On Sept. 19, most food companies that are not considered small businesses must comply with the Hazard Analysis and Risk-Based Preventive Controls (HARPC) of the FDA Food Safety Modernization Act (FSMA). Although much has been written about HARPC, very few articles explore its requirements with any depth.
Under 21 CFR 117.126, the owner, operator or agent in charge of a food facility must prepare and implement a written food safety plan. The food safety plan must be prepared by or have its preparation overseen by one or more “preventive controls qualified individuals.”
This term is defined as “a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or is otherwise qualified through job experience to develop and apply a food safety system.” If a facility does not have the necessary expertise on staff, it must engage an outside preventive controls qualified individual to develop its food safety plan.
In the food safety plan, a covered facility must:
- Identify known or reasonably foreseeable hazards that may be present in the food handled at that facility (including biological, chemical, and physical hazards).
- Implement preventive controls for hazards that require such a control to significantly minimize or prevent them.
- Develop effective monitoring procedures for the controls
- Establish corrective action plans if preventive controls are found to be ineffective.
- Validate the preventive controls, monitoring and corrective action plans.
- Establish a recall plan
- Establish a supply chain program
- Re-analyze the food safety plan at least once every three years and sooner if made necessary by production changes.
HARPC, and the requirement to develop a food safety plan, applies to facilities that manufacture, process, pack or hold human food for consumption in the U.S.; that is, facilities required to register with the FDA.
However, many facilities are exempted from HARPC. These are typically facilities that are subject to specific food safety requirements under the FD&C Act or its implementing regulations, including: dietary supplement facilities; juice and seafood HACCP facilities; operations subject to the produce safety standards; alcoholic beverages at a facility registered with the Alcohol and Tobacco Tax and Trade Bureau; facilities engaged solely in the storage of raw agricultural commodities; low-risk activity/food combinations performed by farm mixed-type facilities that are small or very small businesses.
Although not fully exempted from HARPC, a number of facilities have modified requirements. Low-acid canned foods are exempt from HARPC’s microbiological hazards. “Qualified facilities” – i.e., facilities that are “very small businesses” or facilities with average annual sales of less than $500,000 and at least 50 percent of sales directly to consumers or to local retailers or restaurants – are subject to modified HARPC requirements. Also, facilities engaged in the storage of packaged food that is not exposed to the environment are not subject to HARPC, but if that packaged food requires refrigeration to significantly minimize or prevent the growth of or toxin production by pathogens, the modified HARPC requirements at 21 C.F.R. § 117.206 apply.
Once a facility determines that HARPC applies to foods it produces, it must prepare its food safety plan, the first component of which is a hazard analysis.