Regulatory Framework
The FDA's Food Safety Modernization Act replaced reactive food safety with a preventive-control framework. Affinity QMS gives food manufacturers every tool needed to document, maintain, and demonstrate a compliant Food Safety Plan under HARPC.
Overview
The Food Safety Modernization Act (FSMA), signed into law in 2011, fundamentally shifted the FDA's approach to food safety from reactive inspection to proactive prevention. The centerpiece of FSMA for food manufacturers is the Hazard Analysis and Risk-Based Preventive Controls (HARPC) rule, codified at 21 CFR Part 117 Subpart C.
HARPC replaced the older Hazard Analysis and Critical Control Points (HACCP) framework for most FDA-regulated food facilities. While HACCP was voluntary for most food companies and mandatory only for seafood, juice, and meat (under USDA), HARPC is mandatory for all registered food facilities unless a specific exemption applies. Exemptions include very small businesses (average annual sales below $1 million), facilities subject to USDA HACCP regulations, and certain farm operations.
Under HARPC, every covered facility must employ or engage a Preventive Controls Qualified Individual (PCQI) — a person who has successfully completed FDA-recognized training or who has equivalent job experience — to prepare, validate, and review the facility's Food Safety Plan. This requirement alone drives significant compliance infrastructure needs for food manufacturers of all sizes.
FDA inspectors assess HARPC compliance through records review and on-site observation. Facilities can expect a routine FDA inspection every three to five years depending on risk profile, though FDA has been significantly ramping inspection frequency since the rule's full implementation. Failures to comply can result in warning letters, import alerts, mandatory recalls, and facility registration suspension.
The Five Elements
HARPC requires every covered facility to prepare and implement a written Food Safety Plan containing five distinct elements. Each must be documented, monitored, and reviewed by the PCQI at least every three years or when significant changes occur.
ELEMENT 01
A written analysis identifying known or reasonably foreseeable biological, chemical (including radiological), and physical hazards for each type of food manufactured, processed, packed, or held. The analysis must evaluate the severity of illness or injury and probability of occurrence to determine whether the hazard requires a preventive control.
ELEMENT 02
Risk-based, reasonably appropriate procedures, practices, and processes to control hazards requiring a preventive control. Types include process controls (CCPs), food allergen controls, sanitation controls, and supply-chain controls. Each must be identified, implemented, and managed to ensure the hazard will be significantly minimized or prevented.
ELEMENT 03
Written procedures for monitoring preventive controls with sufficient frequency to provide assurance that each is consistently performed or consistently achieved. Monitoring records must be reviewed by a qualified individual within seven days (or within a timeframe specified by the PCQI) and retained for at least two years.
ELEMENT 04
Written corrective action procedures describing steps taken when preventive controls are not properly implemented. Must address how affected food will be evaluated for safety, how the facility will restore control, and how recurrence will be prevented. All corrective actions must be documented and the disposition of affected food recorded.
ELEMENT 05
Activities to verify that preventive controls are consistently implemented and are effectively and significantly minimizing or preventing hazards. Includes validating preventive controls (before implementation and after changes), calibrating monitoring instruments, reviewing records, and reassessing the Food Safety Plan at least every three years.
Platform Mapping
Affinity QMS was designed so that every HARPC obligation maps directly to a module workflow. No gaps, no manual bridging, no spreadsheets alongside your QMS.
| HARPC Requirement | 21 CFR Part 117 Reference | Affinity QMS Module | What It Does |
|---|---|---|---|
| Food Safety Plan documentation | §117.126 | Document Control | Controlled document authoring, version history, review/approval workflows, and PCQI sign-off with audit trail |
| Corrective Action Procedures | §117.150 | CAPA Management | Structured CAPA workflow from identification through root cause, corrective action, and effectiveness verification with full record retention |
| Supply-Chain Preventive Controls | §117.410 | Supplier Management | Approved supplier list, supplier qualification records, annual verification activities, and supply-chain-applied control documentation |
| Verification Activities | §117.165 | Audit Management | Internal audit scheduling, verification checklists aligned to Food Safety Plan elements, and 3-year reassessment reminders |
| PCQI Qualification | §117.4 | Training Management | PCQI training records, competency verification, training completion tracking, and certificates linked to personnel records |
| Monitoring Records | §117.190 | QMS Core | Configurable record forms for process controls, allergen controls, and sanitation controls with 7-day review workflows and 2-year retention enforcement |
Who This Is For
PCQI / Food Safety Manager
The Preventive Controls Qualified Individual who owns the Food Safety Plan needs a documentation platform that enforces the five-element structure, automates review reminders, and produces audit-ready records without administrative burden.
VP of Operations / Plant Manager
Operations leaders at food manufacturers with 10–200 employees who are scaling production and facing their first FDA routine inspection need HARPC compliance embedded in daily operations, not bolted on.
QA Director at a Co-Packer
Contract manufacturers and co-packers serving multiple branded customers must maintain HARPC compliance across diverse product lines. Affinity QMS handles multiple Food Safety Plans within a single account with per-product scope controls.
Founder / CEO of a Food Startup
Early-stage food and beverage brands preparing for first FDA registration need an affordable, structured path to HARPC compliance before production scales. Start at $299/month with the Document Control and CAPA modules and add more as you grow.
Common Questions
What is the difference between HARPC and HACCP?
HACCP (Hazard Analysis and Critical Control Points) is the older framework, developed in the 1960s, that identifies Critical Control Points where a specific control measure is essential to food safety. HARPC is broader: it requires analysis of all known or reasonably foreseeable hazards, mandates preventive controls (not just CCPs), requires supply-chain controls as a distinct category, and mandates a PCQI to own the plan. HACCP is still required for seafood (21 CFR Part 123), juice (21 CFR Part 120), and meat/poultry (USDA FSIS regulations). For most other FDA-regulated food facilities, HARPC under 21 CFR Part 117 applies. A HARPC-compliant Food Safety Plan can incorporate a HACCP plan within it, but a HACCP plan alone does not satisfy HARPC requirements.
How often does FDA inspect food facilities for HARPC compliance?
FSMA mandated that FDA inspect all high-risk domestic food facilities within five years of enactment and every three years thereafter. Non-high-risk facilities must be inspected within seven years and every five years thereafter. In practice, inspection frequency varies based on FDA's risk-tiering model, facility size, complaint history, and outbreak association. Facilities that have received a warning letter or been associated with a recall will face more frequent follow-up inspections. FDA has been increasing its inspection capacity significantly since 2023.
What records must be kept and for how long?
Under 21 CFR Part 117 Subpart F, all records required by the Preventive Controls rule must be retained for at least two years. This includes the Food Safety Plan itself, records of monitoring activities, records of corrective actions, records of verification activities (including validation studies), and supplier verification records. Records must be available for review by FDA during inspections. Affinity QMS enforces retention schedules and flags records approaching end-of-retention for review before deletion, ensuring you never accidentally purge records still within the mandatory window.
What qualifies someone as a PCQI?
A Preventive Controls Qualified Individual (PCQI) must have successfully completed training in the development and application of risk-based preventive controls — at minimum the FDA-recognized curriculum developed by the Food Safety Preventive Controls Alliance (FSPCA) — or have the equivalent combination of training and experience. The PCQI is responsible for preparing the Food Safety Plan, validating preventive controls, reviewing records, and reanalyzing the plan. One PCQI may serve multiple facilities for a single business, but the PCQI must have specific knowledge of the products and processes at each covered facility.
Does HARPC apply to farms, restaurants, and small businesses?
HARPC does not apply to farms (which are subject to the FSMA Produce Safety Rule instead), retail food establishments, restaurants, or facilities whose average annual sales of human food are less than $1 million (adjusted for inflation) and that sell primarily direct to consumers or to retailers in the same state or within 275 miles. Very small businesses (under $1 million in total annual sales of human food) qualify for an exemption but must still comply with current Good Manufacturing Practices under 21 CFR Part 117 Subpart B. All exemptions should be confirmed with qualified regulatory counsel based on your specific business structure.
Can Affinity QMS produce a complete Food Safety Plan document?
Yes. Affinity QMS includes a structured Food Safety Plan template aligned to the five HARPC elements. The Document Control module manages the plan as a living controlled document with version history, PCQI approval workflows, and automated three-year reassessment reminders. Hazard Analysis records, preventive control descriptions, monitoring procedures, corrective action procedures, and verification activities are all linked within the system so that a complete, current Food Safety Plan is always one export away from audit-ready presentation.
Related Resources
See how Affinity QMS structures your Food Safety Plan documentation, automates PCQI review reminders, and keeps your team inspection-ready — without a consultant.
Book a Demo