Hazard Analysis Risk Based Preventive Controls (HARPC) is a risk based model for the identification of significant hazards and the establishment of preventive controls.
FSMA HARPC was made into law on July 4, 2012. FDA issued a proposed rule implementing it on January 2013.
The main difference between HACCP and HARPC is that HACCP requires risk assessment with controls in place while HARPC requires risk assessment with no controls in place. For a summary on HACCP, refer to our article titled What is HACCP.

Hazard Evaluation

HACCP and HARPC share the same model, with one exception: Hazard Evaluation.

FMSA: c1 – (i) Hazard evaluation: The hazard analysis must include an evaluation of the hazards identified in paragraph (b) of this section to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls.

HACCP requires conducting a hazard analysis followed by a risk assessment of the hazards to determine their significance. To do that, is necessary to list out the preventive measures already existing at the step and the implication is that the risk is determined with these preventive controls in mind. This will result in a lower risk (assuming preventive controls are in place).

However, FSMA takes a fundamentally different approach. FMSA, for HARPC requires the same exercise in the absence of preventive controls. As a result, HARPC enlist more significant hazards which require a preventive control which takes no account of basic mitigation measures such as sanitation and requires full planning, verification, validation and review. HARPC doesn’t requires the establishment of critical limits, but requires more documentation for non-CCP controls such as monitoring, corrective action and verification.

HARPC requirements:

• Identification of naturally occurring hazards or intentionally introduced hazards (acts of terrorism): biological, chemical, physical and radiological, including natural toxins, pesticides, drug residues, decomposition, parasites, allergens, and unapproved food and color additives
• Preventive controls:

Sanitation procedures for food contact surfaces
Sanitation procedures for utensils and equipment
Staff hygiene training
Environmental monitoring program
Food allergen control program
Recall plan
GMPs
Supplier verification activities

• FDA Bioterrorism Facility Establishment registration
• Updates of the HARPC plan every 3 years

7 Steps of HARPC

1. Assess the hazards: This includes the normal product-specific hazards, along with a broad range of other hazards (listed above) and facility-specific concerns such as food defense and emergency management issues.
2. Institute Preventive Controls: These include sanitation procedures for food contact points, staff hygiene training, environment monitoring, supplier verification and more.
3. Monitor effectiveness of the controls: Not all controls are measurable by critical limit numbers, but these Preventive Controls can be evaluated on a routine basis.
4. Establish corrective action measures: Recall plans may not seem preventive, but the critical steps between knowing something is wrong with a product and keeping it away from consumers’ hands should involve identifying and correcting the weak spots within the controls. The objective is to prevent occurrences of unsafe and nonconforming food product.
5. Establish verification measures: The process of verification ensures that the facility is effectively meeting its food safety standards on a consistent basis.
6. Record keeping.
7. Reanalyze the plan once every 3 years, or when needed: When changes in process or product happen, HARPC plans should be reevaluated.

Guides and Templates

• https://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM517404.pdf
• https://www.ifsh.iit.edu/sites/ifsh/files/departments/fspca/pdfs/FSPCA_Ap2_Worksheets__V1.1_Fillable.pdf