Prerequisite programs (PRPs) are the foundational conditions and practices, good manufacturing practices, sanitation, pest control, employee training, and the rest, that keep a plant hygienic enough that its HACCP plan only has to control the few hazards genuinely needing step-level control. They are the base the whole food-safety system stands on, not an appendix to it.
New HACCP teams often pour their energy into the CCP table and treat prerequisites as background. That is backwards. A HACCP plan controls a handful of critical points; prerequisite programs control the conditions everywhere else, and when they are weak, hazards that should have been handled by the environment come knocking at the HACCP plan instead. This guide explains what PRPs are, the common ones, how they differ from CCPs and operational PRPs, and why the whole system fails when the foundation cracks.
What are prerequisite programs?
Prerequisite programs are the universal steps and procedures that control the operational conditions within a food plant, creating the environmental and hygienic baseline a HACCP system needs to work. Codex describes them as good hygiene practices and other practices that establish the basic conditions for producing safe food. They are applied across the whole facility rather than at one measured step.
The relationship is easiest to see as a division of labor. Prerequisite programs manage hazards that are general and plant-wide, a clean environment, pest exclusion, potable water, trained people. The HACCP plan manages the specific, significant hazards that survive the prerequisites and must be controlled at a defined step, like a cook or a metal detector. A strong prerequisite layer keeps the HACCP plan small and focused; a weak one forces the HACCP plan to do the prerequisites’ job.
What are the common prerequisite programs?
Most food plants run a similar set, because they map to the ways a plant can go wrong. The exact list depends on the process, but a typical prerequisite program portfolio includes:
| Prerequisite program | What it controls |
|---|---|
| Good manufacturing practices | Personnel hygiene, facility and equipment design, process controls, the baseline conditions |
| Sanitation / SSOPs | Cleaning and sanitizing procedures and their verification, pre-operational and operational |
| Pest control | Exclusion, monitoring, and treatment to keep pests out of the facility |
| Allergen management | Segregation, scheduling, cleaning, and labeling controls for allergenic ingredients |
| Supplier approval & receiving | Verifying incoming materials meet specification from approved suppliers |
| Water and utilities safety | Potable water, ice, steam, and compressed air that contact product |
| Preventive maintenance & calibration | Keeping equipment functioning and instruments accurate |
| Training | Making sure people can actually perform the practices the plant depends on |
| Chemical control | Storage and use of cleaning chemicals, lubricants, and non-food compounds |
| Waste, glass & brittle plastic, traceability/recall | Housekeeping and control programs that reduce contamination and enable response |
None of these is exotic. What makes them work is that they are documented, assigned, performed on a schedule, and verified, not left as things everyone assumes are happening. An informal habit is not a prerequisite program; a written procedure with records is.
What is the difference between a PRP, a CCP, and an oPRP?
A PRP controls general conditions plant-wide without a measured critical limit; a CCP controls a specific significant hazard at a defined step with a critical limit and immediate monitoring; and an oPRP, operational prerequisite program, sits in between, controlling a significant hazard through management activities rather than a measured limit at a single step. The oPRP concept comes from ISO 22000 and FSSC 22000; classic Codex HACCP works with just PRPs and CCPs.
| PRP | oPRP | CCP | |
|---|---|---|---|
| Controls a significant hazard? | No, general conditions | Yes | Yes |
| Tied to a specific step? | No, plant-wide | Usually a specific point or activity | Yes, a defined step |
| Measured critical limit? | No | Action criteria, not a measured critical limit | Yes, a validated critical limit |
| Loss of control means? | Degraded conditions | Corrective action; product assessed | Potentially unsafe product; hold and correct |
| Example | Sanitation schedule, pest control | Managed allergen changeover; controlled dry-cleaning | Cook step; metal detection |
The practical test between a CCP and an oPRP is whether you can set and monitor a measurable critical limit whose breach means unsafe product. A cook step has one, 74°C for a defined time, so it is a CCP. A managed allergen changeover controls a real hazard but through a validated cleaning procedure rather than a single measured number, so many schemes treat it as an oPRP. If it is neither a significant-hazard control nor tied to a step, it is a PRP.
One caution on labels: getting the name exactly right matters less than making sure every significant hazard is controlled somewhere and can be shown to be under control. Teams can spend a whole meeting debating oPRP versus CCP for a borderline step. The safer instinct, when it is genuinely close, is to control it as a CCP with a critical limit, the extra rigor rarely hurts, and a defensible over-control beats an under-controlled hazard hiding in a loosely monitored program.
How do PRPs relate to your HACCP plan?
They come first, and they decide how big your HACCP plan has to be. The flow diagram and hazard analysis assume the prerequisites are in place; the hazard analysis then asks, step by step, which hazards remain significant despite the prerequisites and need a CCP. Build the prerequisites deliberately, in order:
- Identify which PRPs your process needs. Work from the standard portfolio, then add what your specific hazards demand, a bakery needs allergen and dry-cleaning programs a beverage line may not.
- Write each as a real procedure. Who does it, how, how often, and how it is verified. A prerequisite program without a documented procedure is a wish.
- Assign ownership and schedule it. Every PRP needs a named owner and a cadence, daily pre-op sanitation, monthly pest review, annual training refresh.
- Verify and keep records. Pre-op inspections, sanitation checks, pest-device logs, training sign-offs. The records are what prove the program runs and what an auditor examines first.
- Feed the hazard analysis. With prerequisites solid, run the hazard analysis; only hazards not adequately controlled by PRPs become CCPs or oPRPs. This is what keeps the CCP count small and defensible.
Done in that order, the prerequisites do most of the food-safety work quietly, and the HACCP plan is left with the two or three points that genuinely need step-level control. Start the whole thing from a HACCP plan template so the prerequisites and the plan stay in one working format.
Why do weak prerequisite programs sink HACCP?
Because a failing foundation forces hazards upward into a plan that was never meant to hold them. If sanitation is unreliable, environmental pathogens become a hazard at more steps; if pest control leaks, contamination becomes reasonably likely where it should not be; if training is thin, the people running your CCP monitoring cannot be trusted to run it right. Suddenly you are arguing that receiving, storage, and six other steps are CCPs, drowning in monitoring records instead of watching the two steps that actually protect people.
Auditors read the prerequisites first, because a plant that cannot keep a sanitation schedule current will not keep CCP monitoring current either. The state of the PRPs predicts the state of the whole system.
This is also where HACCP and GFSI audits are quietly won and lost. The plan reads well; the prerequisite records are where the gaps show, the pre-op check that was skipped, the pest log with a three-week hole, the training record that does not exist for the operator signing the CCP log. Prerequisite programs generate more records, more often, across more of the plant than the HACCP plan does, and that is exactly why they slip.
That is a capture problem before it is a discipline problem. When sanitation checks, pest logs, and training sign-offs live on clipboards scattered across the plant, a missed check is invisible until an auditor or an inspector finds the hole. Plants that capture prerequisite records digitally at the point of work get a live view of which programs are current and which are slipping, the gap shows up the same shift, not at the audit. That is the paperwork foundation Harmony builds for food and beverage manufacturers, layered on the systems they already run with no rip-and-replace, the way one manufacturer replaced paper production logging and automated its daily reporting. Strong prerequisite programs and disciplined good manufacturing practices are what let a HACCP plan stay small, focused, and trusted. Neglect them and the best CCP table in the world sits on sand.