HARPC vs HACCP: What F&B Manufacturers Should Know

HARPC vs HACCP: Differences F&B Manufacturers Should Know.

HARPC and HACCP are not the same thing, and if you are a food manufacturer in the United States, getting them confused can leave you exposed during an FDA inspection. This guide breaks down the two frameworks side by side, clarifies which one applies to your facility, and gives you the crosswalk between their core elements that no other comparison article on the web currently provides.

HARPC vs HACCP: The Short Answer

HACCP (Hazard Analysis and Critical Control Points) is the global method for controlling food safety hazards in production. HARPC (Hazard Analysis and Risk-Based Preventive Controls) is the FDA's regulatory implementation of a similar concept, codified in 21 CFR Part 117 under the Food Safety Modernization Act. If your facility is registered with the FDA and you produce food for human consumption, you are required to have a written food safety plan that meets HARPC requirements, not just a HACCP plan.

The table below captures the most important differences at a glance.

The USDA HARPC and HACCP Overview Fact Sheet provides the brief government summary of this comparison. The table above, anchored to current 21 CFR 117, gives you the practical detail you need to act on it.

Quick Definitions

What HACCP Is (and Where It Came From)

HACCP was developed in 1959 by Pillsbury in collaboration with NASA and the US Army Natick Laboratories to ensure food safety for the Apollo space program. The core concept: identify the hazards that can harm consumers, find the points in the process where you can control those hazards, monitor those points, and verify that your controls work. By 1993, the Codex Alimentarius had codified HACCP into an international standard. In 1997, the National Advisory Committee on Microbiological Criteria for Foods (NACMCF) published the seven-principles framework that most facilities still use today.

HACCP is the foundation for virtually every food safety management system in use globally. The FDA HACCP Principles and Application Guidelines remain the reference document for the seven-principle approach. If you want to understand what those principles actually require in practice, our HACCP principles guide breaks down each one.

What HARPC Is (and Why FSMA Created It)

HARPC is not a separate standard that replaced HACCP. It is the FDA's regulatory expression of hazard-analysis-plus-preventive-controls logic, enacted through the Food Safety Modernization Act of 2011 and implemented in the FSMA Final Rule for Preventive Controls for Human Food, which took effect in 2015 as 21 CFR Part 117. The acronym itself comes from the regulation's name: Hazard Analysis and Risk-Based Preventive Controls.

FSMA shifted US food safety regulation from reactive (responding to outbreaks) to preventive (building controls before hazards cause illness). HARPC operationalizes that shift for FDA-regulated facilities. Rather than requiring a HACCP plan, FDA requires a written food safety plan that addresses hazards, preventive controls, monitoring, corrections, corrective actions, verification, validation, supply-chain controls, and a recall plan, all as defined in 21 CFR Part 117. The January 2024 Draft Guidance refresh (discussed later in this article) further clarified several of these requirements.

If you want a deep dive into building a food safety plan under HARPC, see our food safety plan guide.

The Single Most Important Distinction: Jurisdiction

Most HARPC vs HACCP comparisons on the internet blur a critical regulatory boundary. Here is the clean version.

FDA-Regulated Facilities: HARPC (21 CFR 117)

If your facility is registered with the FDA and you manufacture, process, pack, or hold food for human consumption, you are subject to 21 CFR Part 117. That means HARPC requirements apply. This covers the vast majority of US food manufacturers: packaged foods, bakery, dairy, beverages, and snacks, among others.

USDA-FSIS-Regulated Facilities (Meat, Poultry, Egg Products): HACCP (9 CFR 417)

If your facility produces meat, poultry, or egg products, USDA-FSIS regulates you, not FDA. USDA-FSIS requires a HACCP plan under 9 CFR Part 417: a completely separate regulation with its own requirements, verification procedures, and inspection model. HARPC does not apply to these facilities for their meat, poultry, or egg product lines. This is a common source of confusion in comparison articles: at least one top-ranking page for this keyword incorrectly states that FDA mandates HACCP for meat and poultry. FDA does not. USDA does.

Dual-Jurisdiction Facilities: When You Need Both

Some facilities produce both FDA-regulated foods and USDA-regulated products. A facility that makes both a jerky snack mix (USDA-regulated) and a granola bar (FDA-regulated) on separate lines would need both a HACCP plan for the USDA-regulated lines and a food safety plan meeting HARPC requirements for the FDA-regulated lines. If you run a dual-jurisdiction operation, the FSIS Guidebook for the Preparation of HACCP Plans covers the USDA side, and 21 CFR Part 117 governs the FDA side.

Seafood and Juice: Why HACCP Still Applies (21 CFR 120 and 123)

FDA carved out seafood processors and juice manufacturers from the HARPC rule. These facilities remain subject to mandatory HACCP under 21 CFR Part 123 (seafood) and 21 CFR Part 120 (juice): separate, older FDA HACCP regulations that were not replaced by FSMA. If you process seafood or juice, your compliance path is those regulations, not 21 CFR Part 117.

A Decision Table: Which Framework Applies to Your Products?

Side-by-Side: The 8 Differences That Actually Matter

1. Hazard Scope

HACCP addresses three hazard categories: biological (pathogens, spoilage organisms), chemical (pesticides, cleaning agents, allergens), and physical (glass, metal, bone). HARPC under 21 CFR Part 117 broadens this to include radiological hazards and economically motivated adulteration (EMA), meaning deliberate contamination for economic gain, such as the melamine-in-milk incidents. For most facilities, the biological and chemical categories are where the practical analysis lives, but your written hazard analysis must confirm that radiological and EMA hazards were evaluated and explain the conclusion.

2. Control Vocabulary

In HACCP, the output of a hazard analysis is a set of Critical Control Points (CCPs) with Critical Limits: measurable thresholds where a process parameter must be maintained to control a hazard. Missing a critical limit is an automatic deviation. Under HARPC, the equivalent terms are Preventive Controls (PCs) with Parameters and Values: broader language that accommodates controls that do not fit the CCP model neatly. See critical control point examples for the HACCP-specific detail on CCPs.

3. Categories of Preventive Controls under HARPC

HARPC explicitly categorizes four types of preventive controls in 21 CFR 117 Subpart C:

• Process preventive controls: Parameters for processes such as cooking, pasteurization, or acidification (analogous to CCPs in HACCP)
• Sanitation preventive controls: Controls for environmental pathogens and allergen cross-contact from equipment surfaces
• Allergen preventive controls: Formulation controls, labeling verification, and rework controls to prevent undeclared allergens
• Supply-chain preventive controls: Verification activities for hazards controlled by your suppliers, addressed in Subpart G

HACCP does not define these categories explicitly. Allergen controls in HACCP are typically addressed through prerequisite programs outside the HACCP plan itself.

4. Team Qualification

HACCP requires a HACCP team with appropriate multidisciplinary expertise in the product and process. There is no regulatory-mandated credential for team members. HARPC requires that a Preventive Controls Qualified Individual (PCQI) prepare or oversee the preparation of the food safety plan and conduct or oversee required activities. The PCQI credential is typically earned through the FSPCA's PCQI course. This is a specific regulatory requirement under 21 CFR 117.180. There is no HACCP equivalent.

5. Reassessment Frequency

Under HACCP, you should review your plan at least annually and whenever significant changes occur. Under HARPC, the regulation requires a full reanalysis at least every three years, or whenever you make a change that could reasonably affect whether a hazard requires a preventive control. The three-year cycle is a floor, not a ceiling: if your process changes significantly before the three years are up, you reanalyze at that point.

6. Supply-Chain Controls

HACCP addresses supply-chain hazards informally through prerequisite programs and supplier qualification, but there is no HACCP-specific regulatory requirement for a written supply-chain program. HARPC dedicates 21 CFR 117 Subpart G to supply-chain program requirements: you must have written procedures, conduct supplier verification activities (on-site audits, sampling, or review of supplier food safety records), and document everything. Allera's supplier management software is built to support this specific requirement.

7. Recall Plan

HACCP plans do not require a recall plan. HARPC food safety plans do. The written recall plan must be maintained as a component of the food safety plan and must address procedures for recalling products. This is one of the requirements that most often catches facilities off guard when converting an existing HACCP plan into a HARPC food safety plan.

8. Documentation Burden

A complete HARPC food safety plan under 21 CFR Part 117 must include: a written hazard analysis, written preventive controls, a written supply-chain program (if applicable), a written recall plan, and written monitoring, corrective action, verification, and validation procedures. Your HACCP plan requires a hazard analysis and HACCP records; the documentation structure is narrower. For HARPC, document control software helps manage the additional components in one place.

The 7 HACCP Principles vs HARPC Elements Crosswalk

This row-by-row crosswalk is the section that no current comparison page on the web provides in mapped format. Use it to understand how your existing HACCP documentation aligns to HARPC requirements, and where the gaps are.

Reference: FDA HACCP Principles and Application Guidelines and 21 CFR Part 117 Subpart C.

Already mapping your HARPC plan against your HACCP records? Allera's food quality management software stores hazard analyses, preventive controls, and supply-chain program records in one audit-ready system.

Glossary: The Preventive Controls Vocabulary

Auditors and PCQIs routinely encounter terminology drift between HACCP and HARPC. Here is a plain-language reference for the terms defined in 21 CFR Part 117.

Process Preventive Control

A control measure applied to a manufacturing or processing step to significantly minimize or prevent a hazard. Examples include cooking time-temperature parameters, pasteurization, pH control, and water activity reduction. Process PCs function similarly to CCPs in HACCP but are not always labeled "CCPs" in a HARPC food safety plan. The documentation requirement includes the parameters and values, monitoring records, and validation evidence.

Sanitation Preventive Control

A control designed to minimize contamination of food from environmental sources or allergen cross-contact from surfaces and utensils. Sanitation PCs typically appear in your environmental monitoring program and allergen cleaning verification protocols. Under HACCP, these are usually handled through Sanitation Standard Operating Procedures (SSOPs) as prerequisite programs. Under HARPC, they become explicit preventive controls in the food safety plan when they are needed to control a hazard requiring a PC.

Allergen Preventive Control

A control to prevent or minimize undeclared allergen hazards. This includes formulation controls, labeling verification, rework controls (ensuring allergen-containing rework does not contaminate allergen-free products), and sanitation procedures between allergen and non-allergen runs. Allergen controls are a HARPC-specific category; under HACCP, allergen management is typically handled outside the HACCP plan in a separate allergen control program.

Supply-Chain Preventive Control

A control where you rely on your supplier to control a hazard rather than your own process. If your supplier is responsible for controlling a specific hazard (for example, a farm certifying that a raw ingredient was not treated with certain pesticides), you need a written supply-chain program to verify that control. 21 CFR 117 Subpart G specifies what that program must include.

Parameters and Values (vs HACCP's Critical Limits)

Under HACCP, a critical limit is the maximum or minimum value to which a biological, chemical, or physical parameter must be controlled. Under HARPC, the equivalent term is "parameters and values": the operating conditions under which a preventive control is effective. The practical difference is that parameters and values applies to all PC types (including sanitation and allergen PCs), not only process-step controls, making the framework more flexible but also more documentation-intensive.

Monitoring, Corrections, and Corrective Actions

HARPC distinguishes between two tiers of response. Corrections are minor adjustments made during normal operations to bring a parameter back within its required range. Corrective actions are the full response when a correction fails or when you discover that affected product may have a food safety risk: identifying and segregating affected product, determining the root cause, and implementing steps to prevent recurrence. HACCP uses only "corrective actions" without this two-tier distinction.

Verification and Validation

Verification activities confirm that your preventive controls are consistently implemented. Validation activities confirm that your controls actually work to control the hazard: the scientific basis for why a specific parameter is effective. HARPC requires validation for process preventive controls and allows FDA to challenge you if your validation evidence is insufficient. HACCP includes verification as its sixth principle but does not carry an equivalent stand-alone validation requirement with the same regulatory weight.

Reanalysis

The HARPC equivalent of HACCP reassessment. You must conduct a reanalysis of your food safety plan at least every three years, or when changes to your facility, process, product, or supply chain could reasonably affect whether a hazard requires a preventive control.

HACCP Team vs PCQI: What's the Difference?

HACCP Team Composition (NACMCF Guidance)

The NACMCF guidance recommends that a HACCP team include people with technical expertise relevant to the product and process: typically production supervisors, quality assurance personnel, sanitation managers, and an equipment or engineering representative. There is no regulatory credential required for HACCP team members in the US, though external training or the use of a food safety consultant is strongly recommended.

Preventive Controls Qualified Individual (PCQI): 21 CFR 117.180

HARPC requires that your food safety plan be prepared or have its preparation overseen by a PCQI. The regulation defines a PCQI as someone who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum (§117.180(c)(1)), or who is otherwise qualified through job experience. The PCQI is also responsible for overseeing validation activities, corrective actions, reanalysis, and recall plan maintenance.

Training Pathways: FSPCA's PCQI Course and Equivalents

The Food Safety Preventive Controls Alliance (FSPCA) offers the standardized PCQI training course that FDA recognizes as meeting the §117.180 requirement. The course takes approximately two days and is available through FSPCA Lead Instructors at universities, food safety consultants, and online platforms. For a full comparison of approved programs and what to look for, see our PCQI training programs guide.

Can the Same Person Lead a HACCP Team and Be a PCQI?

Yes. A qualified individual can serve as both the PCQI and as a member of the HACCP team. The PCQI designation does not replace or supersede HACCP team training: it is an additional requirement layered on top of the existing team structure. If your facility operates under both frameworks (for example, a dual-jurisdiction facility), having a single experienced FSQA professional serve in both roles is common and efficient.

Do You Actually Need HACCP, HARPC, or Both? A Decision Framework

Manufacturer Producing FDA-Regulated Human Foods Only

If you manufacture, process, pack, or hold food for human consumption under FDA jurisdiction (and you are not a very small business or qualified facility eligible for modified requirements), you need a food safety plan meeting HARPC requirements under 21 CFR Part 117. A HACCP plan does not satisfy this requirement on its own. If you currently have a HACCP plan, it can serve as a strong starting point, but you will need to add the supply-chain program, recall plan, expanded documentation, and PCQI oversight to meet HARPC.

Meat, Poultry, or Egg Product Facility

You need a HACCP plan under 9 CFR Part 417. HARPC does not apply to those lines. If your facility also produces FDA-regulated products on separate lines, you need both frameworks for the respective product lines.

Seafood or Juice Processor

You fall under FDA HACCP requirements under 21 CFR Part 123 (seafood) or 21 CFR Part 120 (juice). If you also produce other FDA-regulated human foods beyond seafood or juice, those additional product lines are subject to 21 CFR Part 117 (HARPC).

Dietary Supplement Manufacturer

You are not subject to 21 CFR Part 117. Dietary supplements are regulated under 21 CFR Part 111 (Current Good Manufacturing Practice for dietary supplements): a separate regulatory framework with its own requirements.

GFSI-Certified Facility (SQF, BRCGS, FSSC 22000)

Your certification scheme incorporates HACCP-based requirements. GFSI certification does not automatically satisfy FDA's HARPC requirements under 21 CFR Part 117. Depending on the scheme and edition, you may be close, but the PCQI designation and the supply-chain program documentation under 21 CFR 117 Subpart G must be explicitly addressed. The section on GFSI schemes below covers what each scheme covers and where the gaps are.

The Simple Rule

Ask two questions: Is my facility registered with the FDA? Do I produce human food (other than seafood, juice, meat, poultry, or dietary supplements)? If both answers are yes, you need HARPC. If you also produce USDA-regulated products on separate lines, you need HACCP for those lines as well.

How HARPC Interacts With Other US Food Safety Requirements

Current Good Manufacturing Practices (CGMPs): 21 CFR 117 Subparts A and B

CGMPs are not separate from HARPC: they are the regulatory foundation underneath it. 21 CFR Part 117 Subparts A and B establish the baseline sanitation, personnel hygiene, facility design, and equipment maintenance requirements. Your food safety plan assumes CGMP compliance. If your facility's GMP baseline is weak, your hazard analysis will identify more hazards requiring preventive controls than it should. See GMP in the food industry for a practical overview of what CGMPs require, and our GMP audit checklist for a structured review tool.

Foreign Supplier Verification Program (FSVP): For Importers

If you import food from outside the United States, you are subject to the FSMA Foreign Supplier Verification Program rule (21 CFR Part 1, Subpart L) in addition to your HARPC obligations. FSVP requires you to verify that imported foods are produced in a manner that meets the same safety standards as US foods. FSVP is separate from the supply-chain program required under 21 CFR Part 117 Subpart G, though some verification activities can overlap if properly documented.

FSMA 204 Food Traceability Rule: The Other Plan Your Team Needs

The FSMA 204 Traceability Rule (21 CFR Part 1, Subpart S) requires enhanced traceability records for foods on the FDA's Food Traceability List. The compliance deadline was extended from January 2026 to January 20, 2028, following FDA's March 2025 announcement. If you handle foods on the list (including leafy greens, shell eggs, nut butters, and fresh-cut fruits and vegetables), you will need to maintain and share key data elements at each Critical Tracking Event. FSMA 204 runs parallel to your HARPC obligations, and the same FSQA team managing your food safety plan will likely be responsible for traceability records as well. See our FSMA 204 guide for the full detail, and our food traceability overview for how traceability fits into your broader food safety management system.

Food Allergen Labeling and Consumer Protection Act (FALCPA)

FALCPA requires labeling of the nine major food allergens (sesame was added in 2023, joining the original eight). Your HARPC allergen preventive controls must align with your FALCPA labeling obligations. A recall plan that addresses allergen-related mislabeling incidents should reference both the HARPC requirements and FALCPA compliance procedures.

How HACCP and HARPC Fit Inside GFSI Schemes

SQF Edition 9: Built on HACCP and Risk-Based Preventive Controls

SQF Edition 9 is built on a HACCP-based food safety plan (Module 2, Food Safety Fundamentals). The SQF food safety plan maps closely to the HARPC hazard analysis and preventive controls structure, though it does not use HARPC-specific terminology. Key gaps for US facilities pursuing FSMA compliance through SQF: the supply-chain program under 21 CFR 117 Subpart G has more specific verification activity requirements than SQF's supplier qualification program, and the PCQI designation is not an SQF-specific requirement. See our complete SQF certification guide.

BRCGS Food Issue 9: HACCP-Based with FSMA-Aligned Requirements

BRCGS Food Issue 9 requires a HACCP-based food safety plan and includes requirements for supply-chain approval and monitoring. The allergen management requirements in BRCGS Issue 9 Clause 5 are detailed and align well with HARPC's allergen preventive controls category. Like SQF, BRCGS certification does not automatically satisfy the PCQI requirement or the specific Subpart G supply-chain program documentation standard. See BRCGS certification for a full breakdown.

FSSC 22000 V6: ISO 22000, Sector PRPs, and Additional Requirements

FSSC 22000 V6 is built on ISO 22000 (hazard analysis plus operational prerequisite programs plus HACCP plans), Sector-Specific PRPs, and FSSC Additional Requirements. Version 6 introduced requirements that align more closely with FSMA's risk-based approach. For US manufacturers, FSSC 22000 certification provides a strong compliance posture for HARPC, but the PCQI gap applies, and FDA inspectors will not accept your FSSC certificate as a substitute for 21 CFR 117 documentation requirements. See FSSC 22000 Version 6 for the Version 6 changes.

Quick Mapping: GFSI Clauses That Auto-Satisfy HARPC Elements

The PCQI gap is consistent across all three schemes. If you are GFSI-certified and also FDA-registered, you need to explicitly designate a PCQI and ensure your supply-chain program documentation meets 21 CFR 117 Subpart G. Those are the two areas where scheme compliance most commonly falls short of HARPC requirements.

What FDA's January 2024 Draft Guidance Changed

FDA published a Draft Guidance for Industry on Hazard Analysis and Risk-Based Preventive Controls for Human Food in January 2024 (Federal Register published February 2, 2024). This is the most significant revision to the HARPC guidance framework since the original PCHF rule took effect in 2015. None of the currently top-ranking comparison articles for this keyword have been updated to reflect it.

Refreshed PCHF Guidance Chapters

The January 2024 Draft Guidance reorganized and updated several chapters of the original guidance document. It provides clearer direction on how to document the written hazard analysis, including specific language around the "known or reasonably foreseeable" hazard identification standard that practitioners had interpreted inconsistently since 2015.

Clearer Direction on Environmental Monitoring and Pathogens

The updated guidance clarifies expectations for environmental monitoring programs, particularly for facilities handling ready-to-eat (RTE) foods where environmental pathogens such as Listeria monocytogenes represent a significant hazard. Facilities with minimal environmental monitoring in their food safety plans should review this section of the draft guidance and assess whether updates are needed.

Updated Supply-Chain Program Expectations

The draft guidance refines the description of supplier verification activities, particularly for situations where you use an on-site audit as your primary verification method. It provides additional clarity on what constitutes adequate supplier verification records and when on-site audits can be replaced with other verification approaches.

What This Means for an Existing HARPC Plan

If your food safety plan was prepared before January 2024 and has not been updated since, a review against the draft guidance's updated chapters is warranted, even during the comment period. Facilities that have incorporated the draft guidance into their plans are better positioned for FDA inspections and have a cleaner documentation trail. The draft guidance is not yet finalized, so changes are possible before finalization, which is another reason to maintain your food safety plan documentation in a system that can be updated efficiently rather than in static documents.

Auditing a HARPC Plan vs a HACCP Plan

FDA Routine Inspections Under PCHF (and FDA's Risk-Based Inspection Model)

FDA conducts risk-based routine inspections of registered food facilities. During an inspection, FDA investigators will review your written food safety plan, ask for records demonstrating that monitoring activities have been performed, and verify that corrective actions were documented and resolved. FDA investigators use Form 483 (Notice of Inspectional Observations) to document observed violations. Common HARPC-related Form 483 observations include: food safety plan not updated after a significant change, validation evidence absent or insufficient for a process PC, supply-chain program records not maintained, and PCQI oversight not documented.

USDA-FSIS HACCP Verification

USDA-FSIS verifies HACCP plans through regular in-plant inspection activities. FSIS inspectors are present daily in slaughter and processing facilities and conduct scheduled and unannounced HACCP verification reviews. Unlike FDA's inspection model, FSIS has continuous in-plant presence for most meat and poultry establishments, which means HACCP record gaps are identified in real time rather than during periodic inspections.

Common HARPC Audit Findings (Form 483 Observations)

The most frequent FDA observations related to HARPC compliance include: missing or inadequate written hazard analysis (particularly for environmental pathogens and allergens), monitoring records with gaps or inconsistencies, no written recall plan, supply-chain verification activities conducted but not documented, and food safety plans that have not been reanalyzed despite significant process changes. A robust food safety audit program that mirrors what FDA inspectors look for is the most reliable way to identify these gaps before an inspection does.

Common HACCP Audit Findings

For USDA-regulated facilities, common HACCP findings include: critical limits set without scientific justification, monitoring frequency insufficient to detect deviations, corrective actions not documented or not effective, and HACCP plans that have not been updated to reflect process changes. Third-party GFSI auditors find similar issues when reviewing HACCP plans as part of scheme certification.

How Software Reduces Documentation Risk During an Audit

Form 483s and HACCP non-conformances trace back to missing records more often than to actual control failures. When your hazard analysis, preventive controls records, monitoring logs, corrective actions, and supply-chain program records live in separate spreadsheets or paper binders, gaps accumulate. Centralizing these records in FSMA compliance software or HACCP compliance software creates the audit trail FDA and GFSI auditors expect to see.

Form 483s usually trace back to missing records, not missing controls. See how Allera centralizes the documentation FDA inspectors ask for at alleratech.com/software/best-fsma-compliance-software.

Frequently Asked Questions

Q: Are HACCP and HARPC the same?

A: No. HACCP is the global hazard analysis and critical control point methodology codified by Codex Alimentarius and used as the basis for food safety plans worldwide. HARPC is FDA's regulatory framework for most US food manufacturers under 21 CFR Part 117, enacted through FSMA. HARPC builds on HACCP concepts but includes additional requirements: radiological and EMA hazards, a mandatory PCQI, a written supply-chain program, a written recall plan, and a broader preventive controls vocabulary. Having a HACCP plan does not satisfy HARPC regulatory requirements on its own.

Q: Does HARPC replace HACCP?

A: For most FDA-regulated human food facilities, HARPC is the regulatory requirement, not HACCP. HARPC did not abolish HACCP. Seafood and juice processors still follow FDA HACCP rules under 21 CFR 120 and 123. USDA-regulated facilities still follow HACCP under 9 CFR 417. GFSI schemes still use HACCP as their foundation. The more accurate framing: HARPC is the FDA's updated regulatory expression of hazard-analysis logic, and it is what you are required to implement if you are a registered FDA food facility producing general human foods.

Q: Is HARPC mandatory? Who is exempt?

A: HARPC under 21 CFR Part 117 is mandatory for most FDA-registered food facilities. The main exemptions and modified requirements include: very small businesses (less than $1 million in total annual sales of human food, averaged over a three-year period) who qualify as Qualified Facilities with modified requirements, farms not covered by the Produce Safety Rule, facilities that produce only dietary supplements (regulated under 21 CFR 111), and alcoholic beverage facilities meeting certain criteria. The Small Entity Compliance Guide provides the full detail on qualified facility status and modified requirements.

Q: Is there such a thing as HARPC certification?

A: There is no "HARPC certification" for facilities. FDA does not issue certifications for HARPC compliance. What does exist: the PCQI credential (an individual training credential, not a facility certification), GFSI scheme certifications (SQF, BRCGS, FSSC 22000) that incorporate HARPC-aligned requirements, and third-party food safety plan reviews. When readers search for "HARPC certification," they are typically looking for one of these: PCQI training, a GFSI scheme certification, or audit readiness guidance.

Q: Do meat and poultry plants follow HARPC?

A: No. Meat, poultry, and egg product facilities regulated by USDA-FSIS are required to follow HACCP under 9 CFR Part 417, not HARPC. If a facility produces both USDA-regulated and FDA-regulated products on separate lines, both frameworks apply to the respective lines.

Q: What is the difference between a CCP and a PC?

A: A Critical Control Point (CCP) is a step in a process where a control measure is essential to prevent or eliminate a food safety hazard, characterized by a critical limit that, if exceeded, triggers an immediate corrective action. A Preventive Control (PC) under HARPC is a broader category: it includes process PCs (the closest analog to CCPs), but also sanitation, allergen, and supply-chain controls that do not have "critical limits" in the traditional sense. All process PCs function like CCPs, but not all preventive controls follow the CCP model.

Q: What is the difference between a HACCP coordinator and a PCQI?

A: A HACCP coordinator manages the HACCP program at your facility: maintaining the HACCP plan, overseeing monitoring and corrective actions, and training the HACCP team. The role is defined by your internal program, not by regulation. A PCQI is a regulatory role defined in 21 CFR 117.180: the individual who prepares or oversees the preparation of your food safety plan, conducts or oversees validation, reviews corrective actions, and manages reanalysis. A qualified individual can hold both roles, but the PCQI designation carries specific regulatory obligations that the HACCP coordinator role does not.

Q: How often must I reanalyze a HARPC food safety plan?

A: At least once every three years, and also whenever you identify new information about potential hazards, or whenever you make a change to facilities, equipment, ingredients, source of ingredients, production methods, or any other change that could reasonably be expected to affect whether a hazard requires a preventive control. Document the reanalysis, including what triggered it and what changed as a result.

Q: Is HARPC required for dietary supplements?

A: No. Dietary supplement manufacturers are subject to 21 CFR Part 111 (cGMPs for dietary supplements), not 21 CFR Part 117. Part 111 has its own hazard analysis concept, but it is structured differently from HARPC. If a facility manufactures both conventional food and dietary supplements, the food lines are subject to 21 CFR 117 and the supplement lines to 21 CFR 111.

Q: Does FSMA 204 traceability apply to HARPC facilities?

A: FSMA 204 and HARPC are separate requirements that often apply to the same facility. If you are an FDA-registered food manufacturer and you handle foods on the FDA's Food Traceability List, you are subject to both 21 CFR Part 117 (HARPC) and the 21 CFR Part 1, Subpart S traceability requirements. The FSMA 204 compliance deadline has been extended to January 20, 2028. See our FSMA 204 guide for the full detail.

Q: Does a GFSI certification (SQF, BRCGS, FSSC 22000) cover HARPC?

A: A GFSI certification demonstrates that your facility has a robust food safety management system meeting the scheme's requirements, which are largely HACCP-based and align significantly with HARPC. GFSI certification does not satisfy the FDA regulatory requirements under 21 CFR Part 117 on its own. The two areas where certified facilities most commonly have gaps: the PCQI designation (none of the three major schemes require it as a named role) and the Subpart G supply-chain program documentation standard.

Q: Can I write my own HARPC food safety plan, or do I need a consultant?

A: You can write your own food safety plan as long as it is prepared by or under the oversight of a PCQI. If someone at your facility has completed PCQI training and has the technical knowledge to conduct the hazard analysis and identify appropriate preventive controls, you do not need an external consultant. Many facilities use a consultant to develop the initial food safety plan and then maintain it internally. Our food safety plan guide, HACCP plan resources, and free HACCP plan template give your team a structured starting point for the documentation.

Run HARPC and HACCP Documentation in One Place

Whether your facility operates under HACCP, HARPC, or both, the documentation requirement is substantial: written hazard analyses, preventive controls records, monitoring logs, corrective action files, supply-chain verification records, validation studies, recall plans, and reanalysis documentation. Allera's food quality management software is built for FSQA teams managing exactly this, with hazard analysis workflows, preventive controls documentation, supplier verification records, and audit-ready record storage in a single system.

Whether you operate under HACCP, HARPC, or both, the documentation lift is the same. See Allera in a 30-minute walkthrough.

For a broader introduction to the US food safety regulatory landscape, our food safety guide covers the full context.