Does an Existing HACCP Plan Fit Into HARPC?

For some time now, I’ve been mulling over the age-old HACCP (hazard analysis and critical control points) and FSMA’s new HARPC (hazard analysis and risk-based preventive controls), their differences, and whether an existing HACCP plan fits into FSMA’s new HARPC provisions.

As I’ve read the proposed FSMA rules and the final rules, I still see HACCP, but I also now have to come to terms with the phrase HARPC. Additionally, I am seeing new phrases including risk assessment and risk-based management. I have to say I get a bit confused. Since 1990 or so, we’ve all learned hazard analysis. But SQF requires risk assessments. And now FSMA and the FDA require risk-based preventive controls.

So what is a good quality practitioner to do? Will my existing hazard analysis be acceptable in HARPC or not?

I figured that I was probably not the only one who was confused, so, in the spirit of public service, I took another look at the final rule and made some observations. I hope this summary will help you decide what you’ll need to do at your facilities.

Section 117.130 specifies that a hazard analysis must be completed. (Good news so far!) As for details, the requirements for a hazard analysis are two-fold:

1. We must identify and evaluate—based on experience, illness data, scientific reports, and other information—known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at our facilities to determine whether there are significant hazards; and
2. The hazard analysis must be written.

The section goes on to define the hazard identification: The hazard identification must consider biological, chemical (including radiological) and physical hazards … and hazards that may be present in the food for any of the following reasons: the hazard occurs naturally; the hazard may be unintentionally introduced; or the hazard may be intentionally introduced for purposes of economic gain. To me, this sounds like our existing hazard analysis with a few minor additions.
 

Section 117.135 discusses preventive controls. Specifically, we need to identify and implement preventive controls to provide assurance that significant hazards will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated.… Required preventive controls include, as appropriate to the facility and the food: controls at critical control points (CCPs) if there are any CCPs; and controls, other than those at CCPs, that are also appropriate for food safety. Of course they must be written. And they include, as appropriate to the facility and the food: process controls, food allergen controls, sanitation controls, supplier controls, recall plan, and other controls. (i.e., GMPs). To me, this is HACCP 101. If we have significant hazards, design a program to control them. But it also adds in preventive controls that may currently be prerequisite programs (PRPs).
 

Section 117.140 provides for management of the preventive controls. As all HACCP-wise people know, this means monitoring, corrective actions, and verifications. The interesting part here is that we now need to manage the PRPs with monitoring, corrective actions, and verifications. Not really new, though, because good facilities are already managing their PRPs in this way. PRPs are routinely reviewed (audited) by a staff or internal auditor, they have a corrective action/preventive action (CAPA) program, and verifications are conducted daily by those who lead the programs. Still, it could be a new way of thinking about how we manage our internal programs that are not CCPs.
 

Section 117.165 provides for verification. It defines some verification activities. This simply means that we need to assure that the PRPs are consistently implemented and effectively managed to appropriately minimize the risks. The FDA does specifically note some verification activities: equipment and instrument calibration, product testing (pathogen or indicator organism), environmental monitoring, records review, and others. Good facilities have already implemented these programs and are routinely reviewing data to verify the programs are effectively reducing or eliminating food safety risks.
 

What Does It All Mean?

With that review of some areas of the new preventive controls rule, what does it mean for our existing HACCP plan hazard analysis? The new rule sure sounds a lot like a HACCP plan with a hazard analysis, preventive controls, monitoring, and verifications. It also adds some elements around PRPs. PRPs now must be managed similar to CCPs.

FDA has listed some PRPs for us, but we all have our own list of PRPs we manage in our plants. If we weren’t already managing them as described in the new rule, we’ll need to beef up this area. If our existing hazard analysis includes the elements noted by FDA, we’re good to go. In other words, if we are adequately and properly managing our HACCP and PRPs as preventive controls—with monitoring, CAPA, and verifications—our existing plan could be acceptable.

In my case, there are some tweaks to the existing programs that are needed to assure we meet the letter of the law. I think all good plants are similar in that regard. My bottom-line decision is that as long as we all look at our PRPs to assure we are managing them to meet this new rule, even though we are already managing them to keep our products safe and of high quality, we’ll be satisfying the HARPC rule. And our existing hazard analysis may need some tweaks where we justify or note the controls already in place. Those controls that are in place that are not CCPs may become the PRPs that now need to be managed as preventive controls with monitoring, CAPA, and verifications.

I hope this helps you determine what you need to do to move forward and meet compliance with the new rule.