1.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 1 | P a g e
How Food Companies Can Modify Their Existing
HACCP Plans into an All-Encompassing Food
Safety Plan
Edited by: Eng. Akram Malkawi, University of Petra, Senior Food Safety & Quality
Management consultant and Lead Assessor.
Since the U.S. Food and Drug Administration (FDA) made the decision to declare
prerequisite programs (PRPs) at the same level of concern as Critical Control
Points (CCPs), collectively referring to all of them as preventive controls, the
nuances of the Hazard Analysis and Critical Control Points (HACCP) system are
being modified. The HACCP plan will now be referred to as the Hazard Analysis
Risk-Based Preventive Controls (HARPC) Food Safety Plan, as it is known in the
published rule. FDA’s idea behind this shift is that PRPs have caused a majority of
outbreaks and recalls. Due to this realization, FDA would like PRPs that control a
significant hazard to have documentation similar to a CCP’s. This has led to some
confusion about what constitutes an HACCP plan versus an HARPC plan and has
resulted in recommendations and suggestions to completely revamp the HACCP
plan even to the extent of removing CCPs altogether. Some PRPs may need
additional verification and, where appropriate, validation; however, it may not be a
good idea to remove the CCPs from the system altogether. Removing a CCP might
reduce the science and the justification and thereby reduce the effectiveness of a
food safety system. Instead of removing the CCPs, it might prove more beneficial
to strengthen the risk assessment and associated PRPs while also taking the time to
fully understand what makes an HACCP plan function as an effective HARPC
plan.

2.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 2 | P a g e
HACCP vs. HARPC
HARPC is similar to HACCP in that it points out a need for control when there is a
significant hazard. Both HARPC and HACCP are risk assessments, but they differ,
slightly, in how significant hazards are addressed. Classic HACCP employs a CCP
whenever there is a significant hazard; however, HARPC recognizes that there
might be a program, such as hand-washing, that is used as a control for a significant
hazard but may not have parameters like a traditional CCP. Because some of these
programs do not have parameters, HARPC requests additional documentation for
them, which a CCP also requires, such as monitoring, corrective action and
verification. Under HARPC, a preventive control is a control measure that prevents
or minimizes a significant hazard. Since a CCP meets the definition of what is a
preventive control under HARPC, a company may continue using CCPs within
their plan.
It’s all in the name, or is it? In light of the Food Safety Modernization Act, a
number of companies have renamed their HACCP plan an HARPC plan or Food
Safety Plan or have combined names such as “HACCP and Food Safety Plan.”
HACCP does include PRPs as well as control points and CCPs throughout the
system. A company may like to continue using the title of HACCP, and it should
be able to do so since, for example, employees may relate better to HACCP
because this is what they have been trained on for the past couple of decades. For
the majority of companies that already have a good, thorough HACCP plan in
place, modifying that plan to an HARPC Food Safety Plan should not be difficult.
Minor changes to the plan should make it compliant with the FDA’s Preventive
Controls rule.
What about Prerequisite Programs?

3.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 3 | P a g e
While HACCP should discuss PRPs within the control measures column, it may
not highlight the importance of their monitoring, verification, corrective action and
record-keeping. A PRP summary is relatively easy to add to an HACCP plan and
goes beyond what is actually required within HARPC since it captures all PRPs
that control a hazard whether the hazard is significant or not. One can create a
table, as shown in Table 1, indicating the PRP, the process steps with which it is
associated, the hazards it helps control and whether the hazard is significant. The
rest of the table acts as a list of record-keeping activities, which companies should
typically already have in place. Under monitoring, it will be important to call out
what is being monitored, who is doing the monitoring, the frequency of the
monitoring and how the program is to be monitored. Corrective action should also
be noted and can be specific to the action. Preventive action may also be good to
account for, but these actions should be discussed within a corrective action report
rather than within the HACCP plan. Records that are kept for the prerequisite
documentation should be listed so it is easy to link documents to the program being
monitored and verified. Note that the prerequisite summary does not have a column
for critical limits as you would have with a CCP summary. This is because PRPs
generally do not involve processing parameters. Another difference resides with
whether to include validation for PRPs. While some PRPs will have a validation
step, such as a sanitation program or allergen control, many PRPs, such as hand-
washing or supplier verification, may not include validation as part of the program.
Validation, however, is always included for CCPs as well as operational PRPs
(oPRPs).

4.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 4 | P a g e
While oPRPs are handled in the same manner as a CCP, they are geared toward
operational processes where a CCP may not be designated.
A good example of an oPRP is the thermal process within a canning facility.
Because the Low-Acid Canned Food regulation is an HACCP-based concept and
the thermal process for retorting is regulated, it may or may not be considered a
CCP. While the thermal process may not warrant a CCP since it is already a
regulatory requirement, it is still a good practice to define it within the HACCP
plan as an oPRP. The same documentation standards that apply for a CCP can
apply for an oPRP. Just like a CCP, the oPRP will be given a number, as shown in
the first column in Table 2. In the second column, the process step will be defined
followed by the hazard it controls and the control limits for the processing measure.
With three choices for the process step designation, the Codex Alimentarius
decision tree may not be the best option. One of the concerns with the Codex
decision tree is that for every question it asks, the answer is generally “yes,”
leading to every process step becoming a CCP (Table 3). Using scientific
justifications, the decision tree shown in Figure.1 was developed by Michigan State
University and Coca-Cola.

5.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 5 | P a g e
This decision tree will help distinguish between a PRP, an oPRP and a CCP. For
instance, in some cases, a subsequent step in the process will control the hazard,
indicating that not every step will have an oPRP or CCP; however, every step will
have a PRP that makes sense since Good Manufacturing Practices and sanitation
among other prerequisites should be considered for every process step regardless of
whether a step has a specific hazard. Although this decision tree is a great resource
for risk assessment, its disadvantage is that it does not necessarily meet HARPC
guidelines, since the first question it asks is whether the hazard is significant, and if
not, then it is a PRP. HARPC states that a PRP can be used to control a significant
hazard. This is where the PRP summary is useful because it captures the
requirements of HARPC for PRPs that control a significant hazard. Regardless of
this disadvantage, this decision tree is very useful for science-based risk
assessments.
A

6.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 6 | P a g e
Look at the Hazard Assessment
Just as important in utilizing a thorough decision tree is conducting a thorough
hazard assessment and risk analysis for the HACCP plan. It is the assessment of
hazards combined with the decision tree that will lead to a strong, thorough
HACCP plan. Interestingly, there have been many recommendations around the
way to quantify these hazards, but how is an illness such as listeriosis quantified
when the immune response varies among the population? Similarly, what about
those Salmonella infections that lead to chronic arthritic complications? How are
these measured within a matrix? Even the assessment of likelihood can be hard to
quantify. If Salmonella is likely to occur only once a year within one lot of
ingredients, does this matter? What if this one occasion leads to an outbreak? What
can be recommended in lieu of the quantifiable matrix is to review with a
designation of low, medium or high. This makes the hazard assessment broad
enough to equalize illness with a potential fatality but also give a level of
assessment to the hazard to indicate the necessary control measures. Of course, it is
not just as simple as low, medium or high. While this measure is not as clear-cut as
a numbering scale, it is still important to consider industry and academic studies,
government guidance documents, plant or corporate validation studies, etc. These
documents will help guide the hazard assessment and also help implement control
measures for those hazards. Table 4 shows what this assessment will look like for
biological and chemical hazards. Low (L), medium (M) or high (H) will be used for
a separate risk assessment for the likelihood and severity.
Using this supporting documentation is also important for physical hazard
identification, but the physical hazard assessment will be a quantified measure as
discussed below.

7.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 7 | P a g e
Even though it may be difficult to use a quantified matrix for biological or
chemical hazards, it can be very useful for physical hazards. As shown in Table 5,
the severity and likelihood of physical hazards are easy to plot within a matrix and
can be easily understood provided there is a solid definition for each rating given to
the physical hazard in question. Severity can be broken down into three categories:
minor, medium or major. The minor category should include such items as hair or
cardboard that are unlikely to cause injury. This is followed by the medium
category, which includes harder items such as wood or soft plastics. Finally, the
major category should include items such as metal and glass that have the potential
to cause severe injury and harm if ingested.

8.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 8 | P a g e
For the size rating, there is the handy FDA Compliance Policy Guide on physical
hazards that discusses at what size a foreign material poses a hazard to human
health. Other sources may be case studies or complaints to determine the size
rating. Likelihood can be easy to capture by use of historical data gathered at the
plant level. How often has a physical hazard been associated with an incoming
ingredient? How often has a physical hazard been found due to ongoing
maintenance on machinery? What about wear on machinery? These are all
questions that can lead to a quantifiable answer provided the records are in place to
help answer the questions. For the length of time on likelihood, 2 years is used as
the lowest frequency since 2 years is the time frame required by FSMA to keep
records. This may change, depending upon the company or plant’s record-retention
policy. Once the severity, size and likelihood have been determined, they are
multiplied to get one numerical value. This number will then indicate whether the
hazard is a quality risk (no concern on a food safety level), safety risk, critical risk
or significant critical risk. Quality risks will be managed with PRPs, safety risks
will be managed with oPRPs, critical risks are managed with CCPs and significant
critical risks should be managed with multiple CCPs or a combination of CCPs and
oPRPs. This risk assessment will then be documented in the Hazard Analysis for
physical hazards as shown in Table6.

9.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 9 | P a g e
Severity Rating Guidance:
• Minor: Straw, vine, paper, cardboard, hair, congealed material (soft)
• Medium: Wood, soft plastic or rubber, insects, congealed material (hard)
• Major: Metal, rock, glass, hard plastic, bones
Size Rating Guidance:
• Not a safety hazard: Objects greater than 4.5 cm (1.75 inches)
• Minor hazard: Particles less than 7 mm (0.3 inch)
• Major hazard: Objects between 7 mm and 20 mm (0.3 to 0.8 inch)
• Choke hazard: Objects between 2 and 4.5 cm (0.8 to 1.75 inches)
Likelihood/Probability of Occurrence of Threat:
• Remote: Chance of occurrence is less than once every 2 years
• Possible: Occurs at least once every year but less than once in 2 years
• Potential: Occurs at least once a month but less than 6 months
• Likely: Occurs at least twice a month or more often
Risk Level:
Severity Rating × Size Rating × Likelihood/Probability
Bridging the Gaps
Integrating the HARPC regulations with HACCP can seem daunting because it is
easy to overthink the necessary changes that need to be made. HARPC is basically
an expansion of HACCP. If companies have done their due diligence with their
HACCP plans, then there may not be a lot of change with the implementation of
HARPC regulations. After all, even though CCP appears within the HACCP
acronym, it does not mean that HACCP accounts only for the CCPs. When done
correctly, HACCP actually covers all other control points within the system and
does not necessarily have to be restrictive to the CCPs provided there are strong
documentation and thorough risk assessments, using PRPs in combination with
oPRPs and CCPs, the HACCP plan will function as a plant wide HARPC Food
Safety Plan. Another bonus is that using the tables within this article will provide

10.
Eng. Akram Malkawi, Amman-Jordan, Email eng.karam@outlook.com Tel. (+962) 795705076 10 | P a g e
good documentation and records for the food safety program. This will be
important for food safety plan reassessments as well as for third-party audits or
federal inspections. Furthermore, for those products that fall under both U.S.
Department of Agriculture and FDA regulations, companies probably will not need
two separate plans. One holistic HACCP plan should be able to provide all the
aspects of an HARPC Food Safety Plan.