Hazard Analysis & Risk-Based Preventive Controls

HARPC — Hazard Analysis and Risk-Based Preventive Controls — is the food-safety planning approach the U.S. FDA requires under the Food Safety Modernization Act (FSMA). It lives in the Preventive Controls for Human Food rule, 21 CFR Part 117, and it shifts food safety from reacting to problems toward preventing them. Rather than catching contamination after the fact, HARPC asks you to identify where hazards could enter your process and to put documented controls in place before they ever reach a consumer.

It is important to be clear about one thing: HARPC is a regulatory compliance requirement, not a certification. There is no HARPC certificate to hang on the wall. What you build is a written food safety plan that an FDA investigator can review during an inspection, and what you demonstrate is that your facility is inspection-ready and operating in compliance with the rule.

At its core the rule requires a written plan, developed and overseen by a qualified individual, that analyzes your hazards, applies preventive controls where they are needed, and keeps the records that prove those controls are actually working day to day.

HARPC generally applies to facilities that are required to register with the FDA and that manufacture, process, pack, or hold human food. That covers a wide range of operations across the supply chain, including:

• Food and beverage manufacturers and processors of all sizes.
• Co-packers and contract manufacturers producing food for other brands.
• Packing and repacking operations that handle finished or in-process food.
• Warehousing and holding facilities storing human food, where holding conditions matter to safety.
• Importers, who face related FSMA obligations for the foods they bring into the country.

There are exemptions and modified requirements — for example, certain very small businesses may face reduced obligations, and some facilities already regulated under other FDA rules (such as seafood, juice, or dietary supplements) or under USDA authority may fall outside Part 117. These carve-outs are genuinely fact-specific and depend on your products, sales, and how the FDA classifies your facility. If you are unsure whether the rule applies to you, that determination is worth getting right early — we help clients confirm their status before building anything.

The heart of HARPC is a written food safety plan prepared and overseen by a Preventive Controls Qualified Individual (PCQI) — a person with the training or experience to develop and validate the plan. The plan brings together several connected pieces:

• Hazard analysis — a systematic look at biological, chemical (including radiological), and physical hazards, and whether each one requires a preventive control.
• Risk-based preventive controls — the controls applied to significant hazards, which commonly include process controls, food-allergen controls, sanitation controls, and supply-chain controls.
• Monitoring — checking that each preventive control is doing its job, on a defined schedule.
• Corrective actions — what you do when a control fails or a problem is found, including how you handle affected product.
• Verification — the activities, and validation where appropriate, that confirm the controls are effective and the plan is being followed.
• Recall plan — a written procedure for removing affected product from the market when a hazard requires it.

Underlying all of it are records. The rule expects documented evidence that controls are monitored, deviations are handled, and verification happens — because under HARPC, if it is not recorded, an investigator has no way to confirm it occurred.

The first reason is simple: it is the law. For facilities covered by Part 117, a compliant food safety plan is not optional. During an inspection, gaps can lead to FDA 483 observations, and unresolved problems can escalate to warning letters and, in serious cases, to product detention, seizure, or suspension of a facility's registration. Those outcomes disrupt operations and are far more costly than getting the plan right.

HARPC also differs from HACCP in ways that matter. HACCP is a well-established, principle-based method that many facilities already use. HARPC is broader and preventive-controls-based, and — unlike HACCP on its own — it is a legal FDA requirement. It reaches beyond traditional critical control points to include areas like allergen, sanitation, and supply-chain controls. Facilities already fluent in HACCP are not starting over, but they do need to extend and reframe their existing work to satisfy the rule.

Finally, HARPC compliance is increasingly a customer expectation. Retailers and buyers want assurance that their suppliers meet FSMA obligations, so a solid, defensible food safety plan protects commercial relationships as much as it satisfies regulators.

We have spent 30+ years building food-safety and management systems and have supported 900+ organizations with a 100% first-time pass rate on the work we take through to completion. For HARPC that experience shows up as a plan that holds up under FDA scrutiny and still makes sense to the people running the line.

Our 10-Step Approach takes you from an initial assessment and hazard analysis through preventive controls, monitoring, corrective actions, verification, and your recall plan, to a fully documented, inspection-ready system — with us alongside you at each step. We write it as lean, single-level documentation, typically under 200 pages, matched to your real process rather than a generic template, so your team actually uses it instead of filing it away.

We also address the PCQI requirement directly: we help you develop and support the qualified individual who owns the plan, so the responsibility rests with your organization and does not walk out the door when the project ends. And because so much of HARPC comes down to what an investigator can see, we prepare your facility and your people for FDA inspection — the records, the walkthrough, and the questions — so that when an investigator arrives, nothing is a surprise.

• Assuming an existing HACCP plan is enough. HARPC is broader and a legal requirement; we extend your HACCP work into full preventive controls rather than leaving gaps a HACCP plan alone would not cover.
• No qualified PCQI in place. The plan must be prepared and overseen by a Preventive Controls Qualified Individual — we help you build that capability in-house so it is genuine, not a name on paper.
• A hazard analysis that misses allergens or supply-chain risks. These are among the most common findings; we make sure the analysis is complete and honest about your real hazards.
• Records that exist only on paper. Monitoring logs filled in after the fact will not survive an inspection — we build recordkeeping into the daily routine so it reflects what actually happened.
• No validation or verification. Having controls but never confirming they work; we build verification and, where needed, validation into the plan from the start.
• A missing or untested recall plan. We make sure the written recall procedure exists and that your team knows how to use it before it is ever needed.
• Overbuilt documentation nobody follows. Binders of generic procedures satisfy no one; we keep the plan lean, specific, and usable so it stays current.
• Waiting until an inspection to get ready. We prepare the facility and staff ahead of time, so an FDA visit confirms compliance rather than exposing gaps.