What is HARPC?

In agriculture and food, HARPC stands for Hazard Analysis and Risk-Based Preventive Controls. It is the common industry shorthand for the FDA preventive-controls framework created under the Food Safety Modernization Act (FSMA). For many registered food facilities, HARPC means maintaining a written food safety plan that identifies known or reasonably foreseeable hazards, determines which hazards require a preventive control, and documents the controls, monitoring, corrective actions, verification, recall planning, and records needed to manage them.

For executives, HARPC is not just a quality-assurance document. It affects plant operations, supplier approval, allergen management, sanitation, capital spending, acquisition diligence, and the ability to keep products in customer channels that expect credible preventive compliance.

What the term means

HARPC is widely used in industry, but it is not the formal title of an FDA rule. FDA generally refers to the Preventive Controls rules. For human food, the main regulation is 21 CFR Part 117. For animal food, the parallel rule is 21 CFR Part 507. The practical idea is the same: move from a largely reactive approach to a prevention-based system that identifies food safety risks before product is released.

In scope are many businesses that must register with FDA as food facilities, although exemptions and modified requirements apply in some cases. Farm activities may be outside facility registration depending on the facts, while mixed-type facilities and off-farm processing or packing operations may fall into scope. Juice and seafood facilities remain subject to separate HACCP regulations, so leaders should be careful not to assume that one framework automatically covers every business unit.

Why HARPC matters in agriculture and food

HARPC matters because it connects regulatory compliance to daily operating discipline. Under FSMA, FDA expects facilities to show not only that they understand their hazards, but also that they have designed, implemented, and documented controls appropriate to the food, process, and supply chain.

• Regulatory risk: weak hazard analysis, poor records, or an inadequate supply-chain program can create inspection findings, warning letters, detained product, or recall exposure.
• Commercial risk: customers, co-manufacturing partners, and investors often view preventive-controls maturity as a proxy for operational reliability.
• Supply-chain dependence: many hazards are controlled upstream, so procurement, specifications, vendor approval, and audit practices become part of food safety.
• Change management: new ingredients, new SKUs, plant modifications, automation changes, or a new copacker can trigger reanalysis and control redesign.

How HARPC works

Start with a written hazard analysis

The foundation is a hazard analysis for each type of food manufactured, processed, packed, or held at the facility. FDA expects companies to consider known or reasonably foreseeable biological, chemical, physical, and radiological hazards, including hazards that may occur naturally, be introduced unintentionally, or be introduced for economic gain if safety is affected. The question is not whether a hazard is imaginable; it is whether it is reasonably foreseeable in the actual product and process context.

Determine which hazards require a preventive control

After identifying hazards, the facility evaluates their severity and probability and decides whether each hazard requires a preventive control. Not every hazard will require one at the facility level. Some may be managed by prerequisite programs, some may be controlled by the customer, and some may be controlled by suppliers before receipt. The discipline lies in making those decisions explicitly and supporting them with evidence.

Establish the right controls

When a hazard requires a preventive control, the food safety plan should define the relevant control and how it will be managed. Common categories include:

• Process controls, such as time, temperature, pH, water activity, or other parameters tied to lethality or inhibition.
• Food allergen controls, including segregation, formulation control, label review, and changeover practices to prevent cross-contact and mislabeling.
• Sanitation controls, especially where environmental pathogens or hygienic design are material risks.
• Supply-chain controls, when the hazard is controlled before receipt by a supplier or another upstream entity.
• Other controls tailored to the process, product, or facility.

If a hazard requiring a preventive control is present, the facility also needs a written recall plan for the affected food.

Monitor, correct, verify, and keep records

HARPC is operational because each preventive control must be supported by monitoring, corrections or corrective actions when deviations occur, and verification activities such as validation where required or otherwise appropriate, record review, calibration, environmental monitoring, or product testing when warranted by the risk. Records are central. During an FDA inspection, the issue is often less whether a control exists in theory and more whether the company can show that it was implemented consistently.

Assign accountable leadership

Certain activities must be performed or overseen by a Preventive Controls Qualified Individual, or PCQI. In practice, strong programs also rely on line ownership across operations, maintenance, sanitation, procurement, warehousing, regulatory, and quality. The plan must be reanalyzed at least once every three years, and sooner when there is a significant change, new information about hazards, or a breakdown suggesting the plan is no longer adequate.

HARPC versus HACCP

HARPC and HACCP are related, but they are not identical. HACCP, or Hazard Analysis and Critical Control Points, remains fundamental in many food businesses and is mandatory for certain sectors such as juice and seafood. HARPC is generally broader in both regulatory scope and operating implications.

• HARPC is built around hazards requiring preventive controls, not only traditional critical control points.
• It explicitly pulls in areas such as allergen control, sanitation, and supply-chain control when they are needed for food safety.
• It ties more directly to FDA’s preventive-controls recordkeeping and recall-plan expectations.
• It does not replace every existing HACCP obligation, and a legacy HACCP plan by itself may not satisfy HARPC requirements.

A common misconception is that HARPC and the separate FSMA Intentional Adulteration rule are the same. They are not. HARPC includes economically motivated adulteration when it creates a food safety hazard, while the Intentional Adulteration rule addresses acts intended to cause wide-scale public health harm.

Practical example

Consider a manufacturer of refrigerated ready-to-eat dips. Its hazard analysis may identify Listeria monocytogenes in the post-lethality environment, allergen cross-contact from shared lines, foreign-material risk from processing equipment, and a supplier-controlled pathogen risk in an ingredient such as tahini or spice blends. A workable HARPC plan could include sanitation preventive controls supported by environmental monitoring, allergen controls for scheduling and label verification, a metal detector or other process control where justified, and a supply-chain program requiring supplier approval, verification activities, and tighter specifications for high-risk ingredients. The point is not to create paperwork. The point is to define where the risks sit, who controls them, what evidence will be reviewed, and what happens when something goes wrong.

Benefits, limitations, and common failure points

What a strong HARPC program can deliver

• Lower recall and disruption risk through earlier identification of hazards and clearer preventive ownership.
• Better supplier discipline because food safety expectations are embedded in sourcing and qualification.
• More consistent operations across shifts, plants, and co-manufacturers through defined monitoring and record review.
• Stronger diligence posture for investors, lenders, acquirers, and large customers assessing execution risk.

Where companies often struggle

• Paper compliance: the plan exists, but the plant runs on tribal knowledge and inconsistent records.
• Weak scope decisions: leaders misunderstand farm versus facility boundaries or miss a high-risk product family.
• Supplier overreliance: procurement assumes a certificate or questionnaire is enough without a real supply-chain program.
• Poor change control: new ingredients, packaging, equipment, or formulations are launched without reanalysis.
• Framework confusion: management assumes a GFSI-benchmarked certification, HACCP plan, or traceability effort automatically closes HARPC gaps.

HARPC is also not a guarantee of safe food. It is a management system. If sanitation, maintenance, training, and supervisory follow-through are weak, the system will fail in execution even if the documentation looks complete.

How executives should think about HARPC

Senior leadership should treat HARPC as a cross-functional operating requirement rather than a regulatory task delegated entirely to quality. The hardest decisions are usually not technical; they are organizational. Who owns supplier verification? How quickly can the business reanalyze a plan after a formulation change? Which records are still manual? Which sites have single-point-of-failure PCQI coverage? Where are the highest-value interventions: hygienic design, environmental monitoring, labeling controls, or upstream ingredient governance?

• Set clear accountability across quality, operations, procurement, engineering, and regulatory affairs.
• Use site and SKU risk segmentation rather than treating every product and plant as equally urgent.
• Connect food safety controls to capital planning, digital recordkeeping, and network design.
• Review HARPC maturity during transactions, co-manufacturing decisions, and new-product commercialization.

For companies strengthening preventive-controls compliance, redesigning supplier programs, preparing for inspection, or evaluating food safety execution across a plant network, the Umbrex Agriculture & Food Practice can help identify independent consultants with relevant experience in operations, quality systems, regulatory readiness, diligence, and implementation.

Where to start or how to improve

1. Confirm which entities, sites, and activities are actually in scope and where exemptions or modified requirements may apply.
2. Review the hazard analysis product by product, especially after major formulation, sourcing, or process changes.
3. Test whether supplier-controlled hazards are supported by a real verification program, not just supplier paperwork.
4. Examine whether sanitation, allergen, and labeling controls are reflected in daily management routines and records.
5. Strengthen reanalysis triggers so M&A integration, new equipment, automation, or copacker changes do not bypass the food safety plan.
6. Run mock recalls and record-readiness checks to see whether the system works under time pressure.