Normex- Food Safety | Food traceability software solution

HACCP vs. HARPC: What Processors Need to Know

No fluff, just the facts. If you make, pack, or hold food, you live in two worlds: the classic HACCP mindset (Codex/USDA heritage) and the HARPC mindset (FSMA’s risk-based Preventive Controls). They overlap a lot—but they’re not interchangeable. This guide breaks down what matters, where each framework applies, how to implement both without tripping over jargon, and how to operationalize the whole thing with tight execution (and yes, strong records).

TL;DR for busy leaders

HACCP = 7 principles, focused on CCPs that control significant hazards at critical steps. Mandatory in seafood, juice (FDA), and meat/poultry (USDA), and foundational across GFSI schemes.
HARPC (FSMA Preventive Controls, 21 CFR Part 117/507) = broader, hazard analysis and risk-based preventive controls (process, allergen, sanitation, supply-chain) + recall plan, environmental monitoring (when appropriate), and PCQI oversight.
Think of HARPC as HACCP++: everything risk-based HACCP does, plus structured controls for allergens, sanitation/Listeria, supply chains, and program-level verification and reanalysis.
If you export to the U.S. or operate there, you need HARPC (unless a specific HACCP regulation applies). If you’re under USDA, your HACCP plan is mandatory; you still need robust prereqs that look a lot like preventive controls.
Canada’s SFCR requires a Preventive Control Plan (PCP)—conceptually aligned to HACCP/HARPC. If you sell into multiple markets, unify under one risk-based system and map to each regulator.

What each one actually is (without the buzzwords)

HACCP (Hazard Analysis and Critical Control Points)

Origin: Codex Alimentarius; entrenched in global trade and GFSI certification.
Where it’s mandatory in the U.S.:
- Seafood HACCP: 21 CFR 123
- Juice HACCP: 21 CFR 120
- USDA-FSIS (meat & poultry): 9 CFR 417
Core of HACCP: Seven principles—hazard analysis, CCP identification, critical limits, monitoring, corrective actions, verification, recordkeeping.
Strengths: Laser-focus on process steps that must never fail (kill steps, chilling, metal detection, etc.).

HARPC / FSMA Preventive Controls (the modern U.S. FDA rule)

Regulations:
- Human Food: 21 CFR 117
- Animal Food: 21 CFR 507
What’s different: Goes beyond CCPs. Requires you to identify known or reasonably foreseeable hazards and implement Preventive Controls where needed:
- Process controls (like HACCP CCPs, but not limited to them)
- Allergen controls (labeling, changeovers, segregation)
- Sanitation controls (including Listeria environmental monitoring when RTE exposure exists)
- Supply-chain controls (approve/verify suppliers for hazards they control)
- Recall plan (explicit, documented, tested)
Governance: Must have a PCQI (Preventive Controls Qualified Individual) develop/oversee the plan; reanalysis at least every 3 years or when changes occur.

Bottom line: HACCP is the backbone; HARPC is the full body. Most best-in-class programs implement both mindsets: CCPs where process control is critical and preventive controls that cover allergens, sanitation, and suppliers with equal rigor.

Where processors get confused (and how to settle it)

“Do I need HACCP or HARPC?”
- If you’re USDA-regulated (meat/poultry), you need HACCP.
- If you’re FDA-regulated and not in seafood/juice, you’re under FSMA Preventive Controls (HARPC).
- Many multi-category sites run one integrated plan and map it to both regimes.
“Is a CCP always required?”
- No. Under HARPC, you may have no CCPs but still need preventive controls (e.g., allergen or sanitation) that are just as consequential.
“Are allergen and sanitation just PRPs?”
- Under HACCP, often yes (prerequisite programs). Under HARPC, they can be Preventive Controls requiring monitoring, corrective actions, and verification—with teeth.

The seven HACCP principles vs. HARPC requirements (quick contrast)

Hazard Analysis: Both require it. HARPC language emphasizes reasonably foreseeable hazards and severity × probability.
Controls:
- HACCP: CCPs with critical limits.
- HARPC: Process + Allergen + Sanitation + Supply-Chain controls (not all are CCPs) + Recall Plan.
Verification & Validation: Both require it, but HARPC pushes program-level verification (e.g., environmental monitoring, supplier verification).
Governance:
- HACCP: HACCP team.
- HARPC: PCQI (documented training/experience) is explicit.
Reanalysis:
- HACCP: When changes occur.
- HARPC: When changes occur and at least every 3 years.
Records: Both are record-heavy. HARPC expands the scope (supply chain, allergen, sanitation, reanalysis, recall readiness).

A step-by-step approach that satisfies both (and scales)

Use this as your implementation playbook.

Define scope & leadership mandate
Nail down products, processes, and markets (USDA/FDA/CFIA/EU). Assign a PCQI and a HACCP leader. If leadership isn’t engaged, the program will be paper only—and that’s a risk.
Describe products & intended use
Include ingredients, allergen profile, packaging, shelf life, target consumer (e.g., RTE, vulnerable populations).
Map the process
Create detailed flow diagrams from receiving to shipping. Validate them on the floor—do a physical walk-through.
Perform the hazard analysis
For each step, analyze biological, chemical (incl. allergens), and physical hazards. Consider recontamination risks, cross-contact, and supply-chain hazards that originate upstream.
Decide control type—CCP vs. Preventive Control
- CCP when a step and critical limit control a hazard (e.g., cook to 165°F/74°C).
- Preventive Controls when hazards are best addressed by allergen management, sanitation, supplier verification, or programmatic measures.
Set critical limits or parameters
For CCPs: measurable limits (time/temperature, pH, aw, metal detector sensitivity).
For PCs: define monitoring criteria (e.g., allergen label verification, sanitation frequencies, ATP limits, environmental sites/targets).
Monitoring procedures
Who, what, how often, and where records live. No vague language—be explicit.
Corrective actions
Define what happens when limits/criteria aren’t met. Product disposition + root cause + prevent recurrence. Pre-write decision trees for speed.
Verification & validation
- Validation: Scientific/technical basis for your controls (e.g., process lethality data, sanitation efficacy, supplier kill-step validation).
- Verification: Internal audits, record reviews, environmental monitoring (if RTE exposure), label checks, calibration, supplier performance reviews.
Supply-chain program
Approve suppliers, define verification activities (COAs, audits, kill-step validations), and escalation rules. If the hazard is controlled by your supplier, supply-chain PC is mandatory.
Allergen control program
Ingredient receiving checks, segregation, dedicated tools or validated changeovers, label reconciliation, and routine verification (e.g., ELISA swabs when appropriate).
Sanitation controls & environmental monitoring
Sanitation SSOPs that target risk points (e.g., RTE post-lethality areas). Define sites (Zones 2–3; Zone 1 when warranted), frequencies, corrective actions, and trend review.
Recall plan & traceability
Assign roles, create scripts, define decision criteria, test it annually. Map lot coding end-to-end. Food traceability software makes this faster and audit-proof.
Training & competency
Document PCQI credentials, HACCP training, allergen handling, sanitation, and line-specific SOPs. New hire orientation isn’t enough—prove competence.
Reanalysis & change management
Any significant change (ingredient, supplier, equipment, throughput) triggers review. HARPC requires reanalysis at least every 3 years even if nothing changed.
Digital records & dashboards
Paper dies in audits. Adopt food safety software to standardize forms, timestamps, signatures, and alerts. Build KPIs: CCP hit rate, environmental swab trend, allergen label error rate, supplier NCs, CAPA cycle time.

Three real-world examples (how the controls differ in practice)

1) RTE Hummus Line – Listeria risk post-blend

Hazard: Listeria monocytogenes recontamination after the lethality step (if any) or in a cold-mix product.
HACCP view: You might have no CCP unless there’s a validated kill step; you’d lean on sanitation PRPs.
HARPC view: This becomes a Sanitation Preventive Control with environmental monitoring. You’ll define zones, swab frequency, corrective actions (hold & test? intensified sanitation?), and trend reviews.
What processors need to know: Treat sanitation like a control with records equal in weight to CCPs. Auditors will dig here.

2) Peanut Butter Plant – Salmonella in nuts

Hazard: Salmonella in raw peanuts.
If you roast: The roaster is a CCP with a validated time/temperature profile and continuous monitoring.
If you buy roasted peanuts: The hazard is controlled upstream. Under HARPC you need a Supply-Chain Preventive Control: approved supplier program, kill-step validation on file, COAs, and periodic audits.
Takeaway: Under HARPC you can’t hand-wave “supplier does it.” You need evidence and documented verification.

3) Allergen Changeover – From dairy to non-dairy SKU

Hazard: Allergen cross-contact and mislabeling.
HACCP: Often handled as a PRP; not always a CCP.
HARPC: Allergen Preventive Control requiring defined changeover steps, visual/ATP or allergen-specific verification as applicable, label checks, and deviation handling.
Pro tip: Treat label application & reconciliation as a high-risk point. A wrong label is a recall waiting to happen.

Documentation that actually satisfies regulators (and your customers)

You need evidence that your system works every day, not just during audits:

HACCP plan (flow diagram, hazard analysis, CCPs with critical limits, validation)
Preventive Controls plan (process, allergen, sanitation, supply-chain), PCQI designation
Monitoring records (CCP logs, allergen checks, sanitation pre-ops, label verifications)
Corrective action & product disposition records
Verification: calibrations, environmental monitoring maps/data, internal audits, review signatures
Supplier approval files: risk assessment, audits, COAs, performance metrics
Recall plan + mock recall results
Reanalysis/change logs
Training & competency records

If that sounds like a lot, it is. This is where Food safety teams win or lose. Digital systems cut the noise.

Metrics that matter (and expose weak signals early)

CCP/PC conformance rate (target ≥99.8%)
Allergen label error rate (target: zero tolerance; track near-misses)
Listeria environmental trend (rolling 12 weeks; time-to-root-cause ≤5 days)
Supplier NC rate and time-to-closure
CAPA cycle time (from detection to verified effectiveness)
Mock recall speed (trace 2 lots, 1 up/1 down in ≤2 hours; best-in-class: minutes with software)

Common pitfalls (don’t do these)

Treating HARPC as renaming HACCP. It’s broader; if you ignore allergen, sanitation, and supply-chain PCs, you’re exposed.
Forgetting the PCQI. FDA will ask who owns the plan—have proof of training/experience.
Weak supplier verification. A COA alone isn’t always enough. Use risk-based audits and validation evidence.
Environmental monitoring theater. Swab where it’s hard, not where it’s easy. Trend aggressively. Act on patterns.
Paper chaos. If your records aren’t retrievable in minutes, they’re as good as missing.
No reanalysis discipline. Three years fly by. Changes (new line speeds, packaging, ingredients) trigger immediate review.
Allergen complacency. Mislabeling is still a top cause of recalls. Barcoding + dual verification = baseline.

How to operationalize this with less pain (yes, software helps)

A modern program isn’t just binders. Food safety software centralizes your HACCP and Preventive Controls plan, assigns tasks, timestamps execution, and keeps records searchable. Here’s what to expect from a serious platform:

Plan builder: Map hazards to CCPs and PCs, attach validations, and link SOPs/SSOPs.
Tasking & escalation: Auto-schedule monitoring (CCP checks, label verifications, sanitation pre-ops), with alerts for misses.
Environmental monitoring: Swab maps, rotating sites, corrective action playbooks, trend charts.
Supplier module: Approvals, COAs, audits, risk scores, and auto-reminders for expiries.
Label control: Artwork control, barcoded checks at packaging, and dual sign-offs.
Recall & traceability: Lot genealogy and mock-recall drills built in. Food traceability software should give you one-click lists of affected SKUs, customers, and inventory positions.
Dashboards: Real-time KPIs for plant leadership and C-suite visibility.

If you want to see what this looks like in practice, NORMEX can walk you through a live environment tailored to your category.

👉 Book a demo: https://normex.ca/demo

Putting it all together (a pragmatic roadmap)

Unify under one risk-based plan. Keep the HACCP 7 principles for process rigor and layer HARPC’s preventive controls across allergens, sanitation, and supply chain. Map your integrated plan to the exact regulation(s) you face (USDA/FDA/CFIA, etc.).
Invest in validation where it counts. Kill steps, sanitation efficacy (especially for Listeria), allergen changeover, and supplier controls for high-risk ingredients (spices, nuts, dairy powders).
Make documentation effortless. If your team spends more time hunting papers than preventing hazards, you’re upside down. Digitize.
Audit yourself like FDA/USDA would. Quarterly internal audits that hit environmental monitoring, allergen controls, and supplier files will surface issues before regulators—or your customers—do.
Treat continuous improvement as non-negotiable. Trends tell you where tomorrow’s deviation will happen. Act on them early.

Final word

HACCP and HARPC aren’t rivals. HACCP gives you the surgical instruments (CCPs). HARPC forces you to build the hospital around them (allergen, sanitation, supplier, recall). If you’re serious about risk—and you should be—the combined system is non-optional.

If you want a straight-talking walkthrough of how to implement this in your facilities and get audit-ready without drowning in paperwork, see it in action:

Schedule your demo: https://normex.ca/demo

No sugar-coating: the bar keeps rising. The processors who operationalize both frameworks with discipline—and who can prove it instantly—will win the trust of regulators, customers, and consumers.