Ask your desiccated coconut supplier one question: where is the kill step, and who validated it? If the answer is “the dryer”, the process is not validated and the file will not survive an audit.
Codex names desiccated coconut a low-moisture food (CXC 75-2015 §2.1), a category defined as water activity 0.85 or below. Salmonella becomes harder to kill as water activity falls, and survives for months in dry product. Codex states the infectious dose in these foods is “thought to be very low”.
The commercial trade-off is simple. A validated desiccated coconut kill step costs the supplier process time and capital. Testing five 25 g units at the port costs the buyer almost nothing and proves almost nothing.
Is drying the kill step in desiccated coconut?
No. Codex places the lethality step before shredding, not in the dryer.
The Code of Hygienic Practice for Desiccated Coconut (CAC/RCP 4-1971) §IV.D(4)(b) requires that coconut meat, after washing and before shredding, be “subjected to an effective process to eliminate pathogenic organisms from the surface of the meat, such as immersion in an adequate quantity of boiling water for a period of not less than one and a half minutes”.
The desiccating clause that follows specifies no temperature and no time. It asks only for “a current of clean hot air free from chemical contamination”. No lethality claim attaches to drying anywhere in the code, which also bars manual handling of the meat after the kill step.
Industry practice, per the FSANZ imported food risk statement, is a water-bath pasteurisation of the raw meat at 80 °C for 8 to 10 minutes. That is the step to ask about. Not the dryer outlet.
What do the thermal numbers say?
Peer-reviewed data on desiccated shredded coconut is thin; one paper carries most of it. Dhowlaghar, Tang and Zhu (2021), in LWT 149:111851, measured inactivation at two water activities using a three-strain Salmonella cocktail.
| Water activity | Organism | D85 (min) | D90 (min) | z (°C) |
|---|---|---|---|---|
| 0.25 | Salmonella | 28.0 | 12.5 | 15.9 |
| 0.25 | E. faecium B-2354 | 40.0 | 24.2 | 18.2 |
| 0.45 | Salmonella | 15.5 | 6.0 | 12.4 |
| 0.45 | E. faecium B-2354 | 17.0 | 6.5 | 11.4 |
Read the direction as well as the values. At water activity 0.25 Salmonella needs 12.5 minutes at 90 °C per log reduction; at 0.45 the same log takes 6.0 minutes. Drier coconut is harder to pasteurise, which inverts the intuition that dry product is safer.
A 5-log target at 90 °C and 0.25 therefore implies 62.5 minutes at product temperature. That is desk arithmetic on published D-values, not a process recommendation. No ordinary drying pass delivers 5 log.
Is 5-log the required Salmonella reduction?
5-log is an industry convention. No regulator requires it for coconut. Codex §5.2.2 sets no fixed target: the reduction “should be determined considering the expected level of the target pathogen in the food prior to the microbial reduction treatment”.
The nearest binding US number for a comparable low-moisture commodity is 4-log, for California almonds under 7 CFR 981.442(b), mandatory since 1 September 2007. No equivalent order exists for coconut.
When a dossier says “5-log validated”, the follow-up is: against what incoming load, at what water activity, and where on the line? Without those three parameters it is a marketing number.
What belongs in a kill-step validation dossier?
Six documents. A validation is a study, not a certificate. Codex routes it through CXG 69-2008; US-facing manufacturers are bound by 21 CFR 117.160, which requires it be done by a preventive controls qualified individual before implementation, or within 90 calendar days of first production.
- The validation study, run at worst-case conditions: lowest water activity, largest particle size, highest assumed incoming load, lowest achievable line temperature.
- The surrogate justification. In-plant work cannot use Salmonella. Enterococcus faecium NRRL B-2354 is the accepted surrogate, with a limit: at water activity 0.45 its D-values at 85 °C and 90 °C were not significantly different from Salmonella. Codex requires the surrogate be chosen “based on data specific to the low-moisture food of interest”.
- Critical limits and monitoring records for the kill step itself, not the dryer.
- Verification records including instrument calibration, per 21 CFR 117.165.
- Corrective action records for deviation days.
- The environmental monitoring programme covering the zone after the kill step.
That last document carries more weight than most buyers expect.
Where does recontamination happen?
After the kill step. Codex §5.2.4 is direct: “The most stringent hygienic practices should be in place following a pathogen reduction step to prevent recontamination.”
§4.2.1 requires that zone to be physically separated, with hand-wash stations and water piping routed outside it. Codex calls limiting water “one of the primary means to control pathogens in low-moisture food establishments”.
§6.5 sets the monitoring target: Salmonella itself, with Enterobacteriaceae as an optional process-hygiene indicator. The attached warning matters — “testing for EB alone is not sufficient, since even low levels of EB do not guarantee the absence of Salmonella”. A programme that swabs only for Enterobacteriaceae has not met the intent.
What Salmonella limits actually apply?
Fewer than most buyers assume.
| Standard / jurisdiction | Salmonella criterion for desiccated coconut |
|---|---|
| Codex CXS 177-1991 (Rev. 2011) | None. §6.2 defers to CAC/GL 21-1997; the methods table covers moisture, ash, oil and acidity only |
| Codex CAC/RCP 4-1971 §V.B | Qualitative only: product “should not contain pathogenic microorganisms such as salmonellae” |
| EU Reg. (EC) 2073/2005, Annex I Ch. 1 | No coconut row, no dried-fruit row, no general ready-to-eat row in the consolidated text |
| Australia, Food Standards Code Schedule 27 | n=10, c=0, not detected in 25 g (compilation in force 18 June 2025) |
| United States | No numerical action level. Salmonella presence renders food adulterated under 21 U.S.C. 342(a)(1) |
Australia is the outlier and the practical benchmark. Its plan for dried, chipped and desiccated coconut is n=10, twice the n=5 applied to pepper, cinnamon and cocoa powder. A COA showing five units does not meet Schedule 27.
Why lot testing cannot replace the kill step
Sampling maths. Codex §5.2.3 notes “the limited information end-product testing provides”, and recommends an environmental monitoring programme instead.
Run it yourself. In a lot where 1% of 25 g units would test positive, n=5, c=0 passes all five with probability 0.99 to the fifth power, roughly 95%. Australia’s n=10 gives roughly 90%. Both plans release a contaminated lot most of the time. Australia’s own inspection record shows why: between January 2007 and May 2016, 870 Salmonella tests on dried coconut produced 11 failures, a 1.3% rate. Low prevalence is the condition under which lot testing performs worst.
Has this caused actual recalls?
Twice in three months in 2018, in the US alone.
CDC recorded 27 illnesses across nine states with six hospitalisations, linked to Coconut Tree Brand frozen shredded coconut, recalled on 3 January 2018. A separate Salmonella Typhimurium outbreak reached 14 illnesses across eight states and DC, three hospitalised, tied to organic dried coconut recalled on 16 March 2018. An English outbreak of 18 cases in 1998 and 1999 was traced to one imported consignment, and RASFF logged nine Salmonella notifications for desiccated and dehydrated coconut between January 2007 and May 2016.
FSANZ assessed the hazard in November 2016 and did not rate it medium or high risk, because an effective control measure exists. That assessment predates both 2018 outbreaks. Its logic holds with the condition made explicit: risk is low when the pasteurisation step is present and validated.
What this means for buyers
- Procurement, CPG and food manufacturing: file the validation study in the supplier approval pack alongside the COA. Codex §5.3 already requires supplier approval and verification for sensitive ingredients, and coconut qualifies on the past-outbreak test.
- Shipping into Australia: write n=10, c=0 into the contract. A standard five-unit COA fails Schedule 27.
- Shipping into the EU or US: no product limit exists to fall back on. The obligation sits in HACCP and preventive controls, so the dossier is your compliance evidence.
- Multi-origin programmes: validation is plant-specific. A dossier from one Sri Lankan mill says nothing about a second mill in Indonesia.
- Renewing a spec in 2026: FDA’s draft guidance on low-moisture ready-to-eat sanitation, published 7 January 2025, remains draft and does not name coconut.
FAQ
Does Codex set a Salmonella limit for desiccated coconut? No. CXS 177-1991 contains no microbiological criteria and defers to CAC/GL 21-1997. The separate code of practice, CAC/RCP 4-1971, says qualitatively that the product should not contain salmonellae, but sets no sampling plan or limit.
Is drying enough to kill Salmonella in coconut? No. Codex places the lethality step before shredding and specifies no time or temperature for drying. Published D-values indicate Salmonella needs over an hour at 90 °C at water activity 0.25 to reach 5 log.
Which surrogate validates a coconut kill step? Enterococcus faecium NRRL B-2354. In desiccated shredded coconut it is more heat resistant than Salmonella at water activity 0.25, but the margin narrows at 0.45. The supplier must justify it at your product’s water activity.
Does a GFSI certificate prove the kill step is validated? No. GFSI-benchmarked schemes require validated control measures, but the certificate does not show you the study. Ask for the validation document itself and the environmental monitoring data behind it.
Locking a kill-step clause across origins? Send the desk an RFQ.