HARPC Requirements

HARPC is the evolution of HACCP. This article outlines the steps needed to comply with new regulations from the FDA for United States-based producers. Other countries may require similar documentation and we recommend all Kombucha brewers have some form of plan in place to control for any potential hazards or risks.

1. Conduct Hazard Analysis

The “HA” in HARPC stands for “Hazard Analysis” and addresses the core intent of the law: to identify hazards due to the specific foods or food ingredients in the food or due to the various processing, manufacturing, packing, and holding steps applied to the foods. Once identified, the company must evaluate each hazard to assess its probability of occurring and severity of the injury it would bring. This step is designed to prepare the firm for identifying the steps necessary to minimize or prevent the hazards from arising.

To identify the hazards, the company must consider following:

• Known or reasonably foreseeable hazards:
• biological hazards (pathogenic bacteria, viruses, mold or parasites)
• chemical hazards (cleaning agents, pest control substances)
• physical hazards (extraneous or foreign matter such as glass)
• Natural toxins, pesticides, drug residues, decomposition, parasites, allergens, and unapproved food and color additives
• Naturally occurring hazards or unintentionally introduced hazards
• Intentionally introduced hazards for economic gain

After identifying the hazards, the Company must evaluate each by considering formulation, ingredients, facilities, equipment, production flow, storage, and transportation. The Company must also look into relevant factors that could contribute to each hazard throughout the food facility, its operations and personnel, including personnel screening and controls, the entire supply chain of a facility’s food ingredients (raw materials, packaging, dyes, labels, etc.), and the finished foods received, delivered and shipped.

Companies must create a written analysis of the above hazards, in English, so that FDA can review it during inspection or upon request.

2. Risk-based Preventive Controls

The “RPC” in HARPC stands for “Risk-based Preventive Controls.”  This portion of HARPC requires companies, whether foreign or domestic, to develop and implement a series of risk-based controls to significantly minimize or prevent the identified hazards to ensure the safety of the food it manufactures, processes, holds and distributes. The Company must designate controls at food processing steps that are appropriate for ensuring the safety of the food, especially, the critical control point (CCP). CCPs are critical manufacturing points, where the Company can apply controls to minimize or eliminate the hazard or reduce the hazard to an acceptable level under normal manufacturing operations.

Examples of types of preventive controls include:

• Sanitation procedures at food surface contact points
• Sanitation of utensils and equipment
• Staff hygiene training
• Food allergen control program
• Recall plan
• Current Good Manufacturing Practices (cGMPs)
• Supply-chain controls

The Company must have written preventive controls.
For each hazard that requires a preventive control, the Company must establish a written recall plan.

If a particular hazard will be controlled by another facility in the supply-chain (whether a supplier or later distributor/processor), the Company is not required to implement a preventive control as long as the Company records and obtains written assurance from the other facility that the hazard is being controlled.

3.  Monitoring of Effectiveness

HARPC requires the food facility to establish and implement a written monitoring program, which ensures the firm is conducting regular evaluations of the facility’s control measures to determine that the preventive controls are working.   FDA will evaluate the firm’s monitoring system to identify inadequacies in either the methods of monitoring or the firm’s record keeping.

4.  Corrective Actions

The Company must establish and implement written corrective action procedures that will go into effect if:

• preventive controls are not property implemented;
• there is a question regarding preventive control or food safety plan’s effectiveness;
• the records are incomplete, or other discrepancies in implementing the food safety plan.

The corrective action procedures must include the following steps:

• Identification of weak spots in the controls
• Identification of ineffective controls
• Identification of new hazards
• Performing necessary steps to reduce the likelihood of recurrence
• Evaluating the processed food for safety
• Prevention of adulterated food from entering commerce

5.  Verification

HARPC requires food facilities to design and implement verification steps to ensure that their HARPC plans (including the hazard identification and analysis, preventive controls and control measures, monitoring and corrective action steps) are operating correctly to prevent or minimize food safety and adulteration hazards.  Verification steps should be sufficiently robust to ensure that:

• The selected preventive controls are adequate
• Monitoring is occurring properly as defined in the plan
• Appropriate corrective actions are taken
• Potential food and food processing hazards are reduced
• Periodic reviews are conducted at appropriate intervals so the HARPC plan remains working and takes into account new and emerging risks and hazards

 6.  (Receiving Facilities) Supply-chain Program

HAPRC gives flexibility to receiving facilities’ controls on raw materials. If supplier or a third party entity implements controls to manage the hazards associated with raw material or other ingredients, the receiving facility does not need to establish its own preventive controls itself, but can rely on that of the third party or supplier through a risk-based supply-chain program.

Every receiving facility needs to set up a risk-based supply-chain program to make sure that the relevant hazards are appropriately controlled by its suppliers or third party entities. Under the supply-chain program, the receiving facility must first approve suppliers by considering the nature of the hazards and supplier performance. Then, the receiving facility must determine appropriate verification activities to ensure the supplier’s controls significantly minimize or prevent hazards. Appropriate verification activities may include onsite audits and testing. If the supplier is not controlling the hazards, the receiving facility can also choose to review and the verification conducted by another entity to assess the sufficiency of the controls.

In summary, the contents of the supply-chain program must include:

• Identification and use approved suppliers
• Determining and conducting supplier’s verification activities
• Conducting other facility (non-supplier)’s controls of hazards, or reviewing another entity’s verification activities on the hazards.

The supply-chain program must be written. The receiving facility needs to develop written receiving procedures and document the supplier’s verification activities.

7.  Recordkeeping and Documentation

One key development under HARPC is its new requirements related to recordkeeping and methods of documentation that are now mandatory for food manufacturing, processing, packing and storage facilities.  Previously, under the Bioterrorism Act, FDA could only require a food company to maintain records that enabled food to be traced through the supply chain (one up / one back identification records). Now, HARPC and the supply-chain provisions under FSMA require that records and documents related to food hazards and process control systems be established and maintained for no less than 2 years to cover the following HARPC steps:

• The monitoring of the preventive controls
• The corrective actions
• Testing results and other verification steps designed to ensure the preventive controls are effectively minimizing or preventing hazards
• Supply-chain program
• Trainings

In other words, FDA requires that a written record be kept of the entire plan including the process, the proof, and the problems.  A facility must make these records and documentation available to FDA upon request.

This new authority will result, eventually, in FDA demanding foreign and domestic food facilities to produce their HARPC records rather than the agency spending resources conducting physical plant inspections. The recordkeeping requirements, therefore, must tell the proper story to demonstrate HARPC compliance.

8.  Requirement to Reanalyze

After developing and implementing an adequate HARPC plan, the food facility must periodically evaluate its food safety HARPC system.  Under HARPC the facility must reanalyze its plan:

• Whenever there is a significant change at the facility that might increase a known hazard or introduce a new one
• Every 3 years (if no other significant changes occur)

Additionally, HARPC requires the facility to perform a new hazard analysis and implement any new, necessary preventive controls before operational changes occur.  Any changes must be documented in the firm’s HARPC records. If no changes are necessary after a reanalysis of a HARPC system, the firm must document the basis for that decision.

FAQ’s

Who is responsible for the HARPC plan?

The owner, operator, or agent in charge of each domestic or international food facility is required to develop an adequate HARPC plan for any facility that is subject to FDA food facility registration under The Bioterrorism Act. There are no substantive adulteration charges that apply to food manufactured in a facility that fails to comply with HARPC. Rather, failure to implement HARPC is defined by the FSMA as a “prohibited act”. Therefore, failure to comply could lead to criminal prosecution of the company (corporation, partnership, association, etc.) and / or the owner, operator or agent in charge of the facility.

How are HARPC and HACCP similar/different?

• HACCP (Hazard Analysis and Critical Control Point) is the FDA’s regulatory predecessor to HARPC under FSMA.  HACCP is a very similar hazard control system, but only applies to seafood and juice processors. HARPC applies to all food facilities subject to FDA registration except those covered by and in compliance with HACCP (and a few other significant exemptions discussed below). Another significant difference is that seafood and juice HACCP were created by FDA regulation – not by federal statute. HARPC was created by an amendment to the Food Drug and Cosmetic Act, specifically, the Food Safety Modernization Act (FSMA). Although arguments could be made that seafood and juice HACCP are unconstitutional, in that they laws (legislation) created by a federal regulatory agency and not by Congress, signed by the President, those arguments do not exist for HARPC. Functionally, HACCP and HARPC are very similar, though supplier verification procedures (including the Foreign Supplier Verification Program requirements (FSVP) are much more rigorous under FSMA.

How often do I have to submit or update my HARPC plan?

• FDA requires that a facility update its HARPC plan every 3 years or whenever there is a significant change at that facility which may increase a potential hazard or introduce a new one. Additionally, FDA may require an update based on new biological or chemical hazards.  There is no statutory requirement to submit your HARPC plan to FDA at any particular time, except, when FDA requests you to provide a copy of it. FDA would also request records necessary to demonstrate that you have properly implemented your HARPC plan. FDA’s request could be oral or in writing including during an FDA inspection.

What if I don’t have a HARPC plan? (Or my plan is inadequate?)

• If a facility does not have a HARPC plan or if FDA determines a HARPC plan is inadequate, FDA can take a number enforcement steps. First, FDA can criminally charge a company or person for owning, operating or acting as agent in charge of a facility not in compliance with HARPC. Second, FDA can issue a public warning letter and / or place foreign firms on Import Alert.
• If food from a non-compliant facility presents a significant food safety risk, FDA could suspend the facility’s food facility registration and thereby prevent the facility from distributing food products until FDA has approved a corrective action plan.
• In the case of a foreign firm, FDA would likely place the facility on an Import Alert (similar to Import Alert 16-120). A firm that is listed on this Import Alert would find its food automatically detained at importation, effectively barring it from the United States market unless FDA reviews and accepts an adequate HARPC plan.

More information on HARPC and HACCP can be in found in the 2016 & 2017 KKon presentations