ISO Compliance Insights & Best Practices

HACCP vs HARPC: 8 Essential FSMA Differences Explained (2026)

HACCP vs HARPC is the comparison every US food facility has to settle before it writes a food safety plan, because the two are not interchangeable and the regulator does not treat them as such. HACCP — Hazard Analysis and Critical Control Points — is the Codex method: seven principles applied through twelve steps, controlling significant hazards at critical control points with measurable critical limits. HARPC — Hazard Analysis and Risk-Based Preventive Controls — is what the Food Safety Modernization Act wrote into 21 CFR Part 117 Subpart C for FDA-registered facilities: a hazard analysis that must be written whatever its outcome, preventive controls that go beyond CCPs to allergen, sanitation and supply-chain controls, a recall plan, and a Preventive Controls Qualified Individual who owns the plan. This guide sets the two side by side on eight points, explains which facilities are under HARPC and which remain under HACCP by regulation, shows how a Codex HACCP plan is converted into a Part 117 food safety plan, and lists the gaps an FDA investigator finds when a facility assumes its HACCP plan is enough.

HACCP vs HARPC: the same hazard analysis, a wider set of controls — Codex HACCP: 7 principles, 12 steps, CCPs with critical limits. FSMA HARPC (21 CFR 117 Subpart C): written hazard analysis regardless of outcome, process + allergen + sanitation + supply-chain controls, recall plan, PCQI, reanalysis every 3 years.

HACCP vs HARPC: the eight differences

	HACCP (Codex CXC 1-1969, HACCP annex)	HARPC (FSMA, 21 CFR 117 Subpart C)
Legal basis	An international method; mandatory where a regulation adopts it — USDA meat and poultry (9 CFR 417), FDA seafood (21 CFR 123) and juice (21 CFR 120), EU Regulation 852/2004	US federal rule for facilities required to register with FDA under section 415 of the FD&C Act, unless exempt
Hazard analysis	Principle 1: identify hazards and control measures; documented as part of the plan	§ 117.130: identify and evaluate known or reasonably foreseeable hazards; ‘must be written regardless of its outcome’; must consider biological, chemical (including radiological) and physical hazards, and hazards introduced intentionally for economic gain
Unit of control	The critical control point, with a critical limit that separates acceptable from unacceptable	The preventive control — ‘controls at CCPs, if there are any CCPs’, plus controls other than at CCPs
Types of control	CCPs; prerequisite programmes sit underneath the plan	§ 117.135(c): process controls, food allergen controls, sanitation controls, supply-chain controls, a recall plan, and other controls as appropriate
Management components	Monitoring, corrective actions, verification, records (principles 4–7)	§ 117.140: monitoring, corrective actions and corrections, verification — ‘as appropriate to the nature of the preventive control’
Validation	Step 8 (validated critical limits) and step 11 in the 2020 Codex revision	§ 117.160: by or overseen by a PCQI, before implementation or within 90 days of first production; not required for allergen, sanitation, recall and supply-chain controls
Who owns the plan	The HACCP team; regulation may require a trained individual (9 CFR 417.7)	One or more preventive controls qualified individuals — § 117.126(a)(2), § 117.180
Reanalysis	Review at least annually or on significant change (Codex; 9 CFR 417.4 annual reassessment)	§ 117.170: the whole plan at least once every 3 years, and on significant change, new hazard information, an unanticipated problem or an ineffective control

The through-line of HACCP vs HARPC is that HARPC keeps the HACCP hazard analysis and widens the set of controls it feeds. A facility whose only hazards are controlled at cooking and metal-detection CCPs will find its Part 117 plan looks like its HACCP plan plus a recall plan and a supply-chain programme. A facility with allergen changeovers, environmental Listeria risk in a ready-to-eat area and ingredients whose hazards are controlled by the supplier will find HARPC asks for three kinds of control HACCP never named. Our guide to the seven HACCP principles covers the method both start from.

HACCP vs HARPC by facility: who is under which

Facility	Regime	Basis
FDA-registered manufacturer, processor, packer or holder of human food	HARPC — 21 CFR 117 Subparts C and G	§ 117.126 food safety plan requirement
Meat, poultry and egg products under USDA FSIS inspection	HACCP — 9 CFR 417	FSIS’s own HACCP regulation; § 117.5(d) exempts activities subject to the meat and poultry acts
Seafood processors	HACCP — 21 CFR 123	§ 117.5(b): Subparts C and G do not apply to activities subject to Part 123 if in compliance with it
Juice processors	HACCP — 21 CFR 120, including the 5-log pathogen reduction	§ 117.5(c): same exemption for Part 120 activities
Qualified facility (very small business under $1,000,000 in annual human-food sales, adjusted for inflation, or majority direct-to-qualified-end-user sales under $500,000)	Modified requirements — § 117.201 attestation	§ 117.5(a); Subparts C and G do not apply
Low-acid canned foods (Part 113), dietary supplements (Part 111) and the other activities § 117.5 exempts	The specific rule for what it covers; Subpart C only where § 117.5 leaves hazards uncovered	§ 117.5(d) onward — read the paragraph that names your product
Retail food establishments, restaurants, farms	Not required to register — outside Subpart C; state and local codes apply, often HACCP-based	§ 117.5 and the registration rule

HACCP vs HARPC in the plan: converting one into the other

Rewrite the hazard analysis to § 117.130. Keep the Codex worksheet; add the columns Part 117 expects — severity and probability for each hazard, economically motivated adulteration considered, and the written conclusion for every hazard including those that need no preventive control (§ 117.136 records the basis where a control is not established because a downstream customer controls the hazard).
Reclassify the controls. Each CCP becomes a process control. Then ask what controls allergen cross-contact and labelling (allergen controls), what controls environmental pathogens in ready-to-eat areas (sanitation controls), and which ingredient hazards are controlled by suppliers (supply-chain programme under Subpart G).
Write the recall plan. § 117.139: notification of direct consignees, public notification where appropriate, effectiveness checks, and disposition of recalled product — with names against each step.
Attach management components proportionately. Monitoring, corrective action and verification procedures for each control “as appropriate to the nature of the preventive control” — a sanitation control is verified differently from a cook step.
Validate the process controls under a PCQI. Scientific or technical basis that the control works, before implementation or within 90 days of first production. Our guide to HACCP validation vs verification covers what counts.
Name the PCQI and schedule the reanalysis. The plan is prepared or overseen by a PCQI; the whole plan is reanalysed at least every three years and on trigger.

Where HACCP-only plans fail an FDA inspection

No written conclusion for hazards judged not significant. Codex lets a team stop at “not significant”; § 117.130 requires the written analysis regardless of outcome.
Allergen and sanitation controls left as prerequisites. If they control a hazard requiring a preventive control, they need monitoring, corrective action, verification and records, not a PRP checklist.
Supplier hazards assumed. A certificate of analysis is not a supply-chain programme; Subpart G requires approved suppliers and verification activities.
No recall plan, or one without effectiveness checks.
No PCQI. A HACCP-trained team leader is not automatically a PCQI; the FDA-recognized curriculum or equivalent experience is the test.

Our guide to prerequisite programmes covers where PRPs stop and controls begin under ISO 22000, which draws the same line.

Frequently asked questions

What is the difference in HACCP vs HARPC?
HACCP is the Codex method of controlling significant hazards at critical control points with critical limits. HARPC is FSMA’s rule in 21 CFR 117 Subpart C: the same hazard analysis, written regardless of outcome, feeding a wider set of preventive controls — process, allergen, sanitation and supply-chain — plus a recall plan, a PCQI and reanalysis every three years.

Does a HACCP plan satisfy FSMA?
Only if the facility is under a HACCP regulation FSMA defers to — meat and poultry (9 CFR 417), seafood (21 CFR 123) or juice (21 CFR 120). Other FDA-registered facilities need a Part 117 food safety plan; a HACCP plan is the starting point, not the finish.

Is HARPC harder than HACCP?
Wider rather than harder. The hazard analysis is the same discipline; HARPC adds controls HACCP treated as prerequisites, a recall plan and a qualified individual, and it requires written conclusions even where no control is needed.

Who can be the PCQI?
Someone who has completed training equivalent to the FDA-recognized standardized curriculum, or is qualified through job experience to develop and apply a food safety system — 21 CFR 117.3. The PCQI need not be an employee.

How often is a HARPC plan reviewed?
The whole plan at least once every three years under § 117.170, and sooner on a significant change, new hazard information, an unanticipated problem or an ineffective control. USDA HACCP plans are reassessed at least annually.

Where this leaves you

Settle HACCP vs HARPC by regulation first — meat, poultry, seafood and juice stay with their HACCP rules; every other FDA-registered facility needs a Part 117 food safety plan. Then convert rather than start over: keep the hazard analysis, write it regardless of outcome, reclassify the controls into the four Part 117 kinds, add the recall plan and the PCQI, and put the three-year reanalysis in the calendar.

References

21 CFR Part 117 — Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food (eCFR) — Subpart C: §§ 117.126–117.190; exemptions in § 117.5; definitions in § 117.3.
9 CFR Part 417 — Hazard Analysis and Critical Control Point (HACCP) Systems (eCFR) — The FSIS HACCP regulation for meat, poultry and egg products.
Codex Alimentarius — General Principles of Food Hygiene, CXC 1-1969 (rev. 2020) — The HACCP principles and the twelve-step application.

More on HACCP

HACCP vs HARPC — you are here
The seven HACCP principles
The HACCP plan in 12 Codex steps
HACCP hazard analysis: the worksheet
HACCP validation vs verification
Critical limits: setting and validating them

The Hazard Analysis Worksheets, the CCP monitoring and verification plans, the Corrective Action Records, the Product Recall & Withdrawal Procedure and the Guideline for Allergen Control that carry a HACCP plan into a Part 117 food safety plan are in the HACCP Toolkit, or start with the free templates.

Governance Docs

Governance Docs LLC