HARPC and complying with the preventive rule
Rather than work through FSMA systematically, rule by rule, I’m going to dive straight into the preventive controls rule and HARPC, as this seems to be the most popular request (thank you to Kathryn, Simon, Rina, Bronwyn, Karen, Carrie, Nicola and James for your feedback on the last post).
As a lot of sites have BRC – I’m also going to cover the differences between the preventive controls rule and the clauses of the BRC standard. However, first we need to do a bit of ground work and understand what the preventive control rule is (which we’ll cover in this post), how it differs from HACCP (which I’ll cover in the next post) and then the comparison to BRC (which I’ll cover in the post after that).
As I’ve said before, I would REALLY like this to be an interactive forum, so if you have any questions at all, or any comments – please share them in the comments section at the bottom of this post. I truly believe no question is a silly question, so please ask. Plus, if you don’t agree with something I’ve put or if you have a different interpretation, please share it with us.
A new term has been created since the launch of the FDAs FSMA – HARPC. Pronounced ‘harp-see’.
HARPC stands for ‘hazard analysis and risk based preventive controls’.
Although it sounds similar to HACCP (hazard analysis and critical control points), it is fundamentally different. As a HACCP expert, the principles of HACCP have been drilled into me and I’ve found it difficult to get my head around the requirements of HARPC.
However, the more I learn about it and the more I think about how it would be applied in practice, the more I realised it requires a completely different mind-set.
I’ll explain why, but first we need to go through what the requirements are.
Implementing a preventive approach
The full title for the preventive controls rule is – Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.
In order to comply with FSMA the FDA have stated that a facility must:
- Conduct a food safety hazard analysis
- Implement preventive controls
- Implement a supply chain program
- Have a recall plan
- Implement monitoring systems
- Implement corrective action procedures
- Conduct verification activities
All of the above are part of the preventive rule. However, those in blue are part of the hazard analysis system and those in green are what we would normally refer to as pre-requisite programmes, or the building blocks that support the food safety plan.
In order to understand how to implement a preventive control plan, to meet FSMA, we need to understand the steps required to complete the hazard analysis, or HARPC.
So what is HARPC?
I’ve broken down the requirements of the preventive controls rule of FSMA, into 8 HARPC steps, which are:
- Define the scope of the assessment
- Identify the hazards
- Carry out hazard analysis
- Add preventive controls
- Implement monitoring systems
- Add corrective actions and corrections
- Verify the system
- Re-analyze the system
I’ll take each one in turn and explain them.
1. Define the scope of the assessment
The FDA have defined the scope of the HARPC plan. The scope is focused solely on food safety.
- The hazard analysis must consider:
- Known inherent hazards
- hazards which could ‘reasonably occur’
The hazards categories that must be considered are:
- Chemical, this includes radiological
The hazards may be caused because:
- they are inherent to the raw material, product or process
- they occur through error during the process
- they are carried out deliberately for economic gain (for food safety only)
2. Identify the hazards
Sources of hazards to be considered are:
- the environmental (FDA specifically quote pathogens from the environment which may contaminated ready-to-eat foods)
- the recipe or formulation
- ingredients (inherent risks)
- the manufacturing processes
- the fabrication of the facility
- the equipment used
- the tools used
- the intended use of the food
Key point to consider at this step is that we only need to include the hazards that could ‘reasonably occur’ (see step 1).
In HACCP we would normally include all hazards and use the likelihood assessment to mitigate them, using our pre-requisite controls. If we were to adopt that approach here, we would end up with an unmanageable amount of unfocused preventive controls.
Therefore, I would expect a HARPC plan to be much shorter, but contain much more focused and ‘real’ hazard.
3. Carry out hazard analysis
The analysis must include:
- severity and,
- likelihood (FDA terms this probability of occurrence) in the absence of preventive controls
Note that the assessment is carried out in the absence of preventive controls. This is different to HACCP, where we would carry out the assessment taking the controls into consideration. Therefore, it would be expected, that the likelihood results will be higher/greater.
Although the FDA haven’t explained the purpose of carrying out the hazard analysis, it would be reasonable to expect that it is to assess the significance the hazard. Therefore, a process of calculating significance based on the severity and likelihood assessment of the hazard is required. If you would like to know more about significance and how to assess it, it’s the same as significance in HACCP – you can learn more about it in a previous post called “The purpose of hazard significance in HACCP”.
The calculation of significance is usually done through a scoring or a grid system.
Once the significance has been determined, only significant hazards are taken forward through the assessment. Those that are not deemed to be significant are managed through the normal controls that are in place.
4. Add preventive controls
To control each of the significant hazards, preventive controls must be applied.
The FDA advise that these will include measures such as (these are examples, not an exhaustive list):
- process controls
- food allergen controls
- sanitization controls
- supply-chain controls
- recall plan
Note, that although the FDA have provided these as examples of preventive controls, they are not all controls.
The definition of ‘control’ in this context is to prevent, reduce or eliminate a hazard to an acceptable level.
So, a recall plan is not a control, as it does not prevent, reduce or eliminate the hazard from happening. It does prevent or reduce the impact of the unsafe food from reaching the consumer. This is why they’ve called it a recall plan, rather than recall control. This means that you cannot have the recall plan listed as a preventive control for a hazard in your HARPC. The recall plan, is there to support the whole system in the case of failure, as a correction (we’ll come on to corrections).
Key point at this stage – in HACCP we would normally list all the controls that may reduce the likelihood of a hazard occurring. If we did this for HARPC, we would again, end up with an impractical amount of unfocused preventive controls. Therefore, when applying a preventive control consideration must be made to what truly prevents that hazard from occurring. Where ever possible, I would try to implement a preventive control that positively confirms that the hazard is in control.
5. Implement monitoring systems
For each preventive control required to manage a significant hazard, a monitoring procedure must be created and implemented. The procedure must include the frequency of the verification and the process in which the verification must be carried out. The monitoring procedure must be appropriate to the nature of the hazard it is controlling – therefore the procedure needs to be justified or validated to prove that it does manage the hazard.
Records must be completed and retained to prove that the monitoring has been carried out, as set out in the procedure.
6. Add corrective actions and corrections
A procedure must be created and implemented for each preventive control, which covers:
- where the monitoring procedure highlights a problem
- where the monitoring procedure has not been adhered to
For each of the instances above, a correction and corrective action must be applied:
Correction is identifying and correcting the specific current problem in a timely manner. This includes evaluating any food which may be affected for food safety, correcting it so it is safe or disposing of it, so it doesn’t put consumer safety at risk.
Corrective action where the problem is assessed to its root cause, to prevent or reduce the likelihood of it occurring in the future.
7. Verify the system
FDA state that verification must be implemented to show that the preventive controls are working. However, they state that this should include validation of preventive controls, which would not be acceptable to any HACCP purists, as verification and validation are two very distinct and separate activities.
Verification would include activities such as:
- checking and signing off that preventive control records have completed, and that they have been completed correctly
- testing of raw materials, in process materials or finished product
- verifying the accuracy of monitoring or measuring equipment
- environmental testing
- reviews, including trending such as complaints
8. Re-analyze the system
The HARPC plan must be reviewed every 3 years as a minimum.
It must also be reviewed when:
- there is a significant change which may change the hazards which affect the food
- new information regarding food safety is received
- a preventive control is found to be ineffective
Where the FDA say ‘where a preventive control is found to be ineffective’, they do not mean each time a preventive control monitor highlights a problem, or where a monitoring procedure has not been adhered to – but when it is realised that an existing preventive control does not control the hazard highlighted.
HACCP & HARPC
As you can see the steps of HARPC are very similar to HACCP. But there are few significant differences, such as the fact that there is no mention of pre-requisite programmes and the purpose of the assessment is not to define CCPs, but rather preventive controls.
To me, at first, this was a difficult thing to accept. I’ve now got my head around it, but I’m still a little worried that by not having CCPs, that the really key food safety elements (which we would normally manage as CCPs), may get lost in all of the preventive controls. I hope this doesn’t ‘water down’ the focus on them. But I’m optimistic, I’m starting to warm to this approach and I think once I start working through the practicalities of implementing a HARPC system it will all become much more solid in my mind.
Next post I’ll share my learnings with you, as I go through the differences between HARPC and HACCP and what that actually means in practise when implementing such as system.
As always, I’d love to hear your thoughts on what I’ve covered in this post and any specific questions you may have. Please also share you experiences and learnings too with your FSMA companions! 🙂
We've tagged this article as: FSMA