HAZARD ANALYSIS RISK-BASED PREVENTIVE CONTROL [HARPC] & TRADITIONAL HACCP

Eng. Akram Malkawi, Amman-Jordan, Email [email protected] Tel. (+962) 795705076 1 | P a g e

How Food Companies Can Modify Their Existing

HACCP Plans into an All-Encompassing Food

Safety Plan Edited by: Eng. Akram Malkawi, University of Petra, Senior Food Safety & Quality

Management consultant and Lead Assessor.

Since the U.S. Food and Drug Administration (FDA) made the decision to declare

prerequisite programs (PRPs) at the same level of concern as Critical Control

Points (CCPs), collectively referring to all of them as preventive controls, the

nuances of the Hazard Analysis and Critical Control Points (HACCP) system are

being modified. The HACCP plan will now be referred to as the Hazard Analysis

Risk-Based Preventive Controls (HARPC) Food Safety Plan, as it is known in the

published rule. FDA’s idea behind this shift is that PRPs have caused a majority of

outbreaks and recalls. Due to this realization, FDA would like PRPs that control a

significant hazard to have documentation similar to a CCP’s. This has led to some

confusion about what constitutes an HACCP plan versus an HARPC plan and has

resulted in recommendations and suggestions to completely revamp the HACCP

plan even to the extent of removing CCPs altogether. Some PRPs may need

additional verification and, where appropriate, validation; however, it may not be a

good idea to remove the CCPs from the system altogether. Removing a CCP might

reduce the science and the justification and thereby reduce the effectiveness of a

food safety system. Instead of removing the CCPs, it might prove more beneficial

to strengthen the risk assessment and associated PRPs while also taking the time to

fully understand what makes an HACCP plan function as an effective HARPC

plan.

mailto:[email protected]

http://www.foodsafetymagazine.com/categories/regulatory-category/fda/

http://www.foodsafetymagazine.com/categories/regulatory-category/haccp/

http://www.foodsafetymagazine.com/categories/process-control-category/process-validation/

http://www.foodsafetymagazine.com/fsm/cache/file/9C24B65A-77EE-436F-8D6A32D21050B9AF.jpg


HACCP vs. HARPC

HARPC is similar to HACCP in that it points out a need for control when there is a

significant hazard. Both HARPC and HACCP are risk assessments, but they differ,

slightly, in how significant hazards are addressed. Classic HACCP employs a CCP

whenever there is a significant hazard; however, HARPC recognizes that there

might be a program, such as hand-washing, that is used as a control for a significant

hazard but may not have parameters like a traditional CCP. Because some of these

programs do not have parameters, HARPC requests additional documentation for

them, which a CCP also requires, such as monitoring, corrective action and

verification. Under HARPC, a preventive control is a control measure that prevents

or minimizes a significant hazard. Since a CCP meets the definition of what is a

preventive control under HARPC, a company may continue using CCPs within

their plan.

It’s all in the name, or is it? In light of the Food Safety Modernization Act, a

number of companies have renamed their HACCP plan an HARPC plan or Food

Safety Plan or have combined names such as “HACCP and Food Safety Plan.”

HACCP does include PRPs as well as control points and CCPs throughout the

system. A company may like to continue using the title of HACCP, and it should

be able to do so since, for example, employees may relate better to HACCP

because this is what they have been trained on for the past couple of decades. For

the majority of companies that already have a good, thorough HACCP plan in

place, modifying that plan to an HARPC Food Safety Plan should not be difficult.

Minor changes to the plan should make it compliant with the FDA’s Preventive

Controls rule.

What about Prerequisite Programs?


http://www.foodsafetymagazine.com/fsm/assets/Image/1215116HACCPFTable1.jpg


While HACCP should discuss PRPs within the control measures column, it may

not highlight the importance of their monitoring, verification, corrective action and

record-keeping. A PRP summary is relatively easy to add to an HACCP plan and

goes beyond what is actually required within HARPC since it captures all PRPs

that control a hazard whether the hazard is significant or not. One can create a

table, as shown in Table 1, indicating the PRP, the process steps with which it is

associated, the hazards it helps control and whether the hazard is significant. The

rest of the table acts as a list of record-keeping activities, which companies should

typically already have in place. Under monitoring, it will be important to call out

what is being monitored, who is doing the monitoring, the frequency of the

monitoring and how the program is to be monitored. Corrective action should also

be noted and can be specific to the action. Preventive action may also be good to

account for, but these actions should be discussed within a corrective action report

rather than within the HACCP plan. Records that are kept for the prerequisite

documentation should be listed so it is easy to link documents to the program being

monitored and verified. Note that the prerequisite summary does not have a column

for critical limits as you would have with a CCP summary. This is because PRPs

generally do not involve processing parameters. Another difference resides with

whether to include validation for PRPs. While some PRPs will have a validation

step, such as a sanitation program or allergen control, many PRPs, such as hand-

washing or supplier verification, may not include validation as part of the program.

Validation, however, is always included for CCPs as well as operational PRPs

(oPRPs).


http://www.foodsafetymagazine.com/categories/process-control-category/intervention-controls/



While oPRPs are handled in the same manner as a CCP, they are geared toward

operational processes where a CCP may not be designated.

A good example of an oPRP is the thermal process within a canning facility.

Because the Low-Acid Canned Food regulation is an HACCP-based concept and

the thermal process for retorting is regulated, it may or may not be considered a

CCP. While the thermal process may not warrant a CCP since it is already a

regulatory requirement, it is still a good practice to define it within the HACCP

plan as an oPRP. The same documentation standards that apply for a CCP can

apply for an oPRP. Just like a CCP, the oPRP will be given a number, as shown in

the first column in Table 2. In the second column, the process step will be defined

followed by the hazard it controls and the control limits for the processing measure.

With three choices for the process step designation, the Codex Alimentarius

decision tree may not be the best option. One of the concerns with the Codex

decision tree is that for every question it asks, the answer is generally “yes,”

leading to every process step becoming a CCP (Table 3). Using scientific

justifications, the decision tree shown in Figure.1 was developed by Michigan State

University and Coca-Cola.




This decision tree will help distinguish between a PRP, an oPRP and a CCP. For

instance, in some cases, a subsequent step in the process will control the hazard,

indicating that not every step will have an oPRP or CCP; however, every step will

have a PRP that makes sense since Good Manufacturing Practices and sanitation

among other prerequisites should be considered for every process step regardless of

whether a step has a specific hazard. Although this decision tree is a great resource

for risk assessment, its disadvantage is that it does not necessarily meet HARPC

guidelines, since the first question it asks is whether the hazard is significant, and if

not, then it is a PRP. HARPC states that a PRP can be used to control a significant

hazard. This is where the PRP summary is useful because it captures the

requirements of HARPC for PRPs that control a significant hazard. Regardless of

this disadvantage, this decision tree is very useful for science-based risk

assessments.

A


http://www.foodsafetymagazine.com/fsm/assets/Image/1215116HACCPFigure1.jpg


Look at the Hazard Assessment

Just as important in utilizing a thorough decision tree is conducting a thorough

hazard assessment and risk analysis for the HACCP plan. It is the assessment of

hazards combined with the decision tree that will lead to a strong, thorough

HACCP plan. Interestingly, there have been many recommendations around the

way to quantify these hazards, but how is an illness such as listeriosis quantified

when the immune response varies among the population? Similarly, what about

those Salmonella infections that lead to chronic arthritic complications? How are

these measured within a matrix? Even the assessment of likelihood can be hard to

quantify. If Salmonella is likely to occur only once a year within one lot of

ingredients, does this matter? What if this one occasion leads to an outbreak? What

can be recommended in lieu of the quantifiable matrix is to review with a

designation of low, medium or high. This makes the hazard assessment broad

enough to equalize illness with a potential fatality but also give a level of

assessment to the hazard to indicate the necessary control measures. Of course, it is

not just as simple as low, medium or high. While this measure is not as clear-cut as

a numbering scale, it is still important to consider industry and academic studies,

government guidance documents, plant or corporate validation studies, etc. These

documents will help guide the hazard assessment and also help implement control

measures for those hazards. Table 4 shows what this assessment will look like for

biological and chemical hazards. Low (L), medium (M) or high (H) will be used for

a separate risk assessment for the likelihood and severity.

Using this supporting documentation is also important for physical hazard

identification, but the physical hazard assessment will be a quantified measure as

discussed below.




Even though it may be difficult to use a quantified matrix for biological or

chemical hazards, it can be very useful for physical hazards. As shown in Table 5,

the severity and likelihood of physical hazards are easy to plot within a matrix and

can be easily understood provided there is a solid definition for each rating given to

the physical hazard in question. Severity can be broken down into three categories:

minor, medium or major. The minor category should include such items as hair or

cardboard that are unlikely to cause injury. This is followed by the medium

category, which includes harder items such as wood or soft plastics. Finally, the

major category should include items such as metal and glass that have the potential

to cause severe injury and harm if ingested.




For the size rating, there is the handy FDA Compliance Policy Guide on physical

hazards that discusses at what size a foreign material poses a hazard to human

health. Other sources may be case studies or complaints to determine the size

rating. Likelihood can be easy to capture by use of historical data gathered at the

plant level. How often has a physical hazard been associated with an incoming

ingredient? How often has a physical hazard been found due to ongoing

maintenance on machinery? What about wear on machinery? These are all

questions that can lead to a quantifiable answer provided the records are in place to

help answer the questions. For the length of time on likelihood, 2 years is used as

the lowest frequency since 2 years is the time frame required by FSMA to keep

records. This may change, depending upon the company or plant’s record-retention

policy. Once the severity, size and likelihood have been determined, they are

multiplied to get one numerical value. This number will then indicate whether the

hazard is a quality risk (no concern on a food safety level), safety risk, critical risk

or significant critical risk. Quality risks will be managed with PRPs, safety risks

will be managed with oPRPs, critical risks are managed with CCPs and significant

critical risks should be managed with multiple CCPs or a combination of CCPs and

oPRPs. This risk assessment will then be documented in the Hazard Analysis for

physical hazards as shown in Table6.


http://www.foodsafetymagazine.com/categories/regulatory-category/fsma/

http://www.foodsafetymagazine.com/fsm/assets/Image/1215116HACCPFTable6(1).jpg


Severity Rating Guidance:

• Minor: Straw, vine, paper, cardboard, hair, congealed material (soft)

• Medium: Wood, soft plastic or rubber, insects, congealed material (hard)

• Major: Metal, rock, glass, hard plastic, bones

Size Rating Guidance:

• Not a safety hazard: Objects greater than 4.5 cm (1.75 inches)

• Minor hazard: Particles less than 7 mm (0.3 inch)

• Major hazard: Objects between 7 mm and 20 mm (0.3 to 0.8 inch)

• Choke hazard: Objects between 2 and 4.5 cm (0.8 to 1.75 inches)

Likelihood/Probability of Occurrence of Threat:

• Remote: Chance of occurrence is less than once every 2 years

• Possible: Occurs at least once every year but less than once in 2 years

• Potential: Occurs at least once a month but less than 6 months

• Likely: Occurs at least twice a month or more often

Risk Level:

Severity Rating × Size Rating × Likelihood/Probability

Bridging the Gaps

Integrating the HARPC regulations with HACCP can seem daunting because it is

easy to overthink the necessary changes that need to be made. HARPC is basically

an expansion of HACCP. If companies have done their due diligence with their

HACCP plans, then there may not be a lot of change with the implementation of

HARPC regulations. After all, even though CCP appears within the HACCP

acronym, it does not mean that HACCP accounts only for the CCPs. When done

correctly, HACCP actually covers all other control points within the system and

does not necessarily have to be restrictive to the CCPs provided there are strong

documentation and thorough risk assessments, using PRPs in combination with

oPRPs and CCPs, the HACCP plan will function as a plant wide HARPC Food

Safety Plan. Another bonus is that using the tables within this article will provide



good documentation and records for the food safety program. This will be

important for food safety plan reassessments as well as for third-party audits or

federal inspections. Furthermore, for those products that fall under both U.S.

Department of Agriculture and FDA regulations, companies probably will not need

two separate plans. One holistic HACCP plan should be able to provide all the

aspects of an HARPC Food Safety Plan.
