risk-based preventative control

For most food facilities, the Food Safety Modernization Act (FSMA) introduces a new requirement to implement risk-based preventive controls.

But, what exactly are they?

The FDA defines preventive controls as “those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, or holding at the time of the analysis.”

That's a mouthful! Let's look at what it all means in the context of the more familiar process based on critical control points.

Risk-based preventive controls include, but aren't limited to, critical control points

One major difference between the hazard analysis and critical control points (HACCP) system and the new hazard analysis and risk-based preventive controls (HARPC) system is the scope.

HACCP focuses on critical control points, which the FDA defines as “step[s] at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.” For example, a HACCP plan may specify that a product needs to be heated to a certain temperature for a certain amount of time. If those conditions are met, the product is considered safe. If they aren't, it isn't.

HARPC includes these kinds of discrete controls for specific hazards, but they aren't limited to them.

Risk-based preventive controls also include things like staff personal hygiene, cleaning and sanitation, and supplier control. Under the HACCP plan, these types of general operational procedures are known as prerequisite programs, and are considered distinct from critical control points. HARPC doesn't make this distinction.

The risk-based preventive control rule is non-prescriptive

Another difference between HACCP and HARPC is that the new system is not prescriptive.

HACCP requirements, such as those for juice and seafood, provide industry standards for companies to use in developing their plans.

HARPC, on the other, hand is prevention-oriented and more facility-based. Risk-based preventive controls go far beyond just conforming to industry standards. The new rules require companies to identify all possible food safety hazards within their facilities and perform research to identify the controls that will best reduce or eliminate those hazards.

Risk-based preventive controls are implemented by a Preventive Controls Qualified Individual (PCQI)

One of the big changes of FSMA is the requirement for the food safety plan, including the preventive controls, to be developed, monitored, and periodically reassessed by what the FDA calls a Preventive Controls Qualified Individual (PCQI).

This person doesn't have to be an employee of the facility, but she does have to be an individual person (rather than a team). Learn more about the role of the PCQI in this article from TraceGains.

Risk-based preventive controls are a mindset, not a checklist

As an overall framework, HARPC is more like a mindset, whereas HACCP is closer to a checklist.

Another way to think about it is that HARPC requires facilities to understand and respect the spirit, rather than the letter, of the law. There may be times when the complete picture of hazards and their controls is unknown. Under HARPC, it's the facility's responsibility to identify, control, monitor, and verify them, regardless of where in the overall process they occur.