What is the difference between HACCP and HARPC?

They sound very similar, but there are distinct differences between them.  Some, which at first seem contradictory.  In this weeks post I’m going to go through the requirements for both, the similarities, the differences and how to comply with both.

Comparing HACCP & HARPC

The following compares the 12 logic sequence steps as defined in Codex used for HACCP, to the requirements of the preventive control rule which defines the rules for HARPC.

Codex (HACCP)

Pre-requisite Programmes (PRPs)

Codex states that the HACCP plan must be based good hygienic practises, which it defines as pre-requisite programmes.

Preventive Rule (HARPC)

The preventive control rule includes the two following typical pre-requisite programmes:

  • Implement a supply chain program
  • Have a recall plan


The preventive rule does not specifically require pre-requisite programmes to be in place.

However, it does expect CGMPs (current good food manufacturing practices) to be in place.

The CGMPs would also not be taken into consideration when carrying out the hazard analysis, as pre-requisites would when conducting a HACCP study.

Codex (HACCP)

Preparatory stages 1 – Assemble the team

The team:

  • ideally should be multi-disciplinary
  • can use outside expert help
  • should define the scope
    • start and end points
    • hazards to be considered

Preventive Rule (HARPC)

  1. Define the scope of the assessment

Food safety hazard analysis must consider:

  • Known inherent hazards
  • hazards which could ‘reasonably occur’

The hazards categories that must be considered are:

  • Microbiological
  • Chemical, including radiological
  • physical

The hazards may be caused because

  • they are inherent to the raw material or product
  • they occur through error during the process
  • be carried out deliberately for economic gain (for food safety only)


The FDA do not refer to ‘scope’, however when you compare the requirements there are a number of elements such as defining the hazards, which we would expect to see in a typical HACCP scope.

The FDA go one step further than HACCP by specifically stating that not only typical manufacturing hazards should be included, but also those that are inherent to the raw material and also those due to food fraud.

Codex (HACCP)

Preparatory stages 2 – Describe the product

Relevant safety information about the product should include:

  • composition
  • intrinsics such as aw, pH etc.
  • treatments which reduce, eliminate or hold microbial levels, such as cooking, freezing etc.
  • packaging
  • durability
  • storage conditions
  • distribution methods

Preventive Rule (HARPC)

No specific comparison to Codex.


The preventive rule does not state that a product description is required, however an understanding of the intrinsics of the product would be necessary anyway, due to:

  • to meet the production and process control element of the CGMPs
  • to enable inherent risks of the raw material and product to be established

Therefore, it would be advisable to have this included in the preparatory information, although it could be structured in a way in which meets the requirements of the product, rather than being set by Codex.

Codex (HACCP)

Preparatory stages 3 – Identify the intended use

This should:

  • who the product is produced for (the customer)
  • the expected uses by the customer
  • who the product is not suitable for

Preventive Rule (HARPC)

No specific comparison to Codex.


Again, the FDA have not specified that this is required, but in order to establish all of the required hazards that need to be included in the analysis, an understanding of the intended use and intended user is essential.

Codex (HACCP)

Preparatory stages 4 -Construct flow diagram

The process flow should cover all steps in the manufacturing process off the product, in line with the scope (start and end points)

Preparatory stages 5 – On-site confirmation of flow diagram

Walk the process flow, confirming the steps

Preventive Rule (HARPC)

No specific comparison to Codex.


The preventive rule does not specify a process flow diagram is required.

Although it would probably advantageous to have one, to assist in identification of the relevant hazards.

However, the manufacturing process may not be only process where hazards should be identified. To ensure food fraud is covered, hazards would need to be identified prior to the raw materials delivery to site. Also, hazards may need to be included which may occur in processes prior to the production of a product, such as during development or at the artwork/labelling stage – which would be out of the scope of a typical HACCP.

Codex (HACCP)

Codex principle 1 – Hazard analysis

  • List the potential hazards
  • carry out hazard analysis of severity and likelihood
  • consider control measures (not monitors)

Preventive Rule (HARPC)

  1. Identify the hazards

Sources of hazards to be considered are:

  • the environmental (FDA specifically quote pathogens from the environment which may contaminated ready-to-eat foods)
  • the recipe or formulation
  • ingredients (inherent risks)
  • the manufacturing processes
  • the fabrication of the facility
  • the equipment used
  • the tools used
  • the intended use of the food
  1. Carry out hazard analysis

The analysis must include severity and likelihood (FDA terms this probability of occurrence) in the absence of preventive controls


This is where it starts to get interesting. At first this may seem similar – identify the hazards and then carry out the hazard analysis using severity and likelihood to determine significance.

There is one key change though, which makes a massive difference – the hazard analysis is carried out without taking the current controls into consideration.

Typically in HACCP, the controls are taken into account when carrying out the hazard analysis, and in doing so this reduces the likelihood result.

Therefore, if controls were not taken into consideration, there would be a much greater number of hazards that come out of the analysis as significant.

So, comply with both HACCP and HARPC, this part of the typical HACCP hazard analysis method would need to be adjusted – so that all hazards were assessed without taking controls into consideration.

Just because the controls are not taken into account in the analysis, they would still need to be listed.

The type of controls that are listed, in order to comply with FSMA would need to be much more specific than you would see in a typical HACCP. Putting ‘training’ as a control for example would not be enough, as this is very vague and you could not actually prove the link between ‘training’ and the control of a hazard.

Where hazards are deemed not to be significant, they would need to be managed using the CGMPs (or as we would typically see in HACCP your pre-requisite programmes).

Codex (HACCP)

Codex principle 2 – Determine CCPs

  • Using a CCP decision tree

Preventive Rule (HARPC)

  1. Add preventive controls

To control each of the significant hazards, preventive controls must be applied.  The FDA advise that these will include measures such as (these are examples, not an exhaustive list):

  • process controls
  • food allergen controls
  • sanitisation controls
  • supply-chain controls
  • recall plan


Clearly this is a massive difference to HACCP, the CCPs are not a requirement of the preventive control rule.

All hazards that come out as significant in the hazard analysis need to be managed using preventive controls.

These controls can however, include CCPs if you wish.

In order to comply with both HACCP and HARPC, all the significant hazards would need to be put through the decision tree. Where CCPs are identified, these would be managed as CCPs. Where CCPs are not identified, these would be managed as preventive controls.

So now, we have three levels of control:

    • CCPs
    • Preventive controls
    • CGMP controls

The problem that we have here though, is that the reason that the hazard analysis for CCPs is carried out with the controls taken into consideration, is to ensure that only the really high risk hazards go through as being significant. The risk of having a lot of significant hazards, is that when these go through a typical CCP decision tree – a high proportion of them will come out as CCPs. Therefore, a new style of CCP decision tree will be required.

Codex (HACCP)

Codex principle 3 – Establish critical limits for each CCP

  • Define the critical limits that will control the CCP
  • Validate the critical limits

Preventive Rule (HARPC)

No specific comparison to Codex.


The FDA do not use the term ‘critical limit’. They would expect limits to be set where risk assessment determines it is required, but they state that not all preventive controls would require critical limits.

It can be presumed, that were critical limits are not provided, criteria should be set to provide the boundaries of control.

Therefore, this would mean that critical limits would need validation, but where criteria are applied instead – justification would be sufficient.

Codex (HACCP)

Codex principle 4 – Establish a monitoring system for each CCP

  • Define how the CCP will be monitored using the critical limits
  • Set frequency of monitoring
  • Records to be verified on completion

Preventive Rule (HARPC)

  1. Implement monitoring systems

For each preventive control required to manage a significant hazard, a monitoring procedure must be created and implemented, which includes:

  • Frequency
  • Process
  • Completion of records


Although the control that is being managed is different (CCP or preventive control), the way in which they should be managed is fully aligned.

Codex (HACCP)

Codex principle 5 – Establish corrective actions

  • Define what steps must be taken where monitoring shows deviation to the critical limits

Preventive Rule (HARPC)

  1. Add corrective actions and corrections

A procedure must be created and implemented for each preventive control, which covers:

  • where the monitoring procedure highlights a problem
  • where the monitoring procedure has not been adhered to


Again, the type of control may be different but the requirements are the same.

Codex (HACCP)

Codex principle 6 – Establish verification procedures

  • Define the verification activities
  • Review of the plan

Preventive Rule (HARPC)

  1. Verify the system

FDA state that verification must be implemented to show that the preventive controls are working.  Verification would include activities such as:

  • checking and signing off that preventive control records have completed and completed correctly
  • testing of raw materials, in process materials or finished product
  • verifying the accuracy of monitoring or measuring equipment
  • environmental testing
  • reviews, including trending e.g. complaints
  1. Reanalyse the system

The hazard analysis must be reviewed every 3 years as a minimum.  It must also be reviewed when:

  • there is a significant change which may change the hazards which affect the food
  • new information regarding food safety is received
  • a preventive control is found to be ineffective

Where the FDA say ‘where a preventive control is found to be ineffective’, they do not mean each time a preventive control monitor highlights a problem, or where a monitoring procedure has not been adhered to – but when it is realised that an existing preventive control does not control the hazard highlighted.


Verifying the system and ensuring that the system stays up to date and relevant are requirements in both HACCP and HARPC.

Codex (HACCP)

Codex principle 7 -Establish documentation and record keeping

  • To be able to provide evidence that the system is under control

Preventive Rule (HARPC)

FSMA now expects food facilities to have records to prove that protection measures have been applied and adhered to and these must be available on request of an audit.


Record are a requirement of both systems, the addition of preventive controls (to CCPs) means that additional records will be required, as evidence needs to be provided that the system was followed.


So, to summarise, although the systems have distinct differences, there are enough synergies to allow the systems to be run together – with a few tweaks.

In the next post I’ll go through the BRC Food Safety standard and assess the key differences, to highlight the additional requirements which will need to be introduced to comply with FSMA.

Please let me know your thoughts on the comparison above, can you see any additional issues?  Do you think you can adapt your current system to comply?

Have your say…

4 thoughts on “Your FSMA Companion: What is the difference between HACCP and HARPC?

  1. All of this information is great help in designing the plan for HARPC. However, taking it to the next step and bringing it to life as a stand alone or Combined with HACCP Plan is going to be very challenging. So many significant differences within the interpretation of the FSMA rule compared to HACCP that makes this process just a little deceiving. Don’t get me wrong your explanation of the comparison of the two is very helpful and very much appreciated. I still think that with our simple process we can combine the two plans into one that will meet the requirements of FSMA as well as comply with the Guidelines of HACCP and BRC Food Safety Standard. Very interested in your next post as it will bring more light to the beginning process of building the steps of HARPC into our HACCP Plan. The two plans should be able to work in conjunction with each other if formatted correctly. The design may be somewhat tricky in how they reference each other in various sections. Always up for a good challenge!

    1. Hi Kathryn,
      It’s definitely a challenge! 🙂 You’re right, it’s the small details in the differences that are going to make it hard – but not impossible! There will need to be some tweaks to the well established elements of HACCP, such as the decision tree – which is causing me a few headaches, but I think I’ve got a really simple solution forming in my head!
      Lots of work to do before the next post…
      Thanks, Kassy

  2. Your comparisons are very useful. Your statement about now having 3 levels of control reminds me a bit of the ISO 22000 format which includes OPRPs. I think once I’ve digested your next comparison with BRC I should be able to figure out how to encompass all that is required both sides of the pond! Maybe a colour coded system just like your comparison boxes might be worth a thought….

Share your thoughts…

Your email address will not be published. Required fields are marked *

We've tagged this article as:

Thousands of Food Techies all over the world read and trust our newsletter.

Sign-up to our newsletter and get our articles direct to your inbox - for free!