Guest Column

The ABCs Of Building A Food Safety Plan: From HACCP To HARPC

By Anne Sherod, MS, Director of Food Safety, The Acheson Group

Anne Sherod, MS, Director of Food Safety, The Acheson Group

The FDA required hazard analysis critical control point (HACCP) for juice and seafood, and the USDA for meat and poultry. The Food Safety Modernization Act’s (FSMA) proposed Preventive Controls rule for Human Food requires a written Food Safety Plan (FSP) be developed using the hazard analysis risk-based preventive control (HARPC) approach. A preventive approach to food safety is nothing new. But the HARPC approach is a new paradigm shift in thinking. This article will explain this new thinking, define, what HARPC approach is, explain how HARPC is different than HACCP, and how employing this thinking helps you arrive at developing a Food Safety Plan.

HACCP is an international standard that has seven principles used to develop a plan for each product or product type in operation. The FSP using the HARPC approach is a new preventive framework designed to identify specific hazards in addition to traditional HACCP critical control points (CCPs) for processing and take appropriate steps to counter the hazard before a food-safety event occurs. The details below outline the differences in the approach in the context of building an FSP.

Step 1 — Qualified Individual

Developing an FSP with the HARPC approach is a holistic method for a food safety system. The first step is to identify the Qualified Individual(s) (QI). This person is required to have education and experience relevant to food safety and the QI is required to develop the FSP. HACCP requires at least one person to be HACCP Certified, but the development of the HACCP plan is performed by the HACCP team.

Step 2 — Identify The Food

The second step in an FSP is to identify the food, including a product description, intended consumer, reasonable and foreseeable uses, ingredients, processing methods, labeling, packaging, storage and distribution, shelf-life, etc… Similarly, HACCP requires a preliminary task of describing the product. The intent of this is to help gain insight into the risks to the consumer. For example, let’s use a chicken salad sandwich:

  • ingredients are all ready to eat (RTE)
  • the process is assembly
  • refrigeration is required
  • this is sold to the general public and food service venues such as cafeteria including hospitals
  • storage and distribution is temperature controlled
  • shelf-life is one week

Step 3 — Follow A Flow Diagram

There is no requirement in an FSP for a flow diagram; however, there is for HACCP. I believe, like the FDA has stated in the proposed preventive controls rule (PRC) preamble, a flow diagram is a helpful tool. It is the identification of the product “life-cycle” as soon as it starts in the facility, until it leaves your control. What better way to identify all “known or reasonably-foreseeable” hazards associated with a product than to follow a flow diagram, which leads to step 4.

Step 4 — Identify The Hazard

When considering all known or reasonably foreseeable hazards in the FSP, there are three types of hazards to address: biological, chemical (including radiological), and physical — includes economically motivated adulteration (EMA). There is an expectation that the final rule will require control of EMA, but precisely how that will have to be undertaken is unclear at this point. HACCP addresses the three hazards as well, but does not specifically call out radiological and does not include EMA. For both the FSP and HACCP, the list of hazards must be documented.

Step 5 — Evaluate Hazards

Once known or reasonably-foreseeable hazards are identified, the facility needs to determine if any hazards are “significant.” In the re-proposal of the PCR, “significant” hazard replaced hazards that are “reasonably likely to occur,” which is HACCP terminology. One reason for the terminology change is to get the industry thinking “beyond HACCP” since there are ways to control significant risks that do not fit nicely into the seven steps of HACCP. Some questions to consider in making this determination are:

  • Does the facility already have measures in place to control the hazard?
  • Has the facility recalled this product due to this hazard?
  • Are there customer complaints related to this hazard?
  • Has this hazard been the cause of an outbreak or a caused a recall of product at another facility?
  • If this hazard were discovered in product, would it trigger a Class I or Class II recall?
  • Is there scientific data that suggests this hazard is commonly associated with the product?

If a hazard is determined significant, it will require a preventive control. You need evidence to support conclusions about hazards, especially if a conclusion is that a hazard is not significant. In regard to HACCP, there are steps to determine if the reasonably-likely-to-occur hazard requires a CCP, but it does not recognize other controls as preventive controls.

Applying this thinking, let’s go back to the example of the chicken salad sandwich and discuss a few potential significant hazards.


  • Salmonella from the incoming cooked chicken
  • Listeria monocytogenes from the processing facility


  • Allergen from the mayonnaise and bread (Milk, Eggs, Wheat)


  • Metal hazard from equipment (blender) and utensils (knives)

Step 6 — Identify Preventive Controls

Each significant hazard must have at least one PC in place. A PC is a reasonably-appropriate procedure, practice, and process to significantly minimize, eliminate, or prevent a significant hazard. Examples of PC are process, sanitation, allergen, employee hygiene, supplier control, and recall plans. HACCP identifies a CCP as a step at which a control is applied to prevent or eliminate a food safety hazard to an acceptable level.

So what is the difference? The difference can be explained using the chicken salad sandwich example below:

Type Of Food Safety System Significant Hazard  Control (Prerequisite Program, CCP Or PC)
HACCP Salmonella Supplier Control Pre-requisite
HACCP Listeria Monocytogenes Environmental Control Program (EMP) Pre-requisite
HACCP Milk, Egg, Wheat Allergen Control Pre-requisite
HACCP Metal Metal Detection CCP
HARPC Salmonella  Supplier Control PC
HARPC Listeria Monocytogenes Sanitation Program PC (potential GMP and EMP PC)
HARPC Milk, Egg, Wheat Allergen Control PC
HARPC Metal Foreign Material Control Program


This table illustrates the difference in the approach of how to control significant hazards. For example, applying HACCP to the risk of Listeria monocytogenes from the environment, the resulting control is a pre-requisite program (PRP). This PRP would be deployed without any specific program requirements. Applying HARPC principles, the control is a sanitation PC which requires monitoring, verification, corrective action, records review, and reanalysis. See how this approach is moving beyond HACCP?

Step 7 — Validate Preventive Controls And Establish Parameters

Both the FSP and HACCP have similar definitions for validation; the scientific and technical basis to show that a control (CCP or PC) significantly minimizes, eliminates, or prevents the hazard being controlled. HACCP has critical control limits and HARPC has parameters, they are both the specific values that must be reached/maintained (ex: pH, time, temperature, volume or flow rate, contact time, etc...).

Step 8 — Monitoring CCPs

For the FSP and HACCP, monitoring is a documented and planned event (measurement or observation) at a set frequency to ensure a CCP or CP parameter is achieved. Monitoring serves three purposes: it’s an early warning of a potential problem, it shows effective implementation of the control, and it generates records for verification.

Step 9 — Implement Corrective Actions
If the PC is not implemented according to its pre-set parameters, and similarly, a CCP per it critical limits, the product affected by that loss of control is presumptively adulterated/misbranded. Therefore, action must be taken in both instances. Corrective actions must be pre-established and documented for the PC and CCP.

The FSP identifies “ad hoc” corrective actions to a PC. These are problems which occur without a pre-established corrective action. In all instances, a corrective action still needs to be performed, such as immediately placing on hold all implicated product. Ad hoc corrective actions drive a reanalysis of the FSP to include the new significant hazard.

Step 10 – Verify Activities

The FSP and HACCP consider verification activities, not including monitoring, that show the HACCP plan or CP is working as implemented. The following table identifies verification activities for the FSP and HACCP.

Verification Activity          FSP HACCP
Validation     x x
Verify monitoring and corrective actions       x x
Verify calibration of equipment and measuring devices x x
Finished product and environmental testing  x x
Review of records to ensure the FSP is being properly and consistently implemented x x
Complaint review     x
Reanalysis of the FSP  Minimum every three years Annual reassessment

The FSP requires the owner, operator, or agent-in-charge to verify that monitoring is being conducted and appropriate decisions about corrective actions are being made. Realistically, these activities will be delegated to the Quality and Food Safety personnel.

Recall Plan — The FSP also requires the development of a recall plan, whereas HACCP does not. While a recall plan may be seen by some a reactive tool to respond to a crisis, the FDA sees it as a proactive, preventive tool to be prepared to respond in the event a crisis should occur.

So what does this all mean to you? If you are following a HACCP plan, you have a good start for building a solid, facility-specific FSP. Be sure to enlist a project team, make a plan that is achievable, including specific milestones, such as updating programs for compliance with the new GMPs, identify all products or categories of products, perform a HARPC-based hazard analysis, and identify preventive controls. I suggest you to start now — the final rule is right around the corner!

Anne Sherod, MS, Director of Food Safety, The Acheson Group
Anne Sherod is a Director of Food Safety with The Acheson Group.  With her 16 years of experience in food and dietary supplement manufacturing, Anne has led successful teams in manufacturing, for both corporate and retail settings. Specific areas of focus include prevention and preparedness like HACCP, current good manufacturing practices, food and dietary supplement labeling, GRAS notifications, new dietary ingredient approvals and product recalls.

Prior to joining The Acheson Group, Anne held leadership roles in Corporate Food Safety, Quality for companies such as the L. Perrigo Company, The Schwan Food Company, Target, and Milk Specialties Global. Additional roles for Anne also include being an adjunct professor of Food Microbiology at Southwest State University in Marshall, MN.

Anne earned her Master of Science in Food Safety from Michigan State University and Bachelors of Science in Food Science from South Dakota State University. She has a Food Law Certificate from Michigan State University, is HACCP Certified, a Safe Quality Foods Practitioner, and a certified BRC Internal Auditor.

Read more about the differences between HACCP and HARPC here.