HARPCHazard Analysis and Risk-Based Preventive Controls

HARPC is the operational heart of the 2011 Food Safety Modernization Act — the largest reform of US food safety law since 1938. Codified in 21 CFR Part 117 Subpart C, it requires every domestic and foreign facility that manufactures, processes, packs or holds human food for the US market to develop and implement a written Food Safety Plan. The plan is built by a Preventive Controls Qualified Individual (PCQI) and contains: a written hazard analysis, written preventive controls (process / allergen / sanitation / supply-chain / recall as relevant), monitoring procedures, corrective-action procedures, verification activities and records. HARPC extends HACCP by making the preventive-control framework mandatory beyond just process CCPs and by explicitly covering radiological and economically-motivated adulteration hazards. Compliance dates rolled in 2016-2018 by business size; HARPC is now the steady-state regime for FDA-regulated human food.

• Scope expansion — HACCP focused on process CCPs; HARPC requires preventive controls across 5 categories (Process, Allergen, Sanitation, Supply-Chain, Recall).
• Mandatory in 21 CFR 117 — HACCP was voluntary for most non-juice/non-seafood/non-meat-or-poultry food; HARPC is required for almost all FDA-regulated human food facilities.
• PCQI — a specifically trained individual is required to develop or oversee the plan and the validation, verification and reanalysis activities.
• Radiological hazards — explicitly required to be considered in the hazard analysis.
• Economically-motivated adulteration (EMA) — explicitly required to be considered (e.g. melamine in milk, horse meat in beef).
• Recall plan — required for any food with a hazard requiring a preventive control.
• Supply-chain program — required when the facility's preventive control for a hazard is applied by the supplier (raw-material verification, on-site audits, sampling and testing).
• Verification and reanalysis — formal verification activities required; reanalysis required at least every 3 years and whenever there is a significant change.

1. Hazard analysis — written, considering biological / chemical / physical / radiological / EMA hazards for each food and each process step.
2. Preventive controls — written, for any hazard requiring a preventive control: Process Preventive Controls (including CCPs), Food Allergen Preventive Controls (labelling + cross-contact), Sanitation Preventive Controls (zoning, ATP, environmental monitoring for RTE products), Supply-chain Preventive Controls, Recall Plan.
3. Monitoring procedures — what's measured, how often, by whom, with what records.
4. Corrective-action procedures — what happens when monitoring shows the preventive control is not effective.
5. Verification procedures — calibration of monitoring instruments, product testing, environmental monitoring, review of monitoring and corrective-action records (within 7 working days), validation of the preventive control's effectiveness.
6. Reanalysis — at least every 3 years and whenever there is a significant change.
7. Records — all of the above maintained for at least 2 years (or longer for some specific records).

HARPC carefully distinguishes validation (proving the control will work — e.g. a thermal-kill study proving a 5-log Salmonella reduction at the chosen time/temperature) from verification (confirming it does work on each batch — e.g. monitoring the cooker temperature against the validated setpoint). Validation is required for process preventive controls (with some narrow exemptions) and is a science / lab task. Verification is operational — monitoring records, calibration records, product testing, environmental monitoring (mandatory for RTE products exposed to the environment), and review of monitoring and corrective-action records by a PCQI within 7 working days of the record's creation. The 7-day rule is one of the most-cited HARPC compliance findings — review must be timely, not 'eventually'.

When the facility identifies a hazard requiring a preventive control and the control is applied by the supplier (e.g. roasted peanuts are received already roasted; the kill step is at the supplier), the facility must operate a supply-chain program: approved-supplier list, written supplier-verification procedures, supplier-verification activities (audit, sampling and testing, or review of records), and re-evaluation when significant changes occur. The required activity scales with the hazard — a 'serious adverse health consequences or death' hazard requires an annual on-site audit unless an equivalent activity is justified. Documentation of who applies which control and the verification of that supplier sits in the supply-chain program file.

• Very small businesses (< $1M average annual sales) — qualified, simplified requirements but not fully exempt.
• Farms (covered by Produce Safety Rule, 21 CFR Part 112, not HARPC).
• USDA-regulated facilities (meat, poultry, egg) — covered by USDA HACCP, not FDA HARPC.
• Dietary supplements (covered by 21 CFR Part 111 cGMPs, not HARPC).
• Alcoholic beverages — covered by TTB authority for most aspects.
• Low-acid canned foods (LACF) and acidified foods (AF) — already covered by 21 CFR Part 113/114, HARPC overlay for hazards not covered by those rules.
• Juice and seafood — already operating under their own mandatory HACCP rules (21 CFR Parts 120 and 123); HARPC does not duplicate.

1. Hazard analysis does not consider radiological or EMA hazards — present in many FSMA-era plans rolled forward from HACCP without revision.
2. PCQI training certificate present but no documented PCQI activity on the plan (reanalysis, validation review) — designation in name only.
3. Monitoring records not reviewed within 7 working days.
4. Reanalysis overdue (>3 years since last) or never done.
5. Environmental monitoring program for RTE products absent or not species-level identifying isolates.
6. Supply-chain program weak — approved-supplier list exists but the verification activities are unrecorded or out of date.
7. Recall plan generic and not tested — first time the procedure is exercised is during an actual event.
8. Validation of a thermal preventive control by 'industry standard' rather than a documented scientific study.

• Food Safety Plan workspace per facility per product family — hazard analysis, preventive controls, monitoring, corrective actions, verification and records all linked, version-controlled and PCQI-signed.
• PCQI role and training-record gate — only a designated PCQI can approve a plan, sign a reanalysis or close a validation study; non-PCQI approval is hard-blocked.
• 7-day monitoring-review SLA — records past their review deadline surface on the PCQI dashboard and route to a backup PCQI if the primary is unavailable.
• Reanalysis schedule per plan — 3-year forward calendar with significant-change triggers (new supplier, new equipment, new product, environmental excursion) that pull reanalysis forward automatically.
• Supply-chain program tied to the supplier master — every supplier carrying a HARPC-applied control has its verification activity (audit due, sampling result, record review) tracked with expiry.
• Environmental monitoring program for RTE — per-zone, per-route, with species-level isolate ID and trending; excursion opens a sanitation corrective-action workflow.
• Recall plan with mock-recall capability — annual exercise scheduled, results captured, gaps drive plan revision.
• Industry-aware UI — food-facility tenants see HARPC-native terminology and screens; dietary-supplement tenants are routed to 21 CFR 111 (different rule).