:
- Air supply / HEPA filters.
- Dirty areas adjacent to cleanroom / isolator (including differential pressures; airflow movement).
- Room air (air change rates; use of barriers).
- Surfaces (sterilization; effectiveness of cleaning / disinfection procedures).
- People (cleanroom clothing and gloves; room ventilation; training).
- Machines and equipment (sterilization, effectiveness of cleaning, exhaust systems).
(2) Determining the Critical Control Points (CCPs).
Examples of critical control points in pharmaceutical manufacturing are pressure mixing speed and temperature. To add to this it is important to consider:
- The amount of contamination on, or in, the source that is available for transfer.
- Ease by which the contamination is dispersed or transferred.
- The proximity of the source to the critical point where the product is exposed.
- How easily the contamination can pass through the control method.
The process of assigning a critical control point also requires an assessment of whether the control point is needed. For this a decision tree can be useful, such as the one proposed by Buchanan (27):
Figure 3: Critical control point decision tree
(3) Establishing critical limit(s).
(4) Establishing a system to monitor control of the CCP. For example:
- HEPA filter integrity tests,
- Air supply velocity, air change rates,
- Room pressure differentials,
- Particle counts,
- Air samplers; settle plates, contact plates etc.
(5) Establishing the corrective action to be taken when monitoring indicates that a particular CCP is not under control. In general:
- The greater the hazard, the greater the amount of monitoring required.
- Trend analysis for alert and action levels: in or out of control.
(6) Establishing procedures for verification to confirm that the HACCP system is working effectively. For example:
- System for data review,
- Examine filling trials,
- Reassess hazards, effectiveness of control systems, and frequency of monitoring, appropriateness of alert and action levels.
(7) Establishing documentation and record keeping. For instance:
- Describe the steps being taken,
- Describe the monitoring procedures,
- Describe the reporting and review procedures.
One thing HACCP is less good at is comparing risks and control points. To assess the relative importance of different risks, they can be ranked based on probability of something going wrong. For example, from the biocontamination control perspective this could be based on microbial proliferation (28).
Applications of HACCP to pharmaceuticals and healthcare
HACCP is suited to any part of the pharmaceutical process where risks can occur and there are points that can be monitored. In particular, it is well-suited to microbiological risks to the process. For example, in capturing the potential introduction of contamination from raw materials, excipients, utilities, material flow, and the breakdown of cleanroom control parameters (29).
With these, HACCP can be used to assess key questions of contamination concern, such as (30):
- Can microorganisms survive?
- Is there potential for microorganisms to produce toxins?
- Can equipment be effectively cleaned and decontaminated?
- Is a disinfection step appropriate?
- Is a sterilization step needed?
- What is the impact of personnel?
- Are there different risks in relation to open and closed processing?
- What process time limits are in place and do process delays contribute to the contamination risk?
An approach to for conducting a HACCP risk assessment is through twelve steps, which relate to the seven principles outlined aove:
1. Assemble HACCP team
As with any risk assessment tool, the team involved in undertaking the risk assessment should be knowledgeable about the process under examination (that is a multidisciplinary team). From the outset the scope of the HACCP plan should be identified. The scope should describe what is to be looked at and the general classes of hazards to be addressed (e.g. microbiological).
2. Describe the product or process
A full description of the product or process should be drawn up, including relevant operational parameters relating to the environment. A flow chart is especially useful for this (as with figure 1).
3. Identify process stage and subsequent processing
The process stage at which the hazard occurs or could occur should be examined. Consideration should be given to the next stage of processing so that the relative risk can be evaluated (e.g. if the product is filtered at the next stage the risk might be lesser than if the product was placed into an open vessel). A process map is especially useful for this.
4. Construct flow diagram
The flow diagram should be constructed by the HACCP team. The flow diagram should cover all steps in the operation. When applying HACCP to a given operation, consideration should be given to steps preceding and following the specified operation.
5. Confirmation of flow diagram
The HACCP team should confirm the processing operation against the flow diagram during all stages and hours of operation and amend the flow diagram where appropriate.
6. List all potential hazards associated with each step, conduct a hazard analysis, and consider any measures to control identified hazards
This relates to principle 1 listed above. For this the HACCP team should list all of the hazards that may be reasonably expected to occur at each step from primary production, processing, manufacture, and distribution until the point of consumption.
The HACCP team should next conduct a hazard analysis to identify for the HACCP plan which hazards are of such a nature that their elimination or reduction to acceptable levels is essential to the production of clean product.
In conducting the hazard analysis, the following should be included (where applicable):
- The likely occurrence of hazards and severity of their adverse health effects;
- The qualitative and/or quantitative evaluation of the presence of hazards;
- Survival or multiplication of microorganisms of concern;
- Production or persistence in foods of toxins, chemicals or physical agents; and,
- Conditions leading to the above.
The HACCP team must then consider what control measures, if any, exist which can be applied for each hazard (more than one control measure may be required to control a specific hazard(s) and more than one hazard may be controlled by a specified control measure).
7. Determine Critical Control Points
This connects with the second principle described above. At each step there may be more than one critical control point (CCP) at which control needs to be applied to address the same hazard (this can also include places to monitor; indeed HACCP is quite an effective tool to use when selecting locations for microbiological environmental monitoring). Sometimes decision trees can be useful when deciding which controls are of relevance. If a hazard has been identified and it is decided that control is necessary, and where no control measure exists, a control measure should be adopted.
8. Establish critical limits for each CCP
Critical limits, in connection to the third principle, must be specified and validated for each CCP. In some cases more than one critical limit will be required at a particular step. Criteria often used include measurements of temperature, time, moisture level, pH, water activity, microbial bioburden and endotoxin.
9. Establish a monitoring system for each CCP
Monitoring is the scheduled measurement or observation of a CCP relative to its critical limits (as set out in principle four). The monitoring procedures must be able to detect loss of control at the CCP (for this short term or long term data analysis may be required). Where possible, process adjustments should be made when monitoring results indicate a trend towards loss of control at a CCP. Normally physical and chemical measurements can be undertaken in 'real time' or shortly after a sample is taken, allowing some actions to be considered for risk situations (such as a rise in temperature which might trigger microbial growth). Although rapid microbiological methods are becoming more commonplace, microbiological results are often available sometime after the event has happened.
10. Establish corrective actions
In line with the fifth principle, specific corrective actions must be developed for each CCP in the HACCP system in order to deal with deviations when they occur. The actions must ensure that the CCP has been brought under control. Actions taken must also include a product risk assessment.
11. Establish verification procedures
Establishing procedures for verification forms part of the sixth principle. For this, test results (often as trend reports) and auditing records are particularly useful. In addition, deviation reports and a review of the effectiveness of corrective and preventative actions can provide valuable information.
12. Establish documentation and record keeping
Efficient and accurate record keeping is essential to the application of a HACCP system and is the core of the seventh principle. HACCP procedures should be documented. Documentation examples are:
- Hazard analysis;
- CCP determination;
- Critical limit determination.
- Record examples are:
- CCP monitoring activities;
- Deviations and associated corrective actions;
- Modifications to the HACCP system.
These twelve steps are summarized in Figure 4 below:
Figure 4: Example of HACCP step approach
Advantages and disadvantages of HACCP
The advantages of the HACCP approach are that it allows for a systematic overview of the process for the evaluation of each processing step, which leads to each step to be examined for the possible risks, and the measures required for controlling each risk to be specified. The primary disadvantage is that, unlike FMEA, HACCP cannot be used to rank or prioritize risks (albeit with the concerns about risk ranking discussed earlier). HACCP is also less effective for focusing on one aspect for the process in detail, for the objective of HACCP is to map out an entire process.
This article has presented the HACCP approach and the main steps that should be followed in order to complete a successful HACCP exercise. The HACCP approach has been illustrated with examples drawn from microbial risks and controls relating to pharmaceutical and healthcare facilities.
The approach may come across, as with any description of a risk assessment tool, as somewhat abstract. This is addressed in a follow up article which consider how to use HACCP to review an environmental monitoring program, with a particular focus on pinpointing locations for monitoring. See: “Use of Hazard Analysis and Critical Control Points (HACCP) – Part 2: Determining environmental monitoring locations.”
The references for this article are listed at the end of the second article.