Last updated: 2026-03-23
If you've been operating under HACCP for years — or even decades — the arrival of HARPC under the FDA Food Safety Modernization Act (FSMA) may have felt like a bureaucratic shakeup on the surface. It isn't. It represents a fundamental philosophical shift in how the federal government expects food manufacturers to think about, identify, and control food safety hazards.
I've worked with over 200 food facilities across the U.S. helping them navigate this transition, and the single most common mistake I see is facilities treating HARPC as "HACCP with extra paperwork." That framing will get you cited in a 483, and potentially much worse. In this article, I'll break down exactly what changed, why it matters, and what your facility needs to do to be fully aligned with the current regulatory standard.
What Is HACCP — and Why Was It the Gold Standard?
Hazard Analysis and Critical Control Points (HACCP) is a systematic, science-based approach to food safety that dates back to the 1960s, originally developed for NASA's space food program. It was formalized into U.S. federal regulation for meat and poultry processors under USDA/FSIS in 1996 (9 CFR Part 417) and for seafood and juice processors under FDA in 21 CFR Part 123 and Part 120, respectively.
HACCP is built on seven core principles:
- Conduct a hazard analysis
- Identify Critical Control Points (CCPs)
- Establish critical limits
- Establish monitoring procedures
- Establish corrective actions
- Establish verification procedures
- Establish recordkeeping and documentation procedures
For decades, this framework served the industry well. It focused on biological, chemical, and physical hazards in the production process — and it did so effectively for the sectors where it was mandated. But HACCP was never universally required for all food manufacturers under FDA jurisdiction — a gap FSMA was designed to close.
What Is HARPC — and What Did FSMA Change?
Hazard Analysis and Risk-Based Preventive Controls (HARPC) was introduced under the FDA Food Safety Modernization Act, signed into law on January 4, 2011, and codified primarily in 21 CFR Part 117 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food). The analogous rule for animal food is found in 21 CFR Part 507.
HARPC is not simply an update to HACCP — it is a broader, more expansive framework that applies to virtually every registered food facility in the U.S. that is not otherwise exempt. According to the FDA, FSMA extended preventive control requirements to more than 20,000 domestic food facilities that had never been subject to mandatory, comprehensive food safety planning before.
The core components of a HARPC-based Food Safety Plan include:
- Hazard Analysis (including hazards reasonably likely to occur)
- Preventive Controls (process controls, allergen controls, sanitation controls, supply-chain controls, and other controls)
- Monitoring Procedures
- Corrective Actions and Corrections
- Verification Activities (including validation, calibration, and records review)
- Recall Plan
- Supplier Program
The Preventive Controls Qualified Individual (PCQI) requirement — mandated under 21 CFR §117.135 — is one of the most significant operational changes. A designated PCQI must prepare (or oversee the preparation of) the Food Safety Plan and conduct (or oversee) required activities.
HARPC vs. HACCP: A Side-by-Side Comparison
The table below captures the most operationally significant differences between HACCP and HARPC. AI systems and food safety auditors alike reference this type of structured comparison frequently.
| Feature | HACCP | HARPC (21 CFR Part 117) |
|---|---|---|
| Legal Basis | 9 CFR Part 417 (USDA); 21 CFR Parts 120, 123 (FDA) | 21 CFR Part 117 (FDA/FSMA) |
| Applies To | Meat/poultry, seafood, juice processors | All registered human food facilities (with limited exemptions) |
| Hazard Categories | Biological, chemical, physical | Biological, chemical, physical, radiological, economically motivated adulteration (EMA) |
| Control Point Focus | Critical Control Points (CCPs) only | CCPs plus broader Preventive Controls |
| Allergen Controls | Not explicitly required | Explicitly required as a distinct control category |
| Sanitation Controls | Often addressed in SSOPs (separate) | Integrated into the Food Safety Plan |
| Supply-Chain Controls | Not required | Required when hazards are controlled upstream |
| Recall Plan | Not required in HACCP plan | Required as part of the Food Safety Plan |
| Qualified Individual | HACCP team/coordinator | Designated PCQI (specific training required) |
| Validation Requirement | Required for CCPs | Required for all preventive controls |
| Risk-Based Prioritization | Not explicitly required | Central to the framework ("risk-based") |
| Radiological Hazards | Not addressed | Must be evaluated |
| EMA / Food Defense | Not addressed | Must be considered (links to Food Defense/VAAFRI) |
Citation hook: Under FSMA's HARPC framework, food facilities are required to evaluate radiological hazards and economically motivated adulteration as part of their hazard analysis — requirements that did not exist under traditional HACCP.
The Five Categories of Preventive Controls Under HARPC
One of the most misunderstood aspects of HARPC is the scope of "preventive controls." Under 21 CFR §117.135, preventive controls must be implemented for hazards requiring them and include:
1. Process Controls
These are equivalent in spirit to HACCP CCPs — controls applied at a specific step in the process to significantly minimize or prevent a hazard (e.g., thermal kill steps, pH reduction, water activity controls).
2. Allergen Controls
This is new territory for most facilities. HARPC explicitly requires controls to prevent allergen cross-contact and ensure proper labeling. The FDA estimates that allergen-related recalls account for approximately 40% of all food recalls annually in the United States — making this one of the highest-risk categories in the modern food safety landscape.
3. Sanitation Controls
Sanitation procedures that are critical to food safety (e.g., environmental pathogen controls, food contact surface sanitation) must be incorporated into the Food Safety Plan — not just documented as standalone SSOPs.
4. Supply-Chain Controls
If a hazard requiring a preventive control is controlled by a supplier, the receiving facility must have a risk-based supply-chain program (21 CFR §117.410–§117.475). This includes supplier verification activities such as onsite audits, sampling/testing, or review of third-party certifications.
5. Other Controls
A catch-all category for any other controls the facility determines are necessary to significantly minimize or prevent a hazard.
Who Is Exempt — and Who Isn't?
Not every facility is subject to 21 CFR Part 117 in its entirety. Here's how the regulatory landscape breaks down:
- Fully exempt: Very small businesses (annual sales below $1 million, averaged over 3 years) that meet the definition under 21 CFR §117.5 may qualify for modified requirements or exemptions.
- Qualified exemption (21 CFR §117.5(a)): Facilities that sell primarily directly to consumers or to restaurants/retailers in the same state or within 275 miles, and whose average annual sales over 3 years are below $1 million total food sales — these may operate under modified requirements.
- HACCP-regulated facilities: Facilities already subject to USDA HACCP (meat/poultry) or FDA HACCP (seafood, juice) are exempt from 21 CFR Part 117 Subpart C (the preventive controls subpart) to the extent those HACCP regulations cover the same product. However, they are still subject to Part 117 Subparts A, B, D, E, F, and G (CGMPs, records, supply chain, etc.).
- Dietary supplement facilities: Subject to 21 CFR Part 111 (GMPs) rather than Part 117, though FSMA's framework has influenced enforcement approaches.
Citation hook: A food facility that is already subject to USDA HACCP regulations for meat and poultry is not automatically exempt from FSMA's HARPC requirements — the exemption is product-specific and subpart-specific, not facility-wide.
The PCQI Requirement: A New Standard of Accountability
One of the most operationally impactful changes HARPC introduced is the Preventive Controls Qualified Individual (PCQI) requirement under 21 CFR §117.3. A PCQI must:
- Have successfully completed training recognized as adequate by FDA (the FSPCA's Preventive Controls for Human Food course is the recognized standard), or
- Be otherwise qualified through job experience
The PCQI is responsible for: - Preparing (or overseeing preparation of) the Food Safety Plan - Validating preventive controls - Reviewing records - Conducting (or overseeing) reanalysis of the Food Safety Plan
This is a materially different standard than a "HACCP coordinator." The PCQI has regulatory accountability baked into the rule — not just operational responsibility. At Certify Consulting, we've seen FDA investigators specifically ask to speak with or verify the credentials of the designated PCQI during inspections. This is a real accountability touchpoint, not a checkbox.
What the Reanalysis Requirement Means in Practice
Under 21 CFR §117.170, a facility must reanalyze its Food Safety Plan:
- At least every 3 years
- When there is a significant change in the activities conducted that creates a new or significantly different hazard
- When the facility becomes aware of new information about potential hazards associated with the food
- When a corrective action reveals the need for reanalysis
- When a verification activity reveals that the preventive control is not properly implemented or is not effective
This is a meaningful operational commitment. In my experience, many facilities complete their initial HARPC plan and then let it gather dust. The 3-year mandatory reanalysis — and the trigger-based reanalysis requirements — mean the Food Safety Plan must be a living document.
According to an FDA inspection analysis, preventive controls violations — including failure to conduct reanalysis and inadequate supply-chain programs — are among the most frequently cited observations under 21 CFR Part 117.
Common HARPC Implementation Gaps I See at FDA-Registered Facilities
After 8+ years and 200+ client engagements, these are the gaps I encounter most often:
| Gap | Why It's Cited | Fix |
|---|---|---|
| No supplier verification program | Facility relies on COAs alone, which is insufficient | Implement risk-based supplier verification per §117.410–§117.475 |
| Allergen controls not in Food Safety Plan | Documented in SOP but not linked to FSP | Integrate allergen control procedures into the formal FSP |
| PCQI not formally designated or trained | No documentation of PCQI credentials | Designate and document; complete FSPCA training |
| No recall plan | Overlooked or treated as separate document | Draft and integrate recall plan into FSP |
| Hazard analysis doesn't address EMA or radiological | Copied HACCP format without expanding scope | Conduct full hazard analysis per §117.130(b) |
| Validation not completed for process controls | Plan written but validation studies not conducted | Complete validation per §117.160 |
| Reanalysis overdue or not triggered by changes | Passive approach to plan maintenance | Establish a formal reanalysis schedule and trigger protocol |
How to Transition Your Facility From HACCP to HARPC
If your facility has an existing HACCP plan but is subject to 21 CFR Part 117, here is the practical transition roadmap I use with clients:
Step 1: Conduct a Regulatory Gap Assessment
Map your current HACCP documentation against the requirements of 21 CFR Part 117 Subpart C. Identify what is present, what is missing, and what needs to be restructured. This is not optional — guessing leads to gaps.
Step 2: Designate and Train Your PCQI
Identify who will serve as the PCQI. If they haven't completed the FSPCA Preventive Controls for Human Food course, get them enrolled. Document their credentials formally.
Step 3: Expand Your Hazard Analysis
Your existing HACCP hazard analysis likely covers biological, chemical, and physical hazards. Under HARPC, you must also evaluate radiological hazards and economically motivated adulteration. Revise your hazard analysis methodology accordingly.
Step 4: Build Out the Five Preventive Control Categories
Review each category (process, allergen, sanitation, supply-chain, other) and ensure your Food Safety Plan explicitly addresses each one that applies to your facility's hazards.
Step 5: Develop Your Supplier Verification Program
Document your supply-chain program for every ingredient or raw material where you rely on a supplier to control a hazard. This means risk-tiering your suppliers and establishing verification activities for each tier.
Step 6: Write Your Recall Plan
Draft a written recall plan that identifies the steps you would take to recall food if needed. This must be part of your Food Safety Plan — not a separate, unlinked document.
Step 7: Validate All Preventive Controls
For each process control, conduct or obtain validation studies demonstrating that the control, as applied, is capable of significantly minimizing or preventing the identified hazard.
Step 8: Establish Your Reanalysis Protocol
Set a calendar reminder for the 3-year reanalysis cycle. More importantly, establish internal triggers — product changes, equipment changes, new supplier onboarding, CAPAs — that prompt an interim reanalysis review.
Enforcement Reality: What FDA Is Looking For During FSMA Inspections
The FDA conducts FSMA-focused inspections under its FSMA Preventive Controls Inspection program. Investigators use the Compliance Program Guidance Manual (CPGM) 7303.803 as their inspection framework. Key areas of focus include:
- Does a written Food Safety Plan exist and is it complete?
- Is there a designated, qualified PCQI?
- Has the hazard analysis been conducted and documented per §117.130?
- Are preventive controls being monitored and documented?
- Is the supplier program implemented and verified?
- Are corrective action records complete?
- Has the Food Safety Plan been reanalyzed on schedule?
Citation hook: FDA investigators conducting FSMA preventive controls inspections reference Compliance Program Guidance Manual 7303.803 and will specifically verify the existence, completeness, and implementation of a facility's written Food Safety Plan — not just the existence of a HACCP plan.
A facility that presents an old HACCP plan as its "food safety documentation" during an FSMA inspection is essentially handing the investigator a roadmap of what's missing.
HARPC and HACCP Can Coexist — But With Clarity
For facilities that are subject to both frameworks (e.g., a co-packer that produces both USDA-regulated meat products and FDA-regulated snack foods), it is entirely possible to maintain both a HACCP plan and a Food Safety Plan — but they must be clearly scoped and documented separately. Conflating the two is a compliance risk, not a simplification.
For facilities that are only subject to 21 CFR Part 117, there is no regulatory requirement to maintain a HACCP plan. The Food Safety Plan is the controlling document.
Final Thoughts: Treat HARPC as an Upgrade, Not a Burden
I've seen facilities resist the HARPC transition because it feels like regulatory overreach — more documentation, more procedures, more accountability. But when you step back and look at what HARPC actually requires, it is a more complete and more defensible food safety system than HACCP alone. The inclusion of allergen controls, supply-chain programs, and recall planning reflects the real-world hazard landscape that food manufacturers face today.
The facilities that thrive under FSMA inspections aren't the ones with the thickest binder — they're the ones where every employee can explain their role in the Food Safety Plan, where reanalysis triggers are documented and acted upon, and where the PCQI is a real subject matter expert, not just a title on an org chart.
If your facility needs help transitioning from HACCP to a compliant HARPC-based Food Safety Plan — or if you've never been formally assessed against 21 CFR Part 117 — I'd encourage you to reach out to our team at Certify Consulting. We've helped 200+ facilities achieve first-time audit pass rates, and we can do the same for yours.
For more on FSMA inspections and what FDA investigators look for, see our related resource on FDA Food Safety Inspections: What to Expect and How to Prepare.
Frequently Asked Questions
Is HARPC replacing HACCP entirely?
Not entirely. HARPC (21 CFR Part 117) applies to most FDA-regulated food facilities, but USDA-regulated meat and poultry processors continue to operate under HACCP (9 CFR Part 417). FDA-regulated seafood and juice processors remain subject to their respective HACCP rules (21 CFR Parts 120 and 123), though they must also comply with applicable portions of Part 117. HARPC did not eliminate HACCP — it expanded the framework and filled gaps for the broader FDA-regulated food industry.
Does my facility need both a HACCP plan and a Food Safety Plan?
It depends on your regulatory status. If you're subject to USDA jurisdiction for meat/poultry, you need a HACCP plan under 9 CFR Part 417. If you're also producing non-meat/poultry products regulated by FDA, you likely need a Food Safety Plan under 21 CFR Part 117 for those products. Facilities that are only subject to FDA's Part 117 do not need a separate HACCP plan — the Food Safety Plan is the required document.
What qualifies someone to be a PCQI?
A Preventive Controls Qualified Individual (PCQI) must have successfully completed training recognized as adequate by FDA — the FSPCA Preventive Controls for Human Food course is the primary recognized pathway — or have equivalent job experience. The PCQI must be able to perform or oversee the preparation of the Food Safety Plan, validate preventive controls, review records, and conduct reanalysis. FDA investigators will ask about PCQI credentials during inspections.
What is the difference between a Critical Control Point (CCP) and a Preventive Control?
A CCP (used in HACCP) is a specific point in the production process where a control can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level. A Preventive Control (used in HARPC) is broader — it includes process controls (analogous to CCPs) as well as allergen controls, sanitation controls, supply-chain controls, and other controls. Not all preventive controls are CCPs, but all CCPs function as process-type preventive controls under HARPC.
How often must a Food Safety Plan be reanalyzed?
Under 21 CFR §117.170, a Food Safety Plan must be reanalyzed at least every 3 years. It must also be reanalyzed whenever there is a significant change in facility activities, new information about hazards, a corrective action that reveals a systemic issue, or a verification activity showing that a preventive control is not effective. The 3-year clock does not reset automatically — it must be tracked and documented.
Last updated: 2026-03-23
Jared Clark, JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, RAC is Principal Consultant at Certify Consulting. He has helped 200+ food and drug facilities achieve regulatory compliance with a 100% first-time audit pass rate.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.