Hazard Analysis and Risk-Based Preventive Controls (HARPC)

1. What Is Hazard Analysis and Risk-Based Preventive Controls (HARPC)?

Hazard Analysis and Risk-Based Preventive Controls (HARPC) is a food-safety framework that connects the identification of potential hazards with preventive measures, operating oversight, and documented evidence. It is an operational and regulatory system—not simply a risk-ranking exercise. For covered food facilities, it translates analysis into an implemented, written food safety plan.

For agriculture and food executives, the practical question is: where could ingredients, processing conditions, equipment, or handling make food unsafe, and who must prevent that outcome? HARPC helps structure decisions about supplier qualification, sanitation, production controls, labeling, and release of affected product.

2. Origin and Background

HARPC’s statutory foundation is Section 103 of the U.S. Food and Drug Administration (FDA) Food Safety Modernization Act (FSMA), approved on January 4, 2011. Congress established the preventive-controls mandate; FDA developed implementing regulations. The human-food and animal-food preventive-controls rules became final in September 2015, under 21 CFR Parts 117 and 507, respectively. It is therefore not a consulting model attributable to an individual creator.

The central shift was toward preventing food-safety problems rather than primarily responding after they occurred. HARPC builds on preventive food-safety thinking while extending management attention beyond individual processing checkpoints to a broader control system.

3. How Hazard Analysis and Risk-Based Preventive Controls (HARPC) Works

The acronym expresses three connected ideas, not five prescribed stages:

• H—Hazard and A—Analysis: Identify and evaluate known or reasonably foreseeable sources of illness or injury for each food and its production conditions.
• R—Risk-Based: Assess severity and the probability of occurrence without preventive controls—not merely the frequency of recent incidents.
• P—Preventive and C—Controls: Establish written measures that significantly minimize or prevent hazards determined to require control.

The analysis considers biological, chemical—including allergen and radiological—and physical hazards. Controls can operate at critical control points or elsewhere. For human food, the following categories apply as appropriate to the facility and food; they are not a checklist requiring every category in every operation.

Monitoring checks control execution. Corrective actions address failures and affected food. Verification checks implementation and effectiveness. Validation establishes scientific adequacy where required. These functions are distinct: Part 117 does not require validation of allergen controls, sanitation controls, the supply-chain program, or recall plans, although applicable verification obligations remain.

A written recall plan is required when a hazard requiring a preventive control is identified. The hazard analysis itself must be written even when it identifies no such hazard.

4. When to Use Hazard Analysis and Risk-Based Preventive Controls (HARPC)

Use HARPC when assessing a new product, changing suppliers, expanding capacity, integrating an acquisition, or closing food-safety gaps. For processors handling specialty crops and vegetables, it is especially useful for connecting incoming-produce hazards with washing, cutting, packing, and refrigerated handling.

Determine regulatory applicability first. Farms may operate under separate produce-safety requirements; animal-food operations have a parallel preventive-controls rule; USDA-regulated meat and poultry establishments operate under their applicable HACCP requirements. Applying the human-food template indiscriminately across these businesses can mislead management.

Start with product specifications, process flows, supplier information, scientific evidence, deviations, complaints, and verification records. Involve food safety, operations, procurement, engineering, and maintenance. A workshop can produce an initial assessment; site observation, supplier verification, and necessary studies determine the real effort.

HARPC is powerful when control ownership can be traced across these functions. It is a poor fit for evaluating commercial attractiveness or authenticity alone. Where analysis exposes operating gaps, product safety compliance work can translate findings into procedures, responsibilities, and evidence.

5. How to Apply Hazard Analysis and Risk-Based Preventive Controls (HARPC): Step-by-Step

1. Clarify the decision and scope.

   Specify whether the objective is launch readiness, supplier substitution, expansion, or remediation. Define facilities, product families, intended consumers, distribution conditions, and the operating period—for example, the next harvest season.

2. Gather product and process inputs.

   Collect formulations, ingredient specifications, flow diagrams, storage conditions, supplier records, sanitation procedures, and relevant scientific information. Observe actual production, including startup, changeovers, rework, and maintenance.

3. Define the units of analysis.

   Assess ingredient–hazard and process-step–hazard combinations. Group products only when their hazards, processing conditions, and controls are genuinely comparable. Do not assume every product sharing a production line belongs in one analysis.

4. Construct the hazard-and-control worksheet.

   Record each hazard, its justification, severity, likelihood without controls, the control decision, control location, owner, and supporting evidence. Link the worksheet to monitoring, corrective-action, verification, and recall procedures. Numerical scoring is optional—not a substitute for technical judgment.

5. Challenge the conclusions.

   Ask what would happen without the proposed control. Distinguish absence of reported incidents from evidence of low risk. Check whether shelf life, intended use, or customer handling invalidates an assumption.

6. Translate controls into operating work.

   Define procedures, relevant parameters, monitoring responsibilities, escalation rules, affected-product evaluation, and verification activities. Identify necessary scientific support, equipment changes, supplier work, staffing, and training before implementation.

7. Test alternative operating scenarios.

   Examine seasonal sourcing, emergency suppliers, different ingredients, equipment downtime, increased throughput, and night-shift execution. Test whether the control remains effective under these conditions rather than assuming normal production represents the entire business.

8. Align, approve, and iterate.

   Have the preventive controls qualified individual (PCQI) perform or oversee the applicable technical responsibilities. Resolve disagreements with evidence, train operators, and connect changes to plan reanalysis. Operations leadership should own implementation, not delegate the entire system to quality.

For a multi-site rollout, program management support can coordinate supplier actions, equipment modifications, training, and evidence completion while technical accountability remains with qualified food-safety personnel.

6. Example: Hazard Analysis and Risk-Based Preventive Controls (HARPC) in Action

Fictional scenario: Cedar Vale Foods produces plain and sesame-topped ready-to-eat vegetable mixes. It plans to add growers and increase output for customers in foodservice distribution. A label near-miss and inconsistent changeover records prompt management to reassess expansion readiness.

The team examines incoming produce by supplier, wash-water management, cutting equipment, shared packing, labels, and refrigerated dispatch. Inputs include supplier practices, process observations, environmental results, cleaning records, and scientific evidence.

The analysis identifies three distinct prevention needs: supplier controls for incoming pathogens, sanitation controls for environmental contamination, and allergen controls for sesame cross-contact and labeling. Importantly, the team does not treat produce washing as a pathogen-elimination step; FDA guidance distinguishes wash-water cross-contamination control from a kill step for pathogens attached to produce.

Management postpones expansion until the identified gaps are closed. Cedar Vale strengthens supplier verification, redesigns a difficult-to-clean conveyor section, formalizes allergen changeovers and label checks, and establishes deviation and product-hold procedures. It also tests recall coordination with distributors. The executive output is a hazard–control–owner–evidence summary, not a blanket assurance that negative finished-product tests prove safety.

7. Strengths and Limitations

Strengths

• Connects analysis with execution. Each significant hazard can be linked to a control, responsible owner, and evidence requirement.
• Clarifies cross-functional responsibilities. Procurement, engineering, sanitation, and production can see their contribution to safe output.
• Improves investment discussions. Use identified control gaps to justify specific equipment, supplier, staffing, or training changes.

Limitations

The analysis depends on sound hazard knowledge and an accurate description of operations. Treat it as incomplete when supplier practices, seasonal variation, rework, or maintenance conditions remain poorly understood. A polished plan cannot compensate for weak execution.

HARPC also does not encompass every fraud or defense concern. It addresses reasonably foreseeable hazards introduced for economic gain when food safety is affected. Fraud affecting authenticity alone falls outside that preventive-controls scope. Deliberate acts intended to cause wide-scale public-health harm are addressed separately by FDA’s intentional-adulteration rule.

8. Common Pitfalls and How to Avoid Them

• Rating risk after assuming controls work. This can hide the reason a control is necessary. Assess hazard probability without preventive controls before evaluating control effectiveness.
• Copying another facility’s plan. Similar products can have different equipment, suppliers, and exposure conditions. Verify the actual flow and operating environment.
• Treating supplier certificates as sufficient. Check whether evidence addresses the particular hazard, ingredient, and supplier-controlled process—not merely general certification.
• Using one score as the decision. A severity–likelihood matrix can organize discussion, but avoid thresholds that mechanically dismiss serious, foreseeable hazards.
• Ignoring operational exceptions. Include emergency sourcing, changeovers, rework, and maintenance in the review. Assign escalation and affected-product responsibilities before exceptions occur.
• Stopping at documentation. Close equipment and capability gaps, observe execution, and review whether records demonstrate the intended control.

9. How Hazard Analysis and Risk-Based Preventive Controls (HARPC) Relates to Other Frameworks

HACCP

Hazard Analysis and Critical Control Points (HACCP) provides a closely related foundation for preventive food safety. Reuse sound hazard analyses and process-control evidence, then assess the broader applicable HARPC requirements. Neither system should be reduced to finished-product testing, and HARPC does not replace every sector-specific HACCP regime.

ISO 22000

ISO 22000 addresses food-safety management systems across the food chain. It can provide an organizational structure for integrating hazard-control work. Use it alongside HARPC when building a broader management system, but assess applicable U.S. regulatory requirements separately rather than assuming certification establishes compliance.

Fraud and food-defense vulnerability assessments

Use complementary assessments alongside HARPC to investigate substitution incentives, authenticity risks, and opportunities for malicious contamination. Food-defense vulnerability assessment asks where an intentional attack could succeed; HARPC asks which foreseeable food-safety hazards require preventive controls. These are related but distinct analyses.

10. Key Takeaways

• HARPC connects hazard analysis with an implemented control system—not just a risk matrix.
• Use food, ingredient, supplier, and process conditions as the units of analysis.
• Keep monitoring, corrective action, verification, and validation distinct.
• Confirm regulatory applicability before selecting a template.
• Maintain complementary fraud and food-defense work where needed.

11. FAQs About Hazard Analysis and Risk-Based Preventive Controls (HARPC)

Is HARPC required for every agriculture and food business?

No. Coverage depends on activities, facility status, products, and applicable exemptions or modified requirements. Growing produce, processing human food, manufacturing animal food, and producing USDA-regulated products require separate applicability assessments.

Who can oversee a HARPC food safety plan?

For covered human-food facilities, preparation must be performed or overseen by a PCQI. Qualification can come through training equivalent to an FDA-recognized standardized curriculum or qualifying job experience; a particular commercial certificate is not universally required.

Can smaller processors use HARPC without specialized software?

Yes. A controlled worksheet and clearly linked procedures can be a practical starting point. Prioritize technical competence, accurate process descriptions, usable records, and disciplined execution before investing in software.

How often should the plan be reassessed?

For covered human-food facilities, the plan as a whole requires reanalysis at least every three years. Earlier reanalysis is required for specified triggers, including significant changes affecting hazards, new hazard information, certain unanticipated problems, or ineffective controls.