4.3 FSMA Preventive Controls & HARPC vs. Traditional HACCP

4.3 FSMA Preventive Controls & HARPC vs. Traditional HACCP

Exam Key: Signed into law in 2011, the FDA Food Safety Modernization Act (FSMA) represents the most sweeping reform of U.S. food safety laws in over 70 years. FSMA shifted the regulatory focus from responding to foodborne outbreaks after they occur to proactively preventing contamination across the global food supply chain.

The FSMA Framework & 21 CFR Part 117

FSMA enacted seven foundational rules governing food production, transportation, and importation. The centerpiece for human food manufacturing is the Preventive Controls for Human Food (PCHF) Rule codified in 21 CFR Part 117.

The 7 Core Rules of FSMA

1. Preventive Controls for Human Food (21 CFR 117): Mandates HARPC food safety plans for human food facilities.
2. Preventive Controls for Animal Food (21 CFR 507): Establishes cGMPs and preventive controls for pet food and animal feed.
3. Produce Safety Rule (21 CFR 112): Sets science-based standards for growing, harvesting, packing, and holding produce.
4. Foreign Supplier Verification Program (FSVP - 21 CFR 1 Subpart L): Requires U.S. importers to verify foreign food safety compliance.
5. Third-Party Certification (21 CFR 1 Subpart M): Establishes accreditation framework for foreign facility audits.
6. Sanitary Transportation of Human & Animal Food (21 CFR 1 Subpart O): Controls sanitary practices during transit.
7. Intentional Adulteration / Food Defense (21 CFR 121): Requires mitigation strategies against intentional acts of terrorism.

---

HARPC vs. Traditional HACCP

Under 21 CFR Part 117, FDA established HARPC (Hazard Analysis and Risk-Based Preventive Controls). While HARPC shares roots with HACCP, HARPC is significantly broader in scope, hazard identification, and management controls.

Comprehensive Comparison Matrix

---

Role of the Preventive Controls Qualified Individual (PCQI)

Under 21 CFR 117.180, a facility's Food Safety Plan must be developed, implemented, and overseen by a Preventive Controls Qualified Individual (PCQI).

PCQI Qualification Pathways

An individual becomes a PCQI through one of two recognized routes:

1. Successful completion of standardized training under a curriculum recognized by the FDA (such as the 20-hour Food Safety Preventive Controls Alliance / FSPCA Lead Instructor course).
2. Accumulation of equivalent job experience developing and implementing complex food safety systems.

Mandatory PCQI Responsibilities

• Preparation & Oversight of the Food Safety Plan: Authoring the hazard analysis, selecting preventive controls, and establishing monitoring/verification protocols.
• Validation of Process Preventive Controls: Ensuring scientific validation is completed within 90 calendar days after production begins (or longer if justified by the PCQI).
• Record Review Sign-off: Reviewing monitoring and corrective action records within 7 working days of creation.
• Mandatory Plan Re-Analysis: Re-evaluating the Food Safety Plan every 3 years, or immediately following an operational deviation, equipment change, or reportable food incident.

---

The 5 Core Pillars of a HARPC Food Safety Plan

                    ┌──────────────────────────────────────────┐
                    │          HARPC FOOD SAFETY PLAN          │
                    └────────────────────┬─────────────────────┘
                                         │
 ┌──────────────────┬────────────────────┼────────────────────┬──────────────────┐
 │                  │                    │                    │                  │
 ▼                  ▼                    ▼                    ▼                  ▼
Process PCs    Allergen PCs        Sanitation PCs      Supply-Chain PCs     Recall Plan
(Thermal,      (Cross-Contact      (Environmental      (Supplier Audits,    (Traceback, RFR
 Chill, pH)     & Labeling)         Pathogen Control)   COA Verification)   Notification)

1. Process Preventive Controls

Procedures, practices, and processes implemented at specific steps to control hazards. Process PCs are very similar to traditional HACCP CCPs. They require defined parameters (critical limits or operating parameters), monitoring, corrective actions, and validation (e.g., pasteurization, thermal cooking, metal detection, acidification).

2. Food Allergen Preventive Controls

Written procedures designed to protect food from allergen cross-contact and ensure proper allergen labeling. The rule targets the Big 9 U.S. Food Allergens (Milk, Eggs, Fish, Crustacean Shellfish, Tree Nuts, Peanuts, Wheat, Soybeans, and Sesame—added by the FASTER Act of 2021).

• Cross-Contact Prevention: Physical separation of allergen storage; dedicated processing lines; strict sequencing (producing non-allergenic foods first, followed by allergenic foods); allergen cleanouts between production runs.
• Label Verification SOPs: Mandatory physical checks at the packaging line to ensure that incoming labels match the product formulation being packed. Undeclared allergens are the #1 leading cause of FDA food recalls.

3. Sanitation Preventive Controls

Mandatory practices in facilities where food is exposed to the environment prior to packaging (especially Ready-to-Eat / RTE foods). Sanitation PCs focus on:

• Preventing environmental pathogen harborage, specifically Listeria monocytogenes in wet/refrigerated processing environments and Salmonella spp. in dry processing environments.
• Clean-break procedures and environmental monitoring programs (sponge/swab testing of non-food contact and food-contact surfaces).
• Preventing cross-contamination between raw ingredient handling areas and finished RTE packaging rooms.

4. Supply-Chain Preventive Controls

A written Supply-Chain Program is mandatory whenever the facility's hazard analysis identifies a significant hazard in a raw material or ingredient that is controlled upstream by the supplier before receipt.

• Verification Activities: On-site annual audits by qualified auditors, lot-by-lot Certificates of Analysis (COAs), sampling and testing, or review of supplier food safety records.
• Approved Supplier Requirement: Ingredients requiring supply-chain controls must only be sourced from suppliers pre-approved by the facility's PCQI.

5. Mandatory Recall Plan

Under HARPC, if the hazard analysis identifies any hazard requiring a preventive control, the facility must have a written Recall Plan. The plan must outline step-by-step procedures to:

• Directly notify immediate consignees and commercial customers.
• Notify the general public when necessary to protect public health.
• Conduct effectiveness checks to verify that recalled product is removed from trade channels.
• Execute proper disposition of recalled product.
• FDA Reportable Food Registry (RFR) Mandatory Notification: Under federal law, if a facility determines that an distributed product poses a reasonable probability of causing serious adverse health consequences or death (Class I recall situation), the facility must report the instance to the electronic FDA RFR within 24 hours.

---

Foreign Supplier Verification Program (FSVP)

Codified in 21 CFR Part 1 Subpart L, FSVP places legal responsibility on U.S. importers to ensure that foreign food manufacturers produce food using safety standards equivalent to U.S. PCHF and Produce Safety rules. Importers must perform hazard analyses, evaluate foreign supplier risk, conduct supplier verification (e.g., annual on-site audits), and maintain detailed FSVP records for at least 2 years.