This guide breaks the subject down across the eight Food Safety & Quality system elements below — Development, Documentation, Implementation, Monitoring, Corrective & Preventative Action, Verification, Validation and Training. Select any element to explore detailed, best-practice guidance.
Downloading a resource will add this resource to your resource subscriptions. You will be notified of future updates to this resource via email (you may unsubscribe at any time by clicking the unsubscribe link in the email notification, or to unsubscribe immediately from all update notifications, click here)
Downloading a resource will add this resource to your resource subscriptions. You will be notified of future updates to this resource via email (you may unsubscribe at any time by clicking the unsubscribe link in the email notification, or to unsubscribe immediately from all update notifications, click here)
Development
To define detail, scope and purpose.
Development
This information can be used to develop food safety and quality programs that meet the requirements of modern Regulatory, Customer and Industry Standards:
We take the time to explain the expectations and requirements of food safety and quality compliance as these relate to your food safety and quality programs.
You may choose to use our Premium Resources to build, enhance or upgrade your food safety and quality program.
We encourage you to share this webpage with any food compliance associates and peers you believe may benefit from our commitment to providing our users with user-friendly information and resources to achieve a superior Food Compliance Culture.
We welcome your suggestions for additions of general or specific content through the haccp.com Contact Page.
Key Definitions for Business Continuity and Crisis Management
Business Continuity: The ability of an organisation to continue to function, even after a disastrous event. Outcomes should include the ability to ensure that critical business functions will be available to customers, suppliers, regulators, and other relevant entities after a disastrous event.
CCP: Critical Control Point. A step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.
Crisis Management: Actions taken by an organisation in response to unexpected events or situations with potentially negative effects that threaten resources and people or the success and continued operation of the organisation.
Emergency Preparedness: The planning, training, and resourcing that allows a business to respond effectively to an emergency. The term is often used interchangeably with Business Continuity and Crisis Management.
HACCP: Hazard Analysis and Critical Control Points. A systematic, preventive approach to food safety. See the HACCP page for more information.
Incident Management: The coordinated response to an event that may disrupt operations or affect product safety or quality, from first detection through to resolution and review.
ISO 22301: The international standard for business continuity management systems (ISO 22301:2019).
ISO 31000: The international standard providing guidelines for risk management (ISO 31000).
Mock Recall: A simulated recall exercise used to test whether a recall procedure and its records work within the targeted timeframes.
Private Label (house brand): A product sold under a retailer or distributor brand and manufactured by another business.
Recovery Time Objective (RTO): The target time within which a disrupted process, service, or supply must be restored after an incident to avoid unacceptable consequences.
Risk Exposure: The overall threat of a risk to the business, balancing the likelihood of actual loss with the magnitude of the potential loss.
TACCP: Threat Assessment and Critical Control Points. A risk management approach used to identify and control deliberate threats such as sabotage or malicious contamination.
Business Continuity and Crisis Management Development
When considering the development, documentation, and implementation of Business Continuity and Crisis Management within food safety and quality management systems, the following information should be considered to ensure effective outcomes:
About Business Continuity and Crisis Management
Recovery time objectives are set so critical activities are restored before the maximum tolerable outage is reached.
Business Continuity and Crisis Management plans are developed, documented, and implemented to ensure a food business has a structured and tested system to deal with known threats to the supply of safe and quality finished products. Business continuity plans may be strongly linked to other systemic elements, including those for Product Recall and Product Withdrawal.
Contemporary food businesses are expected to have business systems in place that support the production of safe and quality foodstuffs. These systems should also ensure, where possible, that the production and supply of foodstuffs to customers are not disrupted by manageable incidents or emergencies. Standards such as ISO 22301 provide a recognised framework for a business continuity management system.
Business Continuity and Crisis Management includes the development of plans to reduce the risk of a crisis occurring and to deal with any crises that do arise, and the implementation of these plans to minimise the impact of crises and assist the organisation to recover from them. Crises may occur as a result of external factors such as the actions of a competitor, changes in legislation, or an event affecting a key supplier, or internal factors such as a product failure or faulty decision making, and often involve the need to make quick decisions based on uncertain or incomplete information.
Within the context of food industry compliance standards, the terms Business Continuity and Crisis Management are often used interchangeably with other terms, including Emergency Preparedness and Incident Management.
It is important to consider that the Business Continuity and Crisis Management system may have strong links to the established Product Recall and Product Withdrawal systems within a food business. These links may become apparent both before and after activation of the Business Continuity and Crisis Management protocols. The following examples are provided as indicators of prospective related interactions:
Recall leading to activation: A Product Recall or Product Withdrawal has been implemented, and the Business Continuity and Crisis Management system may need to be activated as a result. For example, the investigation into a Product Recall or Product Withdrawal may show that a substantial incident has affected product safety or quality.
Incident leading to recall: A Product Recall or Product Withdrawal may be conducted as a result of a Business Continuity and Crisis Management incident, where a significant incident within the business operation may have affected the safety or quality of foods dispatched from the food business.
Recovery time objectives (RTO) and the maximum tolerable outage for critical activities, such as production, dispatch, and communication, should be defined so that recovery plans can be prioritised and tested against realistic targets.
Business Continuity and Crisis Management review activities should be scheduled, conducted, and recorded on an ongoing basis. Such activities are similar to a Mock Recall, in which a hypothetical scenario is devised and the Business Continuity and Crisis Management system is activated within the food business. The procedures are followed, and records are maintained to show a diary of events and timeframes. Mock Business Continuity and Crisis Management exercises are commonly scheduled at least annually.
Business Continuity and Crisis Management System Elements
Contact listings should include primary, secondary, and after-hours methods of contact.
Elements of a Business Continuity and Crisis Management system usually consist of documented policies and procedures for:
The type of events that would constitute the activation of the Business Continuity and Crisis Management system;
Designated nominations for responsibility for the application of the Business Continuity and Crisis Management system, including alternates;
Contact listings for persons or entities with responsibility for the application of the Business Continuity and Crisis Management system. Contact listings should contain details for primary and secondary methods of contact, including after-hours options;
Communication to contact listees, consumers, and regulatory authorities within an appropriate timeframe;
Business Continuity and Crisis Management links to recall and withdrawal procedures, including requirements for stock reconciliation, logistics, product recovery, product storage, and product disposal where applicable (see Product Recall and Product Withdrawal);
Notification of relevant customers, food standards certification bodies, and other stakeholders whenever the Business Continuity and Crisis Management system is activated;
Contact listings for Business Continuity and Crisis Management should include the following where applicable:
Business Continuity and Crisis Management team members;
Emergency services;
Suppliers;
Customers;
Food standards certification bodies;
Regulatory authorities;
Analytical testing laboratories;
Legal representatives;
Media representatives;
Financial representatives;
Insurance representatives;
Staff and employee representatives;
Business recovery specialists.
Business Continuity and Crisis Management systems are commonly developed, documented, and implemented in food businesses to define the procedures and responsibilities for handling contingencies such as Disruption to Key Services, Destruction of Premises or Equipment, or Malicious Contamination or Sabotage.
Activation Levels and Escalation
Many businesses define levels of response so that the scale of the response matches the scale of the event. An example structure is:
Level 1 (minor): A contained event that can be managed by the site team within normal operations;
Level 2 (major): An event with a significant effect on product safety, quality, or supply that requires the Business Continuity and Crisis Management team to be convened;
Level 3 (crisis): An event that threatens the safety of consumers, the continuity of the business, or its reputation, and requires senior management and external notification.
Documented triggers and the authority to activate each level should be clearly defined, so that decisions are not delayed during an incident.
Crisis Communication
Clear and consistent communication is a central part of an effective response. A Business Continuity and Crisis Management system should address:
A single nominated spokesperson, with an alternate, for communication with the media and the public;
Prepared holding statements that can be adapted quickly to different scenarios;
Consistent messages for employees, customers, regulators, and other stakeholders;
Monitoring of, and responses to, social media activity;
Records of all communications issued during an incident;
Seeking legal advice before public statements are made where appropriate.
Disruption of Key Services
Loss of electricity can disrupt refrigeration, production, and information systems.
Disruption of key services may include instances in which the following are impaired within a food business:
Potable or non-potable water;
Electricity;
Gas;
Refrigeration and cold chain capability;
Transport access;
Staff availability, including during a pandemic or other widespread illness;
Telephone access;
Internet and email access;
Information systems, including protection from cyber attack;
The supply of a key ingredient, packaging, or service from a critical supplier (see Approved Supplier Management).
Destruction of Premises or Equipment
Flooding and storm damage can disable premises and equipment for extended periods.
Destruction of premises or equipment may occur due to:
Fire;
Explosion;
Flood;
Storm damage;
Pest infestation;
Natural disasters.
Malicious Contamination or Sabotage
Monitoring devices help deter and detect deliberate tampering.
Although the likelihood of deliberate malicious contamination or sabotage is low, the consequences can be severe. It is therefore important to take reasonable steps to prevent deliberate malicious contamination or sabotage of products or processes.
Consideration of such prevention may take into account the following:
Screening of staff members, contractors, and visitors with access to critical areas or systems within a food business, and controlling access (see Visitor and Contractor Management);
Fitting cameras or other monitoring devices in a manner that does not breach privacy laws;
Use of tamper-evident packaging where appropriate;
Securing chemicals, and protecting water supplies and ingredient storage tanks from unauthorised access;
Commissioning of metal detection or X-ray devices for raw materials, work in progress, or finished products. These devices are detection controls for physical contaminants and are separate from the security measures above;
Defining Business Continuity and Crisis Management Risk
Risk exposure balances the likelihood of a loss with its potential magnitude.
As with any food safety and quality system element, Business Continuity and Crisis Management requires a structured approach to defining the risk associated with the outcomes of food business incidents. A factual approach to decision-making defines a business’s ability to use accurate information and data as a foundation for decisions.
The benefits of a factual approach to decision-making include:
Enhanced outcomes of the decisions made within the business operation;
Decisions founded on objective data and information, and the ability to demonstrate the effectiveness of decisions by referring to that data and information;
Increased accessibility of relevant data and information for those who require it;
Greater inclusion of experience, skill, and knowledge in the decision-making process;
Reliance on data and information gained from reputable sources.
About Risk Management
Risk management is best carried out by a multidisciplinary team.
Risk management principles can be applied across food industry sectors and business systems, including food safety, food quality, workplace health and safety, finance, and operational management. ISO 31000 provides internationally recognised guidelines for risk management.
Risks are an unavoidable component of any business operation. Risk-taking is often essential to progress and success, and failure can be an important part of learning. Although some risks are inevitable, recognising and managing risk does not need to limit creativity. Risks are often known by management but may be poorly communicated, and communicating risks up the chain of command can be more difficult than communicating them down. The risk management process is ongoing and requires constant analysis, as actions need to be decided, implemented, and managed.
Risk management processes are best managed by multidisciplinary teams. When risk management teams use proactive risk management, the continuous assessment creates data and information that can be used for decision-making in all phases of the risk management activity. The team should ensure that risks are identified, managed, and resolved in a manner that supports continuous improvement for the business.
The Risk Management Process
Contemporary risk management processes include the following five elements:
Risk Identification;
Risk Analysis;
Risk Action Planning;
Risk Tracking; and
Risk Control.
Risk Identification
Risk identification is the first step in the proactive risk management process. Risks must be identified before they can be managed. Risk identification provides the risk management team with opportunities, stimuli, and information that allow them to surface major risks before they affect the business. This step involves adequate and appropriate communication between team members and stakeholders to be successful, and it is a powerful way to expose assumptions and differing viewpoints between all parties involved in the risk management process.
Risk Analysis
Risk analysis is the second step in the risk management process. It converts risk data into risk decision-making information, and thorough risk analysis helps ensure that the risk management team is managing the appropriate risks. During this step the team may use a system that identifies the following:
Risk identifier: The name the team uses to uniquely identify a risk analysis nomination for reporting and tracking purposes;
Risk source: The focus area and the risk factor that was used to identify the risk;
Risk condition: A description of the existing condition that could lead to a negative outcome for the business;
Risk consequence: A description of the negative outcome that would occur for the business if the risk became certain;
Risk probability: An expression of a percentage greater than zero and less than 100 percent that represents the likelihood that the risk will result in a negative outcome for the business;
Risk impact classification: Whether the impact of the risk is financial, strategic, technical, legal, or another category;
Risk impact: The magnitude of impact should the risk occur. This may be the dollar value of the loss or a number between 1 and 10 that indicates relative magnitude. The result of multiplying risk impact by risk probability is often used to rank risks;
Risk exposure: The overall threat of the risk to the business, balancing the likelihood of actual loss with the magnitude of the potential loss. The team uses risk exposure to rate, rank, and prioritise risks;
Risk context: A paragraph containing additional background information that helps to clarify the risk situation;
Related risks: A list of risk identifiers the team uses to track interdependent risks.
Risk Action Planning
Risk action planning is the third step in the risk management process. It turns risk information into decisions and actions. Planning involves developing actions to address individual risks, prioritising risk actions, and creating an integrated risk management plan, which may contain the following:
Risk identifier: The name the risk management team uses to uniquely identify the risk statement for reporting and tracking purposes;
Risk statement: A description of the condition that could lead to a negative outcome for the business, and of the negative outcome that would occur if the risk became certain;
Risk management strategy: A statement describing the team’s strategy for managing the risk, including any assumptions that have been made;
Risk management strategy measures: The measures the team will use to determine whether the planned risk management actions are working;
Action items: A list of actions the team will take to manage the risk;
Due dates: The date by which each planned action item will be completed;
Personnel assignments: The people assigned to perform the action items;
Risk contingency strategy: A description of the team’s strategy if the actions planned to manage the risk do not work. The team would execute the contingency strategy if its trigger were reached;
Risk contingency strategy metrics and trigger values: The measures and triggers the team will use to determine when the contingency strategy should be put into effect and whether it is working.
Risk Tracking
Risk tracking is the fourth step in the risk management process. In this step the risk management team monitors the status of risks and the actions it has taken to observe and control them. Risk tracking is essential to effective risk action plan implementation. This means defining the risk measures and triggering events needed to ensure that the planned risk actions are working. Tracking is the observation function of the risk action plan. Risk reviews are recommended as part of each program review.
Risk Control
Risk control is the final step in the proactive risk management process, after which the process returns to risk analysis. Once the team has chosen the risk measures and triggering events, risk control becomes a component of the normal business management process. It is intended to manage the risk action plans, correct variations from those plans, respond to triggering events, and improve the general risk management process.
Where a Business Continuity and Crisis Management incident has arisen from a customer complaint, it is important to ensure that appropriate action is taken for the complaint, as well as for the other requirements of the system. See Customer Focus and Customer Complaint Management for further information.
Customer Complaint Investigation
A complaint should be investigated promptly by a suitably qualified person.
The complaint should be investigated immediately by a suitably qualified person from the business, or by an approved external specialist.
The investigation should answer the following questions:
How did the problem occur?
Did the problem occur in the manufacturing plant, or was it caused by a raw ingredient or packaging received from a supplier?
Could the problem affect other products?
All products that may have been implicated by the problem should be immediately risk assessed and investigated.
Record in the customer complaint file:
The name of the person from the business who investigated the complaint;
Date and time of the investigation;
Investigation findings;
Other products that may be affected by the problem;
Corrective action taken;
Preventative action taken or proposed actions to be implemented.
Foreign Object Complaints
Where customer complaints involve allegations such as foreign objects, samples of such objects may be provided by the complainant. During the investigative process, it is in the best interests of the food business to:
Test the foreign object to confirm its composition, which can provide information regarding the source of the material;
Assess the size of the foreign object against the size of the physical contaminant controls in the process, such as screens, filters, or metal detectors. This may provide useful information about the genuine nature of the complaint, or may provide a stimulus for considering deliberate product contamination.
Where an identified foreign object is extremely unlikely to have originated from raw materials or processing, consideration should always be given to the potential for deliberate product contamination or a false complaint.
Notification of Authorities and Customers
After giving the matter proper consideration, if key team members have reason to believe that a foodborne illness incident has occurred, the following contacts should be made within an appropriate timeframe:
Key customers: Contact key customers who on-sell the items manufactured by the food business;
Legal representative: Advise the legal representative of the situation and the action taken. Legal advice will usually recommend full co-operation with the health authority, and the representative may wish to be included in the investigation to ensure that the rights of all concerned are properly respected;
Insurer: Depending on the nature and extent of the incident, the insurer may become involved. It is advisable to inform the insurance representative at the beginning of an official investigation.
Once the investigation has gathered as much information as possible from all relevant sources:
Contact the senior management of the business and all relevant personnel, and make them aware that the person handling the complaint has gathered all of the relevant information. If more information is required from the complainant or other sources, it should be collated and recorded as soon as possible. The business must then determine whether any of the alleged suspect food remains on the premises. Any such food should be hygienically segregated, secured, and identified so that it cannot cause further foodborne illness;
When all of the investigation findings are available, a decision on notification to relevant authorities should be made. This may include contacting the local health authority to confirm that the corrective and preventative actions applied are appropriate for the situation. Notification requirements vary between jurisdictions, and a multi-tiered contact structure may be required for regulatory bodies. Relevant food legislation must be followed to ensure appropriate notification of suspected or confirmed foodborne illness incidents. Once notification has occurred, it is often the responsibility of the relevant government departments to investigate the matter and assist with related processes, which may include Product Recall and Product Withdrawal.
If the business supplies foodstuffs manufactured to a customer’s specifications, it may be required to contact the customer before notifying the nominated regulatory body, particularly where private label (house brand) products are involved. Legal accountability for the regulatory compliance of a foodstuff may remain with the brand owner rather than the manufacturer, depending on the jurisdiction and contract. Any specific Business Continuity and Crisis Management requirements relating to those items should also be considered.
A health authority notification contact list should contain the following information:
Name of the primary contact;
Contact telephone number;
Contact email address;
Contact postal address;
Secondary contact details.
Outcomes of the notification process generally include details of:
What to do with the affected product;
How to correct the problem.
The following details should be recorded as part of notifications:
Who made the corrective and preventative action decision, including time and date;
The details and dates of the corrective action taken with the affected product;
The corrective action taken to fix the problem that caused the incident, and any preventative actions taken to prevent recurrence.
Business Continuity and Crisis Management Development Key Points
Business Continuity and Crisis Management programs must be developed to meet relevant Regulatory, Industry, and Customer standards and requirements;
The Senior Management of your business is committed to providing adequate resources for the development of your Business Continuity and Crisis Management program;
Should you require additional resources for the development of Business Continuity and Crisis Management program elements, please discuss this with the relevant Senior Management representative;
A properly developed Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly developed Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Documentation
To establish the developed detail in a viewable format to facilitate information.
Documentation
Document: A document provides guidance or direction for performing work, making decisions, or rendering judgments that affect the safety or quality of the products or services that customers receive.
Documented policies, procedures, work instructions, and schedules form the basis of any food safety and quality management system. The following documentation formats may be considered to ensure ongoing compliance with specified requirements for Business Continuity and Crisis Management:
Business Continuity and Crisis Management policy;
Business Continuity and Crisis Management development procedures;
Business Continuity and Crisis Management implementation procedures and work instructions;
Business Continuity and Crisis Management monitoring procedures;
Business Continuity and Crisis Management corrective and preventative action procedures;
Business Continuity and Crisis Management verification schedule;
Business Continuity and Crisis Management verification procedures;
Business Continuity and Crisis Management validation schedule;
Business Continuity and Crisis Management validation procedures;
Business Continuity and Crisis Management training procedures;
Business Continuity and Crisis Management contact listings;
Business impact analysis and recovery time objectives for critical activities;
Activation levels, triggers, and escalation procedures;
Crisis communication procedures and holding statements;
Records of mock exercises and post-incident reviews.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Documentation requirements in relation to their items.
You may wish to visit the Business Continuity and Crisis Management Templates section of haccp.com for examples of Business Continuity and Crisis Management documentation, record, and resource formats commonly applied within food safety and quality systems.
Business Continuity and Crisis Management Documentation Key Points
Business Continuity and Crisis Management programs must be documented to meet relevant Regulatory, Industry, and Customer standards and requirements;
All documented Business Continuity and Crisis Management program elements must be controlled to ensure compliance;
Key documented Business Continuity and Crisis Management program elements should be available to your business’s team at all times to ensure they can carry out required tasks;
A properly documented Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly documented Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Implementation
To facilitate the application of the documentation.
Implementation
Implementation: Implementation is the application of documented food safety and quality system elements into the actual business operation.
The implementation of Business Continuity and Crisis Management within any food business requires genuine commitment from senior management, staff, contractors, and visitors to ensure the nominated goals of implementation are achievable on an ongoing basis. It is a step that requires significant planning and consideration of general and specific food business circumstances, so that the outcomes of Business Continuity and Crisis Management do not negatively affect the safety and quality of the food items dispatched from the business.
Implementation of Business Continuity and Crisis Management must include a clear definition of responsibilities and authorities for all levels of participation by senior management, staff, contractors, and visitors to the site.
When implementing Business Continuity and Crisis Management within a food safety and quality system, the following requirements may be considered before completion:
Communication and display of the Business Continuity and Crisis Management policy;
Completion of verification and validation of Business Continuity and Crisis Management development procedures;
Availability of Business Continuity and Crisis Management implementation procedures and work instructions;
Availability of Business Continuity and Crisis Management monitoring procedures and record templates where applicable;
Availability of Business Continuity and Crisis Management corrective and preventative action procedures and record templates where applicable;
Availability of the Business Continuity and Crisis Management verification schedule and procedures;
Availability of the Business Continuity and Crisis Management validation schedule and procedures;
Completion of Business Continuity and Crisis Management training procedures;
Completion of product design and development requirements related to Business Continuity and Crisis Management;
Completion of process design and development requirements related to Business Continuity and Crisis Management;
Completion of training for team members who have responsibilities and involvement within Business Continuity and Crisis Management;
Completion of competency approval for team members who have responsibilities and involvement within Business Continuity and Crisis Management;
An initial mock activation of the system to confirm that contact listings, responsibilities, and recovery arrangements work as intended.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Implementation requirements in relation to their items.
Business Continuity and Crisis Management Implementation Key Points
Business Continuity and Crisis Management programs must be implemented to meet relevant Regulatory, Industry, and Customer standards and requirements;
Your Business Continuity and Crisis Management program must be fully implemented in line with relevant documented Policies, Procedures, and Work Instructions;
The implementation of Business Continuity and Crisis Management requires a commitment to the provision of resources by the Senior Management of your business;
A properly implemented Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly implemented Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Monitoring
To review, confirm and document evidence of the implementation against documented limits.
Monitor
Monitoring: Monitoring is the act of reviewing and confirming measurable parameters of a defined process or product status.
Monitoring requirements within food industry sectors are generally identified against limits of acceptability defined within HACCP plans, implementation procedures, and work instructions. Monitoring usually includes some element of record-keeping, which may be maintained manually or through digital systems. Advancements in technology have produced many systems and processes that are self-monitored or self-adjusted when variances are identified. Regardless of the system used, the goal of any monitoring activity is to provide sufficient evidence that any limit of acceptability has been met.
Traditional Business Continuity and Crisis Management monitoring requirements include manual recording and the application of corrective actions when the results of monitoring are found to be outside acceptable limits. Corrective actions should also be strongly linked to the monitoring process to ensure full traceability of the actions applied.
Common monitoring activities and record formats that may apply to Business Continuity and Crisis Management include:
Templates for responses and statements to an incident managed through the Business Continuity and Crisis Management system;
Records of Business Continuity and Crisis Management verification activities;
Records of mock exercises, including timeframes achieved against targets;
Checks that contact listings are current, with dates and the person responsible recorded;
Review of the readiness of emergency equipment and alternative supply arrangements where applicable.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Monitoring requirements in relation to their items.
You may wish to visit the Business Continuity and Crisis Management Templates section of haccp.com for examples of Business Continuity and Crisis Management documentation, record, and resource formats commonly applied within food safety and quality systems.
Business Continuity and Crisis Management Monitoring Key Points
Monitoring provides real-time confirmation and evidence that your risk-based food safety and quality controls are effectively implemented;
Business Continuity and Crisis Management programs must be monitored to meet relevant Regulatory, Industry, and Customer standards and requirements;
Monitoring of Business Continuity and Crisis Management must be carried out in line with relevant documented Policies, Procedures, and Work Instructions;
Nominated monitoring records for Business Continuity and Crisis Management must be maintained in line with relevant documented Policies, Procedures, and Work Instructions;
A properly monitored Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly monitored Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Corrective Action and Preventative Action
To apply “real time” interventions to documented monitoring limits.
Corrective Action
Corrective Action: Corrective action is mandatory action to be taken when a deviation from the quality system occurs, particularly in relation to a Critical Control Point.
Preventative Action: At any step in the process where a hazard has been identified, preventative action must be put into place to prevent recurrence.
Corrective action and preventative action are implemented to ensure that any identified non-conformance is documented, investigated, and rectified within appropriate timeframes. Corrective action is any action applied to regain control over a product, process, policy, or procedure that has been identified as non-conforming or outside nominated limits of acceptability. Preventative action is any action applied to prevent an identified non-conformance from recurring.
The outcomes of corrective and preventative actions should result in regained process control after effective application. Specified corrective actions are commonly linked to the HACCP plan and the food business certification process.
Below are corrective action and preventative action examples that may be associated with Business Continuity and Crisis Management non-conformance:
Review of the Business Continuity and Crisis Management policy;
Review of the Business Continuity and Crisis Management development procedures;
Review of the Business Continuity and Crisis Management implementation procedures and work instructions;
Review of the Business Continuity and Crisis Management monitoring procedures;
Review of the Business Continuity and Crisis Management corrective and preventative action procedures;
Review of the Business Continuity and Crisis Management verification schedule;
Review of Business Continuity and Crisis Management verification procedures;
Review of the Business Continuity and Crisis Management validation schedule;
Review of Business Continuity and Crisis Management validation procedures;
Review of Business Continuity and Crisis Management training procedures;
Retraining in Business Continuity and Crisis Management;
Review of management review activities to include Business Continuity and Crisis Management as an agenda item;
Initiation of product hold procedures where safety or quality may be compromised;
Initiation of a product recall or recall procedures where investigations show that there is a substantial safety or quality risk to the released product;
Review of the approved supplier program for failed service providers whose services may be implicated as the cause of a Business Continuity and Crisis Management incident;
Contacting stakeholders, including customers, regarding any confirmed or potential Business Continuity and Crisis Management concerns involving their product;
A post-incident review after each activation or mock exercise, with the findings, lessons learned, and resulting actions recorded.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Corrective Action requirements in relation to their items.
You may wish to visit the Corrective Action and Preventative Action section of haccp.com for examples of best practice applications for this food safety and quality system element.
Business Continuity and Crisis Management Corrective Action and Preventative Action Key Points
The implementation of Corrective Action and Preventative Action provides confidence that your food safety and quality program is effectively implemented and that food safety and quality criteria are being met;
Where deviations or variations are observed, corrective action and preventative action must be carried out to meet relevant Regulatory, Industry, and Customer standards and requirements;
Corrective Action and Preventative Action of Business Continuity and Crisis Management must be carried out in line with relevant documented Policies, Procedures and Work Instructions;
Records of corrective action and preventative action for Business Continuity and Crisis Management must be maintained in line with relevant documented Policies, Procedures and Work Instructions;
Proper application of Corrective Action and Preventative Action for your Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
Poor application of Corrective Action and Preventative Action for your Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Verification
To review and confirm documented monitoring and corrective actions against documented parameters.
Verify
Verification: The act of reviewing, inspecting, testing, checking, auditing, or otherwise establishing and documenting whether items, processes, services, or documents conform to specified requirements.
Verification is the detailed review of all food safety and quality system elements to confirm that they are effectively developed, documented, implemented, monitored, and reviewed. All food safety and quality system elements, including documented policies, procedures, training, HACCP plans, and their operational applications, should be verified on an ongoing scheduled basis. The verification process commonly includes a defined schedule of the verification activities required, how often they are conducted, who is responsible, and detailed documented procedures for each nominated verification activity.
The general goal of an established verification process is to ensure that any systemic non-conformance is identified and rectified within an appropriate timeframe. When non-conformance is identified through the verification process, corrective actions and preventative actions should be implemented to ensure it does not affect the effectiveness of the food safety and quality system.
The following examples of verification activities may apply to Business Continuity and Crisis Management:
Review of the Business Continuity and Crisis Management policy;
Review of the Business Continuity and Crisis Management development procedures;
Review of the Business Continuity and Crisis Management implementation procedures and work instructions;
Review of the Business Continuity and Crisis Management monitoring procedures;
Review of the Business Continuity and Crisis Management corrective and preventative action procedures;
Review of Business Continuity and Crisis Management monitoring records;
Review of the Business Continuity and Crisis Management verification schedule and procedures;
Review of the Business Continuity and Crisis Management validation schedule and procedures;
Review of Business Continuity and Crisis Management training procedures;
Review of Business Continuity and Crisis Management performance since the last review and historically;
Analytical testing of product or process to confirm the effectiveness of Business Continuity and Crisis Management where applicable;
Inclusion of Business Continuity and Crisis Management as an agenda item within the Management Review process;
Review of Business Continuity and Crisis Management contact listings at least annually, as best practice, and more often where personnel or supplier details change;
Requesting and updating validation certifications for relevant service providers and recovery specialists within the Business Continuity and Crisis Management system;
Activation, recording, and review of a mock Business Continuity and Crisis Management incident on a scheduled basis, at least annually, to confirm the effectiveness of the documented procedures and policies.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Verification requirements in relation to their items.
You may wish to visit the Verification Activities section of haccp.com for examples of best practice applications for this food safety and quality system element.
Business Continuity and Crisis Management Verification Key Points
Your verification program provides evidence that your food safety and quality controls have worked;
Business Continuity and Crisis Management programs must be verified to meet relevant Regulatory, Industry, and Customer standards and requirements;
The verification of Business Continuity and Crisis Management must be carried out in line with relevant documented Policies, Procedures and Work Instructions;
Nominated verification records for Business Continuity and Crisis Management must be maintained in line with relevant documented Policies, Procedures, and Work Instructions;
A properly verified Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly verified Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Validation
To confirm the documented monitoring or procedural limits.
Validate
Validation: The process of gathering evidence to provide a scientific basis for the documented act of demonstrating that a procedure, process, or activity will consistently lead to the expected results. It often includes the qualification of systems and equipment.
Validation is the provision of evidence to support the limits of control or acceptability nominated within systemic elements. For Business Continuity and Crisis Management, this typically means confirming that the recovery timeframes, response targets, and resources defined in the plan are realistic and achievable.
Common sources of validation include regulatory and legislative standards, customer requirements, industry codes of practice and guidelines (such as ISO 22301), verified and validated research, historical incidents and process control outcomes, and the results of mock exercises.
Validation activities are commonly defined within the verification schedules and procedures of established food safety and quality management systems.
The following examples may apply to validation of Business Continuity and Crisis Management:
Confirmation that recovery time objectives and maximum tolerable outage periods are achievable, using mock exercise results and historical incidents;
Confirmation that nominated response timeframes, such as the time to assemble the team, trace product, and notify customers and authorities, are met in mock exercises;
Confirmation that alternative supply, storage, and production arrangements can operate at the capacity assumed in the plan;
Confirmation of analytical testing methods used to assess the safety and quality of product after an incident, to ensure the accuracy of outcomes.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Validation requirements in relation to their items.
You may wish to visit the Validation Activities section of haccp.com for examples of best practice applications for this food safety and quality system element.
Business Continuity and Crisis Management Validation Key Points
Your validation program provides evidence that your food safety and quality controls will work;
Business Continuity and Crisis Management programs must be validated to meet relevant Regulatory, Industry, and Customer standards and requirements;
The validation of Business Continuity and Crisis Management must be carried out in line with relevant documented Policies, Procedures and Work Instructions;
Nominated validation records and supporting documentation for Business Continuity and Crisis Management must be maintained in line with relevant documented Policies, Procedures, and Work Instructions;
A properly validated Business Continuity and Crisis Management program will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
A poorly validated Business Continuity and Crisis Management program will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
Training, Competency and Resources
Skills, knowledge and competency requirements to facilitate development, documentation, implementation, monitoring, corrective action, verification and validation of every Food Safety and Quality System Element.
Skills and Knowledge
Skills and Knowledge: Skills and knowledge are attributes of human interactions commonly linked to competency within any specified job-related task.
Training and competency requirements for Business Continuity and Crisis Management must be ongoing, including regularly scheduled reviews to ensure the effectiveness of training and competency outcomes.
Team members who have defined responsibilities regarding Business Continuity and Crisis Management should have knowledge including:
Basic Business Continuity and Crisis Management requirements;
Positive outcomes of Business Continuity and Crisis Management;
Negative outcomes of a lack of Business Continuity and Crisis Management;
Current Business Continuity and Crisis Management procedures, methods, and techniques;
General operational, corporate, and social awareness regarding Business Continuity and Crisis Management;
Regulatory, industry, and customer requirements regarding Business Continuity and Crisis Management.
Team members who have defined responsibilities regarding Business Continuity and Crisis Management should have skills including:
Competency regarding basic Business Continuity and Crisis Management;
Effective application of current Business Continuity and Crisis Management procedures, methods, and techniques;
Participation in mock activations and practice in crisis communication;
The basic development, documentation, and implementation of HACCP and Prerequisite Programs (see Good Manufacturing Practices) within the food industry sector.
Team members who have defined responsibilities regarding Business Continuity and Crisis Management should have access to resources including:
Business Continuity and Crisis Management training;
Business Continuity and Crisis Management associations and events;
Regulatory standards, and industry and customer information and updates regarding Business Continuity and Crisis Management;
Incidents within the food industry sector regarding Business Continuity and Crisis Management;
Commitment to Business Continuity and Crisis Management by senior management;
Suitably qualified food industry professionals with verified experience in Business Continuity and Crisis Management;
Effective communication systems, including email, internet, and phone, through which Business Continuity and Crisis Management information can be sent and received within suitable timeframes.
If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific Business Continuity and Crisis Management Training, Competency, and Resources requirements in relation to their items.
You may wish to visit the Training, Competency, and Resources section of haccp.com for examples of best practice applications for this food safety and quality system element.
Business Continuity and Crisis Management Training, Skills and Knowledge Key Points
Your Training, Skills, and Knowledge program ensures all participating personnel, contractors, and visitors have the required skills and knowledge to effectively meet the requirements of your food safety and quality program;
Training, Skills and Knowledge programs for Business Continuity and Crisis Management must be carried out to meet relevant Regulatory, Industry, and Customer standards and requirements;
Training, Skills and Knowledge programs for Business Continuity and Crisis Management must be carried out in line with relevant documented Policies, Procedures, and Work Instructions;
Training, Skills and Knowledge records for Business Continuity and Crisis Management must be maintained in line with relevant documented Policies, Procedures, and Work Instructions;
Properly applied Training, Skills, and Knowledge programs for Business Continuity and Crisis Management will provide a strong framework for your business to maintain compliance with relevant Regulatory, Industry, and Customer standards and requirements;
Poorly applied Training, Skills, and Knowledge programs for Business Continuity and Crisis Management will not fully support your business and may contribute to significant non-compliance against Regulatory, Industry, and Customer standards and requirements.
We use cookies to give you the best experience on our website. By continuing to use this site, accepting these terms, or by closing this message, you agree to the storing of cookies on your device to enhance site navigation, Please feel free to view our Privacy Policy as required.
