HACCP — Critical Control Points, Borrowed From Food Safety

Hazard Analysis and Critical Control Points asks a narrower question than FMEA: not every failure mode in a process, but where the few points are whose failure directly threatens the patient — worked through a sterile-fill bioburden-control example.

The one idea

Instead of scoring every failure mode in a process, HACCP asks a narrower, sharper question: where in this process is a critical control point — a step where losing control means the hazard reaches the patient, with nothing downstream left to catch it?

Mechanics

HACCP originated in food safety (developed for NASA’s manned space program, to guarantee astronaut food had zero tolerance for contamination) and maps cleanly onto sterile and biologic manufacturing, which share that same “no downstream catch” property. The full method has seven principles; the ones that matter for a control-strategy discussion are:

Conduct a hazard analysis — what biological, chemical, or physical hazards could occur at each process step?
Identify critical control points (CCPs) — of all the steps, which ones are the point where the hazard can still be prevented, eliminated, or reduced to an acceptable level? A step downstream of the true control point is not itself a CCP, even if a hazard could theoretically show up there.
Establish critical limits — a measurable threshold for each CCP (a temperature, a pressure differential, a bioburden count) that separates “in control” from “out of control.”
Establish monitoring — how and how often the critical limit is checked, and by whom.
Establish corrective action — what happens, specifically, the moment a critical limit is exceeded.

(The remaining two principles — verification and record-keeping — are the documentation backbone that makes the first five auditable, and aren’t specific to any one CCP.)

Worked example — sterile fill/finish bioburden control

Step	Hazard	Is it a CCP?	Critical limit	Monitoring	Corrective action
Raw material receipt	Contaminated excipient	No — caught downstream	—	Certificate of analysis review	Reject lot
Compounding	Microbial ingress during mixing	No — bioburden reducible later	—	Environmental monitoring (routine)	Investigate, re-clean
Sterilizing-grade filtration	A non-sterile filter passes organisms into the final fill	Yes — nothing downstream removes a missed organism	Filter integrity test (bubble point) passes pre- and post-use	100% integrity testing, every batch	Fail the batch; do not release; investigate filter lot and process
Aseptic fill	Environmental contamination during filling	Partially — mitigated by isolator/RABS design, not a single measurable limit	— (engineering control, not a CCP in the classic sense)	Continuous particle counts, media fills	Halt line, investigate
Final inspection	Visible particulate	No — a quality check, not a hazard-elimination point	—	Visual inspection	Reject unit

The filtration step is the CCP because it is the last point where the hazard (a non-sterile product) can still be prevented — everything upstream can be caught or corrected later in the process, and everything downstream has no way to remove an organism that already got through. That is the test for “is this a CCP,” not “could something go wrong here.”

When to reach for it vs. FMEA

FMEA decomposes an entire process into every failure mode and scores each one — useful when you want comprehensive coverage of a method or process. HACCP deliberately does the opposite: it narrows attention to the small number of points where losing control is unrecoverable, which is exactly right for manufacturing and process risk (sterility assurance, allergen control, cross-contamination) but a poor fit for analytical method risk, where FMEA’s step-by-step, fully-scored decomposition is what regulators and most labs actually expect.

Known weaknesses

Works best when there really are a small number of make-or-break points; forcing a HACCP structure onto a process with many, roughly-equally-important risks just reproduces an FMEA with extra steps.
Identifying the true CCP takes real process understanding — misidentifying a downstream inspection point as a CCP gives false confidence, since it doesn’t actually prevent the hazard, only detects it after the fact.
Less natural for analytical-method risk (where FMEA dominates) than for manufacturing/process risk, where it originated and still fits best.