CCP deviation: what to do with the product, the process and the paperwork

The probe reading at the end of the cook is below the critical limit on your HACCP plan, the line is still running and the supervisor wants to know what to do. Most sites have a CCP deviation corrective action written into the plan, but it often says no more than “recook” or “inform QA”. That is not enough when an auditor, or a customer complaint, asks what happened to every unit made since the last good check.

Principle 5 of the Codex HACCP guidelines (CXC 1-1969, revised 2020) is to establish corrective actions, in writing, before anything goes wrong. In practice that means four things must happen every time a critical limit is not met.

What counts as a deviation and what is only an adjustment

Not every out-of-target reading is a deviation. Many plans set an operating limit, or target, that sits inside the critical limit. It gives the operator room to adjust before safety is at risk.

• Adjustment: the reading has drifted towards the critical limit but has not crossed it. The operator corrects the process, for example by extending the cook time, and records the adjustment. The product is still safe.
• Deviation: the critical limit was not met. Safety of the product can no longer be assumed, and the full corrective action applies.
• Loss of monitoring: a check was missed, the thermometer was out of calibration or the record was not completed. You cannot prove the critical limit was met, so treat it as a deviation.

That third point catches many sites. A blank on the monitoring record is not “probably fine”. It is unverified product.

Step 1: bring the process back under control

Stop making product that could be unsafe. Depending on the CCP, that might mean stopping the line, diverting product into a hold area, or keeping the batch in the cooker until it reaches the limit.

Then find out why the process went out and fix the immediate cause: a door seal on the cooker, a blocked fan on the chiller, a detector sensitivity that was changed. Do not restart until the CCP is confirmed working, with a fresh monitoring check recorded.

Step 2: find and hold every affected product

The rule is simple: everything made since the last good check is suspect. If the last satisfactory reading was at 10:00 and the failure was found at 11:00, every unit made between those times is on hold, not just the batch in front of you.

• Identify affected product by batch, time and line using your production records.
• Physically separate it and label it clearly as on hold, with the date, reason and name of the person who held it.
• Enter it in a hold register so it cannot be dispatched by mistake.
• If any affected product has already left site, inform the person responsible for traceability and recall straight away.

Short monitoring intervals make this step smaller. A site that checks every two hours has two hours of product to hold. A site that checks once a shift may have to hold the whole shift.

Step 3: decide what happens to the product

The fate of held product must be decided on evidence, by someone authorised to make that decision. The options are:

• Reprocess: put the product back through the step that failed, if that is safe and the product quality allows it. Undercooked product can often be recooked to the critical limit.
• Rework: use the product in another batch, under a documented rework procedure, where the hazard will be controlled.
• Divert: send the product to a use where a later step controls the hazard, for example a product that will receive a full cook downstream.
• Destroy: when the hazard cannot be controlled, or when you cannot show the product is safe.

Be careful with testing as a release tool. A microbiological test on a few samples cannot prove that a whole batch is safe, because contamination is rarely spread evenly. Testing can support a decision, but it should not be the only reason to release product after a CCP failure.

Step 4: record it, review it and find the cause

Every deviation needs a record that someone else can read and understand a year later. As a minimum, the corrective action record should show:

Field	What to write
CCP and critical limit	Which control point and what limit was not met
Date, time and reading	When it was found and the actual value
Product affected	Batch codes, quantities and the time window back to the last good check
Immediate action	What was done to bring the process back under control
Product disposition	Reprocessed, reworked, diverted or destroyed, with evidence
Root cause	Why it happened, not only what happened
Preventive action	What will stop it happening again
Signatures	Person who took the action and person who verified it

“Operator error” is not a root cause. Ask why the operator made the error: unclear instruction, no training, a probe that was hard to read, pressure to keep the line moving. Repeated deviations at the same CCP are a signal for the HACCP team to review the plan itself. Your internal food safety audits should sample these records and check that the actions were closed.

Who may release held product

The person who made the product should not be the person who releases it. Production is under pressure to ship; the release decision needs someone who is not.

• Name the people with release authority in the HACCP plan, usually the QA manager or HACCP team leader and a trained deputy.
• Make sure there is someone with that authority available on every shift, or a clear rule that product stays on hold until they are.
• Require a signature in the hold register for every release or disposal decision.

If you are setting up or reviewing these procedures as part of your system, our HACCP and GMP implementation consulting covers corrective action and hold and release procedures.

CCP deviation corrective action in practice: cooker, blast chiller and metal detector

Cooker at a meat processor in the Western Cape

At 14:00 the core temperature of a batch of cooked hams is below the critical limit at the end of the programme. The last good check was the previous batch at 12:00. The operator keeps the batch in the cooker and extends the cycle until the critical limit is met and recorded. The previous batch had passed, so it is not affected. Root cause: the cooker was overloaded and the hams were packed too tightly for heat to reach the centre of every piece. Preventive action: a maximum load per rack is added to the work instruction and the loaders are retrained.

Blast chiller at a catering kitchen in Durban

A tray of cooked rice has not reached the temperature in the plan within the cooling time set as the critical limit. Rice is a known risk because spores of Bacillus cereus survive cooking and can germinate, grow and form toxin during slow cooling. Reheating will not reliably destroy that toxin, so the batch is destroyed. The chiller is found to be overloaded with warm food from two services at once. Preventive action: rice is cooled in shallow trays and the chiller loading is scheduled.

Metal detector at a bakery in Gqeberha

At the hourly check the detector fails to reject one of the test pieces. Everything packed since the last passed check, one hour of bread rolls, is held. The detector is repaired and verified with all test pieces. The held product is then passed through the working detector, the rejects are investigated, and the batch is released by the QA manager with a signed record. The cause was a sensitivity setting changed during a product changeover, so changes to settings are now locked to the QA manager.

Supervisors and CCP monitors are the people who make these calls on the floor. Our HACCP course for supervisors and HACCP teams covers monitoring, corrective action and verification in practical terms.

What to do this week

• Read the corrective action column of your HACCP plan. Does each CCP cover all four steps?
• Check that each plan states “hold back to the last good check”, not just “recook”.
• Name the people with release authority and confirm cover on every shift.
• Set up a hold register and hold labels if you do not have them.
• Pull the last three deviation records and check whether a real root cause was found.