HARPC and complying with the preventive rule

Rather than work through FSMA systematically, rule by rule, I’m going to dive straight into the preventive controls rule and HARPC, as this seems to be the most popular request (thank you to Kathryn, Simon, Rina, Bronwyn, Karen, Carrie, Nicola and James for your feedback on the last post).

As a lot of sites have BRC – I’m also going to cover the differences between the preventive controls rule and the clauses of the BRC standard. However, first we need to do a bit of ground work and understand what the preventive control rule is (which we’ll cover in this post), how it differs from HACCP (which I’ll cover in the next post) and then the comparison to BRC (which I’ll cover in the post after that).

As I’ve said before, I would REALLY like this to be an interactive forum, so if you have any questions at all, or any comments – please share them in the comments section at the bottom of this post. I truly believe no question is a silly question, so please ask. Plus, if you don’t agree with something I’ve put or if you have a different interpretation, please share it with us.


A new term has been created since the launch of the FDAs FSMA – HARPC.  Pronounced ‘harp-see’.

HARPC stands for ‘hazard analysis and risk based preventive controls’.

Although it sounds similar to HACCP (hazard analysis and critical control points), it is fundamentally different. As a HACCP expert, the principles of HACCP have been drilled into me and I’ve found it difficult to get my head around the requirements of HARPC.

However, the more I learn about it and the more I think about how it would be applied in practice, the more I realised it requires a completely different mind-set.

I’ll explain why, but first we need to go through what the requirements are.

Implementing a preventive approach

The full title for the preventive controls rule is – Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.

In order to comply with FSMA the FDA have stated that a facility must:

  • Conduct a food safety hazard analysis
  • Implement preventive controls
  • Implement a supply chain program
  • Have a recall plan
  • Implement monitoring systems
  • Implement corrective action procedures
  • Conduct verification activities

All of the above are part of the preventive rule. However, those in blue are part of the hazard analysis system and those in green are what we would normally refer to as pre-requisite programmes, or the building blocks that support the food safety plan.

In order to understand how to implement a preventive control plan, to meet FSMA, we need to understand the steps required to complete the hazard analysis, or HARPC.

So what is HARPC?

I’ve broken down the requirements of the preventive controls rule of FSMA, into 8 HARPC steps, which are:

  1. Define the scope of the assessment
  2. Identify the hazards
  3. Carry out hazard analysis
  4. Add preventive controls
  5. Implement monitoring systems
  6. Add corrective actions and corrections
  7. Verify the system
  8. Re-analyze the system

I’ll take each one in turn and explain them.

1. Define the scope of the assessment

The FDA have defined the scope of the HARPC plan. The scope is focused solely on food safety.

  • The hazard analysis must consider:
  • Known inherent hazards
  • hazards which could ‘reasonably occur’

The hazards categories that must be considered are:

  • Microbiological
  • Chemical, this includes radiological
  • physical

The hazards may be caused because:

  • they are inherent to the raw material, product or process
  • they occur through error during the process
  • they are carried out deliberately for economic gain (for food safety only)

2.  Identify the hazards

Sources of hazards to be considered are:

  • the environmental (FDA specifically quote pathogens from the environment which may contaminated ready-to-eat foods)
  • the recipe or formulation
  • ingredients (inherent risks)
  • the manufacturing processes
  • the fabrication of the facility
  • the equipment used
  • the tools used
  • the intended use of the food

Key point to consider at this step is that we only need to include the hazards that could ‘reasonably occur’ (see step 1).

In HACCP we would normally include all hazards and use the likelihood assessment to mitigate them, using our pre-requisite controls.  If we were to adopt that approach here, we would end up with an unmanageable amount of unfocused preventive controls.

Therefore, I would expect a HARPC plan to be much shorter, but contain much more focused and ‘real’ hazard.

3. Carry out hazard analysis

The analysis must include:

  • severity and,
  • likelihood (FDA terms this probability of occurrence) in the absence of preventive controls

Note that the assessment is carried out in the absence of preventive controls.  This is different to HACCP, where we would carry out the assessment taking the controls into consideration. Therefore, it would be expected, that the likelihood results will be higher/greater.

Although the FDA haven’t explained the purpose of carrying out the hazard analysis, it would be reasonable to expect that it is to assess the significance the hazard. Therefore, a process of calculating significance based on the severity and likelihood assessment of the hazard is required.  If you would like to know more about significance and how to assess it, it’s the same as significance in HACCP – you can learn more about it in a previous post called “The purpose of hazard significance in HACCP”.

The calculation of significance is usually done through a scoring or a grid system.

Once the significance has been determined, only significant hazards are taken forward through the assessment. Those that are not deemed to be significant are managed through the normal controls that are in place.

4. Add preventive controls

To control each of the significant hazards, preventive controls must be applied.

The FDA advise that these will include measures such as (these are examples, not an exhaustive list):

  • process controls
  • food allergen controls
  • sanitization controls
  • supply-chain controls
  • recall plan

Note, that although the FDA have provided these as examples of preventive controls, they are not all controls.

The definition of ‘control’ in this context is to prevent, reduce or eliminate a hazard to an acceptable level.

So, a recall plan is not a control, as it does not prevent, reduce or eliminate the hazard from happening. It does prevent or reduce the impact of the unsafe food from reaching the consumer. This is why they’ve called it a recall plan, rather than recall control.  This means that you cannot have the recall plan listed as a preventive control for a hazard in your HARPC.  The recall plan, is there to support the whole system in the case of failure, as a correction (we’ll come on to corrections).

Key point at this stage – in HACCP we would normally list all the controls that may reduce the likelihood of a hazard occurring.  If we did this for HARPC, we would again, end up with an impractical amount of unfocused preventive controls.  Therefore, when applying a preventive control consideration must be made to what truly prevents that hazard from occurring. Where ever possible, I would try to implement a preventive control that positively confirms that the hazard is in control.

5. Implement monitoring systems

For each preventive control required to manage a significant hazard, a monitoring procedure must be created and implemented. The procedure must include the frequency of the verification and the process in which the verification must be carried out. The monitoring procedure must be appropriate to the nature of the hazard it is controlling – therefore the procedure needs to be justified or validated to prove that it does manage the hazard.

Records must be completed and retained to prove that the monitoring has been carried out, as set out in the procedure.

6.  Add corrective actions and corrections

A procedure must be created and implemented for each preventive control, which covers:

  • where the monitoring procedure highlights a problem
  • where the monitoring procedure has not been adhered to

For each of the instances above, a correction and corrective action must be applied:

Correction is identifying and correcting the specific current problem in a timely manner.  This includes evaluating any food which may be affected for food safety, correcting it so it is safe or disposing of it, so it doesn’t put consumer safety at risk.

Corrective action where the problem is assessed to its root cause, to prevent or reduce the likelihood of it occurring in the future.

7.  Verify the system

FDA state that verification must be implemented to show that the preventive controls are working.  However, they state that this should include validation of preventive controls, which would not be acceptable to any HACCP purists, as verification and validation are two very distinct and separate activities.

Verification would include activities such as:

  • checking and signing off that preventive control records have completed, and that they have been completed correctly
  • testing of raw materials, in process materials or finished product
  • verifying the accuracy of monitoring or measuring equipment
  • environmental testing
  • reviews, including trending such as complaints

8.  Re-analyze the system

The HARPC plan must be reviewed every 3 years as a minimum.

It must also be reviewed when:

  • there is a significant change which may change the hazards which affect the food
  • new information regarding food safety is received
  • a preventive control is found to be ineffective

Where the FDA say ‘where a preventive control is found to be ineffective’, they do not mean each time a preventive control monitor highlights a problem, or where a monitoring procedure has not been adhered to – but when it is realised that an existing preventive control does not control the hazard highlighted.


As you can see the steps of HARPC are very similar to HACCP.  But there are few significant differences, such as the fact that there is no mention of pre-requisite programmes and the purpose of the assessment is not to define CCPs, but rather preventive controls.

To me, at first, this was a difficult thing to accept. I’ve now got my head around it, but I’m still a little worried that by not having CCPs, that the really key food safety elements (which we would normally manage as CCPs), may get lost in all of the preventive controls.  I hope this doesn’t ‘water down’ the focus on them.  But I’m optimistic, I’m starting to warm to this approach and I think once I start working through the practicalities of implementing a HARPC system it will all become much more solid in my mind.

Next post I’ll share my learnings with you, as I go through the differences between HARPC and HACCP and what that actually means in practise when implementing such as system.

As always, I’d love to hear your thoughts on what I’ve covered in this post and any specific questions you may have.  Please also share you experiences and learnings too with your FSMA companions!  🙂

Have your say…

8 thoughts on “The Preventive Rule and HARPC

    1. Hi Haley,
      Hope you’re well?
      Yes, definitely – although the FDA haven’t detailed allergens as a hazard category in itself, but they do talk about allergen cross contact hazards and preventive controls. Therefore, I’m presuming they are listing it under the chemical hazard category.

  1. Hi Kassy,
    Since HACCP is accepted much more widely than HARPC, my guess is that my customers and third party audit schemes will still require a HACCP Plan. I’ve heard colleagues say the same and they are planning to treat HARPC more as taking over their PRPs and adjust their HACCP plans accordingly. This way, they have both in place to meet FSMA and second/third party requirements. From what you’ve determined thus far, is this a plausible approach? What should we, as the industry, do to comply with both requirements if it’s not?

    1. Hi Kaci,
      Yes, I totally agree with you. FSMA will apply to UK manufacturers that import into the US, and here we have to have a HACCP that complies with Codex by law, so both would be required. In my mind it should be possible to meet both sets of requirements, it’ll just need some thinking about how to practically achieve it, without it being too complex. In the next post (8th March) I’ll be covering the differences between HACCP and HARPC and so I may be able to touch on this subject then. However, I think it’s going to probably need a full post to this subject to do it right, so I think I’ll plan that in too. Let’s see how we go over the next few weeks – there’s so much to get through! 🙂

  2. Good Morning,
    I find this entire process kind of repetitious as it is very similar to HACCP. Unless I have a misconception of the requirements we are now going to have a HACCP Plan as well as a HARPC plan. Could you use HACCP as a reference in appropriate areas of your HARPC Plan?

    We are currently BRC Issue 7 certified. BRC Fundamental 2 is written for compliance in HACCP. Will there be, or is there already a Fundamental or clause that is specifically written for the compliance of HARPC? If so what clause is it?

    You have provided us with a great deal of information and it is genuinely appreciated. Putting the structure of this information into context that is not a repeat of the HACCP program may be somewhat challenging. If the two plans are necessary they should both have a special uniqueness to them that truly sets them apart from each other. This is the part that I am currently struggling with.

    Thank you,

    1. Hi Kathy,
      I totally hear your frustration. For those in the US or those that supply product into the US AND have a requirement to have HACCP (for your customers, for BRC or to meet local laws), you will need to comply with both the HACCP and HARPC requirements. I believe there is a way to have this in one plan though. One plan that does both things. Please bear with me and I’ll work it out and let you know how it can be achieved 🙂
      Regarding BRC and HAPPC – no, there are no clauses in BRC that request HARPC. Whether they amend the standard at some point to allow flexibility for both systems in the future, I’m not sure. But it would require quite a fundamental change, so I think they would wait until version 8 to do it, which is a little while away yet.

  3. Hello Kassy,

    Thank you so much for you insight on the differences of these principles so far. I found it most helpful realizing we need to asses the hazards without the preventative controls. I just wanted to clarify a comment about the hazard analysis portion of HARPC. In the end of section 3 you stated:

    “Once the significance has been determined, only significant hazards are taken forward through the assessment. Those that are not deemed to be significant are managed through the normal controls that are in place.”

    Are the hazards not deemed to be significant due to the normal controls mentioned, or because they are insignificant they can be managed through normal controls instead of preventive controls? Is this similar to HACCP in the sense of control points and critical control points? Also, if we are incorporating normal controls into our hazard assessment, how can we determine if our controls are considered normal or preventive?

    In my opinion, if these assessments are being performed without the preventive controls, we may identify more “significant hazards,” but these can easily be controlled by identifying systems we already have in place as our “preventive controls.”

    Kind regards,

    1. Hi Paula,
      I’m glad you’ve found the post useful. 🙂
      I would say yes to your second option; “because they are insignificant they can be managed through normal controls instead of preventive controls”. In my mind, just because they are not significant enough to food safety be managed using preventive controls, they still need to be managed – so other controls would be required (these in HACCP would normally be your pre-requisite controls). For example, very small pieces of soft plastic in a product may not cause someone harm if they ate them, but it’s still not right that they are there – so this hazard would still need to be managed (controlled).
      I totally agree with you, if the hazards are assessed without taking the preventive controls into consideration, there will definitely be many more significant hazards than you would see in a HACCP plan. You’re also correct by saying that you can use existing systems you have in place to control these hazards, essentially you’re just re-tagging them as preventive controls.
      The question I still need to get my head around is – is there a difference in the way we would manage preventive controls to manage food safety and other ‘normal’ controls for insignificant hazards? In HACCP when you identify a CCP, it’s clear that the CCP needs more focused management that an pre-requisite control. To comply with FSMA would preventive controls to be managed like CCPs, but perhaps without the rigidity of critical limits? So, that’s one of the things on my list to establish!
      It certainly will add another level of complexity, having pre-requisite controls, preventive controls and CCPs. What do you think?

Share your thoughts…

Your email address will not be published.

We've tagged this article as: