Since the U.S. Food and Drug Administration (FDA) made the decision to declare prerequisite programs (PRPs) at the same level of concern as Critical Control Points (CCPs), collectively referring to all of them as preventive controls, the nuances of the Hazard Analysis and Critical Control Points (HACCP) system are being modified.[1] The HACCP plan will now be referred to as the Hazard Analysis Risk-Based Preventive Controls (HARPC) Food Safety Plan, as it is known in the published rule. FDA’s idea behind this shift is that PRPs have caused a majority of outbreaks and recalls. Due to this realization, FDA would like PRPs that control a significant hazard to have documentation similar to a CCP’s.[1] This has led to some confusion about what constitutes an HACCP plan versus an HARPC plan and has resulted in recommendations and suggestions to completely revamp the HACCP plan even to the extent of removing CCPs altogether. Some PRPs may need additional verification and, where appropriate, validation; however, it may not be a good idea to remove the CCPs from the system altogether. Removing a CCP might reduce the science and the justification and thereby reduce the effectiveness of a food safety system. Instead of removing the CCPs, it might prove more beneficial to strengthen the risk assessment and associated PRPs while also taking the time to fully understand what makes an HACCP plan function as an effective HARPC plan.

HACCP vs. HARPC
HARPC is similar to HACCP in that it points out a need for control when there is a significant hazard.[1] Both HARPC and HACCP are risk assessments, but they differ, slightly, in how significant hazards are addressed. Classic HACCP employs a CCP whenever there is a significant hazard; however, HARPC recognizes that there might be a program, such as handwashing, that is used as a control for a significant hazard but may not have parameters like a traditional CCP. Because some of these programs do not have parameters, HARPC requests additional documentation for them, which a CCP also requires, such as monitoring, corrective action and verification. Under HARPC, a preventive control is a control measure that prevents or minimizes a significant hazard. Since a CCP meets the definition of what is a preventive control under HARPC, a company may continue using CCPs within their plan.[1]

It’s all in the name, or is it? In light of the Food Safety Modernization Act, a number of companies have renamed their HACCP plan an HARPC plan or Food Safety Plan or have combined names such as “HACCP and Food Safety Plan.” HACCP does include PRPs as well as control points and CCPs throughout the system.[2] A company may like to continue using the title of HACCP, and it should be able to do so since, for example, employees may relate better to HACCP because this is what they have been trained on for the past couple of decades. For the majority of companies that already have a good, thorough HACCP plan in place, modifying that plan to an HARPC Food Safety Plan should not be difficult. Minor changes to the plan should make it compliant with the FDA’s Preventive Controls rule. 

What about Prerequisite Programs?
While HACCP should discuss PRPs within the control measures column, it may not highlight the importance of their monitoring, verification, corrective action and record-keeping. A PRP summary is relatively easy to add to an HACCP plan and goes beyond what is actually required within HARPC since it captures all PRPs that control a hazard whether the hazard is significant or not. One can create a table, as shown in Table 1, indicating the PRP, the process steps with which it is associated, the hazards it helps control and whether the hazard is significant.[3] The rest of the table acts as a list of record-keeping activities, which companies should typically already have in place.[3] Under monitoring, it will be important to call out what is being monitored, who is doing the monitoring, the frequency of the monitoring and how the program is to be monitored.[2] Corrective action should also be noted and can be specific to the action. Preventive action may also be good to account for, but these actions should be discussed within a corrective action report rather than within the HACCP plan. Records that are kept for the prerequisite documentation should be listed so it is easy to link documents to the program being monitored and verified.[3] Note that the prerequisite summary does not have a column for critical limits as you would have with a CCP summary. This is because PRPs generally do not involve processing parameters. Another difference resides with whether to include validation for PRPs. While some PRPs will have a validation step, such as a sanitation program or allergen control, many PRPs, such as handwashing or supplier verification, may not include validation as part of the program. Validation, however, is always included for CCPs as well as operational PRPs (oPRPs).[2]

While oPRPs are handled in the same manner as a CCP, they are geared toward operational processes where a CCP may not be designated.[4] A good example of an oPRP is the thermal process within a canning facility. Because the Low-Acid Canned Food regulation is an HACCP-based concept and the thermal process for retorting is regulated, it may or may not be considered a CCP. While the thermal process may not warrant a CCP since it is already a regulatory requirement, it is still a good practice to define it within the HACCP plan as an oPRP. The same documentation standards that apply for a CCP can apply for an oPRP.[4] Just like a CCP, the oPRP will be given a number, as shown in the first column in Table 2. In the second column, the process step will be defined followed by the hazard it controls and the control limits for the processing measure.[3]

With three choices for the process step designation, the Codex Alimentarius decision tree may not be the best option. One of the concerns with the Codex decision tree is that for every question it asks, the answer is generally “yes,” leading to every process step becoming a CCP (Table 3). Using scientific justifications, the decision tree shown in Figure 1 was developed by Michigan State University and Coca-Cola.[5] This decision tree will help distinguish between a PRP, an oPRP and a CCP. For instance, in some cases, a subsequent step in the process will control the hazard, indicating that not every step will have an oPRP or CCP; however, every step will have a PRP that makes sense since Good Manufacturing Practices and sanitation among other prerequisites should be considered for every process step regardless of whether a step has a specific hazard.[5] Although this decision tree is a great resource for risk assessment, its disadvantage is that it does not necessarily meet HARPC guidelines, since the first question it asks is whether the hazard is significant, and if not, then it is a PRP. HARPC states that a PRP can be used to control a significant hazard.[1] This is where the PRP summary is useful because it captures the requirements of HARPC for PRPs that control a significant hazard. Regardless of this disadvantage, this decision tree is very useful for science-based risk assessments.

A Look at the Hazard Assessment
Just as important in utilizing a thorough decision tree is conducting a thorough hazard assessment and risk analysis for the HACCP plan.[2] It is the assessment of hazards combined with the decision tree that will lead to a strong, thorough HACCP plan.[2] Interestingly, there have been many recommendations around the way to quantify these hazards, but how is an illness such as listeriosis quantified when the immune response varies among the population? Similarly, what about those Salmonella infections that lead to chronic arthritic complications? How are these measured within a matrix? Even the assessment of likelihood can be hard to quantify. If Salmonella is likely to occur only once a year within one lot of ingredients, does this matter? What if this one occasion leads to an outbreak? What can be recommended in lieu of the quantifiable matrix is to review with a designation of low, medium or high.[3] This makes the hazard assessment broad enough to equalize illness with a potential fatality but also give a level of assessment to the hazard to indicate the necessary control measures. Of course, it is not just as simple as low, medium or high. While this measure is not as clear-cut as a numbering scale, it is still important to consider industry and academic studies, government guidance documents, plant or corporate validation studies, etc. These documents will help guide the hazard assessment and also help implement control measures for those hazards. Table 4 shows what this assessment will look like for biological and chemical hazards. Low (L), medium (M) or high (H) will be used for a separate risk assessment for the likelihood and severity.[3] Using this supporting documentation is also important for physical hazard identification, but the physical hazard assessment will be a quantified measure as discussed below.

Even though it may be difficult to use a quantified matrix for biological or chemical hazards, it can be very useful for physical hazards. As shown in Table 5, the severity and likelihood of physical hazards are easy to plot within a matrix and can be easily understood provided there is a solid definition for each rating given to the physical hazard in question.[4] Severity can be broken down into three categories: minor, medium or major. The minor category should include such items as hair or cardboard that are unlikely to cause injury. This is followed by the medium category, which includes harder items such as wood or soft plastics. Finally, the major category should include items such as metal and glass that have the potential to cause severe injury and harm if ingested.[4]

For the size rating, there is the handy FDA Compliance Policy Guide on physical hazards that discusses at what size a foreign material poses a hazard to human health.[6] Other sources may be case studies or complaints to determine the size rating. Likelihood can be easy to capture by use of historical data gathered at the plant level. How often has a physical hazard been associated with an incoming ingredient? How often has a physical hazard been found due to ongoing maintenance on machinery? What about wear on machinery? These are all questions that can lead to a quantifiable answer provided the records are in place to help answer the questions. For the length of time on likelihood, 2 years is used as the lowest frequency since 2 years is the time frame required by FSMA to keep records.[1] This may change, depending upon the company or plant’s record-retention policy. Once the severity, size and likelihood have been determined, they are multiplied to get one numerical value.[4] This number will then indicate whether the hazard is a quality risk (no concern on a food safety level), safety risk, critical risk or significant critical risk. Quality risks will be managed with PRPs, safety risks will be managed with oPRPs, critical risks are managed with CCPs and significant critical risks should be managed with multiple CCPs or a combination of CCPs and oPRPs.[4] This risk assessment will then be documented in the Hazard Analysis for physical hazards as shown in Table 6.[3]

Severity Rating Guidance:
•    Minor: Straw, vine, paper, cardboard, hair, congealed material (soft)

•    Medium: Wood, soft plastic or rubber, insects, congealed material (hard)

•    Major: Metal, rock, glass, hard plastic, bones

Size Rating Guidance:
•    Not a safety hazard: Objects greater than 4.5 cm (1.75 inches)

•    Minor hazard: Particles less than 7 mm (0.3 inch)

•    Major hazard: Objects between 7 mm and 20 mm (0.3 to 0.8 inch)

•    Choke hazard: Objects between 2 and 4.5 cm (0.8 to 1.75 inches)

Likelihood/Probability of Occurrence of Threat:
•    Remote: Chance of occurrence is less than once every 2 years

•    Possible: Occurs at least once every year but less than once in 2 years

•    Potential: Occurs at least once a month but less than 6 months

•    Likely: Occurs at least twice a month or more often

Risk Level:
Severity Rating × Size Rating × Likelihood/Probability
    
Bridging the Gaps
Integrating the HARPC regulations with HACCP can seem daunting because it is easy to overthink the necessary changes that need to be made. HARPC is basically an expansion of HACCP. If companies have done their due diligence with their HACCP plans, then there may not be a lot of change with the implementation of HARPC regulations. After all, even though CCP appears within the HACCP acronym, it does not mean that HACCP accounts only for the CCPs. When done correctly, HACCP actually covers all other control points within the system and does not necessarily have to be restrictive to the CCPs. Provided there are strong documentation and thorough risk assessments, using PRPs in combination with oPRPs and CCPs, the HACCP plan will function as a plantwide HARPC Food Safety Plan. Another bonus is that using the tables within this article will provide good documentation and records for the food safety program. This will be important for food safety plan reassessments as well as for third-party audits or federal inspections. Furthermore, for those products that fall under both U.S. Department of Agriculture and FDA regulations, companies probably will not need two separate plans. One holistic HACCP plan should be able to provide all the aspects of an HARPC Food Safety Plan. 

Amanda M. Yotty, M.Sc., is the regulatory affairs manager for Kent Nutrition Group Inc. She holds an M.Sc. in food safety from the University of Arkansas and is an active participant on the Food Safety Preventive Controls Alliance Animal Foods Subcommittee.

John A. Marcy, Ph.D., is a professor and poultry processing specialist in the Center of Excellence for Poultry Science at the University of Arkansas, Division of Agriculture, Research & Extension. He was designated an Institute of Food Technologist fellow in 2009. Dr. Marcy is currently in his second 2-year appointment to the National Advisory Committee on Meat and Poultry Inspection.

Fred W. Pohlman, Ph.D., is a professor in the department of animal science at the University of Arkansas. He has received numerous industry awards and is an oft-invited speaker and author.

Leslie D. Edgar, Ph.D., is the assistant dean of student programs for the Dale Bumpers College of Agricultural, Food and Life Sciences at the University of Arkansas. She also serves as the director of both the International and Honors Programs for the college.

References
1. www.gpo.gov/fdsys/pkg/FR-2013-01-16/html/2013-00125.htm.
2. www.fda.gov/Food/GuidanceRegulation/HACCP/ucm2006801.htm.
3. ConAgra Foods. 2014. Food Safety Plan Template.
4. Smith, D, ISO 22000 Food Safety: Guidance and Workbook for the Manufacturing Industry (London: British Standards Institute, 2007).
5. Coca-Cola/Michigan State CCP/oPRP Decision Tree. 2009. www.fskntraining.org.
6. FDA/ORA Compliance Policy Guides. Chapter 5 Section 555.425 - Foods - Adulteration Involving Hard or Sharp Foreign Objects.