A Formula for Food Safety: HARPC = CCP + PRP + OPRP [Podcast]

By ETQ on December 14, 2023

NOTE: This blog has been updated since its original publishing

For those working in food quality and safety, FSMA is a critical regulation that demands compliance.  But, the terminology and impact of the regulatory framework can be confusing. The podcast and blog content below should provide food and bev quality and safety professionals with the insight they need to make FSMA compliance as easy as adding fries with a burger! 

HARPC and its Relationship with FSMA

The Food Safety and Modernization Act (FSMA) into law. And with it, a host of changes occurred in how the food industry operates regarding ensuring its products are safe for consumers. One of those includes HARPC, a new regulatory system that is part of the new rules the FSMA put in place. HARPC stands for Hazard Analysis and Risk-based Preventative Controls. 

What is HARPC?

While many in the food industry were already familiar with Hazard Analysis and Critical Control Points (HACCP), the previous widely accepted standard in the industry,  HARPC represents the move towards much more comprehensive regulation on the part of the FDA. Because of HARPC’s significantly more extensive requirements, there continue to be many questions surrounding the program’s implementation. 

What Are the New FMSA Requirements?

So how must a company’s food safety management program change to meet the new Food Safety Modernization Act (FSMA) requirements? Through FSMA, the FDA has stated that preventative measures––called Prerequisite Program (PRPs)––are now considered of equal importance as those intended to control potential outbreaks, otherwise known as Critical Control Points (CCPs). FSMA clumps them all together and calls both of these practices preventive controls. PRPs can further break down to include Operational Prerequisite Programs (OPRPs), a category introduced through ISO 22000.

There are notable distinctions between CCPs and PRPs. Operational prerequisite programs are a kind of PRP that, while still controlling a significant hazard, cannot be monitored and controlled the same way a CCP can. Today, most safety incidents result from poor PRP management instead of CCP failures. Listen to our podcast here for a more in-depth explanation of FSMA, cGMP, and preventive controls for human food rules.

Your current Hazard Analysis and Critical Control Points (HACCP) programs are only a starting point toward fulfilling FSMA requirements. However, it isn’t necessary to reinvent the wheel here––your PRP HACCPs are still relevant and are valuable as a foundational tool in building a HARPC plan. You can continue using your HACCP and CCPs, but you must add more structure around risk-based preventive controls programs by further defining the PRPs and OPRPs. That can be a similar analysis tool to what you’re already using for your HACCP programs. 

Below are some quick explanations of the differences among these three program types and their related control measures. Remember, HACCP and HARPC are risk assessments but differ regarding addressing significant hazards.

Control Measure Categories

Below, we briefly explain the differences between these three food safety programs and their related control measures. We’ve also provided examples of each kind to clarify what each program looks like in practice

Navigating the complexities of food safety quality management can be challenging. Get in touch with our food safety experts for support tailored to your organization’s needs.

What is CCP?: Critical Control Points

The traditional definition of a CCP is “a point, step or procedure at which controls can be applied and a food safety hazard (biological, chemical, physical or radiological) can be prevented, eliminated or reduced to acceptable levels.” CCPs integrate into the process flow and processing parameters within a facility. They’re considered absolute controls and are always tied to a specific hazard and step in the process. That’s the only one requiring a critical limit designation.


  • Cooking/pasteurization
  • Cooling
  • Moisture activity
  • pH level

What is PRP?: Prerequisite Programs

Food safety practices and programs are in place to address the production environment’s role in safe food production. They’re a set of general control measures that may or may not be measurable. Therefore, monitoring and documenting them are often not at the same level as CCPs. They aren’t specific to one step in the process and do not control a specific hazard as CCPs do. They ensure that the environment is maintained hygienically to reduce food safety risks. You’ll need to document the management process for these programs.


  • Allergen control
  • GMPs (Good Manufacturing Practices)
  • Pest control
  • Sanitation

ORP: Operational Prerequisite Programs

An OPRP is a prerequisite program responsible for controlling a significant hazard. It’s a control measure that’s crucial but isn’t considered. The main reason is that a CCP is not an absolute control and can be managed upstream from the CCP. OPRPs are identified through risk assessments. Treat them just like a CCP (to identify, monitor, verification, corrective actions, record keeping, and the like), but defining a critical limit isn’t necessary. You’ll need to determine what can be measured and then determine how. OPRPs may not target a specific hazard source but reduce the likelihood of hazard exposure or other contamination sources.


  • Glass/metal control (not designated as CCP)
  • Hand washing and sanitizing
  • Sanitation effectiveness (pathogen or allergen)
  • Temperature control

Examples of newer ORP monitoring methods include:

  • Adenosine Triphosphate (ATP): bioluminescence cleanliness monitoring
  • Monitoring systems: For handwashing and sanitizing 
  • Pest e-monitoring: A device installed on top of a bait station that sends a signal instantly to a facility device that alerts when pest activity is occurring
  • Remote video monitoring: Could improve food safety, production efficiency, and the product’s quality 
  • Smart ID badges: Bathroom and or hand wash monitoring, hand sanitizing monitoring by location or interval, and zone movement monitoring

Using Risk Assessment Tools During Quality Control

If you’ve previously used a comprehensive HACCP program to identify your processing and environmental PRPs and their various control measures, then it should only be a matter of documenting your PRP and OPRP control measures. Once you do that, all you have to do is ensure that any monitoring, verification, corrective actions, and recordkeeping are being completed in the same manner as with your CCPs. 

Risk assessment tools––including decision trees and risk matrices––support your efforts toward finding solutions for managing hazards by one or more preventive control processes. Then, you can add these to your existing food safety programs to eliminate gaps between your current HACCP and new HARPC plans. 

And if you need help organizing your plan, ETQ offers food safety and quality management software to assist in meeting FMSA and HARPC guidelines. Our EQMS software integrates all aspects of maintaining a solid food safety plan, from keeping track of supplier quality to monitoring equipment and employee safety in one place. Additionally, our existing HAACP module simplifies creating a complementary HARPC program, helping you eliminate gaps and maintain compliance with FSMA as the FDA begins resuming its inspection program.


What are the new FMSA Requirements?

The new FSMA requirements state that preventative measures, called Prerequisite Programs (PRPs), are now considered as important as Critical Control Points (CCPs) for controlling potential outbreaks. These preventive controls include PRPs and Operational Prerequisite Programs (OPRPs), introduced through ISO 22000.

What is HARPC?

HARPC stands for Hazard Analysis and Risk-based Preventative Controls. It represents a move towards more comprehensive regulation by the FDA, significantly expanding the requirements compared to the previous standard, HACCP (Hazard Analysis and Critical Control Points).

What is CCP?

CCP stands for Critical Control Points. It is defined as a point, step, or procedure at which controls can be applied, and a food safety hazard (biological, chemical, physical, or radiological) can be prevented, eliminated, or reduced to acceptable levels.

What is PRP?

PRP, which stands for Prerequisite Programs, are food safety practices and programs put in place to address the production environment’s role in safe food production. PRPs are a set of general control measures that may or may not be measurable, and therefore, monitoring and documenting them often isn’t at the same level as for CCPs (Critical Control Points).

What is an operational prerequisite program (OPRP)?

An OPRP is a type of PRP responsible for controlling a significant hazard but isn’t monitored and controlled in the same stringent manner as a CCP. It includes measures that are crucial but do not target a specific hazard source directly. Instead, they reduce the likelihood of hazard exposure or other contamination sources.

What is the difference between CCPs and PRPs?

CCPs are specific control points in the process that are tied to a specific hazard and step, requiring a critical limit designation. PRPs, on the other hand, are general control measures that may not be measurable and do not control a specific hazard as CCPs do. They ensure that the environment is maintained hygienically to reduce food safety risks.

What does food safety include?

Food safety includes all the conditions and practices that ensure the food we eat is safe to consume. It extends from the beginning of the production process, like on-farm production, to its storage and eventual consumption and is regulated by domestic and international standards. 

What is a food safety policy?

A food safety policy is a set of rules for producing food that ensures food isn’t contaminated and is safe for consumers to purchase and consume. The government sets food safety policies that all companies are legally required to comply with, but organizations can also set internal policies. 

What is a recognized food safety management system? 

A recognized food safety management system is used across various companies and acts as a standard for the industry, both at domestic and international levels. HAACP or ISO 22000 are both examples of food safety management systems

Food & Beverage

Customer Story

ETQ Reliance helps promote food safety, higher crop yield and improved compliance for vertical farming venture