FDA’s new Preventive Controls for Human Foods (PC) requirements under the Food Safety Modernization Act (FSMA) have created quite a stir and a little bit of head scratching (environmental hazard?) by those operating their food safety plans under the time-honored Hazard Analysis and Critical Control Points (HACCP) system. While the end game of both HACCP and the newer Hazard Analysis and Risk-Based Preventive Controls (HARPC) plans are largely the same—a safer food supply—how they get there, at least on the surface, seems to require two food safety plans (FSPs). HACCP utilizes the concept of “reasonably likely” to assess the need to manage or control food safety hazards via prerequisite programs or CCPs, while HARPC utilizes “known or reasonably foreseen hazards” and adds another control, that is, preventive controls that traditional HACCP does not recognize. HARPC also requires the management or control of hazards be risk based, while traditional HACCP implies that the elements used in making risk-based decision about hazards be considered, but the risk-based approach to hazard evaluation is not explicit.
An updated version of traditional HACCP described in the International Organization for Standardization (ISO) 22000 standard seems to be a bridge between the “old” HACCP and the “new” HARPC, introducing the concept of “operational prerequisite programs (OPRPs),” which are essential prerequisites. Are OPRPs and preventive controls conceptually the same? The answer in simple terms is “yes”; however, only a limited number of U.S. food manufacturers utilized the ISO 22000 standard as the basis for their food safety program. Can food safety systems based on the ISO 22000 standard be easily modified to meet the HARPC requirements? Again, the answer conceptually is “yes” with the devil being in the details.
Are HACCP-based food safety plans utilized by food manufacturers because of tradition or because customers demand traditional HACCP, which requires a second food safety plan to meet the U.S. Food and Drug Administration’s HARPC requirements? The answer for some large food manufacturers and at least one large dairy company is “yes.” The reason for two food safety plans is also driven by Global Food Safety Initiative (GFSI)-recognized schemes like SQF, BRC, FSSC 22000 and IFS that require a traditional HACCP approach for a company’s food safety plan. As least some of these GSFI schemes have stated publicly they will not recognize a food safety program built on HARPC, because it is applicable only to U.S. food manufacturers or those exporting food into the U.S. market.
While the creation two food safety plans to satisfy both requirements is certainly possible, operating under two food safety plans is also somewhat unrealistic. The complications of two food safety plans for the same manufacturing facility and the same food include training of processing staff and supervisors, corrective action responses to food safety issues, development and maintenance of dual records systems, etc. Is it realistic to attempt to create one comprehensive plan that satisfies both a traditional HACCP and the newer HARPC risk-based food safety program? The real questions is how to have one food safety plan that satisfies both traditional HACCP and new HARPC requirements. Is the first step to identify these hybrid and merged systems by providing a name? How about RBHAAPC (Risk-Based Hazard Analysis and Preventive Controls), HACCP Plus or HARPC Minus, or better yet, Hazard Analysis, Critical Control Points and Risk-Based Preventive Controls Plan for Human Food (HACCPARBPCPHF)?
So where is the discrepancy between the two plans? The bottom line is that HARPC, as detailed in 21 C.F.R. 117 requires a risk-based hazard analysis using the “known or reasonably foreseeable” standard that is slightly more strict that HACCP’s “reasonably likely” standard. HARPC also mandates environmental monitoring when the Hazard Analysis determines that contamination of a ready-to-eat food with an environmental pathogen requires a preventive control. Other HARPC requirements not found in traditional HACCP include the need to consider radiological and economically motivated hazards; written recall, allergen, sanitation, supplier management (in some cases) and process control plans; and a food safety plan managed and implemented by trained supervisors and staff (Qualified Individuals). HARPC also requires that the food safety plan be actively managed by a “Preventive Controls-Qualified Individual (PCQI).” This would be similar to the SQF requirement of an “SQF Practitioner.”
Is the answer to the fundamental questions of two food safety plans for one food manufacturing facility a hybrid such as RBHAAPC, HACCP Plus, HARPC Minus or HACCPARBPCPHF? Or can a HARPC-based food safety plan supported by a written and implemented set of prerequisite programs the real answer to this difficult question? If a company was to use HARPC as the basis for its food safety plan, what specific additional items would be needed to satisfy the traditional HACCP requirements driven by customers, GFSI-based schemes, etc.?
Who Makes the Plan?
While HACCP required a team approach to the development of a food safety plan, with at least one member of the team being HACCP certified, the risk-based approach requires one individual (PCQI) as the lead: someone with the education and experience to oversee and manage the entire food safety plan and be the point of contact for FDA during on-site investigations. Traditional HACCP implies that the HACCP team leader fulfill this role, without establishing any criteria for the team leader’s qualifications.
Go with the Flow
HACCP requires a flowchart; HARPC does not. In terms of making a complicated process simpler for everyone, a flowchart is a fundamental necessity in building a credible risk-based Hazard Analysis. So while not explicitly required by HARPC, it is a must for any food manufacturer’s food safety plan. Additionally, under traditional HACCP, the process flow diagram needs to be verified to ensure it contains all significant processing steps and all food additives, raw materials and food ingredients. The HARPC training manual issued by the FDA-supported Food Safety Preventive Controls Alliance (FSPCA) does include information on how to build a process flow diagram, how to verify the diagram and encourages all food manufacturers to also have a written narrative of the processing of all food manufactured in each facility.
The Risks of the Hazards
The HARPC risk-based approach includes two hazards not commonly addressed in a traditional Hazard Analysis: radiological (under chemical) and economically motivated adulteration. The use of a risk-based decision tree as found in the FSPCA for HARPC is very similar to what is used in traditional HACCP; however, the more advanced approach is to use a risk-based matrix/table that provides quantitative measures of the risk of likelihood and severity versus the decision-tree approach that utilizes a qualitative identification of the risk of a hazard. Which is better? Both work, but from experience in trying to train the industry, and state and FDA food inspectors, it was much easier for them to understand and apply the risk matrix/table versus the decision tree. Also, the use of the preventive controls as a tool to control hazards, which is mandated in HARPC but not in traditional HACCP, is easy to explain and justify to any customer or outside third-party auditor expecting a food safety plan to be based solely on traditional HACCP.
Prepare for the Unexpected
Recalls may be the ultimate outcome of a failed food safety plan or significant breakdown. HARPC requires a recall plan, whereas HACCP does not. A recall plan enables a company to be prepared for a worst-case scenario so that a determination and actions can be taken quickly and decisively: How best to notify the public, how to identify specifically where that contaminated food has gone so it can be pulled from commerce and how to verify its destruction by lots and/or product numbers. Much like other food safety plan components, a recall plan must be periodically tested, with “surprise” recall drills to identify the weak links in a food manufacturer’s inventory, traceability and supply chain management programs.
FDA has the authority to inspect a company’s food safety plan at any time, for any reason. Keeping plans up to date, documenting changes as they occur and justifying plan actions will not only help food manufacturers maintain FDA regulatory compliance, but will reduce the possibility of food safety problems resulting in recalls and loss of customers. While all “best laid” plans may eventually go awry, having one viable food safety plan, whether you call it RBHAAPC, HACCP Plus, HARPC Minus or HACCPARBPCPHF, not two, will provide the best path to achieving and maintaining food safety success.
Amy Scanlin, M.S. and Allen Sayler are with EAS Consulting Group, LLC.
