What Is HARPC? Hazard Analysis and Risk-Based Preventive Controls Explained

HARPC (Hazard Analysis and Risk-Based Preventive Controls) is the food safety framework the FDA introduced under the Food Safety Modernization Act, requiring most FDA-registered food facilities to identify hazards and put risk-based preventive controls in place to manage them. It's codified at 21 CFR Part 117, Subpart C, and the Preventive Controls for Human Food rule that created it has been in effect since November 2015. In practice, most people in the industry use "HARPC" and "FSMA food safety plan" interchangeably — they refer to the same written plan.

HARPC vs. HACCP: what's the difference

HACCP, which traces back to Codex Alimentarius's General Principles of Food Hygiene, is built around identifying Critical Control Points (CCPs) — the specific steps where a control measure can prevent or eliminate a hazard. HARPC is FDA's own regulatory framework, and it asks a broader question: for every hazard a facility identifies, is there a preventive control needed anywhere in the process, not only at a small number of CCPs? That can include process controls, sanitation controls, supply-chain controls, and allergen controls — categories that don't map neatly onto a traditional HACCP CCP table. A facility building both should treat HARPC as the FDA-mandated floor and HACCP's CCP discipline as one tool used inside it, not two separate, competing systems.

Who has to comply with HARPC

Under 21 CFR Part 117, the requirement applies to domestic and foreign facilities that manufacture, process, pack, or hold human food and are required to register with FDA under section 415 of the FD&C Act. Some categories are exempt or covered by modified requirements, including facilities already regulated primarily by USDA for meat, poultry, and egg products, and certain very small businesses. Because exemption criteria are specific to the activity and business size, facilities should confirm applicability against the rule itself rather than assume size alone settles the question.

What a HARPC food safety plan has to include

Subpart C lays out the plan in a defined sequence: a written food safety plan (§117.126) built on a hazard analysis (§117.130) covering biological, chemical, physical, and radiological hazards. Where the analysis identifies a hazard requiring a preventive control, the facility documents that control (§117.135), along with monitoring procedures, corrective actions and corrections, and verification activities. Our guide to food safety hazards covers the biological, chemical, and physical categories the hazard analysis itself has to work through in more depth. The plan also has to be prepared or overseen by a Preventive Controls Qualified Individual (PCQI) under §117.180 — someone who has completed FDA-recognized training or has equivalent job experience — and facilities generally need a written recall plan (§117.139) for any hazard requiring a preventive control.

Where IONI fits

Turning a hazard analysis into monitoring records, corrective actions, and verification evidence that actually stay connected is where most HARPC plans break down after the initial draft. See how IONI helps food manufacturers build and maintain an audit-ready HARPC food safety plan.

Frequently asked questions

Is HARPC the same as a food safety plan?

Yes, in practice. "HARPC" refers to the hazard analysis and risk-based preventive controls approach FDA requires under 21 CFR Part 117; the written document it produces is generally called a food safety plan.

Is HARPC required for every food facility?

It applies to domestic and foreign facilities required to register with FDA under FD&C Act section 415, with some exemptions and modified requirements — including facilities primarily regulated by USDA and certain very small businesses. Check the rule's specific exemption criteria for your facility.

Who can prepare a HARPC plan?

The plan must be prepared, or its preparation overseen, by a Preventive Controls Qualified Individual (PCQI) — someone who has completed FDA-recognized preventive controls training or has equivalent experience, as defined under 21 CFR §117.180.

Does HARPC replace HACCP?

Not exactly. HARPC is FDA's own regulatory requirement and covers a broader range of preventive controls than a traditional HACCP plan's Critical Control Points. Many facilities use HACCP's hazard-analysis and CCP discipline as part of how they build their required HARPC plan.