Chapter 1: Implement food safety and quality systems

Food safety and quality assurance are fundamental pillars in Kenya’s food processing industry, ensuring that products meet both local and international standards. Implementing robust food safety and quality systems protects consumers from health risks and enhances the competitiveness of Kenyan food products in global markets. This chapter explores key international standards and systems that guide food safety and quality management, focusing on their application within Kenyan food processing contexts.

1.1 Food safety and quality systems

Food safety and quality systems are structured frameworks that a food processor uses to produce safe food of consistent quality, batch after batch. Food safety is about the absence of hazards that could harm the consumer; quality is about meeting the requirements the customer, the law and the processor have set for the product. A flour mill, a fruit juice plant or a milk processing plant needs both, and a system gives each requirement an owner, a procedure and a record. This topic covers the ISO 9000 family for quality management, ISO 22000 for food safety management with the HACCP method inside it, and the Hazard ARPC approach to preventive controls.

1.1.1 ISO 9000

The ISO 9000 family is a set of international standards on quality management systems that any organisation can use, including a food processor. A quality management system is the set of policies, processes and records an organisation uses to meet customer and legal requirements and to improve. Three members of the family matter to a food technologist: ISO 9000:2015 gives the fundamentals and the vocabulary, ISO 9001:2015 sets out the requirements an organisation is audited against, and ISO 9004 gives guidance on sustained success. Only ISO 9001 is used for certification, because ISO 9000 contains no requirements to audit.

Principles of ISO 9000 quality management

ISO 9000:2015 rests on seven quality management principles that guide the design of a quality management system.

• Customer focus: The organisation understands what customers need and works to meet it. A juice plant may adjust bottle size and shelf life after retailers ask for a smaller pack.
• Leadership: Managers set a common direction and create conditions in which people work towards the quality objectives. A plant manager who reviews rejected-batch figures every week shows the direction is real.
• Engagement of people: Competent, empowered staff at every level improve quality. Operators on a tea packing line who are asked how a defect arises often know the cause before the laboratory does.
• Process approach: Activities are managed as interrelated processes that work as one system. Reception, storage, processing, packing and dispatch are planned together, so a delay at one stage is seen at the next.
• Improvement: The organisation keeps improving its processes. A cleaning schedule that is revised after swab results show residues is an example.
• Evidence-based decision making: Decisions rest on analysed data. Microbial counts, moisture readings and complaint trends tell a manager more than opinion does.
• Relationship management: The organisation manages its relationships with suppliers and other interested parties. Agreed raw material specifications and regular supplier visits reduce variation at intake.

Structure and components of ISO 9001:2015

ISO 9001:2015 specifies the requirements for a quality management system in ten clauses. Clauses 4 to 10 hold the requirements, and each can be seen in a food plant.

• Context of the organisation: The organisation identifies the internal and external issues that affect quality and the needs of interested parties, including regulators such as the Kenya Bureau of Standards (KEBS).
• Leadership: Top management shows commitment, sets a quality policy that fits the business and assigns responsibilities.
• Planning: Risks and opportunities that could affect product quality are identified, and actions and measurable quality objectives are planned.
• Support: Resources, competent people, awareness, communication and controlled documented information are provided.
• Operation: Production and service are planned and controlled, for example by controlling fermentation time in a brewery or the drying temperature of a dried fruit line.
• Performance evaluation: Monitoring, measurement, internal audit and management review show whether the objectives are met.
• Improvement: Nonconformities are corrected, causes are removed through corrective action, and the system is improved continually.

Benefits of certification to ISO 9001

A processor that is certified to ISO 9001 by an independent certification body gains the following.

• Market access: Many export buyers and large retailers ask suppliers for certified systems, so certification can open or keep a market.
• Customer confidence: Documented and audited processes give customers a reason to trust the supplier.
• Operational efficiency: Standard methods reduce wastage and rework, for example fewer reprocessed batches in a flour mill.
• Legal compliance support: A documented system makes it easier to show how the requirements of laws such as the Food, Drugs and Chemical Substances Act are met.
• Culture of improvement: Internal audits and management reviews make improvement a routine activity.

Implementation challenges in the Kenyan food industry

Food processors often meet the following obstacles when they introduce an ISO 9001 system.

• Cost: Training, consultancy, laboratory equipment and certification audits are expensive for a small enterprise.
• Limited awareness: Owners and supervisors may not know the requirements or the benefits.
• Weak testing capacity: A plant without reliable laboratory access cannot produce the data the system depends on.
• Resistance to change: Staff used to informal methods may resist written procedures.
• Documentation load: Keeping procedures and records current can overwhelm a small team unless the system is kept simple.

1.1.2 ISO 22000

ISO 22000 is an international standard for food safety management systems for any organisation in the food chain. It combines the HACCP method with management system requirements, so the same standard covers hazard control and the management of the system that controls them. The current edition is ISO 22000:2018 (with Amendment 1 of 2024 on climate action changes), which replaced the 2005 edition and follows the same clause structure as ISO 9001:2015, so a plant that already holds an ISO 9001 system can add food safety to it.

Core elements of ISO 22000

ISO 22000 rests on four elements that work together.

• Interactive communication: Information on hazards and controls passes up and down the food chain, between suppliers, the processor, customers and regulators.
• System management: Food safety is built into the management system, with a policy, objectives, planning, internal audit and management review.
• Prerequisite programmes: The basic hygiene and operating conditions, such as sanitation, pest control and personnel hygiene, that must be in place before hazards are controlled at specific steps.
• HACCP principles: A systematic method of identifying, evaluating and controlling the hazards that are significant for food safety.

Application of ISO 22000 in Kenyan food processing

A processor uses ISO 22000 to show regulators and customers that its hazards are known and controlled. The way it is applied depends on the product.

• Milk processing plants: Temperature control at reception, pasteurisation and cold storage protects against pathogens that grow in milk.
• Fruit juice processors: Hazard analysis covers raw fruit washing, the heat treatment step and the filling of containers.
• Bakeries: Control of allergens, ingredient sourcing and the cleaning of shared equipment is planned and recorded.
• Exporters: Buyers abroad often ask for certification to ISO 22000 or to a scheme built on it, such as FSSC 22000, before they place orders.
• Maize millers: Checks on incoming grain for moulds and toxins, and on foreign matter before milling, are written into the plan.

Advantages and limitations of ISO 22000

ISO 22000 brings clear gains, and it also has limits that a processor should weigh before it starts.

• Advantages:

  • It gives a structured way to assure food safety through the supply chain.
  • It supports trade because buyers in many countries recognise it.
  • It encourages systematic hazard control and continual improvement.
  • It builds consumer confidence in locally processed foods.
  • It combines easily with ISO 9001 in one management system.

• Limitations:

  • Implementation and certification costs can be high for small processors.
  • Skilled people are needed to carry out hazard analysis and monitoring.
  • Documentation and record keeping take time.
  • A shortage of accessible testing laboratories can limit verification.
  • Informal processors may be reluctant to adopt formal systems.

1.1.2.1 Hazard analysis and critical control points (HACCP)

HACCP is a preventive method that identifies the hazards significant for the safety of a food and controls them at the steps where control is essential. It is built into ISO 22000, and it is applied by a team that knows the product and the process. A hazard is a biological, chemical or physical agent in food that could cause harm to the consumer. A critical control point (CCP) is a step at which control can be applied and is essential to prevent or eliminate a hazard or reduce it to an acceptable level. ISO 22000 also recognises operational prerequisite programmes, which control hazards at steps where the control uses action criteria instead of critical limits. HACCP works only on top of sound hygiene, so the prerequisite programmes described under Pre-requisite programs and Good Manufacturing Practices must be in place first.

The three groups of hazard are:

• Biological: bacteria such as Salmonella, viruses, parasites and the moulds that grow on poorly dried grain.
• Chemical: cleaning chemical residues, pesticide residues, mycotoxins such as aflatoxin, and undeclared allergens.
• Physical: metal fragments, glass, stones, plastic and other foreign matter.

Before the principles are applied, the team completes five preparatory steps:

• Assemble the HACCP team: It includes production, quality, engineering and hygiene staff, with someone trained in HACCP.
• Describe the product: Ingredients, composition, packaging, storage conditions and shelf life are written down.
• Identify intended use: The team notes who will eat the product and whether any group, such as infants, is more vulnerable.
• Draw a flow diagram: Every step from raw material receipt to dispatch is shown in order.
• Confirm the flow diagram on site: The team walks the line, at different times of the day, and corrects the diagram where it differs from practice.

The seven HACCP principles then follow in order:

1. Conduct a hazard analysis: list the hazards at each step, judge their likelihood and severity, and decide which are significant and which control measures apply.
2. Determine the critical control points: decide, using a decision tree or structured questions, which steps are CCPs. A hazard that a prerequisite programme already controls does not need a CCP.
3. Establish critical limits: set the measurable value that separates safe from unsafe at each CCP, such as a minimum temperature, a maximum time or a maximum pH.
4. Establish a monitoring system: decide what is measured, how, how often and by whom, so that loss of control is seen at once.
5. Establish corrective actions: define in advance what is done to the product and to the process when a critical limit is not met.
6. Establish verification procedures: confirm that the plan works as designed, through audits, record review, calibration of instruments and product testing.
7. Establish documentation and record keeping: keep the plan, the hazard analysis and the monitoring, corrective action and verification records.

The table shows how two steps could be written up in a plan. The limits are set from the validated process and from legal requirements, so the entries describe the type of limit and not a fixed figure.

Monitoring and verification in daily operation are covered under Importance of regular monitoring and verification, and the records a HACCP plan needs are covered under Food safety and quality records.

1.1.3 Hazard ARPC

Hazard ARPC stands for Hazard Analysis and Risk-Based Preventive Controls, written HARPC, a preventive approach to food safety. The name comes from the United States Food Safety Modernization Act and its rule on preventive controls for human food. A food facility that manufactures, processes, packs or holds food for people in the United States, including a facility outside the country, is generally expected to have a written food safety plan of this kind unless an exemption applies. HARPC is therefore a market requirement for a Kenyan exporter who ships to that market, not an ISO standard and not a Kenyan legal requirement. Its method is close to HACCP, so a processor that already runs HACCP has much of the foundation in place.

Concept and purpose of HARPC

HARPC puts prevention first. The facility analyses hazards, judges the risk, and applies a control to every significant hazard before the hazard can reach the consumer, instead of reacting to a problem after it appears.

• Hazard analysis: Biological, chemical and physical hazards, including radiological hazards, allergens and hazards that come with ingredients, are identified.
• Risk-based approach: Controls are applied in proportion to how likely and how severe each hazard is.
• Preventive controls: Each significant hazard is matched with a control that prevents it or reduces it to an acceptable level.
• Written plan: The analysis and the controls are recorded in a food safety plan that is kept up to date.
• Accountability: A person qualified in preventive controls prepares the plan or oversees its preparation and review.

Components of a HARPC food safety plan

A food safety plan built on HARPC has the following parts.

• Hazard analysis: A written assessment of the known or reasonably foreseeable hazards for each product and process.
• Process controls: Controls such as cooking, heat treatment or chilling, with set parameters and values.
• Food allergen controls: Controls that prevent allergen cross-contact, such as scheduling, cleaning and correct labelling.
• Sanitation controls: Controls on the cleanliness of food contact surfaces and on cross-contamination from people and equipment.
• Supply-chain controls: Controls for hazards that a supplier controls, such as approved supplier lists, audits and certificates of analysis.
• Monitoring, corrections and corrective actions: Checks that controls are working and a defined response when they are not.
• Verification: Validation that the controls can work, review of records and calibration of instruments.
• Recall plan: A written procedure to trace and withdraw product when a hazard has reached the market.

How HARPC differs from HACCP

Steps in preparing a HARPC food safety plan

A processor that exports to the United States market can prepare a plan in the following steps.

1. Appoint a person who has completed recognised preventive controls training to lead the plan.
2. Describe each product, its ingredients and its intended use, and draw the flow diagram of the process.
3. Carry out the hazard analysis for every step, including hazards that arrive with raw materials and packaging.
4. Select the preventive controls for each significant hazard and set the parameters and values that must be met.
5. Write the monitoring, correction, corrective action and verification procedures for each control.
6. Prepare the supply-chain programme and the recall plan.
7. Keep the records, and review the plan whenever a product, process or supplier changes and at regular intervals.

Challenges and opportunities in adopting HARPC

Adoption in Kenya has costs and gains that a processor should weigh.

• Challenges:

  • Training and consultancy costs are high for small processors.
  • Skills in hazard analysis and in writing a plan are limited.
  • Supplier information is hard to obtain when raw materials come from many small farms.
  • Informal processors find formal records and recall procedures difficult to keep.

• Opportunities:

  • Access to export buyers who ask for a documented preventive controls system.
  • One set of hazard analysis records can serve HACCP, ISO 22000 and HARPC.
  • Better traceability helps a processor respond quickly to a complaint at home.
  • Mobile tools can support monitoring records and supplier documents.

Chapter Summary

This chapter explored the implementation of food safety and quality systems, highlighting key frameworks such as ISO 9000 and ISO 22000, with particular emphasis on the Hazard Analysis and Critical Control Points system as a vital tool for identifying and managing risks in food processing. It also addressed the importance of pre-requisite programs including Good Manufacturing Practices and Good Hygienic Practices that create foundational conditions for safe food production. The chapter examined various regulatory requirements, covering international standards like ISO and HALAL certifications, national standards enforced by KEBS, workplace standards, environmental regulations under NEMA, occupational safety through the OSH Act, and local health laws such as the County Public Health Act. Maintaining food quality and safety systems was discussed as an ongoing process involving regular monitoring and continuous improvement to ensure compliance and product integrity. Finally, the chapter underscored the critical role of accurate food safety and quality records in documenting processes, facilitating traceability, and supporting audits. Together, these components form an integrated approach essential for protecting consumers and sustaining trust in the food processing industry.