The difference between HACCP and HARPC. A case of the Emperor’s New Clothes?

What does a child’s tale by Hans Christian Andersen have to do with a piece of American legislation issued regarding food safety? In my efforts over recent weeks to get to grips with the new FSMA Rules, I believe quite a lot. But before I get into all that, I would like to talk more generally about FSMA and what I perceive to be its impacts.

FSMA – Changing the Rules of the Game

Recent issuing of a number of final rules under FSMA has now placed these specific compliance requirements for food businesses firmly in the spotlight. As with any new or changed piece of legislation or food safety standard, at Safefood 360° we undertake a review of the requirements to see how they impact on our software platform and the needs of our customers. Normally this is a straight forward process for our team. Given food safety and its management is core to everything we do, identifying and making any necessary changes to the software is a matter of routine. Not so however, for FSMA.

FSMA is an interesting animal to observe. Unlike other pieces of food safety legislation e.g. EU Food Regulations, reading the requirements of FSMA rules is nothing short of a new vocation for those brave enough to undertake it. It certainly isn’t light bedtime reading. It is legal in its language, circular in nature and more effective at making your head spin than a NASA human centrifuge. You need to be made of the right stuff!

However, FSMA is interesting for none of the above reasons. It is compelling for one reason alone. It’s actually a good piece of legislation. Once you cut through the layers of legal jargon surrounding the requirements contained therein, what we find is something very clear, very prescriptive and which leaves little to the imagination. And as strange as it may sound, this is actually a very good thing.

Most food safety legislation globally tends to be general, stating what needs to be done rather than how it should be done. On the face of it this might appear as a smart approach however it can leave the door wide open to interpretation by companies, auditors and regulators.

Stating what needs to be done rather than how it should be done leaves the door wide open to interpretation

Sometimes it can be a welcome relief to be simply told in clear terms what needs to be done, do it, and then get on with the job of running your food business. And FSMA does this very well. It tells you (in the most unapologetic of tones) what you need to do and how you need to do it.

Compliance Framework Turned on Its Head

But it has also done something very interesting which has gone unmentioned by various food safety commentators. It has turned the compliance framework on its head! In a previous blog, I set out the burden of compliance demands on food businesses. At the bottom of the burden ladder was always legislation. Traditionally it was the minimum requirement to be met by businesses. Next were the requirements of the global standards like BRC, SQF and FSSC22000. Finally came the requirements set out in various food retailer technical standards which tend to be very prescriptive and demanding.

Retailer Technical Standards used to set the highest bar for compliance requirements. With FSMA this setup has been turned upside down.

Whether by design or not, FSMA has changed this. If you read through the rules for FSVP and Preventive Controls for Human Food you will quickly realise that these now represent the highest standard of food safety control surpassing the requirements of the GFSI schemes. For example, under the FSVP requirements, you now need to risk assess, evaluate and develop monitoring controls not for each supplier but for each product supplied by each supplier. There are other examples but the point is that the framework has now been inverted with legislation setting the bar. This leaves the global schemes with an interesting situation to ponder given their unique selling point has always been that certification under their offer represented a higher standard. This may no longer be the case.

Unravelling the Mystery of HARPC  

The new rules, as expected, have also introduced the requirement for Hazard Analysis Risk Based Preventive Controls or what has been called generally called HARPC. This requirement is a risk based model for the identification of significant hazards and the establishment of preventive controls. It is quite an extensive requirement and consistent with any standard for food safety management. On face value it would appear to be HACCP at least in its basic principles, but what exactly is HARPC?

Having read various blogs and other resources on the subject I must admit I continued to struggle to really understand its true nature and relationship with HACCP. Almost embarrassed by my apparent inability to understand this new risk model, I quietly nodded my head and pretended I got it.  Frustrated, I decided to get to the bottom of this conundrum by going to the horse’s mouth – the FSMA Rule itself.

Most commentators say that HARPC is similar to HACCP and for the most part this is true. HARPC like HACCP requires control when there is a significant hazard. Both are risk assessment models. Both allow for the use of CCP’s. Both appear to allow for the use of other Preventive Controls like PRP’s, and oPRP’s. HARPC requires more documentation for non-CCP controls such as monitoring, corrective action and verification. But so do GFSI standards. On the face of it, there would appear to be no difference between the two risk based models. This would suggest that simply renaming our existing HACCP plans is all that is required. This would be the ideal for most food businesses and if true would beg the question, why did the FDA simply not call it HACCP and avoid all this confusion. But confusion there is and food businesses are craving some clear guidance from both the FDA and authority voices in the area.

Food businesses are craving some clear guidance from the FDA and authority voices in this area

For the most part, discussions and guidance on the difference between the two models is of little value. Often they explain the history of both models as a difference. This is interesting but hardly a substantive difference. Other contributions explain that the scope of hazards to be included in HARPC are more extensive and include threats, allergens and recall to name a few. However, in practice the Food Safety Plans called for under GFSI do the same albeit as supports to the HACCP plan. In practice HARPC plans will do the same since inclusions of these directly in the HARPC plan is of little additional value. It is simply moving the chairs around the room. In short, the various sources that set out to explain the differences between the two standards effectively confirm their sameness.

Getting “FSMA ready”

Then we come to the subject of “Getting ready for FSMA / HARPC” and are you “FSMA ready?”. Again we search endlessly through the various forums, blogs and other resources to gain insight into what these terms actually mean and again we are left somewhat vacuous in our understanding. I have read one blog from a commentator who posed the question “What do you need to do to become FSMA compliant?” I waited with abated breath… the answer was “The first thing you need to do is understand what you are being asked to do…”. Still, we are no closer to the truth!

Is it possible that no one really and truly understands what the difference is and even then that there may be no difference. For those of us who have worked for many years with our clients helping them to develop and maintain risk based food safety systems is it not important that when we claim that two things are different that we can at some level explain what those differences are? And if we don’t should we not simply state this?

The fact that more recently we are being told to no longer refer to it as HARPC but rather as PCP (Preventative Controls Program) is I believe a reflection by its promoters that any differences are small at best and an attempt to avoid the perception that they are introducing a brand new risk assessment and management model for food safety. I think this is a positive step if we are to avoid the trap of a logical fallacy.

Rebranding HARPC as PCP is an attempt by promoters to avoid the perception they are introducing a brand new risk assessment and management model for food safety

So is there a Difference between HACCP and HARPC?

It is my belief, analyzing the requirements for both HARPC and HACCP that they are essentially the same. If we take both as food safety plans they follow the exact same approach, logic and structure. The language is slightly different but the models are the same, with one exception – Hazard Evaluation!

It would be easy to miss it, and most of us would appear to have done just that. It is only a few words in the requirements but on close analysis is a major difference between the two models. Here is the requirement from Preventative Controls for Human Food.

Hazard Evaluation is easy to miss but close analysis shows a major difference between the two models

c1 – (i) Hazard evaluation: The hazard analysis must include an evaluation of the hazards identified in paragraph (b) of this section to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls.

Under HACCP any person conducting a study is required to conduct a hazard analysis followed by a risk assessment of the hazards to determine their significance. When doing this, they are required to list out the preventive measures already existing at the step and the implication is that the risk is determined with these preventive controls in mind. This by definition will result in a lower risk (assuming preventive controls are in place which is usually the case).

Table comparing the difference in risk assessment models. The key difference between HARPC and HACCP is that in HARPC the risk assessment is done assuming there is an absence of preventive controls.

However, if we look now at c1-(i) we see that FSMA takes a fundamentally different approach. It requires the person conducting the study to do the same exercise in the absence of preventive controls. This means that all other things being equal the risk for the same hazards will be higher and significantly higher in most cases. The result is that any person seeking to convert their existing HACCP plans over to HARPC will find that the whole risk assessment will be radically different. A major and very significant issue for what is a risk management system.

All other things being equal the risk for the same hazards will be significantly higher in most cases under HARPC.

So where does that leave us? Under HARPC we may well end up with many more significant hazards which require a preventive control which takes no account of basic mitigation measures such as sanitation and requires full planning, verification, validation and review. Basic mitigation controls have now been promoted to the same status of a CCP or oPRP. This in itself is not an issue but it does have a major impact on companies existing HACCP plans. It may be argued that they will need to be re-written from scratch.

The new food safety plan requires you to monitor, verify, document and review your preventive controls similarly as you do with CCPs.

In summary, HACCP requires risk assessment with controls in place while HARPC requires risk assessment with no controls in place. The output is a higher risk rating for HARPC than HACCP but essentially the same in terms of controls. You reach the same destination but by different routes. What is interesting is that both appear to take one of the elements of the Risk Mitigation Model but not both. In the risk mitigation model the risk assessor first estimates the risk in the absence of controls (HARPC) and then applies controls where required. Then a subsequent risk assessment is conducted to determine the risk mitigation or reduction achieved – which is essentially a measure of the effectiveness of the controls (HACCP). HARPC does not directly call for a risk assessment to be conducted in order to establish the risk reduction effect. It is not even implied which is the only justifiable reason for conducting a risk assessment in the absence of preventive controls. Finally, it may be argued that doing a risk assessment based on zero controls is not practical, particularly valuable and contrary to how food businesses work in practice.

It is quite possible that this is simply an oversight by the authors and the spirit of the legislation is what will prevail. Time will tell us if this is the case.

The Emperor’s New Clothes

The introduction of any new standard or legislation is disruptive. It is normal to expect a period of confusion followed by debate, interpretation, clarification and eventually understanding. FSMA is no different. However what is concerning is the almost illogical explanation of concepts like HARPC versus other risk models and what appears to be a fundamental oversight in regard to hazard evaluation. This does not take anything away from what I believe to be an excellent piece of legislation in food safety management. However, we need to guard against becoming like the Emperor’s subjects who from fear of being seen as unfit, stupid, or incompetent ignore the fact that he parades naked before them. Let’s protect FSMA and its significant value and put some clothes on it.