HACCP vs. HARPC: The Role of Temperature, Hazard, and Risk in Food Processing

by Adam Fleder, President, TEGAM, Inc.

(For more info, please visit: http://www.tegam.com)

What’s the Difference?

The most pressing questions for food processing facilities managers are: Which standard applies to my facility? Is it only the USDA regulations based on the Hazard Analysis and Critical Control Point (HACCP) standard? Or is my facility now regulated by the FDA under the just implemented rules of the Food Safety Modernization Act (FSMA)? That act requires a different written food safety plan than HACCP according to the Hazard Analysis and Risk-based Preventive Controls (HARPC) in FSMA. Or might my facility now be dual-regulated under both sets of regulations?

In fact, multiple food industry commentators have noted that there is some confusion about which regulatory requirements apply to food processors. On the surface, the answer appears clear cut. The USDA regulates meat, poultry, and egg processors based on HACCP. Those regulations are administered by the Food Safety Inspection Service (FSIS) within the USDA. Note that HACCP is not a legislative mandate, but rather, a global industry standard adopted as a regulation by both the USDA and the FDA1.

In response to a rise in cases of foodborne pathogens, the FDA promulgated FSMA. Congress passed the act, establishing a legislative mandate that implements a new approach to food safety. The difference between the two, in part, lies in the distinction between the definitions of “hazard” and “risk”.

According to the Toxicology Education Foundation, “A hazard is anything that can cause harm, whereas risk is the potential that a hazard will cause harm. You can think of it this way: A hazard will not pose any risk to you unless you are exposed to enough of that hazard to cause harm. Risks associated with hazards can be zero, or greatly reduced by reducing exposure. The relationship between risk and hazard can be simplified as2:

RISK = HAZARD x EXPOSURE

For food processors, one hazard is the potential for pathogens growing in processed food products. The risk is the probability of a consumer becoming ill after eating a food product containing a colony of harmful pathogens. The risks for a food processor are two-fold.

The foremost concern is (or should be) the potential health risk to consumers due to foodborne illness. Second, the supplier of the product identified as the cause of the

illness faces significant business risks. These include negative press due to a food recall, legal expenses to litigate or settle lawsuits, production line downtime, inventory lost or destroyed, and lost sales to name a few.

1 Food Quality & Safety Magazine, The Evolution of HACCP, by John G. Surak, Feb. 1, 2009. Online at: http://www.foodqualityandsafety.com/article/the-evolution-of-haccp/?singlepage=1 2 Toxicology Education Foundation, May 28, 2015 at: http://toxedfoundation.org/hazard-vs-risk/

The third part of the hazard-risk equation is reducing the exposure. Biochemists have proven that the nine most common foodborne pathogens will not grow below certain minimum temperatures. Food processors who incorporate these well-known temperature controls during processing steps will reduce or eliminate the hazard and thereby the risk to both consumers and the business.

The Regulatory Shift

The FSMA marks a dramatic change in the intent and emphasis of U.S. food regulations that had been in effect for the past 70 years. Under the prior regulations, the FDA reacted to any foodborne outbreak after the fact. FSMA shifts the regulatory focus to a proactive stance aimed at preventing food contamination from “farm-to-fork.” Although the legislation was signed into law in 2011, it has taken the FDA over five years to formulate and finalize the regulations and begin implementation. The Preventive Controls for Human Food deadline is August 30, 2016. Effective dates for the Final Rules vary per the following chart:3

Implementation periods for small and very small businesses extend implementation by one year and two years, respectively.

The change to a proactive stance is reflected in the differences that come after the “HA”, meaning Hazard Analysis, in both acronyms. The principles of HACCP originated in the NASA space program to assure that the food consumed by humans in outer space would be safe. NASA mandated the use of Critical Control Points (CCPs) in its design engineering process, but applying the same concepts to food production was new. This approach required food suppliers to identify “critical failure areas” and eliminate them from the system.4 This set the stage for the development of HACCP as an eventual voluntary global industry standard. In contrast, FSMA legislation passed by Congress and signed into law in January 2011 mandates Hazard Analysis and Risk- based Preventive Controls (HARPC) as the food processing industry’s regulatory standard. For both HACCP and HARPC, compliance begins by identifying and analyzing hazards.

HACCP vs. HARPC -- The Devil is in the Details

In 1989, the National Advisory Committee on Microbiological Criteria for Foods (NACMCF) published the first official HACCP document, standardizing the practice and

3 The Association of Food, Beverage and Consumer Products Companies at: http://www.gmaonline.org/file- manager/FSMA%20Compliance%20Dates(5).pdf 4 TraceGains Insights Blog, HACCP and HARPC: Key Differences and Definitions, by Chelsey Davis, 8/20/15 at: https://www.tracegains.com/blog/haccp-and-harpc-key-differences-and-definitions

presenting the seven principles of HACCP. A brief summary of the HACCP principles appears in the appendices, as does the core of HARPC, the food safety plan mandated by FSMA. Links to both government regulatory sites are listed in Appendix A.

At first glance, HARPC requirements may look quite similar to HACCP. According to the FDA Federal Regulations for implementing FSMA, the core of HARPC starts with a Food Safety Plan. Even though HACCP and HARPC appear to have similarities, let’s summarize the important differences.

HARPC shifts the regulatory emphasis from reactive to a protective and preventive mode. In the past under HACCP, regulators did not spring into action until outbreaks of foodborne illness occurred.

HARPC is mandated by U.S. law, while HACCP is a global non-mandatory standard adopted as a rule by both the USDA, administered by FSIS, and the FDA.

HARPC applies mandatory science-based preventive controls across the food supply chain. Food processors must also establish science-centered Risk-Based Preventive Controls. This extends beyond Critical Control Points defined by HACCP. Section §117.135 of the FSMA regulations specifically mentions Process Controls, Food Allergen Controls, Sanitation Controls, Supply-Chain Controls, a Recall Plan, and Other Controls.5 This differs from HACCP because HARPC enforces preventive controls to identify potential risks or threats to the food supply. It also requires food processors to implement appropriate corrective actions proactively.

HARPC does not require the science of critical limits as does HACCP (Principle 3). According to Cornell University, a critical limit is defined as “a maximum and/or minimum value to which a biological, chemical or physical parameter must be controlled at a CCP to prevent, eliminate or reduce to an acceptable level the occurrence of a food-safety hazard.”6 For the hazard of foodborne pathogens, the risk-based preventive controls in HARPC will still equate to critical limits. You might ask, “Why?” Under FSMA, the FDA has a legislative mandate to require comprehensive, science-based preventive controls across the food supply.7 Therefore, the same science-based critical limits of maximum and minimum temperatures during processing steps in HACCP still apply under HARPC.

Perhaps the most significant difference: HARPC extends risk-based preventive controls beyond in-plant processes to a food processor’s entire supply chain.

5 Ibid. 6 Cornell University, p. 73, available online: http://seafoodhaccp.cornell.edu/Intro/blue_pdf/Chap07Blue.pdf 7 FDA, “Background on the FDA Food Safety Modernization Act (FSMA), available online: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm239907.htm

This last point raises a secondary question: Does your facility sell commercial products that are used as ingredients in your customers’ products? If so, then your facility is also regulated by the FDA under FSMA because the act specifically covers compliance by upstream supply chain vendors, including foreign suppliers. Examples of FSMA regulated products include raw products used as ingredients in pizza toppings, soups, and ready- to-eat packaged foods.

The Hazards of Pathogens and Risk-Based Preventive Temperature Controls

HARPC hazards analysis requires food processors to implement preventive controls to “provide assurances that any hazards requiring preventive control will be significantly minimized or prevented...” The occurrence of foodborne illnesses drove the FDA’s development of FSMA. As evidence of this concern, “process controls” is the first item listed under the preventive controls section (§117.135) and is defined as follows:

“Process controls include procedures, practices, and processes to ensure the control of parameters during operations such as heat processing, acidifying, irradiating, and refrigerating foods. Process controls must include, as appropriate to the nature of the applicable control and its role in the facility's food safety system:

(i) Parameters associated with the control of the hazard; and

(ii) The maximum or minimum value, or combination of values, to which any biological, chemical, or physical parameter must be controlled to significantly minimize or prevent a hazard requiring a process control.”8

The minimum growth temperatures for the most common foodborne pathogens has been well-established in scientific studies as shown in Table 1 below9:

TABLE 1

8 Cornell University, Ibid. 9 Chart from “Ranking the Risks: The 10 Pathogen-Food Combinations With The Greatest Burden on Public Health,” by Batz, Hoffmann, and Morris, available online: https://folio.iupui.edu/bitstream/handle/10244/1022/72267report.pdf

Going one step further, the following chart ranks the disease burden caused by the most common foodborne pathogens. The rankings are based on the illness’s impact on quality of life plus the costs of the illness.

TABLE 2

Temperature Measurement in Food Processing

The relationship between food processing, temperature, and the hazard of pathogens is well documented. Quality control personnel can meet the risk-based preventive control for this hazard by measuring temperatures at critical in-plant control points. However, if proper care is not taken, even the measurement equipment and process can introduce hazards.

Although not specifically required in FSMA regulations, FSMA rules are sprinkled with references to maintaining electronic records. Written records are included as an option as well. Unfortunately, paper and pencil temperature data collection introduces an additional source of potential pathogen contamination. For example, dropping the pencil or clipboard during measurement could introduce contamination to the food being processed. In addition, time-consuming data acquisition and recording on fast moving processing lines introduces the potential for data entry errors.

Unfortunately, poorly designed automated temperature solutions may also cause problems. Many typical thermometer case designs may be awkward to handle and can accumulate grease, dirt, or other residues. FSMA regulations require clean equipment.

One of the best alternatives to pen-and-pencil data management is an automated temperature measurement solution purpose-built for use in food processing. In-plant process temperature measurement acquisition requires accuracy, speed, and cleanliness. Such an automated solution complies with the most demanding design requirements, including a rugged design that withstands drops, shock, vibration, and frequent wash- downs. As a result, it operates reliably over long periods in harsh environments. Operationally, it is also very helpful to quality control personnel if it displays statistical data in real-time.

An automated data capture and storage solution eliminates error-prone paper-and-pencil recording of data. In the ideal situation, the operator simply inserts the probe, while the data logging thermometer automatically captures and records the time-stamped measurements. To facilitate data analysis and reporting, the thermometer then transmits results to either a local cloud server or vendor-neutral cloud storage via built-in wireless connectivity such as Bluetooth.

Although FSMA rules make multiple references to maintaining electronic records, they are not currently mandated. Written records are still included as an option. That said, FSMA requires that facilities be able to access HARPC records within 24 hours, which can be a problem for paper-based systems. Electronic data storage, with appropriate data set identification, can greatly accelerate record access and reporting.

Conclusion: HACCP, HARPC, or Both?

We began by posing the question: “Which standard governs my facility, HACCP or HARPC?” The simple answer: Meat, poultry, and egg processors still operate in the USDA/FSIS regulatory environment under HACCP. However, HARPC also includes a

regulated food processor’s supply chain. On the surface it may appear that your facility is only regulated under HACCP rules. However, it’s important to ask yourself if your facility supplies products that are used as ingredients in your customers’ products. If so, your facility may be dual-regulated and subject to both HACCP and HARPC requirements.

In either regulatory environment, temperature measurement of the foods being processed is crucial to preventing the growth of foodborne pathogens. One of the best solutions is an easy-to-handle, ruggedly designed automated temperature measurement solution. This eliminates the potential for recording and transcription errors of pen-and-pencil methods. Designed with built-in wireless connectivity to a vendor- neutral cloud environment, this solution creates a data repository readily accessed within minutes, well within the 24 hours required by FSMA. In conclusion, if there’s any question, meet both requirements. Although it may seem cumbersome, a written HACCP plan takes you a long way to meeting HARPC requirements. Take the few extra steps.

Appendix A – Additional Reading I. The Seven HACCP Principles

Principle 1: Conduct a hazard analysis. ● Plants determine the food safety hazards and identify the preventive measures

the plant can apply to control these hazards.

Principle 2: Identify critical control points. ● A critical control point (CCP) is a point, step, or procedure in a food process at

which control can be applied and, as a result, a food safety hazard can be prevented, eliminated, or reduced to an acceptable level. A food safety hazard is any biological, chemical, or physical property that may cause a food to be unsafe for human consumption.

Principle 3: Establish critical limits for each critical control point. ● A critical limit is the maximum or minimum value to which a physical, biological,

or chemical hazard must be controlled at a critical control point to prevent, eliminate, or reduce the hazard to an acceptable level.

Principle 4: Establish critical control point monitoring requirements. ● Monitoring activities are necessary to ensure that the process is under control at

each critical control point. FSIS requires that each monitoring procedure and its frequency be listed in the HACCP plan.

Principle 5: Establish corrective actions. ● These are actions to be taken when monitoring indicates a deviation from an

established critical limit. The final rule requires a plant's HACCP plan to identify the corrective actions to be taken if a critical limit is not met. Corrective actions are intended to ensure that no product injurious to health or otherwise adulterated as a result of the deviation enters commerce.

Principle 6: Establish record keeping procedures. ● The HACCP regulation requires that all plants maintain certain documents,

including its hazard analysis and written HACCP plan, and records documenting the monitoring of critical control points, critical limits, verification activities, and the handling of processing deviations.

Principle 7: Establish procedures for verifying the HACCP system is working as intended.

● Validation ensures that the plans do what they were designed to do; that is, they are successful in ensuring the production of safe product. Plants will be required to validate their own HACCP plans. FSIS will not approve HACCP plans in advance, but will review them for conformance with the final rule.

● Verification ensures the HACCP plan is adequate, that is, working as intended. Verification procedures may include such activities as review of HACCP plans, CCP records, critical limits and microbial sampling and analysis. FSIS is requiring that the HACCP plan include verification tasks to be performed by plant personnel. Verification tasks would also be performed by FSIS inspectors. Both FSIS and industry will undertake microbial testing as one of several verification activities.11

II. HARPC Requirements for the food safety plan (§117.126)

(a) Requirement for a food safety plan. (1) You must prepare, or have prepared, and implement a written food safety plan.

(2) The food safety plan must be prepared, or its preparation overseen, by one or more preventive controls qualified individuals.

(b) Contents of a food safety plan. The written food safety plan must include: (1) The written hazard analysis as required by §117.130(a)(2); (2) The written preventive controls as required by §117.135(b); (3) The written supply-chain program as required by subpart G of this part; (4) The written recall plan as required by §117.139(a); and

(5) The written procedures for monitoring the implementation of the preventive controls as required by §117.145(a)(1);

(6) The written corrective action procedures as required by §117.150(a)(1); and (7) The written verification procedures as required by §117.165(b).

(c) Records. The food safety plan required by this section is a record that is subject to the requirements of subpart F of this part.12

III. U.S. Regulatory Sites

FSMA: Final CGMP & Hazard Analysis, and Risk-Based Preventive Controls (HARPC) for Human Food http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334115.htm

USDA/FSIS Pathogen Reduction & HACCP Guidance Documents

11 “Key Facts: The Seven HACCP Principles,” by the Food Safety and Inspection Service, USDA, Rev. January 1998 at:

http://www.fsis.usda.gov/Oa/background/keyhaccp.htm

12 Electronic Code of Federal Regulations, “Title 21, Chapter I, Subchapter B, Part 117, Subpart C -- Hazard Analysis and Risk-Based Preventive Controls,” by the U.S. Government Publishing Office at: http://www.ecfr.gov/cgi-bin/text- idx?SID=e8a441b5672985b0fc94280d70b55bb5&mc=true&node=pt21.2.117&rgn=div5#se21.2.117_1126

http://www.fsis.usda.gov/wps/portal/fsis/topics/regulatory- compliance/haccp/pr-and-haccp-guidance-documents/pathogen-reduction- haccp-guidance