Yogurt line: which controls belong in the hazard control plan
A yogurt manufacturer in Portugal runs one filling line for both plain yogurt and a yogurt with sesame paste. The line has pasteurization at 85 °C for 30 s, a metal detector after filling, and an allergen changeover clean between the sesame and plain products. The food safety team has just completed a hazard analysis for the plain product. Pasteurization is monitored continuously with an alarm at 83 °C; the metal detector is checked hourly with 2.0 mm ferrous and 2.5 mm non-ferrous test pieces. Changeover cleaning is verified by ATP swabs and visual inspection; the allergen swab result is available 24 hours after release of the first plain packs. The plant has 22 employees and no onsite microbiologist. Last month the pasteurizer ran at 84.2 °C for 3 minutes during a startup; the product was held and released after review. The team is unsure which controls must be in the hazard control plan as CCPs and which can remain PRPs/OPRPs, and how to treat the allergen swab delay.
1. Classify pasteurization, metal detection and allergen changeover cleaning for the plain yogurt. For each, state whether it is a CCP, an OPRP or a PRP, and justify the classification using hazard-analysis logic.
Read the worked answer
Step 1 - link each control to a significant hazard. Pasteurization addresses vegetative pathogens in milk; metal detection addresses physical contamination from the line; changeover cleaning addresses sesame cross-contact in the plain product. All three are linked to significant hazards, so none can be dismissed as a purely generic PRP without justification.
Pasteurization - CCP. A critical limit can be stated (85 °C for 30 s), monitoring is continuous and immediate, and a deviation can be corrected before release by holding or reprocessing. That fits the CCP concept: a control measure at a step where a critical limit and measurement are defined and immediate action is possible.
Metal detection - CCP. The critical limit is rejection of the specified test pieces; hourly monitoring gives immediate action. If the site relied only on periodic verification, the control might be an OPRP, but the stated practice supports CCP classification.
Allergen changeover - OPRP, not CCP. Cleaning is a control measure, but the decisive allergen result is available 24 hours later. A CCP needs a critical limit and monitoring that allows immediate action; a 24-hour ELISA cannot do that. The team can set action criteria for the cleaning (validated parameters, visual clean, ATP threshold) and treat the allergen swab as verification. The OPRP must still be in the hazard control plan, not left in general PRPs.
Reasoning trap: labelling everything a CCP does not make the system safer. Classification must follow the hazard analysis and the ability to monitor and act.
2. The pasteurizer ran at 84.2 °C for 3 minutes during startup. The product was held and released after review. Evaluate that decision and state what the team must record and verify.
Read the worked answer
The 84.2 °C reading is below the 85 °C critical limit, so this is a CCP deviation, not a minor process adjustment. Holding the product was correct because it prevented release while the deviation was evaluated.
Release after “review” is defensible only if the review produced evidence that the product achieved the intended lethality - for example, validated time-temperature equivalence for the actual product, a scientific rationale, or reprocessing. A 0.8 °C shortfall for 3 minutes is not automatically safe; the team must evaluate the real time-temperature profile and the target organism. The alarm set at 83 °C also needs checking: an alarm below the critical limit does not replace the CCP limit.
Records should include the deviation, affected batch or lot, hold, disposition decision and its basis, corrective action to prevent recurrence, and verification of effectiveness. If product was already distributed and safety cannot be demonstrated, the site must consider withdrawal or recall and notify interested parties. The corrective action should address the startup procedure and alarm response, not just the individual batch.
3. The first plain packs are released before the 24-hour allergen swab result is available. Is that acceptable, and what must the food safety team do to make the control effective?
Read the worked answer
Releasing before the 24-hour allergen swab is acceptable only if the team can show the control is effective without that result. The allergen swab is a verification activity, not real-time monitoring. If the hazard analysis relies on it as the only evidence that cleaning worked, the product should be held under positive release.
Options include: hold plain product until the swab is negative; validate the cleaning process and use real-time monitoring (validated cleaning parameters, visual inspection, ATP with an action criterion) so the 24-hour swab confirms rather than controls; or change sequencing so sesame products run after plain products, reducing cross-contact risk.
The team must document the validation, define the action criterion, specify the correction if the criterion is not met, and update the hazard control plan. If the 24-hour result is positive, it must trigger corrective action and product assessment. The decision is about control versus verification, not paperwork preference.