HARPC Requirements

What are the major tasks that food companies must perform to comply with the Hazard Analysis and Risk-based Preventive Controls (HARPC) provision in the FSMA? From the general statutory definition (see bottom) we can identify 7:

1. Identify Hazards

The “HA” in HARPC stands for “Hazard Analysis” and addresses the core intent of the law: to identify hazards that might arise due to the specific foods or food ingredients in the food or due to the various processing, manufacturing, packing, and holding steps applied to the foods. Once identified, the company must develop a plan to minimize or prevent the hazards from arising. During the first HARPC step food companies must evaluate the product and processing for the risks of:

• Biological, chemical, physical and radiological hazards

• Natural toxins, pesticides, drug residues, decomposition, parasites, allergens, and unapproved food and color additives

• Naturally occurring hazards or unintentionally introduced hazards

• Intentionally introduced hazards (including acts of terrorism)

Notice, this last bullet point brings into play all aspects of a food company’s facilities (e.g., the physical plant, security measures to prevent potential bioterrorism events), personnel screening and controls, the entire supply chain of a facility’s food ingredients (raw materials, packaging, dyes, labels, etc.), and the finished foods received and delivered and shipped. Although there are legal limitations to FDA’s reach, most companies should plan to address these elements of their food safety programs.

Companies must create a written analysis of the above hazards and include both an identification of the risks as well as an analysis of the risks as they pertain (or could pertain) to the facility and the foods or food ingredients it handles.


2. Risk-based Preventive Controls

The “RPC” in HARPC stands for “Risk-based Preventive Controls.”  This is the portion of HARPC that requires companies to develop and implement a series of risk-based controls at the critical points of the manufacturing process where the identified hazards must be prevented or minimized to ensure safety of the food. These critical manufacturing points are called “critical control points”. The facility must designate control measures at each critical control point to ensure the greatest level of risk prevention or mitigation is achieved by normal operation of that manufacturing, processing, packing or storage step. Per the statutory language, these Control Measures must significantly minimize or prevent the identified hazards.

The law defines “critical control point” as “a point, step, or procedure in a food process

at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.”  The HARPC provision in the FSMA also provides a list of examples of types of preventive controls:

• Sanitation procedures at food surface contact points

• Sanitation of utensils and equipment

• Staff hygiene training

• Environmental monitoring program (for pathogen controls)

• Food allergen control program

• Recall plan

• Current Good Manufacturing Practices (cGMPs)

• Supplier verification activities


3.  Monitoring of Effectiveness

HARPC requires the food facility to implement a monitoring program, which ensures the firm is conducting regular evaluations of the facility’s control measures to determine whether the preventive controls are working.  HARPC requires the facility to establish and implement this monitoring program.


4.  Corrective Actions

As the risk-based preventive controls and control measures in a properly designed HARPC system are monitored any instances of deviation from the control measures must be identified, evaluated with respect to cause, and corrected.  The Corrective Action steps of HARPC will involve:

• Identification of weak spots in the controls

• Identification of ineffective controls

• Identification of new hazards

• Performing necessary steps to reduce the likelihood of recurrence

• Evaluating the processed food for safety

• Prevention of adulterated food from entering commerce

HARPC requires facility owners and operators to identify and fix “out of control” processing steps and to evaluate processed foods for safety and adulteration risks.


5.  Verification

HARPC requires food facilities to design and implement verification steps to ensure that their HARPC plans (the hazard identification and analysis, preventive controls and control measures, monitoring and corrective action steps) are operating correctly to prevent or minimize food safety and adulteration hazards.  This step is designed to verify that:

• The selected preventive controls are adequate

• Monitoring is occurring properly as defined in the plan

• Appropriate corrective actions are taken

• Potential food and food processing hazards are reduced

• Periodic reviews are conducted at appropriate intervals so the HARPC plan remains relevant and takes into account new and emerging risks and hazards


6.  Recordkeeping and Documentation

One key development under HARPC is its new requirements related to records and methods of documentation that have become mandatory for food manufacturing, processing, packing and storage facilities.  Previously, under the Bioterrorism Act, FDA could only require a food company to maintain records that enabled food to be traced through the supply chain (one up / one back identification records). Now, HARPC requires that records and documents related to food hazards and process control systems be established and maintained for no less than 2 years to cover the following HARPC steps:

• The monitoring of the preventive controls

• All instances of deviation or processing nonconformance that could be material to food safety

• Testing results and other verification steps designed to ensure the preventive controls are effectively minimizing or preventing hazards

• All instances where corrective actions became necessary

• Demonstrating of effectiveness of a food facility’s preventive controls and corrective actions

In other words, FDA requires that a written record be kept of the entire plan including the process, the proof, and the problems.  A facility must make these records and documentation available to FDA upon oral or written request. This new authority will result, eventually, in FDA demanding foreign and domestic food facilities to produce their HARPC records rather than the agency spending physical plant inspection resources. The recordkeeping requirements, therefore, must tell the proper story to demonstrate HARPC compliance.


7.  Requirement to Reanalyze

After developing and implementing an adequate HARPC plan, the food facility must periodically evaluate its food safety HARPC system.  Under HARPC the facility must reanalyze its plan:

• Whenever there is a significant change at the facility that might increase a known hazard or introduce a new one

• Every 3 years (if no other significant changes occur)

Additionally, HARPC requires the facility to perform a new hazard analysis and implement any new, necessary preventive controls before operational changes occur.  Any changes must be documented in the firm’s HARPC records. If no changes are necessary after a reanalysis of a HARPC system, the firm must document the basis for that decision. Facility owners, operators and agents may also have to reanalyze their HARPC plans at any time due to new biological, chemical, radiological or terrorist threats identified by the Department of Homeland Security.


Sec. 103 of the Food Safety Modernization Act describes HARPC in the following way:

“The owner, operator, or agent in charge of a facility shall, in accordance with this section, evaluate the hazards that could affect food manufactured, processed, packed, or held by such facility, identify and implement preventive controls to significantly minimize or prevent the occurrence of such hazards and provide assurances that such food is not adulterated under section 402 or misbranded under section 403(w), monitor the performance of those controls, and maintain records of this monitoring as a matter of routine practice.