Prerequisite Programs: The Foundation Every HACCP Plan Needs
Why HACCP Plans Fail Without Prerequisite Programs
Most failed HACCP plans never failed at the CCP. They failed at everything around it. Auditors see this pattern constantly: a plant with perfect critical limit monitoring still gets cited because the condenser drips water onto the product zone, the chemical storage sits next to the packaging, or nobody can show a pest control record. Those aren’t HACCP failures. They’re prerequisite program failures — and without them, HACCP has nothing to stand on.
Codex Alimentarius understood this decades ago. In the Codex General Principles of Food Hygiene (CXC 1-1969, revised 2020), Good Hygiene Practices are the mandatory base layer, and the HACCP system sits on top of them. ISO 22000:2018 says the same thing in different words: prerequisite programs (PRPs) are the conditions and activities necessary to maintain a hygienic environment throughout the food chain. FSMA’s Preventive Controls rule folds this idea into “Good Manufacturing Practices” under 21 CFR 117 Subpart B — the foundation requirements before you ever get to preventive controls.
Think of it this way. HACCP handles a small number of specific, measurable hazards at specific points. Everything else — the thousands of daily hazards that never reach a CCP — is handled by PRPs. If a food safety system were a building, PRPs are the concrete foundation and HACCP is the steel frame. You can engineer the frame perfectly, but pour the concrete wrong and the whole thing shifts.
What Prerequisite Programs Actually Cover
A complete PRP program covers every condition that affects food safety but isn’t managed through your CCPs. ISO 22000 lists them explicitly, and FSMA’s GMP subpart covers the same ground:
- Facility design and maintenance: floors, walls, ceilings, drainage, ventilation, lighting. Condensation management is one of the most common audit findings — overhead drips in a wet processing room above exposed product.
- Cleaning and sanitation: written SSOPs, chemical concentrations, contact times, master sanitation schedules, verification (ATP swabs, visual inspection, microbiological swabs).
- Pest control: contracted or in-house, maps of bait stations, trend reports, and evidence that corrective action follows sightings.
- Personal hygiene: handwashing, protective clothing, illness reporting. FDA Food Code 2022 Section 2-201 covers employee health and exclusion criteria.
- Water quality: potable supply, testing frequency, backflow prevention. 21 CFR 117.37 requires adequate water supply and proper plumbing.
- Waste management: segregation, removal frequency, and keeping waste away from food contact zones.
- Supplier control: approved supplier lists, specifications, receiving inspection, certificates of analysis.
- Foreign material control: glass and brittle plastic registers, knife and blade policies, maintenance work controls.
- Allergen control: segregation, scheduling, cleaning validation between products, label verification.
- Calibration: thermometers, scales, metal detectors — everything that produces a measurement your system depends on.
Notice how many of these produce records an auditor will ask for before they ever look at your CCP logs. A missing pest trend report or an expired thermometer calibration certificate can become a major nonconformity even when every CCP is in spec.
The PRP Audit Checklist Most Plants Skip
Here’s a practical self-check you can run next week. Pick one PRP — say, cleaning and sanitation — and audit it the way a third-party auditor would:
- Is there a written procedure, current version, with an approval signature?
- Do the people doing the work follow it — or have they developed their own shortcut version?
- Are chemicals at the labeled concentration? (Check the titration log, not just the wall chart.)
- Is verification recorded — ATP results, visual inspection sign-offs — on the frequency the procedure requires?
- When a verification failed in the last 90 days, is there a corrective action record that actually closed the root cause?
Step 2 is where most programs fall apart. The written PRP is fine; the executed PRP drifted months ago. Auditors know this, which is why they interview operators and watch them work rather than just reading your binder.
A second pattern auditors flag is orphan PRPs — programs with no clear owner. The pest control binder belongs to the QA manager, the maintenance schedule belongs to engineering, the chemical inventory belongs to sanitation, and nobody connects them. Assigning a single PRP coordinator (or a small cross-functional team) with authority to chase overdue items closes that gap. Also, budget for PRPs like you budget for production. When the sanitation crew is understaffed, the first casualty is the master sanitation schedule’s deep-clean tasks — the ones that prevent the slow biofilm buildup your daily cleaning can’t touch. Auditors can see understaffed sanitation in your records within minutes: skipped frequencies, backlogged corrective actions, ATP trending that goes nowhere. Money spent on PRP resources is the cheapest audit insurance you can buy, because every finding avoided here is a finding that never reaches your HACCP plan.
Building (or Rebuilding) Your PRP Foundation
Start with a gap assessment against a recognized standard. ISO 22002-1 gives you a detailed PRP requirements list for food manufacturing; ISO 22002-100 series covers retail, catering, and transport. For a US plant under FSMA, 21 CFR 117 Subpart B is the legal minimum. Map each requirement to your current written procedure, then to the records that prove it’s actually happening.
Where you find gaps, prioritize by risk, not by what’s easiest to write. A condensation problem above a ready-to-eat line outranks a missing signature on a low-risk form. Management review — required by ISO 22000 clause 9.3 — is the mechanism that turns this into a living system: PRP performance data (pest trends, ATP failure rates, calibration due dates) should reach the management review table every cycle.
Finally, tie your PRPs to your hazard analysis. Codex requires the hazard analysis to consider the effectiveness of PRPs. If your hazard analysis assumes “cleaning controls Listeria on equipment” but the sanitation verification program has a 30% ATP failure rate, your assumption is wrong and your HACCP plan is built on it. Document which PRPs control which hazards. That linkage — PRP to hazard to evidence — is exactly what separates a program that passes audits from one that survives them.
Monday morning: pick your highest-risk PRP, run the five-step self-audit above, and bring one gap with a deadline to your next management meeting. Foundations get fixed one concrete pour at a time.
