HARPC stands for Hazard Analysis and Risk-Based Preventive Controls, a food safety regulation that requires food facilities in the United States to identify potential hazards in their products and put preventive measures in place before problems occur. The FDA finalized this regulation on September 17, 2015, as part of the Food Safety Modernization Act (FSMA), which was signed into law in January 2011. HARPC replaced the older reactive approach to food safety with a prevention-first framework, shifting the focus from responding to contamination after it happens to stopping it before it reaches consumers.
How HARPC Works
At its core, HARPC requires food facilities to create a written food safety plan. This plan must include a thorough hazard analysis that identifies any “known or reasonably foreseeable” hazards associated with the food being produced. These hazards fall into several categories: biological (bacteria, viruses, parasites), chemical (cleaning agents, pesticides), physical (metal fragments, glass), radiological, and even economically motivated hazards like food fraud or intentional adulteration.
Once hazards are identified, the facility must establish preventive controls to manage them. These controls fall into four main types:
- Process controls: Steps like cooking to a specific temperature or acidifying a product to kill harmful bacteria.
- Allergen controls: Measures to prevent cross-contact between allergenic and non-allergenic foods, including proper labeling.
- Sanitation controls: Cleaning and sanitizing procedures that directly affect food safety.
- Supply-chain controls: Verification that ingredients from suppliers meet safety standards before they enter the facility.
The facility must also establish monitoring procedures, corrective actions for when something goes wrong, and verification activities to confirm the controls are actually working. All of this has to be documented and kept on record. The FDA can inspect facilities and request access to these records at any time.
How HARPC Differs From HACCP
If you’ve worked in food safety before, HARPC will look familiar. Its underlying approach closely mirrors the Hazard Analysis Critical Control Point (HACCP) system that has been the global standard for decades. But there are meaningful differences in scope and flexibility.
HACCP focuses on identifying “significant hazards” and controlling them at specific critical control points with strict numerical limits (a minimum cooking temperature, for example). HARPC takes a broader view. Instead of requiring rigid critical limits, it uses the more flexible language of “parameters” and “values,” giving facilities more room to design controls that fit their specific operations. The hazard analysis itself is also wider: HACCP asks what hazards are significant enough to warrant control, while HARPC asks what hazards are “known or reasonably foreseeable,” a lower threshold that captures more potential risks.
The structure differs too. Under HACCP, your plan is essentially one document covering significant hazards. HARPC introduces the concept of a broader “food safety system” with two layers. The first layer is the food safety plan (the HARPC plan itself), which manages higher-risk foreseeable hazards. The second layer consists of prerequisite programs, like general sanitation and employee hygiene, that handle lower-risk hazards and support the main plan.
One of the most practical differences is a staffing requirement. HACCP expects all team members to have appropriate training, but HARPC specifically requires that at least one person on the food safety team be a Preventive Controls Qualified Individual, or PCQI. This person must have the training or experience to develop and oversee the food safety plan.
The PCQI Requirement
The PCQI is a central figure in HARPC compliance. This individual is responsible for preparing or overseeing the preparation of the food safety plan, validating that preventive controls work, reviewing monitoring records, and making decisions about corrective actions. The role doesn’t have to be filled by a single person, but at least one qualified individual must be involved.
Qualifying as a PCQI typically means completing a standardized training course. The Food Safety Preventive Controls Alliance (FSPCA), a public-private partnership of industry, academic, and government stakeholders, developed the core curriculum that most training programs follow. Many food science departments at universities and private training organizations offer the course, which generally takes about two and a half days to complete.
Beyond the PCQI, all employees who manufacture, process, pack, or hold food must be qualified for their specific duties through some combination of education, training, or experience. Everyone is also required to receive training in basic food hygiene and safety principles, including the importance of personal health and hygiene as it relates to their role.
Who Must Comply
HARPC applies to food facilities that are required to register with the FDA. This covers a wide range of operations: manufacturers, processors, packers, and holders of human food. The regulation is codified under 21 CFR Part 117, formally known as the Preventive Controls for Human Food rule.
Not every facility faces the full set of requirements. Part 117 includes several complete or partial exemptions. Very small businesses, certain low-risk activities, and facilities already regulated under other specific food safety systems (like juice or seafood HACCP) may qualify for modified requirements or full exemptions. The specifics depend on factors like annual revenue, the type of food being produced, and the facility’s role in the supply chain.
Reanalysis and Ongoing Compliance
A HARPC plan is not a one-time document. The FDA requires facilities to reanalyze their food safety plan at least once every three years. Beyond that scheduled review, a reanalysis is also triggered whenever a preventive control is found to be ineffective, when new information about a hazard emerges, when the facility changes its processes or ingredients, or when a new hazard is identified that wasn’t previously considered.
This ongoing reanalysis requirement reflects the prevention-oriented philosophy behind FSMA. The goal is to keep food safety plans current and responsive to real-world conditions rather than letting them become outdated paperwork. The FDA can inspect facilities at regular intervals and has the authority to access all records documenting how a facility executes its food safety plan. Facilities that fail to maintain a compliant plan, or that don’t follow through on the controls they’ve documented, face enforcement action.
Why HARPC Matters
Before FSMA and HARPC, the FDA’s approach to food safety was largely reactive. The agency responded to outbreaks and contamination events after they occurred. HARPC flipped that model by requiring facilities to anticipate problems and build systems to prevent them. The regulation applies science-based preventive controls across the entire food supply chain, from how ingredients are sourced to how finished products are stored and shipped.
For food businesses, compliance means investing in training, documentation, and ongoing monitoring. For consumers, it means the food supply operates under a system designed to catch hazards before they cause illness. The shift from “find and fix” to “predict and prevent” represents the most significant change in U.S. food safety regulation in over 70 years.