HACCP Versus HARPC –

White Paper
What's the Difference?

Contents

1 Introduction: HACCP (Hazard Analysis Critical Control Points) Vs

HARPC (Hazard Analysis Hazard Analysis and Risk-based Pre-
ventive Controls) – What's the Difference?

2 Food Safety Modernization Act (FSMA)

3 Hazard Analysis and Critical Control Points (HACCP)

4 Hazard Analysis and Risk-based Preventive Controls (HARPC)

5 Additional Information on HARPC

6 Conclusion

7 Summary Table

8 References

9 Recommended Reading
 1 Introduction: HACCP Vs HARPC – What's the Difference?
HACCP versus HARPC

Hazard Analysis and Critical Control Points (HACCP) and Hazard Analysis and Risk-based Preventive Controls
(HARPC) are often discussed interchangeably in food-processing circles. However, if you ask most food processing
professionals to explain the differences between the two, the answer may not come so easily. While HACCP is a
well-known global standard, HARPC is relatively new.

This white paper takes a thorough look at each food safety standard and explains their similarities and differences,
as well as the key steps food companies must take as they prepare to transition from HACCP to HARPC.

2 Food Safety Modernization Act (FSMA)

Every year, as many as 600 million people (or almost 1 in 10) in the world fall ill after consuming contaminated
food, according to the World Health Organization's (WHO) first ever estimates of the global burden of foodborne
diseases in 20151. Foodborne illness outbreaks have triggered recent food safety legislation, including the Food
Safety Modernization Act (FSMA) which was signed into United States (US) law in January 2011 and represents the
first major reform of food safety laws in more than 70 years. To ensure the US food supply is safe, the FSMA shifts
the Food and Drug Administration's (FDA) focus from responding to contamination to preventing it from occurring in
the first place.

By allowing the FDA to regulate through enforcement the prevention of food safety
problems before rather than after they occur, the law is having a dramatic impact on
food processing facilities. In particular, the Preventive Controls for Human Foods final
rule significantly changes the way food processing companies document their food
safety systems, as the traditional approach of using HACCP transitions to the new
HARPC. Dates for compliance with the new preventive controls final rule are staggered,
based on the size of the business. For example, large companies were required to be
in compliance on September 19th 2016, while small companies (those with fewer than
Foreign body in glass jar 500 full-time equivalent employees) were required to be in compliance on September
18th 2017. Very small companies (businesses averaging less than $1 million per
year (adjusted for inflation) in annual sales of human food plus the market value of human food manufactured,
processed, packed, or held without sale) are required to be in compliance on September 17th 20182.

Before we look at HARPC and its requirements in more detail, let us first focus on HACCP.

3 Hazard Analysis and Critical Control Points (HACCP)

Hazard Analysis and Critical Control Points (HACCP) is a systematic approach to the identification, evaluation and
control of food safety hazards. It was conceptualized in the late 1950s and early 1960s by a team of engineers
and scientists from National Aeronautics and Space Administration (NASA), the Pillsbury Company, and the Army's
Natick Research Labs as a way of ensuring the safety of astronauts' food.

Since then, HACCP's evolution has been continual and resulted in a comprehensive food safety management
system (FSMS). Pillsbury publicly presented the HACCP concept at the 1971 National Conference on Food
Protection, and in 1974 the FDA incorporated its concepts into its low-acid and acidified-food regulations.

¹ http://www.who.int/mediacentre/news/releases/2015/foodborne-disease-estimates/en/
² https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334115.htm

2 White Paper
METTLER TOLEDO
 By the end of the 1980s, McDonald's started requiring its suppliers to adhere to HACCP to ensure the safety of
food served in its restaurants. Shortly afterwards, other large companies followed suit. In 1989, the National
Advisory Committee on Microbiological Criteria for Foods (NACMCF), published the first official HACCP document,
standardizing the practice and presenting the seven principles of HACCP (listed below). Four years' later, the HACCP
system was adopted by the Codex Alimentarius Commission.

HACCP requires a multidisciplinary team for implementation and is based on the following seven principles:

3.1 Conduct a Hazard Analysis

Food companies must list the steps in their manufacturing process and identify where significant hazards are likely
to occur. A hazard is defined as any biological, chemical or physical agent that is reasonably likely to cause illness
or injury in the absence of its control. Once hazards have been identified and evaluated, the HACCP team must
identify critical control points (CCPs).

3.2 Determine the Critical Control Points (CCPs)

A CCP is a point, step or procedure at which control can be applied and a food safety hazard can be prevented,
eliminated or reduced to acceptable levels. A CCP may control more than one food safety hazard or, in some
cases, more than one CCP may be needed to control a single hazard. The number of CCPs required depends on
the processing steps and the control needed to ensure food safety.

3.3 Establish Critical Limits

A critical limit is a maximum and/or minimum value to which a biological, chemical or physical parameter must be
controlled at a CCP to prevent, eliminate or reduce to an acceptable level the occurrence of a food safety hazard. A
critical limit is used to distinguish between safe and unsafe operating conditions at a CCP.

3.4 Establish Monitoring Procedures

Monitoring procedures must be established for the measurement of the critical limit at each CCP. These should
describe how the measurement will be taken, when it will be taken, who is responsible for the measurement, and
how frequently it will be taken during production.

3.5 Establish Corrective Actions

Corrective actions are the procedures that must be taken when monitoring indicates that a particular CCP is not
under control and a deviation from an established critical limit has occurred. The HACCP team must identify the
steps that will be taken to prevent potentially-hazardous food from entering the food chain, along with the steps
necessary to correct the process. This includes identification of the problem and the steps taken to ensure it will not
occur again.

3.6 Establish Verification Procedures

Verification is defined as any activities, apart from monitoring, which confirm the HACCP system is working
effectively. Activities may include, for example, auditing of CCPs, instrument calibration and product testing.

3.7 Establish Record-keeping and Documentation Procedures

For the successful implementation of HACCP-based procedures, appropriate documentation and written records
must be kept and be available to show that critical limits have been met and the system is in control.

White Paper
METTLER TOLEDO
3
 4 Hazard Analysis and Risk-based Preventive Controls (HARPC)
HACCP versus HARPC
Unlike HACCP, Hazard Analysis and Risk-based Preventive Controls (HARPC) is not a global standard, but an
updated US standard incorporated into the FSMA on July 4, 2012. It applies to almost all food processing facilities,
both in the US and abroad, who produce food products for distribution in the US.

Sec. 103 of the Food Safety Modernization Act describes HARPC in the following way:
"The owner, operator, or agent in charge of a facility shall, in accordance with this section, evaluate
the hazards that could affect food manufactured, processed, packed, or held by such facility, identify
and implement preventive controls to significantly minimize or prevent the occurrence of such hazards
and provide assurances that such food is not adulterated under section 402 or misbranded under
section 403(w), monitor the performance of those controls, and maintain records of this monitoring as
a matter of routine practice." 3

Under the FSMA, the FDA has a legislative mandate to require a qualified individual or team of qualified individuals
from virtually every food facility to understand the food safety and adulteration risks associated with their foods and
processes, and implement science-based preventive control measures to reduce the risk of food contamination.

Each facility must have a written food safety plan and perform the following seven tasks for HARPC compliance:

4.1 Identify Hazards

The "HA" in HARPC stands for "Hazard Analysis" and addresses the main purpose of the law, which is to identify
hazards that may arise due to the specific foods or ingredients in the food or the various processing, manufacturing,
packing and holding steps applied to the foods. Once identified, the company must develop a plan to minimize
or prevent the hazards from arising. During the first HARPC step, food companies must evaluate the product and
processing for the risks of:
• B iological, chemical, physical and radiological hazards
• Natural toxins, pesticides, drug residues, decomposition, parasites, allergens and unapproved food and
color additives
• Naturally-occurring hazards or unintentionally-introduced hazards
• Intentionally-introduced hazards (including acts of terrorism)

The final bullet point includes all aspects of a food company's facilities (e.g. the physical plant and security
measures to prevent potential bioterrorism events), personnel screening and controls, the entire supply chain of a
facility's food ingredients (raw materials, packaging, dyes, labels, etc.), and the finished foods received, delivered
and shipped. Companies must create a written analysis of the above hazards and include both an identification of
the risks, as well as an analysis of the risks as they relate to (or could relate to) the facility and the foods or food
ingredients it handles.

³ https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm247548.htm#SEC103

4 White Paper
METTLER TOLEDO
4.2 Develop and Implement Risk-based Preventive Controls
The "RPC" in HARPC stands for "Risk-based Preventive Controls." Companies are required to develop and
implement a series of risk-based controls at the points of the manufacturing process where the identified hazards
must be prevented or minimized to ensure food safety. The facility must designate control measures at each point
to ensure the greatest level of risk prevention or mitigation is achieved by normal operation of that manufacturing,
processing, packing or storage step.

The following types of preventive controls are listed:

• Sanitation procedures at food surface contact points
• Sanitation of utensils and equipment
• Staff hygiene training
• Environmental monitoring program (for pathogen controls)
• Food allergen control program
• Recall plan
• Current Good Manufacturing Practices (cGMPs)
• Supplier verification activities

4.3 Monitor the Controls' Effectiveness

Food companies are required to establish and implement monitoring programs to verify that the preventive controls
are working. However, unlike with a HACCP system, not all controls will have specific limits.

4.4 Outline Corrective Actions

Any deviations from the risk-based preventive controls and control measures in a properly-designed HARPC system
must be identified, evaluated and corrected. The corrective action steps include:
• Recognition of weak spots in the controls
• Recognition of ineffective controls
• Recognition of new hazards
• Performing vital steps to reduce the chance of a recurrence
• Assessing the processed food for safety
• Prevention of contaminated food from entering commerce

Facility owners and operators are required to identify and fix "out of control" processing steps and evaluate
processed foods for safety and adulteration risks.

4.5 Verify the Effectiveness of the Controls

Food facilities are required to design and implement verification steps to ensure their HARPC plans (the
hazard identification and analysis, preventive controls and control measures, monitoring and corrective actions)
are operating correctly to prevent or minimize food safety and adulteration hazards. This step is designed to verify
that:
• The selected preventive controls are sufficient
• Monitoring is occurring correctly as defined in the plan
• Suitable corrective actions are taken
• Potential food and food processing hazards are minimized
• Periodic reviews are conducted at suitable intervals so the HARPC plan remains pertinent and includes new
and emerging risks and hazards

White Paper
METTLER TOLEDO
5
 4.6 Maintain Written Records
HACCP versus HARPC
One significant development under HARPC is its new requirements relating to records and documentation that have
become mandatory for food facilities. Previously, the FDA could only require food companies to keep records that
enabled food to be traced through the supply chain "one up/one down". Now, HARPC stipulates that records and
documents related to food hazards and process control systems are established and kept for no less than two years
to cover the following HARPC steps:
• The monitoring of the preventive controls
• All cases of deviation or processing nonconformity that could affect food safety
• Testing results and other verification steps aimed at ensuring preventive controls are effectively reducing or
preventing hazards
• All cases where corrective actions were required
• Demonstrating the effectiveness of a food facility's preventive controls and corrective actions

4.7 Reanalyze the HARPC Plan

Food facilities must assess their food safety plans regularly and update them
whenever there is a significant change at the processing facility that may
increase a potential hazard or introduce a new one, or every three years if no
other significant changes occur.

Additionally, HARPC requires facilities to carry out a new hazard analysis and
implement any new, necessary preventive controls before operational changes
occur.

Any changes must be documented in the company's HARPC records. If no changes are required after the HARPC
system is reanalyzed, the company must document the grounds for that decision. Facility owners, operators and
agents may also have to reanalyze their HARPC plans at any time if the Department of Homeland Security identifies
new biological, chemical, radiological or terrorist threats.

6 White Paper
METTLER TOLEDO
 5 Additional Information on HARPC

5.1 Who is exempt from HARPC?

The following categories are exempted from the HARPC plan requirement:
• Facilities under the United States Department of Agriculture (USDA) jurisdiction handling, processing, and
shipping meat, poultry, pork and eggs
• Facilities subject to the FDA's Seafood and Juice HACCP regulations
• Facilities subject to the FDA's new Standards for Produce Safety authorities. This exemption applies to
farms, cooperatives, growers, harvesters and other companies handling raw fresh fruits and vegetables
• Low acid and acidified canned food processors, but only as the regulatory controls govern and control
certain aspects of microbiological contamination (e.g. botulism)
• Businesses defined as "small" or "very small" (exemption ceases by mid-September 2018)
• Facilities with a previous three-year average product value of less than $ 500,000
• Facilities that mainly produce food for animals, store raw agricultural commodities other than fruits and
vegetables intended for further processing, or facilities that store packaged food not exposed to the
environment for potential cross-contamination
• Facilities that are mainly engaged in manufacturing, processing, packing or holding that are considered to
be low risk operations, such as shelling and hulling of almonds
• Retail food establishments, restaurants, and farms

5.2 Who needs a HARPC plan?

Aside from those facilities exempted above, all facilities subjected to the FDA's Bioterrorism Facility Establishment
registration, both in the US and abroad, that are producing food products for distribution in the US must develop
and implement a HARPC plan that identifies risks "known or reasonably foreseeable" for each type of food subject
to the regulation.

The preventive controls should be adequate to "significantly minimize or prevent" identified hazards so that the food
is safe. The facility must supply a HARPC plan to the FDA upon receiving a written or oral request.

5.3 Who is responsible for the HARPC plan?

The owner, operator, or agent in charge of a domestic or international food facility is required to develop an
adequate HARPC plan for any facility that is subject to FDA food facility registration under The Bioterrorism Act.
Failure to implement HARPC is defined by the FSMA as a "prohibited act" and will lead to criminal prosecution of the
company and/or the owner, operator or agent in charge.

5.4 How often should you submit or update your HARPC plan?
The FDA requires that facilities update their HARPC plan every three years or whenever there is a substantial change
in the processing facility that may increase a potential hazard or introduce a new one. Furthermore, the FDA may
require an updated plan based on unintentional or new hazards associated with biological, chemical, radiological
or terrorist threats that many occur at a food facility that manufactures, processes, packs or holds food intended for
human consumption.

White Paper
METTLER TOLEDO
7
 5.5 What consequences can the FDA impose if no HARPC plan is in place or the
HACCP versus HARPC
plan is inadequate?

If a facility mandated to develop a HARPC plan does not create a plan or if the FDA inspector determines that it is
insufficient to address threats, the FDA can:
• Issue a public warning letter and/or an import alert for a foreign supplier, effectively prohibiting imports from
such a foreign supplier; food products from a foreign facility or supplier that is placed on the import alert
would be seized at US ports on arrival, thereby effectively barring them from entering into US commerce
until the FDA reviews and approves an updated HARPC plan
• Criminally charge a corporation or the person responsible for a facility for failing to meet HARPC compliance
• Suspend the facility's food facility registration, thus stopping it distributing food in the US until the FDA
endorses the updated plan and corrective actions; this would happen if food from a non-compliant facility
is found to pose a significant food safety risk

8 White Paper
METTLER TOLEDO
6 Conclusion
For all food supply chains, HARPC represents a substantial new regulatory requirement that must be taken
seriously. HACCP and HARPC share more than just four letters, they are both food safety standards based on
prevention, but they differ on execution.

The similarities between HACCP and HARPC include the requirement for conducting a hazard analysis,
implementing controls, monitoring and corrective actions. However, as this white paper shows, HARPC's food
safety plan requirements are more comprehensive than the traditional HACCP system. A HARPC hazard analysis,
for example, includes more detailed hazard identification and evaluation. Unlike HACCP, it includes planning for
potential terrorist acts and/or intentional adulteration and food fraud. A facility's HARPC plan should therefore
include additional security, such as visitor access and control. Supplier and recall programs are also more formal
with HARPC.

Additionally, the HARPC system requires food facilities to identify and implement science or risk-based preventive
controls, rather than critical control points (CCPs) as required by the conventional HACCP system. As such, the
establishment of critical limits may not be required under HARPC. A HARPC plan should not be considered as a
replacement to the conventional HACCP plan, but as a necessary upgrade, and it is important food companies take
time to educate themselves on the new regulatory requirements.

If facilities have an effective HARPC plan in place, they are also in compliance with HACCP. If, however, they
currently function under HACCP guidelines, it is their responsibility to determine if they must comply with HARPC
under FSMA.

White Paper
METTLER TOLEDO
9
 7 Summary Table
HACCP versus HARPC
An overview... HACCP HARPC
Where are the standards HACCP is a global standard HARPC is a US standard, applicable to certain
recognized? FDA-regulated products
Who must comply? HACCP is mandatory primarily for facilities HARPC applies to almost all food processing
processing juice and seafood, as well as facilities, including companies required to
USDA-regulated meat and poultry. register with the FDA in accordance with the
Bioterrorism Act.

There are six categories of exemption to

HARPC:

• Companies covered under the juice and

seafood HACCP rules

• Companies exclusively regulated by the

USDA, such as those that handle, pro-
cess, and ship meat, poultry, and eggs

• Companies subject to the FDA's

Standards for Produce Safety Authorities,
including farms, growers, and harvesters

• Low-acid and acidified canned food

processors

• "Small" or "very small" businesses

• Companies whose previous three-year

average product value was less than
$ 500,000
What hazards are considered? HACCP covers chemical, biological and HARPC covers chemical, biological and
physical hazards. physical hazards, as well as radiological
hazards, intentionally-introduced hazards
(e.g. acts of terrorism), and unintentionally-
introduced hazards.
How are the plans HACCP focuses on critical control points For HARPC, a hazard analysis is only the
implemented? (CCPs), which are points at which a first step. The rule also requires companies
control is required to prevent or reduce a to develop science or risk-based preventive
food safety hazard. Hazard analyses are controls, validate that the controls work, and
based on industry-wide documentation, verify that they are implemented consistently.
and implementation relies on sanitation Each facility is responsible for performing and
standard operating procedures (SSOPs). documenting its own research.

How often do you need to HACCP plans are reviewed once a year or HARPC plans are reviewed once every three
review and update your plan? whenever there is a significant change. years or whenever there is a significant
change.
What happens if you don't Noncompliance with HACCP most often Noncompliance with HARPC can result in
comply? results in fines and a plan for re-evaluation. anywhere from a suspension of the facility's
registration to criminal prosecution.

10 White Paper
METTLER TOLEDO
8 References
http://www.who.int/mediacentre/news/releases/2015/foodborne-disease-estimates/en/
https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334115.htm
https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm247548.htm#SEC103
http://blog.alchemysystems.com/four-key-stops-on-the-journey-from-haccp-to-harpc
https://safefoodalliance.com/newsletter/2015-05/what-is-the-difference-between-the-haccp-and-harpc/
https://www.harpc.com/
https://www.foodsafetymagazine.com/magazine-archive1/octobernovember-2015/hazard-analysis-and-risk-based-
preventive-controls-harpc-the-new-gmp-for-food-manufacturing/
http://www.pjrfsi.com/downloads/Comparing%20HACCP%20and%20HARPC.pdf
https://www.foodonline.com/doc/explaining-differences-between-haccp-and-harpc-0001
https://unithermfoodsystems.com/haccp-vs-harpc-answers-to-common-questions/

9 Recommended Reading
Further information can be found at:
The Organization for Machine Automation and Control (OMAC) – www.omac.org
Organisation Internationale de Métrologie Légale (OIML) – www.oiml.org
Fertigpackungsverordnung (FPVO) – www.bundesrecht.juris.de/bundesrecht/fertigpackv_1981/gesamt.pdf
German Federal Institute of Physics and Technology (PTB) – www.ptb.de
EHEDG – www.ehedg.org
GFSI – www.mygfsi.com
FSMA – www.fda.gov
BRC – www.brcglobalstandards.com/
IFS – www.ifs-certification.com/index.php/en/
FSSC 22000 – www.fssc22000.com/documents/home.xml?lang=en
SQF – www.sqfi.com/
Preventing Product Recalls – http://www.mt.com/pi-productrecalls
FSMA Final Requirements – http://www.mt.com/pi-fmsa
How to Prevent Foreign Body Contamination – http://www.mt.com/xray-preventforeignbodies
Principles of Due Diligence – http://www.mt.com/pi-duediligence
How Hygienically-designed Equipment can Reduce Operational Costs – http://www.mt.com/pi-hygienicdesign
Validation, Verification and Monitoring For Product Inspection Equipment – http://www.mt.com/pi-validation

White Paper
METTLER TOLEDO
11
 About Mettler-Toledo Product Inspection:
The Product Inspection Division of METTLER TOLEDO is a leader in the field of automated inspection
technology. Our solutions increase process efficiency for manufacturers while supporting compliance with
industry standards and regulations. Our systems also deliver improved product quality which helps to protect
the welfare of consumers and reputation of manufacturers.

Checkweighing Metal Detection Track & Trace

Vision Inspection X-ray Inspection

Disclaimer:
Information contained in this publication is provided "as is" and without warranty. METTLER TOLEDO
disclaims all warranties, express or implied, and makes no warranty regarding the accuracy or applicability
of the information contained in this publication, and is therefore explicitly not responsible for any damage,
injury or death resulting from the use of or reliance on the information.

No part of this publication may be reproduced or distributed for any purpose without written permission from
METTLER TOLEDO.

© 2018 METTLER TOLEDO. All rights reserved. Subject to technical changes.

www.mt.com/pi
For more information

METTLER-TOLEDO Group
Product Inspection Division
Local contact: www.mt.com/contact

Phone (813) 549-2617

Fax (607)-266-5478

Subject to technical changes

© 2018 Mettler-Toledo Product Inspection
Printed in the US
PI-PIUS-WP-CCPRPC-050718