HARPC: Hazard Analysis & Risk-Based Preventive Controls

HARPC (Hazard Analysis and Risk-Based Preventive Controls)

If HACCP is the classic system, HARPC is its American evolution — broader, more explicitly risk-based, and with the force of FSMA behind it. If you sell food in the US, this is the framework you’re judged against.

Definition

HARPC is shorthand for the hazard-analysis and risk-based preventive controls approach required by FSMA’s Preventive Controls rules (21 CFR 117). Think HACCP, widened: more hazard types, more control types, heavier verification.

Key facts

• The scope goes beyond CCPs. Preventive controls include process controls, allergen controls, sanitation controls, supply-chain controls — plus a recall plan. It’s the whole system, not just the critical points.
• Hazard analysis must cover “known or reasonably foreseeable” hazards — explicitly including radiological hazards and economically motivated adulteration. Wider than classic HACCP ever went.
• The food safety plan must be written, implemented, and overseen by a Preventive Controls Qualified Individual (PCQI) — a defined, trained role, not just “whoever does quality.”
• Verification gets real emphasis: validate your controls, verify monitoring happened, review corrective actions, and reanalyze at least every three years or whenever something significant changes.

Why it matters

FDA inspections test the food safety plan directly — and the gaps that draw observations are consistent: hazard analyses that missed obvious foreseeable hazards, supply-chain programs that exist only on paper, validations that were never done. The HARPC mindset shift is this: it’s not enough to control what you’ve seen go wrong. You have to address what could reasonably go wrong, with evidence. Companies that treat the food safety plan as a living document pass inspections calmly; companies that treat it as a binder have a bad day.

Sources: FDA.

Quick reference