HARPC Plan Guide | Hazard Analysis Risk-Based Preventive Controls

Quick Answer

A HARPC plan (Hazard Analysis and Risk-Based Preventive Controls) is a written food safety plan required under 21 CFR Part 117 for most FDA-registered food facilities. It identifies known or reasonably foreseeable hazards, establishes preventive controls (process, allergen, sanitation, supply chain, and recall), and documents monitoring, corrective actions, and verification activities. A Preventive Controls Qualified Individual (PCQI) must develop or oversee the plan.

Regulatory Authority: 21 CFR Part 117 — Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food

What Is a HARPC Plan?

A HARPC plan is the core written document required by the FDA Food Safety Modernization Act (FSMA) Preventive Controls for Human Food rule. Codified at 21 CFR Part 117, Subparts C and G, the rule replaced the reactive approach of traditional food safety regulations with a proactive, risk-based framework. Every covered facility must maintain a written food safety plan that serves as the operational blueprint for preventing foodborne illness.

The term HARPC stands for Hazard Analysis and Risk-Based Preventive Controls. Unlike the older HACCP (Hazard Analysis and Critical Control Points) model, HARPC broadens the scope of hazard analysis, expands the types of controls a facility must implement, and introduces new requirements for supply chain oversight and recall planning.

The food safety plan under HARPC must include the following components, as specified in 21 CFR 117.126:

Hazard analysis identifying known or reasonably foreseeable hazards (biological, chemical including radiological, and physical)
Preventive controls to significantly minimize or prevent the identified hazards
Supply chain program for raw materials and ingredients where the supplier controls the hazard
Recall plan with written procedures for product recalls
Monitoring procedures for each preventive control
Corrective action procedures when preventive controls are not properly implemented
Verification procedures to ensure controls are consistently effective

The plan must be prepared, or its preparation overseen, by a Preventive Controls Qualified Individual (PCQI). For a deeper understanding of the broader FSMA framework, see our FSMA Preventive Controls for Human Food guide.

HARPC vs HACCP: Key Differences

Many food safety professionals trained under the HACCP framework need to understand how HARPC differs. While both systems use hazard analysis as the starting point, HARPC is significantly broader in scope and enforceable under federal law with civil and criminal penalties.

Feature	HARPC (21 CFR 117)	HACCP (21 CFR 120/123)
Legal Basis	FSMA (2011), mandatory for most FDA-registered food facilities	Pre-FSMA regulations; mandatory only for seafood and juice
Scope	All known or reasonably foreseeable hazards across the entire facility	Hazards at Critical Control Points (CCPs) in production
Hazard Types	Biological, chemical (including radiological), physical, and economically motivated adulteration	Biological, chemical, and physical
Controls	Process, allergen, sanitation, supply chain, and recall plan	Critical Control Points (CCPs) with critical limits
Supply Chain	Required supply chain program with supplier verification	Not explicitly required
Recordkeeping	Comprehensive records under Subpart F; minimum 2-year retention	CCP monitoring records; retention varies by product
Penalties	Warning Letters, import refusal, seizure, injunction, civil/criminal penalties	Warning Letters, seizure (limited to seafood and juice sectors)

Important Distinction

HACCP remains the required system for seafood (21 CFR 123) and juice (21 CFR 120) facilities. USDA-regulated meat and poultry operations also follow HACCP under 9 CFR Part 417. If your facility handles these products exclusively, HACCP (not HARPC) is your regulatory requirement. Facilities handling both HACCP-covered and non-HACCP food products must comply with both frameworks.

Who Needs a HARPC Plan?

The Preventive Controls for Human Food rule applies to facilities that are required to register with FDA under 21 CFR Part 1, Subpart H. This includes domestic and foreign facilities that manufacture, process, pack, or hold food for human consumption in the United States.

Facilities That Must Have a HARPC Plan

Food manufacturers and processors (bakeries, snack food producers, beverage companies, frozen food manufacturers, etc.)
Food packing facilities and co-packers
Food holding and storage warehouses
Dietary supplement manufacturers (also subject to 21 CFR Part 111 cGMP)
Foreign facilities exporting human food to the United States

Exempt Facilities

The following facilities have exemptions or modified requirements under 21 CFR 117.5:

Very small businesses: Less than $1 million in total annual sales of human food (adjusted for inflation), plus market value of food manufactured but not sold. Modified requirements apply per 21 CFR 117.201.
Qualified facilities: Facilities averaging less than $1 million in annual food sales over the previous three years and where the majority of sales are direct to consumers or to retailers/restaurants within the same state. Subject to modified requirements under 21 CFR 117.201.
Facilities subject to HACCP: Seafood facilities (21 CFR 123), juice facilities (21 CFR 120), and USDA-inspected meat and poultry plants
Farms: Operations that meet the definition of a farm under 21 CFR 1.227 (covered instead by the Produce Safety Rule where applicable)
Alcoholic beverage facilities: Facilities that manufacture, process, pack, or hold alcoholic beverages are exempt from Subpart C if the facility is not required to register under 21 CFR Part 1

If your facility is required to register with the FDA, you likely need a HARPC-based food safety plan. Use our Compliance Calculator to determine your specific requirements, or review our cGMP for Food Manufacturing guide for related current Good Manufacturing Practice obligations.

Not sure if your facility needs a HARPC plan?

Our compliance team can assess your facility type and determine your exact 21 CFR 117 obligations.

Get a Free Assessment

The 14 Steps to Building a HARPC Plan

Building a compliant HARPC plan requires a systematic, step-by-step approach. The following 14 steps represent the complete process from initial team assembly through ongoing reanalysis. Each step maps to specific regulatory requirements in 21 CFR Part 117.

Assemble the food safety team

Designate a PCQI (Preventive Controls Qualified Individual) who has completed FDA-recognized training. Build a cross-functional team including quality, operations, sanitation, and supply chain personnel.

Describe the food products

Document every food product manufactured at the facility, including ingredients, formulation, processing methods, packaging, intended use, and target consumers (including vulnerable populations such as children, the elderly, or immunocompromised individuals).

Create process flow diagrams

Develop detailed flow diagrams for each product or product category showing all steps from raw material receiving through finished product distribution. Include rework loops, storage steps, and any outsourced processing.

Verify flow diagrams on-site

Walk the production floor to confirm that each flow diagram accurately reflects actual facility operations. Document any discrepancies and update the diagrams accordingly.

Conduct a hazard analysis (21 CFR 117.130)

Identify known or reasonably foreseeable biological, chemical (including radiological), and physical hazards for each step in the process. Evaluate severity and probability to determine which hazards require a preventive control.

Identify preventive controls (21 CFR 117.135)

For each hazard requiring a preventive control, determine the appropriate type: process control, food allergen control, sanitation control, supply chain control, or recall plan. Document the parameters and limits for each control.

Establish monitoring procedures (21 CFR 117.145)

Write monitoring procedures that specify what will be monitored, how it will be monitored, the frequency of monitoring, and who is responsible. Monitoring must generate records.

Establish corrective action procedures (21 CFR 117.150)

Define corrective action steps for each preventive control, including product disposition, identification and correction of the problem, actions to reduce recurrence, and evaluation of affected products for safety.

Establish verification procedures (21 CFR 117.155–165)

Define validation activities to demonstrate that controls are capable of controlling hazards. Establish ongoing verification including calibration, record review, environmental monitoring, and product testing where appropriate.

Develop the supply chain program (21 CFR 117.405–475)

For hazards controlled by suppliers, establish an approved supplier program with documented supplier approval criteria, supplier verification activities (audits, testing, or review of supplier records), and corrective action procedures.

Write the recall plan (21 CFR 117.139)

Create written procedures describing steps to notify direct consignees, notify the public if necessary, conduct effectiveness checks, and properly dispose of recalled product. Assign roles and responsibilities for the recall team.

Establish recordkeeping procedures (21 CFR 117 Subpart F)

Implement a records management system covering all plan components. Records must be created at the time of the activity, include the identity of the person performing the activity, and be retained for at least two years.

Train personnel

Ensure the PCQI has completed FDA-recognized training (such as the FSPCA Preventive Controls course). Train all relevant employees on their roles within the food safety plan, including monitoring, corrective actions, and recordkeeping responsibilities.

Conduct reanalysis (21 CFR 117.170)

Reanalyze the food safety plan at minimum every three years. Trigger an immediate reanalysis when significant changes occur, such as new ingredients, new equipment, new products, new suppliers, or when a preventive control is found to be ineffective.

Common Mistake

Many facilities treat the food safety plan as a one-time document. Under 21 CFR 117.170, the plan is a living document that must be reanalyzed whenever significant changes occur and at least every three years. FDA inspectors specifically verify that reanalysis dates are current and that the plan reflects actual operations.

Conducting a Hazard Analysis Under HARPC

The hazard analysis is the foundation of your entire food safety plan. Under 21 CFR 117.130, you must identify and evaluate known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at your facility. The analysis must consider hazards that may be present in the food because they occur naturally, may be unintentionally introduced, or may be intentionally introduced for purposes of economic gain.

Categories of Hazards

Biological Hazards

Pathogenic bacteria (Salmonella, Listeria monocytogenes, E. coli O157:H7)
Viruses (Hepatitis A, Norovirus)
Parasites (Cyclospora, Cryptosporidium)
Environmental pathogens and spoilage organisms

Chemical Hazards (Including Radiological)

Food allergens (major allergens per FALCPA and FASTER Act)
Pesticide residues, drug residues, and heavy metals
Mycotoxins (aflatoxins, ochratoxin A)
Radiological contaminants and unapproved food additives

Physical Hazards

Metal fragments from equipment wear or breakage
Glass, plastic, wood, and stone from facility or packaging
Bone fragments in processed foods
Foreign objects introduced during harvesting or processing

Economically Motivated Adulteration

Substitution of cheaper ingredients (e.g., melamine in milk powder)
Dilution with undeclared substances
Mislabeling of country of origin or species
Unapproved color additives or preservatives

Hazard Evaluation Criteria

For each identified hazard, you must evaluate the severity of the illness or injury that could result and the probability that the hazard will occur in the absence of preventive controls. Under 21 CFR 117.130(c), this evaluation must consider the formulation of the food, the condition and function of the facility and equipment, raw materials and ingredients, transportation practices, manufacturing and processing procedures, packaging and labeling activities, storage and distribution, intended use, and sanitation.

Document the rationale for each determination, including why a hazard does or does not require a preventive control. FDA inspectors expect to see written justifications, not just checkboxes.

Identifying Preventive Controls

Once the hazard analysis determines which hazards require a preventive control, you must identify and implement the appropriate type of control. Under 21 CFR 117.135, preventive controls must be written and must provide assurances that hazards requiring a preventive control will be significantly minimized or prevented.

The Five Types of Preventive Controls

Process Controls (21 CFR 117.135(c)(1))

Procedures, practices, and processes performed during manufacturing to control identified hazards. Includes parameters such as cooking temperature and time, cooling rates, acidification (pH targets), fermentation, drying to specific water activity, and formulation controls. Each process control must have defined parameters, maximum or minimum values, and monitoring procedures.

Food Allergen Controls (21 CFR 117.135(c)(2))

Controls to prevent allergen cross-contact during manufacturing and ensure accurate allergen labeling. Includes production scheduling (running allergen-free products first), dedicated lines or equipment, validated cleaning procedures between allergen-containing runs, ingredient storage segregation, and label verification procedures at packaging.

Sanitation Controls (21 CFR 117.135(c)(3))

Controls for sanitation conditions and practices that are directly related to preventing contamination. Required when environmental pathogens pose a risk to ready-to-eat (RTE) foods. Includes cleaning and sanitizing of food-contact surfaces, environmental monitoring programs (e.g., swabbing for Listeria spp. in RTE environments), and hygienic zoning of production areas.

Supply Chain Controls (21 CFR 117.405–475)

A supply chain program is required when a hazard will be controlled by the supplier rather than the receiving facility. Must include use of approved suppliers, written procedures for receiving raw materials, determination of appropriate supplier verification activities (on-site audits, sampling and testing, or review of supplier records), and documentation of verification outcomes.

Recall Plan (21 CFR 117.139)

Every facility with a food safety plan must include a written recall plan. The plan must describe procedures for notifying the direct consignees of the food being recalled, notifying the public about any hazard presented by the food when appropriate, conducting effectiveness checks to verify the recall is being carried out, and appropriately disposing of recalled food (e.g., destruction, reconditioning, or diversion to non-food use).

Use our Food Safety Plan Builder to generate a customized preventive controls framework based on your specific product types and facility operations.

Monitoring, Corrective Actions, and Verification

Establishing preventive controls is only the first step. The HARPC framework requires a continuous cycle of monitoring, correction, and verification to ensure that controls remain effective over time.

Monitoring Procedures (21 CFR 117.145)

Written monitoring procedures must be established for each preventive control. The procedures must specify:

What is being monitored (e.g., temperature, time, pH, water activity)
How monitoring is performed (e.g., calibrated thermometer, pH meter, visual inspection)
Frequency of monitoring (e.g., continuous, every batch, hourly)
Who is responsible for monitoring activities

Monitoring must be documented with records that include the date, time, values observed, and the identity of the person performing the monitoring.

Corrective Actions (21 CFR 117.150)

Corrective action procedures must address situations when a preventive control is not properly implemented or is found to be ineffective. Required corrective action steps include:

Identifying and correcting the problem with the preventive control
Reducing the likelihood that the problem will recur
Evaluating all affected food for safety
Preventing adulterated food from entering commerce

All corrective actions must be documented, including the nature of the problem, the actions taken, the disposition of the affected product, and the date of each action.

Verification Activities (21 CFR 117.155–165)

Verification ensures that the food safety plan is working as intended. Required verification activities include:

Validation (21 CFR 117.160): Obtaining and evaluating scientific and technical evidence that a preventive control is capable of effectively controlling the identified hazard. Validation must be performed within 90 calendar days of production (or within a reasonable timeframe for seasonal products).
Calibration: Ensuring that monitoring instruments and equipment produce accurate results.
Product testing: Where appropriate, testing raw materials, in-process materials, or finished products for hazards.
Environmental monitoring: For facilities producing RTE foods exposed to the environment, testing for environmental pathogens (e.g., Listeria species monitoring programs).
Record review: A PCQI (or designee) must review monitoring, corrective action, and calibration records within a reasonable time after they are created.

FDA Inspection Focus

FDA inspectors pay particular attention to whether monitoring records match the frequency specified in your plan, whether corrective actions were taken and documented promptly when deviations occurred, and whether verification activities (especially record reviews) are performed by a PCQI. Gaps in any of these areas are among the most common Form 483 observations.

HARPC Recordkeeping Requirements (21 CFR 117 Subpart F)

Comprehensive recordkeeping is the backbone of HARPC compliance. Under 21 CFR 117 Subpart F (117.301–117.335), facilities must create and maintain records that document every component of the food safety plan and its implementation.

Required Records

Food safety plan: The complete written plan including hazard analysis, preventive controls, monitoring procedures, corrective action procedures, verification procedures, recall plan, and supply chain program
Monitoring records: Documentation of each monitoring event with date, time, observed values, and the identity of the person performing monitoring
Corrective action records: Documentation of each deviation, the corrective actions taken, product disposition, and root cause analysis
Verification records: Validation studies, calibration records, product and environmental testing results, and record review documentation
Supply chain records: Supplier approval documentation, verification activity records, and supplier corrective action records
Training records: PCQI certification documentation and training records for all personnel with food safety responsibilities
Reanalysis records: Documentation of each food safety plan reanalysis, including the basis for any changes made

Record Requirements

General Requirements

Created at the time of the activity
Accurate, indelible, and legible
As detailed as necessary to document activities
Include the actual values and observations
Created by or under supervision of the person performing the activity

Retention and Access

Retained for at least 2 years after the date created
Available for official review and copying at reasonable times
Electronic records are acceptable if meeting 21 CFR 117.305
Offsite storage is permitted if records can be retrieved within 24 hours
Kept at the facility or at a reasonably accessible location

For facilities seeking to streamline recordkeeping, the Assurentry platform offers digital food safety plan management with automated record tracking and FDA-ready documentation exports.

Common HARPC Violations and How to Avoid Them

FDA inspection data shows consistent patterns in HARPC-related violations. Understanding the most frequently cited deficiencies can help your facility avoid Form 483 observations and Warning Letters.

No written food safety plan

21 CFR 117.126

Risk: Warning Letter and potential import refusal for foreign facilities. FDA considers this one of the most serious FSMA violations.

Prevention: Develop a written food safety plan with all required components before beginning production. Ensure the plan is prepared or overseen by a PCQI.

Incomplete or inadequate hazard analysis

21 CFR 117.130

Risk: Form 483 observation. If hazards are missed, products may reach consumers without adequate safety controls in place.

Prevention: Systematically evaluate every ingredient, process step, and environmental factor. Include all four hazard categories (biological, chemical, physical, economically motivated). Document the rationale for each determination.

Missing or inadequate monitoring records

21 CFR 117.145 / 117.305

Risk: Form 483 observation. Cannot demonstrate that preventive controls were consistently applied during production.

Prevention: Create standardized monitoring forms with required fields (date, time, value, person). Train personnel on proper recording. Implement supervisor review of records daily.

Failure to take corrective actions when deviations occur

21 CFR 117.150

Risk: Warning Letter. Adulterated product may have entered commerce without appropriate evaluation or disposition.

Prevention: Establish clear corrective action procedures before deviations occur. Train all monitoring personnel on the escalation process. Document all corrective actions in real time.

No PCQI on staff or PCQI training not documented

21 CFR 117.180

Risk: Form 483 observation. The food safety plan may be deemed invalid without qualified oversight.

Prevention: Ensure at least one person completes FSPCA Preventive Controls for Human Food training. Retain certificates. If the PCQI leaves, train a replacement promptly.

Failure to conduct reanalysis

21 CFR 117.170

Risk: Form 483 observation. An outdated plan may not reflect current operations, leaving new hazards uncontrolled.

Prevention: Schedule reanalysis every three years at minimum. Trigger immediate reanalysis for any significant changes to ingredients, processes, equipment, or packaging.

No supply chain program for supplier-controlled hazards

21 CFR 117.405

Risk: Warning Letter. The facility is relying on suppliers to control hazards without any verification or oversight.

Prevention: Identify hazards controlled by suppliers during hazard analysis. Establish an approved supplier list, define verification activities, and document all supplier evaluations.

Prepare for your next FDA inspection

Our compliance team reviews your HARPC plan and identifies gaps before FDA inspectors do.

Schedule a Plan Review

Frequently Asked Questions

What is a HARPC plan?

A HARPC (Hazard Analysis and Risk-Based Preventive Controls) plan is a written food safety plan required under 21 CFR Part 117. It identifies hazards associated with a food facility's operations, establishes preventive controls to minimize or prevent those hazards, and documents monitoring, corrective action, and verification procedures. HARPC replaced HACCP as the primary food safety framework for most FDA-regulated food facilities under FSMA.

What is the difference between HARPC and HACCP?

HARPC is broader than HACCP. HACCP focuses on Critical Control Points in production, while HARPC covers process controls, allergen controls, sanitation controls, supply chain controls, and a recall plan. HARPC is required under FSMA (21 CFR 117), whereas HACCP remains the standard only for seafood (21 CFR 123), juice (21 CFR 120), and USDA-regulated meat and poultry. HARPC also requires a Preventive Controls Qualified Individual (PCQI) rather than a HACCP team leader.

Who needs a HARPC plan?

Any food facility required to register with the FDA under 21 CFR Part 1, Subpart H must have a HARPC-based food safety plan, unless they qualify for an exemption. This includes domestic and foreign manufacturers, processors, packers, and holders of human food. Exemptions exist for very small businesses, qualified facilities, farms, and facilities already subject to HACCP regulations for seafood or juice.

What are the 5 types of preventive controls under HARPC?

The five categories of preventive controls under 21 CFR 117 Subpart C are: (1) Process controls such as cooking temperatures and cooling times, (2) Food allergen controls to prevent cross-contact and ensure proper labeling, (3) Sanitation controls for food-contact surfaces especially for ready-to-eat foods, (4) Supply chain controls to verify that suppliers are controlling identified hazards, and (5) A recall plan with procedures for notifying consumers and conducting effective product recalls.

What training is required for a HARPC plan?

A Preventive Controls Qualified Individual (PCQI) must develop or oversee the food safety plan. The PCQI must have successfully completed training in the development and application of risk-based preventive controls at least equivalent to the standardized curriculum recognized by FDA, or be qualified through job experience. The FSPCA Preventive Controls for Human Food course is the standard recognized training program.

How often must a HARPC plan be reanalyzed?

Under 21 CFR 117.170, the food safety plan must be reanalyzed at least once every three years, or sooner when there is a significant change that creates a reasonable potential for a new hazard or increases the significance of a previously identified hazard. Changes in ingredients, suppliers, equipment, packaging, finished product distribution, or facility layout may trigger a reanalysis.

What records are required under HARPC?

21 CFR 117 Subpart F requires records for the written food safety plan (including hazard analysis and preventive controls documentation), monitoring activities, corrective actions taken, verification activities (including validation and record reviews), supply chain program activities, recall plan, and training records for the PCQI. Most records must be retained for at least two years after the date they were created.

What are the penalties for not having a HARPC plan?

Failure to maintain a compliant food safety plan can result in FDA Warning Letters, import refusal for foreign facilities, product detention and seizure, civil monetary penalties, facility suspension, and in serious cases criminal prosecution. FDA considers the absence of a food safety plan a significant violation during facility inspections, often leading to a Form 483 observation or a Warning Letter.

Does HARPC apply to animal food facilities?

Animal food facilities are covered under a separate rule: 21 CFR Part 507 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Food for Animals). The structure is similar to Part 117 but has specific provisions tailored to animal food manufacturing. Facilities that produce both human and animal food may need to comply with both Part 117 and Part 507.

Can I use my old HACCP plan as a HARPC plan?

An existing HACCP plan does not satisfy HARPC requirements on its own because HARPC has a broader scope. However, a HACCP plan can serve as a foundation. You will need to expand it to include allergen controls, sanitation controls, supply chain controls, and a recall plan. The hazard analysis must also be updated to include all known or reasonably foreseeable hazards, and a PCQI must oversee the plan.

Related Guides

Build Your HARPC Plan with Expert Support

A compliant food safety plan is the foundation of your FSMA obligations. Our PCQI-certified compliance team can build, review, or update your HARPC plan to meet 21 CFR 117 requirements.

Talk to an Expert Food Safety Plan Builder →

Stop reading. Start executing.

Assurentry acts as a technical translation layer. You provide basic business info, and we automatically generate and file the exact electronic submissions required by the FDA.

Automate compliance

100% FDA Acceptance Guaranteed

HARPC Plan: The Complete Guide