FSMA requires the following:
The three below components together equal the HARPC plan (one for each facility owned and operated by a food company):
• Written Hazard Analysis (evaluating the hazards that reasonably could affect food safety)
• Written and validated preventive controls (specifying what preventive steps, or controls, will be implemented to significantly minimize or prevent the hazards; specifying how the facility will monitor these controls to ensure they are working; and maintaining routine records of the monitoring)
• Written corrective action procedures for each hazard (specifying what actions the facility will take to correct problems that arise)
• Written supplier approval and verification program (a risk-based approach to ensure suppliers are not providing food facilities with raw materials or ingredients that pose a significant risk to the final product made by the facility)
• Written verification procedures [that the risk is controlled by the supplier, especially if the facility’s preventive controls do not control a supplier’s hazard (e.g., a ready-to-eat chicken strip that will be added to a salad); the program must include verification activities specific to the preventive control of each hazard; in some cases, an on-site audit may be required, in which case the receiving facility must also maintain documentation of the audit]
• A written recall plan (for food with a hazard that is reasonably likely to occur based on possible failure of a preventive control and its respective corrective action; it must include steps and methods to be used to notify the direct recipients of the food about the recall and the public about any hazard, and to verify that the recall is carried out as well as procedures to appropriately dispose of the recalled food in the food facility and by all recipients)
As a side note, it is important to mention that regular self-assessments by management and employees within a food facility can be helpful to demonstrate preventive controls and any corrective actions made to a failed preventive control. They can provide real-time monitoring of each of the preventive controls (to enable corrective actions and prevent recalls) and documentation to FDA that each was actively monitored according to HARPC.