HACCP Prerequisite Programs for Food Manufacturers

Every HACCP plan depends on a set of foundational controls that keep your facility safe before hazard-specific measures even come into play. These foundational controls are called prerequisite programs (PRPs), and they cover everything from sanitation and pest control to personnel hygiene and supplier approval. This guide walks you through the complete list of HACCP prerequisite programs, explains how they map to major GFSI certification schemes, and gives you a practical framework for building and verifying your own PRP system.

What Are HACCP Prerequisite Programs?

HACCP prerequisite programs are the basic environmental and operating conditions necessary for the production of safe, wholesome food. That definition comes directly from the FDA HACCP Principles & Application Guidelines, which treats PRPs as the hygiene baseline beneath any HACCP system.

The concept traces back to the Codex Alimentarius General Principles of Food Hygiene (CAC/RCP 1-1969), which established PRPs as the operational foundation for all food safety systems worldwide. Both the FDA and Codex agree on the core idea: PRPs handle the broad, facility-wide conditions that make safe food production possible.

The name "prerequisite" is intentional. These programs must be in place before a HACCP plan is valid. They are not afterthoughts or extras. They are the baseline your entire food safety system rests on.

FDA vs Codex: PRPs are recognized under both the FDA's HACCP framework and Codex Alimentarius principles as the hygiene foundation for all food safety systems.

Why PRPs Matter for Your HACCP Plan

PRPs are implemented before HACCP, not after. They are the foundation, not the outcome.

Think of it this way: PRPs are the foundation of a building. Your HACCP plan is the structure built on top. If the foundation cracks, the structure fails regardless of how well it was designed.

Without functioning PRPs, your critical control points (CCPs) become overloaded. Hazards that should be handled by basic sanitation or pest control start showing up in your hazard analysis as risks that need CCP-level monitoring. That drives up cost, complexity, and the chance of something slipping through.

Strong PRPs keep your HACCP principles focused on the hazards that truly require critical controls, not on problems that a solid cleaning schedule should have prevented.

Complete List of HACCP Prerequisite Programs

The FDA, USDA FSIS, and Codex Alimentarius recognize the following categories as core PRPs. Your facility may need additional programs depending on your products, processes, and regulatory requirements.

Here is the full list with a brief description of each program's scope and monitoring approach. For additional detail on PRPs specific to meat and poultry processing, refer to the USDA FSIS Fundamentals of HACCP III.

1. Good Manufacturing Practices (GMPs). Facility design, lighting, air quality, surface materials, and construction standards. GMPs form the broadest PRP category and are codified under FDA 21 CFR Part 117 Subpart B.
2. Sanitation Standard Operating Procedures (SSOPs). Written procedures for cleaning and sanitizing equipment, food contact surfaces, and facilities. SSOPs define what gets cleaned, how, how often, and who verifies it.
3. Personnel Hygiene and Training. Handwashing protocols, illness reporting policies, protective clothing requirements, employee health monitoring, and documented food safety training records.
4. Pest Control Program. Exclusion, monitoring, and elimination of rodents, insects, and birds. Pest control requires documented inspection logs, bait station maps, and trend analysis.
5. Approved Supplier / Vendor Approval Program. Verification of raw material safety through certificates of analysis (COAs), supplier audits, vendor questionnaires, and risk-based approval criteria.
6. Allergen Control Program. Segregation, labeling, production scheduling, and cross-contact prevention procedures. Allergen controls require validated cleaning between allergen changeovers and clear labeling protocols.
7. Water and Ice Quality Control. Potability testing, water treatment monitoring, and ice production safety. Testing frequency depends on your water source and local regulatory requirements.
8. Traceability and Recall Procedures. One-up/one-down traceability systems and mock recall protocols tested at least annually. Your traceability PRP should enable you to trace product within four hours during a recall event.
9. Equipment Maintenance and Calibration. Preventive maintenance schedules and calibration records for critical instruments like thermometers, scales, pH meters, and metal detectors.
10. Waste Management. Waste segregation, removal frequency, container identification, and pest prevention measures around waste storage areas.
11. Temperature Control and Cold Chain. Refrigeration and freezer monitoring, receiving temperature checks, cook/cool logs, and cold chain verification during transport.
12. Food Defense / Security Procedures. Facility access controls, tamper-evident packaging, visitor policies, and vulnerability assessments aligned with FDA food defense guidance.

PRP vs CCP vs OPRP: What's the Difference?

One of the most common points of confusion in food safety is the relationship between PRPs, OPRPs, and CCPs. All three are control measures, but they operate at different levels of risk and require different levels of documentation.

Comparison Table

PRP

• Purpose: Maintain hygienic and environmental baseline
• Hazard focus: General, not product-specific
• Monitoring frequency: Periodic (daily, weekly, per shift)
• Measurable limits: Not required
• Corrective action: Process-level correction
• Regulatory basis: FDA 21 CFR Part 117 / Codex
• Record-keeping: Monitoring logs

OPRP (Operational PRP)

• Purpose: Control specific operational hazards
• Hazard focus: Operational, product or process-specific
• Monitoring frequency: Regular, tied to operational parameters
• Measurable limits: Required (but not called critical limits)
• Corrective action: Documented corrective action
• Regulatory basis: ISO 22000:2018 / FSSC 22000
• Record-keeping: Monitoring and corrective action records

CCP (Critical Control Point)

• Purpose: Eliminate or reduce a significant hazard to an acceptable level
• Hazard focus: Specific critical food safety hazard
• Monitoring frequency: Continuous or at defined intervals
• Measurable limits: Critical limits required
• Corrective action: Documented corrective action plus root cause analysis
• Regulatory basis: All HACCP frameworks
• Record-keeping: Full CCP records required

OPRPs sit between PRPs and CCPs in complexity. They are recognized in ISO 22000:2018 and FSSC 22000, but they are not a required distinction under traditional HACCP or SQF. If your facility operates under SQF or a traditional HACCP system, you will categorize controls as either PRPs or CCPs without the OPRP middle tier.

For a deeper look at CCPs with real-world examples, see our guide on critical control points (CCPs).

How PRPs Map to GFSI Certification Schemes

If your facility is pursuing GFSI-recognized certification, PRPs are not optional. They are formally required under every scheme. The difference is in how each scheme names, organizes, and audits them.

GFSI PRP Requirements by Scheme

SQF Code Edition 9

• PRP Term Used: "Prerequisite Programs"
• Where Defined: Module 2 (Food Safety Fundamentals)
• Key PRP Scope: GMP, sanitation, pest control, allergen control, water quality, supplier approval

BRCGS Food Safety Issue 9

• PRP Term Used: "Good Manufacturing Practice (GMP)"
• Where Defined: Section 4 (Site Standards)
• Key PRP Scope: Site standards, housekeeping, foreign body control, pest management, glass/brittle plastics

FSSC 22000 Version 6

• PRP Term Used: "Prerequisite Programmes (PRPs)"
• Where Defined: ISO/TS 22002-1 + FSSC additional requirements
• Key PRP Scope: All ISO 22000 PRPs plus food defense, food fraud, environmental monitoring

ISO 22000:2018

• PRP Term Used: "Prerequisite Programmes (PRPs)"
• Where Defined: Clause 8.2
• Key PRP Scope: Infrastructure, process hygiene, contamination prevention, waste management

FSMA 21 CFR Part 117

• PRP Term Used: "cGMPs & Preventive Controls"
• Where Defined: Subpart B (cGMPs) + Subpart C (Preventive Controls)
• Key PRP Scope: Sanitation, pest control, allergen controls, supply chain controls

FSSC 22000 note: FSSC 22000 requires PRPs to be documented according to ISO/TS 22002-1 (for food manufacturing). If you are pursuing FSSC 22000 certification, your PRPs must meet the criteria in that technical specification, not just generic HACCP guidance.

Each scheme has its own audit protocol and documentation expectations. For scheme-specific details, check out our guides on SQF certification requirements, BRCGS Food Safety certification, and FSSC 22000 Version 6 requirements.

PRPs and FSMA Compliance

Under FSMA's Preventive Controls for Human Food rule (21 CFR Part 117), current Good Manufacturing Practices (cGMPs) function as the regulatory equivalent of PRPs. If you are an FDA-regulated facility, these are not voluntary. They are legally required.

FSMA goes beyond traditional cGMPs by introducing specific preventive control categories that map directly to HACCP PRP categories:

• Sanitation controls align with your SSOPs and cleaning procedures
• Allergen controls align with your allergen management PRP
• Supply chain controls align with your approved supplier program
• Recall plans align with your traceability and recall PRP

The practical takeaway: if you already have a functioning PRP system, you have the foundation for FSMA preventive controls compliance. But FSMA requires additional documentation that goes beyond traditional PRPs, including a written food safety plan, a hazard analysis, and defined preventive controls with monitoring, corrective actions, and verification activities.

Where FSMA and traditional HACCP differ most is in enforcement. Traditional HACCP is often voluntary (except in seafood, juice, and meat/poultry). FSMA's cGMP and preventive controls requirements are mandatory for most FDA-regulated food facilities. That means your PRPs are not just best practice. They carry regulatory weight, and FDA inspectors will verify compliance during routine inspections.

Your PRPs and your FSMA food safety plan should work together as part of your broader food safety management system (FSMS). The FDA FSMA Final Rule on Preventive Controls for Human Food provides the full regulatory text.

How to Validate and Verify Your Prerequisite Programs

Having PRPs written down is not enough. You need to prove they work, and you need to prove you are checking that they work. That means both validation and verification.

What Does PRP Validation Mean?

Validation is the process of demonstrating that a PRP is capable of achieving its intended control objective. You are answering the question: "Does this program actually control the hazard it is designed to control?"

Examples of PRP validation include:

• Water potability testing that confirms your water quality PRP produces safe water
• Microbial swabbing after cleaning that confirms your sanitation SSOP reduces pathogens to acceptable levels
• Temperature mapping in cold storage that confirms your refrigeration system maintains target temperatures

Validation is typically performed when a program is first designed, after any significant changes, and periodically thereafter. Many facilities revalidate annually as a standard practice.

What Does PRP Monitoring and Verification Look Like?

Monitoring and verification are separate activities, and auditors will ask for evidence of both.

Monitoring is the routine observation that a PRP is operating as intended. Daily temperature logs, pest inspection sheets, sanitation sign-off records, and equipment calibration checks are all monitoring activities. Monitoring happens in real time by the people doing the work.

Verification is the periodic confirmation that your monitoring activities are effective and your PRPs are achieving their goals. Environmental monitoring programs, third-party audits, internal inspections, trend analysis of monitoring data, and management reviews are all verification activities.

Auditor reality check: Auditors from SQF, BRCGS, and FSSC 22000 will ask for both monitoring records and evidence of verification activities. If you cannot show the records, you do not have the program.

For more on preparing for certification audits, see our food safety audit guide.

How to Build and Implement Your Prerequisite Programs

If you are building PRPs from scratch or updating an existing system, here is a five-step framework that aligns with GFSI expectations.

Step 1: Conduct a Prerequisite Program Gap Assessment

Walk your facility against the 12 PRP categories listed above. For each category, document whether you have a written procedure, whether it is being followed, and whether monitoring records exist.

Identify which programs are undocumented, inconsistently applied, or unmonitored. These gaps are your priorities. A gap assessment does not need to be complicated. A simple spreadsheet comparing each PRP category against your current documentation and practices will give you a clear starting point.

Step 2: Document Each PRP as a Written Procedure

Every PRP requires a written Standard Operating Procedure (SOP). Each SOP should include the scope of the program, the responsible party, step-by-step procedure instructions, the monitoring method and frequency, the records to be maintained, and the corrective action process when deviations occur.

Consistency in SOP formatting matters. Use a standard template across all your PRPs so that employees and auditors can find information quickly. Document control software helps you manage version control, approvals, and distribution of these procedures.

Step 3: Assign Ownership and Training

Each PRP should have a named responsible party. This person does not need to perform every task in the program, but they are accountable for making sure the PRP is implemented, monitored, and maintained.

Training records should demonstrate that employees understand and follow each procedure. Annual refresher training is a common expectation across GFSI schemes. For a ready-to-use checklist to assess your GMP training and compliance, see our GMP audit checklist.

Step 4: Establish Monitoring and Record-Keeping

Define the monitoring frequency for each PRP and create standard records or forms for each activity. Your monitoring records are what auditors review first, so they need to be legible, complete, and accessible.

Digital records offer significant advantages over paper. Electronic systems reduce audit preparation time, prevent lost or illegible records, and make trend analysis possible. If your facility still relies on paper binders, consider the time your team spends pulling records for audits versus the time it would take with a searchable digital system.

Common monitoring records include daily sanitation checklists, pest control inspection logs, temperature monitoring sheets, equipment calibration logs, and corrective action forms. Each record should capture the date, the person responsible, the observation or measurement, and any corrective action taken.

Step 5: Review and Update Regularly

PRPs are not static documents. They should be reviewed at least annually, after food safety incidents, and whenever your facility or processes change.

Changes to your PRPs also affect your HACCP hazard analysis. If you add a new product line, change a supplier, modify your facility layout, or update a cleaning chemical, reassess whether your existing PRPs still provide adequate control. Your PRPs and your HACCP plan should always reflect your current operations.

Managing HACCP Prerequisite Programs with Software

Most facilities manage PRPs on paper or spreadsheets. Records end up scattered across binders, shared drives, and filing cabinets. When audit season arrives, the team scrambles to locate sign-off sheets, pull calibration logs, and piece together corrective action trails.

Food safety software solves this by centralizing your entire PRP system in one platform. Here is what that looks like in practice:

• Centralized SOP storage with version control, so everyone works from the current procedure
• Automated monitoring reminders that prompt employees when tasks are due
• Digital sign-offs that create timestamped, tamper-proof records
• Audit-ready record exports that pull all PRP documentation into a single package
• Corrective action workflows that track deviations from identification through resolution

GFSI auditors increasingly expect organized, searchable records. Paper binders create audit risk because missing pages, illegible entries, and incomplete corrective actions are harder to catch until the auditor finds them first.

For a comparison of software options, see our guide on HACCP compliance software. And when audit time comes, our food safety audit guide covers what auditors look for and how to prepare.

See how Allera helps food manufacturers manage PRP documentation, monitoring, and audit readiness in one platform. Schedule a Demo