# HACCP vs. HARPC: What Processors Need to Know **URL:** \ **Category:** Open Forum\ **Created:** [October 7, 2025, 8:00am UTC](https://yodl.cfin-rcia.ca/t/haccp-vs-harpc-what-processors-need-to-know/1768 "2025-10-07T08:00:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rameez\_beig](https://yodl.cfin-rcia.ca/letter_avatar_proxy/v4/letter/r/4a4a54/32.png) [@rameez\_beig](https://yodl.cfin-rcia.ca/u/rameez_beig)\ **Post date:** [October 7, 2025, 8:00am UTC](https://yodl.cfin-rcia.ca/t/haccp-vs-harpc-what-processors-need-to-know/1768/1 "2025-10-07T08:00:00Z")
**No fluff, just the facts.**  If you make, pack, or hold food, you live in two worlds: the classic  **HACCP**  mindset (Codex/USDA heritage) and the  **HARPC**  mindset (FSMA’s risk-based Preventive Controls). They overlap a lot—but they’re not interchangeable. This guide breaks down what matters, where each framework applies, how to implement both without tripping over jargon, and how to operationalize the whole thing with tight execution (and yes, strong records). * * * ## TL;DR for busy leaders - **HACCP**  = 7 principles, focused on  **CCPs**  that control  **significant hazards**  at critical steps. Mandatory in seafood, juice (FDA), and meat/poultry (USDA), and foundational across GFSI schemes. - **HARPC**  (FSMA  **Preventive Controls** , 21 CFR Part 117/507) = broader,  **hazard analysis and risk-based preventive controls**  (process, allergen, sanitation, supply-chain) +  **recall plan** ,  **environmental monitoring**  (when appropriate), and  **PCQI**  oversight. - Think of  **HARPC as HACCP++** : everything risk-based HACCP does,  **plus**  structured controls for allergens, sanitation/Listeria, supply chains, and program-level verification and reanalysis. - If you  **export to the U.S.**  or operate there, you need HARPC (unless a specific HACCP regulation applies). If you’re under  **USDA** , your HACCP plan is mandatory; you still need robust prereqs that look a lot like preventive controls. - Canada’s  **SFCR**  requires a **Preventive Control Plan (PCP)**—conceptually aligned to HACCP/HARPC. If you sell into multiple markets, unify under one risk-based system and map to each regulator. * * * ## What each one actually is (without the buzzwords) ### HACCP (Hazard Analysis and Critical Control Points) - **Origin:**  Codex Alimentarius; entrenched in global trade and GFSI certification. - **Where it’s mandatory in the U.S.:** - **Core of HACCP:**  Seven principles—hazard analysis, CCP identification, critical limits, monitoring, corrective actions, verification, recordkeeping. - **Strengths:**  Laser-focus on  **process steps**  that must never fail (kill steps, chilling, metal detection, etc.). ### HARPC / FSMA Preventive Controls (the modern U.S. FDA rule) - **Regulations:** - **What’s different:**  Goes beyond CCPs. Requires you to identify  **known or reasonably foreseeable hazards**  and implement  **Preventive Controls**  where needed: - **Governance:**  Must have a  **PCQI**  (Preventive Controls Qualified Individual) develop/oversee the plan;  **reanalysis at least every 3 years**  or when changes occur. **Bottom line:**  HACCP is the backbone; HARPC is the full body. Most best-in-class programs implement  **both mindsets** : CCPs where process control is critical  **and**  preventive controls that cover allergens, sanitation, and suppliers with equal rigor. * * * ## Where processors get confused (and how to settle it) - **“Do I need HACCP or HARPC?”** - **“Is a CCP always required?”** - **“Are allergen and sanitation just PRPs?”** * * * ## The seven HACCP principles vs. HARPC requirements (quick contrast) - **Hazard Analysis:**  Both require it. HARPC language emphasizes  **reasonably foreseeable hazards**  and  **severity × probability**. - **Controls:** - **Verification & Validation:**  Both require it, but HARPC pushes program-level verification (e.g., environmental monitoring, supplier verification). - **Governance:** - **Reanalysis:** - **Records:**  Both are record-heavy. HARPC expands the scope (supply chain, allergen, sanitation, reanalysis, recall readiness). * * * ## A step-by-step approach that satisfies both (and scales) **Use this as your implementation playbook.** 1. **Define scope & leadership mandate** Nail down products, processes, and markets (USDA/FDA/CFIA/EU). Assign a  **PCQI**  and a HACCP leader. If leadership isn’t engaged, the program will be paper only— **and that’s a risk.** 2. **Describe products & intended use** Include ingredients, allergen profile, packaging, shelf life, target consumer (e.g., RTE, vulnerable populations). 3. **Map the process** Create detailed  **flow diagrams**  from receiving to shipping. Validate them on the floor—do a physical walk-through. 4. **Perform the hazard analysis** For each step, analyze **biological, chemical (incl. allergens), and physical hazards**. Consider  **recontamination**  risks, cross-contact, and  **supply-chain hazards**  that originate upstream. 5. **Decide control type—CCP vs. Preventive Control** 6. **Set critical limits or parameters** For CCPs: measurable limits (time/temperature, pH, aw, metal detector sensitivity). For PCs: define  **monitoring criteria**  (e.g., allergen label verification, sanitation frequencies, ATP limits, environmental sites/targets). 7. **Monitoring procedures** Who, what, how often, and where records live. No vague language—be explicit. 8. **Corrective actions** Define what happens when limits/criteria aren’t met.  **Product disposition**  +  **root cause**  +  **prevent recurrence**. Pre-write decision trees for speed. 9. **Verification & validation** 10. **Supply-chain program** Approve suppliers, define  **verification activities**  (COAs, audits, kill-step validations), and  **escalation**  rules. If the hazard is controlled by your supplier,  **supply-chain PC is mandatory**. 11. **Allergen control program** Ingredient receiving checks,  **segregation** , dedicated tools or validated changeovers,  **label reconciliation** , and routine verification (e.g., ELISA swabs when appropriate). 12. **Sanitation controls & environmental monitoring** Sanitation SSOPs that target risk points (e.g., RTE post-lethality areas). Define **sites (Zones 2–3; Zone 1 when warranted)**, frequencies, corrective actions, and trend review. 13. **Recall plan & traceability** Assign roles, create scripts, define decision criteria, test it annually. Map lot coding end-to-end.  **Food traceability software**  makes this faster and audit-proof. 14. **Training & competency** Document PCQI credentials, HACCP training, allergen handling, sanitation, and line-specific SOPs. New hire orientation isn’t enough— **prove competence**. 15. **Reanalysis & change management** Any significant change (ingredient, supplier, equipment, throughput) triggers review. HARPC requires reanalysis  **at least every 3 years**  even if nothing changed. 16. **Digital records & dashboards** Paper dies in audits. Adopt  **food safety software**  to standardize forms, timestamps, signatures, and alerts. Build  **KPIs** : CCP hit rate, environmental swab trend, allergen label error rate, supplier NCs, CAPA cycle time. * * * ## Three real-world examples (how the controls differ in practice) ### 1) RTE Hummus Line – Listeria risk post-blend - **Hazard:**  _Listeria monocytogenes_ recontamination after the lethality step (if any) or in a cold-mix product. - **HACCP view:**  You might have  **no CCP**  unless there’s a validated kill step; you’d lean on sanitation PRPs. - **HARPC view:**  This becomes a  **Sanitation Preventive Control**  with  **environmental monitoring**. You’ll define zones, swab frequency, corrective actions (hold & test? intensified sanitation?), and trend reviews. - **What processors need to know:**  Treat sanitation like a  **control with records**  equal in weight to CCPs. Auditors will dig here. ### 2) Peanut Butter Plant – Salmonella in nuts - **Hazard:**  _Salmonella_ in raw peanuts. - **If you roast:**  The  **roaster is a CCP**  with a validated time/temperature profile and continuous monitoring. - **If you buy roasted peanuts:**  The hazard is controlled  **upstream**. Under HARPC you need a  **Supply-Chain Preventive Control** : approved supplier program, kill-step validation on file, COAs, and periodic audits. - **Takeaway:**  Under HARPC you can’t hand-wave “supplier does it.” You need  **evidence**  and documented verification. ### 3) Allergen Changeover – From dairy to non-dairy SKU - **Hazard:**  Allergen cross-contact and mislabeling. - **HACCP:**  Often handled as a PRP; not always a CCP. - **HARPC:**   **Allergen Preventive Control**  requiring defined changeover steps, visual/ATP or allergen-specific verification as applicable, label checks, and deviation handling. - **Pro tip:**  Treat  **label application & reconciliation**  as a high-risk point. A wrong label is a recall waiting to happen. * * * ## Documentation that actually satisfies regulators (and your customers) You need evidence that your system works  **every day** , not just during audits: - **HACCP plan**  (flow diagram, hazard analysis, CCPs with critical limits, validation) - **Preventive Controls plan**  (process, allergen, sanitation, supply-chain),  **PCQI**  designation - **Monitoring records**  (CCP logs, allergen checks, sanitation pre-ops, label verifications) - **Corrective action & product disposition**  records - **Verification** : calibrations,  **environmental monitoring**  maps/data, internal audits, review signatures - **Supplier approval**  files: risk assessment, audits, COAs, performance metrics - **Recall plan**  + mock recall results - **Reanalysis/change logs** - **Training & competency**  records If that sounds like a lot, it is. This is where  **Food safety**  teams win or lose. Digital systems cut the noise. * * * ## Metrics that matter (and expose weak signals early) - **CCP/PC conformance rate**  (target ≥99.8%) - **Allergen label error rate**  (target: zero tolerance; track near-misses) - **Listeria environmental trend**  (rolling 12 weeks; time-to-root-cause ≤5 days) - **Supplier NC rate**  and  **time-to-closure** - **CAPA cycle time**  (from detection to verified effectiveness) - **Mock recall speed**  (trace 2 lots, 1 up/1 down in ≤2 hours; best-in-class: minutes with software) * * * ## Common pitfalls (don’t do these) 1. **Treating HARPC as renaming HACCP.**  It’s broader; if you ignore allergen, sanitation, and supply-chain PCs, you’re exposed. 2. **Forgetting the PCQI.**  FDA will ask who owns the plan—have proof of training/experience. 3. **Weak supplier verification.**  A COA alone isn’t always enough. Use risk-based audits and validation evidence. 4. **Environmental monitoring theater.**  Swab where it’s hard, not where it’s easy. Trend aggressively. Act on patterns. 5. **Paper chaos.**  If your records aren’t retrievable in minutes, they’re as good as missing. 6. **No reanalysis discipline.**  Three years fly by. Changes (new line speeds, packaging, ingredients) trigger immediate review. 7. **Allergen complacency.**  Mislabeling is still a top cause of recalls. Barcoding + dual verification = baseline. * * * ## How to operationalize this with less pain (yes, software helps) A modern program isn’t just binders.  **Food safety software**  centralizes your HACCP and Preventive Controls plan, assigns tasks, timestamps execution, and keeps records searchable. Here’s what to expect from a serious platform: - **Plan builder:**  Map hazards to CCPs and PCs, attach validations, and link SOPs/SSOPs. - **Tasking & escalation:**  Auto-schedule monitoring (CCP checks, label verifications, sanitation pre-ops), with alerts for misses. - **Environmental monitoring:**  Swab maps, rotating sites, corrective action playbooks, trend charts. - **Supplier module:**  Approvals, COAs, audits, risk scores, and auto-reminders for expiries. - **Label control:**  Artwork control, barcoded checks at packaging, and dual sign-offs. - **Recall & traceability:**  Lot genealogy and mock-recall drills built in.  **Food traceability software**  should give you one-click lists of affected SKUs, customers, and inventory positions. - **Dashboards:**  Real-time KPIs for plant leadership and C-suite visibility. If you want to see what this looks like in practice,  **NORMEX**  can walk you through a live environment tailored to your category. 👉  **Book a demo:**  [https://normex.ca/demo](https://normex.ca/demo) * * * ## Putting it all together (a pragmatic roadmap) - **Unify under one risk-based plan.**  Keep the HACCP 7 principles for process rigor and layer HARPC’s preventive controls across allergens, sanitation, and supply chain. Map your integrated plan to the exact regulation(s) you face (USDA/FDA/CFIA, etc.). - **Invest in validation where it counts.**  Kill steps, sanitation efficacy (especially for Listeria), allergen changeover, and supplier controls for high-risk ingredients (spices, nuts, dairy powders). - **Make documentation effortless.**  If your team spends more time hunting papers than preventing hazards, you’re upside down. Digitize. - **Audit yourself like FDA/USDA would.**  Quarterly internal audits that hit environmental monitoring, allergen controls, and supplier files will surface issues before regulators—or your customers—do. - **Treat continuous improvement as non-negotiable.**  Trends tell you where tomorrow’s deviation will happen. Act on them early. * * * ### Final word HACCP and HARPC aren’t rivals. HACCP gives you the surgical instruments (CCPs). HARPC forces you to build the hospital around them (allergen, sanitation, supplier, recall). If you’re serious about risk—and you should be—the combined system is non-optional. If you want a straight-talking walkthrough of how to implement this in your facilities and get audit-ready without drowning in paperwork,  **see it in action** : **Schedule your demo:**  [https://normex.ca/demo](https://normex.ca/demo) No sugar-coating: the bar keeps rising. The processors who operationalize both frameworks with discipline—and who can prove it instantly—will win the trust of regulators, customers, and consumers.