HARPC vs HACCP

HACCP and HARPC are both systems for building food safety around hazard analysis, but they are not the same document. HACCP is the older, globally recognized method built around critical control points. HARPC, hazard analysis and risk-based preventive controls, is the U.S. FSMA-era framework that broadened HACCP and made a written food safety plan mandatory for most FDA-registered food facilities.

The confusion is understandable: HARPC is built on the same logic as HACCP, so plants often ask whether their existing HACCP plan is enough. Usually it is not, because HARPC widens the hazards you must consider, moves programs that HACCP kept outside the plan into it as preventive controls, and adds a formal supply-chain program. This guide lays the two side by side, hazard scope, controls, supply chain, and which rule applies to whom.

What is the difference between HARPC and HACCP?

The core difference is breadth. HACCP identifies significant biological, chemical, and physical hazards and controls them at critical control points, keeping sanitation, allergen, and supplier programs outside the plan as prerequisites. HARPC analyzes a wider set of hazards and manages more of the controls, allergen, sanitation, supply-chain, as preventive controls inside a single written food safety plan.

It helps to think of HARPC as HACCP's regulatory successor for general food manufacturing, not a replacement that erased it. The HACCP method still underpins everything; FSMA simply codified a broader, mandatory version for facilities that previously had no federal HACCP requirement.

Where does HARPC widen the hazard analysis?

HARPC requires you to evaluate hazards HACCP traditionally left aside. Beyond biological, chemical, and physical, the food safety plan must consider radiological hazards, naturally occurring toxins, and, a genuinely new category, hazards that may be introduced intentionally for economic gain, meaning economically motivated adulteration.

This wider scope is why a HACCP plan usually cannot be handed to an FDA investigator as a HARPC food safety plan. Even when the hazards overlap, the documentation the rule requires, and the categories it forces you to consider and rule in or out, go beyond what a traditional plan captures.

What are preventive controls, and how do they differ from CCPs?

A preventive control is any control the food safety plan applies to significantly minimize or prevent a hazard, broader than a CCP. HACCP recognizes essentially one kind of in-plan control, the CCP with a critical limit. HARPC recognizes several types of preventive control and manages them all inside the plan.

The practical effect is that programs a HACCP plant runs informally get formalized under HARPC. A CCP is still a preventive control, a process control with a critical limit, but so is your allergen changeover your sanitation program and your supplier verification, each requiring monitoring, corrections, verification, and records inside the plan. Not every preventive control needs a numeric critical limit the way a CCP does, which is part of why the broader term exists.

What is the supply-chain program?

The supply-chain program is HARPC's requirement to control hazards that are managed by your suppliers rather than at your own process. If a raw material has a hazard requiring a preventive control, and that control is applied upstream, you must have a written program to verify the supplier is actually controlling it.

This is more prescriptive than the informal "approved supplier list" many HACCP plants keep. Under 21 CFR Part 117 Subpart G, you determine appropriate verification activities, which can include on-site audits, sampling and testing, or review of the supplier's food safety records, and the activity has to match the risk. A hazard with a serious health consequence generally calls for an annual on-site audit of the supplier. It ties directly into your supplier quality management and your traceability program, since you cannot verify what you cannot trace.

Who has to follow HACCP, and who has to follow HARPC?

HACCP is mandated by product category; HARPC is mandated by facility registration. Seafood, juice, and meat and poultry have their own HACCP regulations, and a plant in those categories can meet its federal obligation through HACCP. Most other FDA-registered human food facilities fall under HARPC and need a preventive controls food safety plan.

How do you move from a HACCP plan to a HARPC food safety plan?

If you have a solid HACCP plan, you are most of the way there, HARPC reuses the hazard-analysis backbone. The gap-close is systematic:

1. Put a PCQI in charge. A preventive controls qualified individual must prepare or oversee the food safety plan; identify and train that person first.
2. Re-run the hazard analysis with the wider scope. Add radiological hazards, natural toxins, and economically motivated adulteration, and document why each is or is not a hazard requiring a preventive control.
3. Reclassify your controls as preventive controls. Map existing CCPs to process controls, and bring allergen, sanitation, and supply-chain programs inside the plan with their own monitoring, corrections, and verification.
4. Build the supply-chain program. For hazards controlled upstream, define supplier verification activities that match the risk, and document them.
5. Add the written recall plan and reanalysis triggers. Include a recall plan and reanalyze the whole food safety plan at least every three years, or whenever conditions change.

Start the underlying hazard work from the hazard analysis worksheet and the HACCP plan template; the structure carries directly into a HARPC plan, you are just widening the scope and formalizing more controls.

What do the primary sources say?

HARPC is regulation, not guidance, and its requirements are specific:

• HARPC is implemented in 21 CFR Part 117 Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.
• The supply-chain program requirements are in Part 117 Subpart G.
• The FDA summarizes the traditional seven principles in its HACCP Principles & Application Guidelines and seafood HACCP lives in 21 CFR Part 123.
• The FDA's Preventive Controls for Human Food rule overview explains who is covered and the PCQI requirement.

How do you run a preventive-controls plan without drowning in records?

HARPC's breadth is its burden. Pulling allergen, sanitation, and supply-chain controls inside the plan means every one of them now carries monitoring, corrections, verification, and records, on top of your process CCPs. On paper across three shifts, that is a lot of clipboards, and a lot of places for a missed check to hide until the FDA investigator finds it.

The plants that carry HARPC cleanly make the records a by-product of the work. When process, allergen, sanitation, and supplier-verification checks are captured at the station and time-stamped as they happen, a PCQI can see a missed check the same shift, a deviation opens its corrective-action record immediately, and reanalysis runs on real trends instead of a binder. Harmony builds that layer for food and beverage plants, turning paper checks and quality logs into live, searchable data on the systems you already run, no rip-and-replace. One manufacturer replaced paper production logging entirely and automated its daily reporting on exactly this pattern. Build the plan off the template keep the GMP foundation strong, and a broader HARPC plan stays manageable instead of burying the team.