One of the biggest changes the Food Safety Modernization Act (FSMA) has introduced is a transition from a reactive to a proactive approach to food safety. This is demonstrated in the shift from critical control points to preventive controls.

For many companies, the implementation deadline for Hazard Analysis and Risk-Based Preventive Controls (HARPC) is this September. And with the FDA adopting a more inspection- and enforcement-focused approach, you'll want to make sure you're ready when the inspectors knock on your door.

Here are five things you need to know about making the transition from HACCP to HARPC.

1. Your HACCP plan won't cut it under HARPC

In a sense, the HACCP plan you have is just table stakes for HARPC compliance — it's a great start, but not nearly enough.

To start with, the new regulations encompass a broader range of hazards:

  • HACCP covers physical, chemical, and biological hazards.
  • HARPC covers the above three as well as intentionally introduced hazards (e.g., acts of terrorism or by disgruntled employees), naturally occurring hazards, and unintentionally introduced hazards.

HARPC is also not based on the idea of critical limits, and it doesn't provide a specific prescriptive plan for dealing with control points. Instead, it requires processors to take an overall look at their facility to identify all potential hazards and create an overall plan for managing risk.

2. You're responsible for your own research and verification

HACCP plans are generally based on industry standards and research. For example, the FDA's Juice and Seafood HACCPs are designed to help juice and seafood producers identify hazards and develop control strategies.

Under HARPC, this isn't the case. Each facility is responsible for conducting and documenting its own research and verification that the implemented controls work.

3. You must have a complete documented food safety plan

The new regulations also require a written food safety plan that goes far beyond the 7-step HACCP plan. The full plan must include seven elements:

  • Hazard analysis
  • Preventive controls
  • Supply chain program
  • Recall plan
  • Procedures for monitoring the implementation of preventive controls
  • Corrective action procedures
  • Verification procedures

FDA auditors can request to see your food safety plan as well as documentation of proof that it is being carried out.

4. Your plan must be prepared and overseen by a Preventive Controls Qualified Individual (PCQI)

The PCQI requirement has caused a lot of confusion. Here is a brief overview of what a PCQI is and what they do.

  • Every food facility must have at least one PCQI.
  • The PCQI is responsible for:
    • Preparing the food safety plan
    • Validating the preventive controls
    • Reviewing the records
    • Reanalyzing the food safety plan
  • To become a PCQI, a person must:
    • Complete FDA-recognized training based on a standard risk-based preventive controls curriculum OR
    • Have equivalent job experience that qualifies them to develop and implement a food safety system.

The PCQI is not required to be an employee of your facility. So, if you don't have a trained one in-house, you can hire an outside expert to help.

5. Monitoring and verification activities must be ongoing

The goal of FSMA and HARPC is to ensure that food safety is top of mind at all times, not just when something goes wrong or inspectors are in the building. Your PCQI will spearhead the monitoring and verification effort, but it will require cooperation from employees across your organization.

For many processors, the transition from HACCP to HARPC will require a shift in mindset. You can encourage this shift through education and training. Make sure everyone in your facility understands the new rules and requirements — not just what they are, but why they are.

The sooner you get everyone on board, the easier your transition will be.