Hazard Analysis and Risk-Based Preventive Controls (HARPC): The New GMP for Food Manufacturing
The Food Safety Modernization Act (FSMA), described by the U.S. Food and Drug Administration (FDA) as the most sweeping reform of our food safety laws in more than 70 years, was signed into law by President Barack Obama on January 4, 2011. It aims to ensure the U.S. food supply is safe by shifting the focus from responding to contamination to preventing it. The law allows FDA to regulate through enforcement the prevention of food safety problems before rather than after they occur. The requirements of the law could be summarized as an “active managerial control rule” because it requires, for the first time, documentation that active managerial control of all food safety hazards that can reasonably occur in a food manufacturing plant has occurred. So even though the current FDA inspections (pre-FSMA enforcement) of a food plant theoretically do the same at the time of the inspection (auditing the current manufacturing process that day), the new rules allow inspectors to use the documentation of control to retrospectively audit all the food production in a facility before the audit date as well.
FSMA implementation will be the largest change in the food industry that has ever been implemented and enforced by FDA. FSMA implementation processes and compliance tools will also be the largest investment many companies will make over the next 5 years. Each food corporation will be required to implement these rules in each of its food manufacturing facilities for any ingredient and/or product made for human (and animal) consumption. Food distributors will also fall under FSMA, owing to new transportation and traceability of food source requirements. The rules require a supplier approval and verification program as well for each buyer along the supply chain up to but not including retail/foodservice and sales establishments.
The Food Safety Plan
The foundation for the implementation of FSMA will be the establishment of a food safety plan and its direct application in each food manufacturing facility under ownership of the food company. Each food company that manufactures food will be required to develop and maintain a written food safety plan that has defined all of its food safety hazards and modes of prevention. FDA has a legislative mandate to require comprehensive, science-based preventive controls of food safety hazards across the food supply, and each facility will therefore be required to demonstrate to FDA inspectors the past and present operations of each element of the food safety plan (Figure 1). The food safety plan must be developed by a food safety professional (either staff or contracted). In some cases, environmental monitoring and product testing must be part of the food safety plan. Most importantly, FDA will have the authority to approve or disapprove a food safety plan based on its accuracy and who developed the plan.
The food safety plan will probably require six major components to demonstrate a program to actively manage the food safety hazards in all food manufacturing facilities (see “FSMA Food Safety Plan Requirements”).
At the core of the food safety plan is a new process that requires identification and prevention of all reasonably foreseeable food safety hazards—whether naturally occuring or unintentionally introduced into the facility—not just those identified by Hazard Analysis and Critical Control Points (HACCP) methods. This new process is called Hazard Analysis and Risk-Based Preventive Controls (HARPC). While the food safety plan must describe the current knowledge base that the food company uses to prevent food safety issues in each of its manufactured foods, HARPC is the process and plan the food company uses in each of its facilities to implement its food safety plan.
The validation of preventive controls of each HARPC plan in each facility must be done by a qualified individual before the food safety plan is implemented or whenever there is a need to reanalyze it. It must include collecting and evaluating scientific and technical information to support each HARPC plan. The monitoring of the plan must be verified, as must decisions about proper corrective actions. All verification and validation activities must be documented.
What Is HARPC?
Simply stated, it is the system used to control the different hazards found in different facilities that manufacture food. Each food manufacturing facility owned and operated by a food company must have its own HARPC plan if there are any differences in the foods it manufactures between facilities. The food company must include each validated HARPC plan for each of its facilities in its food safety plan.
How does the “HA” in HARPC differ from the “HA” in HACCP?
The use of HACCP by all segments of the food supply chain has become the recognized system used to minimize the chance of a known potential hazard becoming a food safety problem. It is a globally recognized standard, having been adopted by the Codex Alimentarius Commission in its document entitled CODEX General Principles for Food Hygiene (CAC/RCP1-1969, rev.4-2003). Codex recommends HACCP as an approach to enhance food safety. While HACCP is a recognized global standard, HARPC is a U.S. standard (Table 1).
The seven principles of HACCP are well known, used often by the food industry and include the following:
1. Conduct a Hazard Analysis
2. Identify CCPs
3. Establish critical limits
4. Establish monitoring actions
5. Establish corrective actions
6. Establish verification procedures
7. Establish a record-keeping system
The hazards for HACCP have been clearly documented in Seafood HACCP and Juice HACCP. Microbiological hazards have been defined in the Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers standards of FDA. The facilities that are required to comply with Juice and Seafood HACCP are exempt from HARPC. The exemption for HARPC for Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers applies only to the microbiological hazards (Part 113, Chapter 21, Code of Federal Regulations).
With HARPC, if there are unknown preventive controls for an identified hazard, research must be conducted regarding the preventive controls and their effectiveness validated at each facility for all applicable products and processes. For example, a food manufacturing facility may perform a challenge study of a modified atmosphere packaging process for a processed food product that is using new mixtures of gas partial pressures with unknown impact on the growth of anaerobic spore formers such as Clostridium botulinum. The use of a recognized methodology for conducting a challenge study in this case would be very important. Such guidance can be found in a document prepared by the National Advisory Committee on Microbiological Criteria for Foods entitled Parameters for Determining Inoculated Pack/Challenge Study Parameters, adopted March 20, 2009.
How often does each food facility have to submit or update its HARPC plan and results?
FDA will require that each facility update its HARPC plan every 3 years or whenever there is a significant change at that facility that may increase a potential hazard or introduce a new one, for example, when the facility adds a new allergen as an ingredient that will be used on the same production line as another product that required no previous allergen preventive controls. Additionally, FDA may require an update based on new hazards related to biological, chemical, radiological or terrorist threats that are discovered after an HARPC process has been developed and approved by FDA. There is no statutory requirement to submit a HARPC plan to FDA at any particular time, except when FDA asks a food company to provide a copy of its HARPC plan and any and all records necessary to demonstrate that it has properly implemented it at each facility.
What if a food facility does not use the HARPC process or its use is inadequate?
FDA can take a number enforcement steps. First, FDA can criminally charge a company or person for owning, operating or acting as an agent in charge of a facility not in compliance with HARPC. Second, FDA can issue a public warning letter and/or (for foreign firms) an Import Alert. If food from a noncompliant facility presents a significant food safety risk, FDA could suspend the facility’s food facility registration and thereby prevent the facility from distributing product until FDA has approved a corrective action plan to the HARPC process. In the case of a foreign firm, FDA would likely place the facility on an Import Alert (similar to Import Alert 16-120). A firm listed on this Import Alert would find its food automatically detained at importation, effectively barring it from the U.S. market unless FDA reviews and accepts an adequate food safety plan that uses an effective HARPC process.
Are any food facilities exempt from performing HARPC?
Six major categories of food facilities are exempt from using HARPC. The first major exemption relates to food companies under the exclusive jurisdiction of the U.S. Department of Agriculture (those handling, processing or shipping meat, poultry, pork, eggs, etc.). The second major exemption is for companies subject to FDA’s new Standards for Produce Safety authorities, which were also created by FSMA. This exemption applies to farms, cooperatives, growers, harvesters and other companies handling raw fresh fruits and vegetables. The third major exemption applies to facilities that are subject to and comply with FDA’s Seafood and Juice HACCP regulations. The fourth, more limited, exemption involves low-acid and acidified canned food processors, but only as the regulatory controls govern and control certain aspects of microbiological contamination (e.g., botulism). The fifth group of exempt companies includes those defined as “small” or “very small” businesses. FDA is required to define these terms by regulation. Sixth and last is the group of companies with a previous 3-year average product value of less than $500,000. FDA may also, by future regulations, exempt facilities that solely produce food for animals, store raw agricultural commodities (other than fruits and vegetables) intended for further processing or that store packaged foods that are not exposed to the environment.
Risk-Based Preventive Controls
For each hazard identified in the Hazard Analysis of HARPC as reasonably likely to occur, each food facility must identify and show its own implementation of these preventive controls, including at CCPs, if any, to show FDA inspectors that all hazards identified in the Hazard Analysis will be significantly minimized or prevented. All preventive controls should establish:
• Parameters associated with the control of the hazard, such as parameters associated with heat processing, acidifying, irradiating and refrigerating foods.
• The maximum or minimum value, or combination of values, to which any biological, chemical, physical, radiological, natural toxin, pesticide, drug residue, decomposition, parasite, allergen and unapproved food and color additive must be controlled to significantly minimize or prevent a hazard that is reasonably likely to occur.
• Process controls that must include those procedures, practices and processes performed on a food during manufacturing/processing that are employed to significantly minimize or prevent hazards that are reasonably likely to occur.
• Food allergen controls that must include those procedures, practices and processes employed to ensure protection of food from cross-contact, including during ingredient storage and use.
• Labeling of the finished food, including ensuring that the finished food is not misbranded under section 403(w) of the Federal Food, Drug, and Cosmetic Act.
• Sanitation controls, where necessary, to significantly minimize or prevent hazards that are reasonably likely to occur. These include any environmental pathogen that is reasonably likely to occur in a ready-to-eat food that is exposed to the environment prior to packaging, any microorganism of public health significance that is reasonably likely to occur in a ready-to-eat food due to employee handling and any food allergen hazard. Sanitation controls must include procedures for the cleanliness of food contact surfaces, including food contact surfaces of utensils and equipment, and the prevention of cross-contamination from unsanitary objects, personnel, food packaging material and other food contact surfaces as well as from raw product use in the facility.