A Formula for Food Safety: HARPC = CCP + PRP + OPRP [Podcast]

By ETQ on February 14, 2022

To note this blog was updated.

For those working in the quality management end of the food industry, the past few years have meant adapting to significant changes on the regulatory end. With the passing of the FSMA in 2011, a new system was implemented for managing the quality of safety of food products––a system that came not only with a lot of new acronyms to keep track of but also requires a reassessment of safety plans to comply with these new regulations. But have no fear––below, we provide straightforward explanations of what all those updated terms mean and what they mean for your organization going forward.

Listen to my podcast for  information on the FSMA cGMP and preventive controls for human food rule:

HARPC and its Relationship with FSMA

In 2011, President Obama signed the Food Safety and Modernization Act (FSMA) into law. And with it, a host of changes occurred in how the food industry operates regarding ensuring its products are safe for consumers. One of those includes HARPC (Hazard Analysis and Risk-based Preventative Controls), a new regulatory system that is part of the new rules the FSMA put in place. 

What is a HARPC Plan?

While many in the food industry were already familiar with Hazard Analysis and Critical Control Points (HACCP), the previous widely accepted standard in the industry,  HARPC represents the move towards much more comprehensive regulation on the part of the FDA. Because of HARPC’s significantly more extensive requirements, there continue to be many questions surrounding the program’s implementation. 

What Are the New FMSA Requirements?

So how must a company’s food safety management program change to meet the new Food Safety Modernization Act (FSMA) requirements? Through FSMA, the FDA has stated that preventative measures––called Prerequisite Program (PRPs)––are now considered of equal importance as those intended to control potential outbreaks, otherwise known as Critical Control Points (CCPs). FSMA clumps them all together and calls both of these practices preventive controls. PRPs can further break down to include Operational Prerequisite Programs (OPRPs), a category introduced through ISO 22000.

There are notable distinctions between CCPs and PRPs. OPRPs are a kind of PRP that, while still controlling a significant hazard, cannot be monitored and controlled the same way a CCP can. Today, most safety incidents result from poor PRP management instead of CCP failures. Listen to our podcast here for a more in-depth explanation of FSMA, cGMP, and preventive controls for human food rules.

Your current Hazard Analysis and Critical Control Points (HACCP) programs are only a starting point toward fulfilling FSMA requirements. However, it isn’t necessary to reinvent the wheel here––your HACCPs are still relevant and are valuable as a foundational tool in building a HARPC plan. You can continue using your HACCP and CCPs, but you must add more structure around risk-based preventive controls programs by further defining the PRPs and OPRPs. That can be a similar analysis tool to what you’re already using for your HACCP programs. 

Below are some quick explanations of the differences among these three program types and their related control measures. Remember, HACCP and HARPC are risk assessments but differ regarding addressing significant hazards.

Control Measure Categories

Below, we briefly explain the differences between these three food safety programs and their related control measures. We’ve also provided examples of each kind to clarify what each program looks like in practice.

CCP: Critical Control Points

The traditional definition of a CCP is “a point, step or procedure at which controls can be applied and a food safety hazard (biological, chemical, physical or radiological) can be prevented, eliminated or reduced to acceptable levels.” CCPs integrate into the process flow and processing parameters within a facility. They’re considered absolute controls and are always tied to a specific hazard and step in the process. That’s the only one requiring a critical limit designation.


  • Cooking/pasteurization
  • Cooling
  • Moisture activity
  • pH level

PRP: Prerequisite Programs

Food safety practices and programs are in place to address the production environment’s role in safe food production. They’re a set of general control measures that may or may not be measurable. Therefore, monitoring and documenting them are often not at the same level as CCPs. They aren’t specific to one step in the process and do not control a specific hazard as CCPs do. They ensure that the environment is maintained hygienically to reduce food safety risks. You’ll need to document the management process for these programs.


  • Allergen control
  • GMPs (Good Manufacturing Practices)
  • Pest control
  • Sanitation

ORP: Operational Prerequisite Programs

An OPRP is a prerequisite program responsible for controlling a significant hazard. It’s a control measure that’s crucial but isn’t considered. The main reason is that a CCP is not an absolute control and can be managed upstream from the CCP. OPRPs are identified through risk assessments. Treat them just like a CCP (to identify, monitor, verification, corrective actions, record keeping, and the like), but defining a critical limit isn’t necessary. You’ll need to determine what can be measured and then determine how. OPRPs may not target a specific hazard source but reduce the likelihood of hazard exposure or other contamination sources.


  • Glass/metal control (not designated as CCP)
  • Hand washing and sanitizing
  • Sanitation effectiveness (pathogen or allergen)
  • Temperature control

Examples of newer ORP monitoring methods include:

  • Adenosine Triphosphate (ATP): bioluminescence cleanliness monitoring
  • Monitoring systems: For handwashing and sanitizing 
  • Pest e-monitoring: A device installed on top of a bait station that sends a signal instantly to a facility device that alerts when pest activity is occurring
  • Remote video monitoring: Could improve food safety, production efficiency, and the product’s quality 
  • Smart ID badges: Bathroom and or hand wash monitoring, hand sanitizing monitoring by location or interval, and zone movement monitoring

Using Risk Assessment Tools During Quality Control

If you’ve previously used a comprehensive HACCP program to identify your processing and environmental PRPs and their various control measures, then it should only be a matter of documenting your PRP and OPRP control measures. Once you do that, all you have to do is ensure that any monitoring, verification, corrective actions, and recordkeeping are being completed in the same manner as with your CCPs. 

Risk assessment tools––including decision trees and risk matrices––support your efforts toward finding solutions for managing hazards by one or more preventive control processes. Then, you can add these to your existing food safety programs to eliminate gaps between your current HACCP and new HARPC plans. 

And if you need help organizing your plan, ETQ offers food safety and quality management software to assist in meeting FMSA and HARPC guidelines. Our software integrates all aspects of maintaining a solid food safety plan, from keeping track of supplier quality to monitoring equipment and employee safety in one place. Additionally, our existing HAACP module simplifies creating a complementary HARPC program, helping you eliminate gaps and maintain compliance with FSMA as the FDA begins resuming its inspection program.


What does food safety include?

Food safety includes all the conditions and practices that ensure the food we eat is safe to consume. It extends from the beginning of the production process, like on-farm production, to its storage and eventual consumption and is regulated by domestic and international standards. 

What is a food safety policy?

A food safety policy is a set of rules for producing food that ensures food isn’t contaminated and is safe for consumers to purchase and consume. The government sets food safety policies that all companies are legally required to comply with, but organizations can also set internal policies. 

What is QMS software?

A QMS software is a business management system that houses the documentation of all the various processes, procedures, and responsibilities required to maintain the quality of a product in one place. It ensures that companies effectively manage costs, maintain compliance, audit processes, and keep track of various workflows.

What is a recognized food safety management system? 

A recognized food safety management system is used across various companies and acts as a standard for the industry, both at domestic and international levels. HAACP or ISO 22000 are both examples of food safety management systems

Food & Beverage

Customer Story

ETQ Reliance helps promote food safety, higher crop yield and improved compliance for vertical farming venture