Hazard analysis and risk-based preventive controls or HARPC is a successor to the Hazard analysis and critical control points (HACCP) food safety system, mandated in the United States by the FDA Food Safety Modernization Act (FSMA) of 2010.

Preventive control systems emphasize prevention of hazards before they occur rather than their detection after they occur.^[1] The FDA released the rules in the Federal Register from September 2015 onwards.^[2] The first release of rules addressed Preventive Controls for Human Food and Preventive Controls for Foods for Animals.^[3] The Produce Safety Final Rule, the Foreign Supplier Verification Programs (FSVP) Final Rule and the Accredited Third-Party Certification Final Rule were issued on November 13, 2015.^[4] The Sanitary Transportation of Human and Animal Food final rule was issued on April 6, 2016,^[5] and the Mitigation Strategies To Protect Food Against Intentional Adulteration (Food Defense) final rule was issued on May 27, 2016.^[6]

All food companies in the United States that are required to register with the FDA under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, as well as firms outside the US that export food to the US, must have a written FSMA-compliant Food Safety Plan in place by the deadlines listed below:

• Very small businesses of less than $1 million in sales per year are exempt, but must provide proof to the FDA of their very small status by January 1, 2016.
• Businesses subject to Juice HACCP (21 CFR 120) and Seafood HACCP (21 CFR 123) are exempt.
• Businesses subject to the Pasteurized Milk Ordinance; Sept 17, 2018.
• Small businesses, defined as having fewer than 500 full-time equivalent employees; Sept 17, 2017.
• All other businesses; Sept 17, 2016.^[7]

Additionally, for the first time food safety is being extended to pet food and animal feed, with firms being given an extra year to implement Current Good Manufacturing Practices before a Preventive Controls system the following year:

• Primary Production Farms, defined as "an operation under one management in one general, but not necessarily contiguous, location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities" are exempt.
• Very small businesses of less than $2,500,000 in sales per year; Sept 17, 2018 for cGMP, Sept 17, 2019 for Preventive Controls, but must provide proof of very small business status by January 1, 2017.
• Small businesses, having fewer than 500 full-time equivalent employees; Sept 17, 2017 for cGMP, Sept 17, 2018 for Preventive Controls.
• All other businesses; Sept 17, 2016 for cGMP, Sept 17, 2017 for Preventive Controls.^[8]

The FDA estimates that 73,000 businesses currently fall under these definitions. ^{[citation needed]}

• FSMA places a much stronger emphasis on science, research and prior experience with outbreaks than HACCP. For example, the FDA now uses whole genome sequencing to match the exact strain of pathogen isolated from hospital patients to DNA recovered from food manufacturing facilities.^[9][10]
• FSMA requires that a "Preventive Controls Qualified Individual" (PCQI) with training and experience oversee the plan.^[11] HACCP assigned responsibilities to a team drawn from management.
• FSMA requires that firms vet ("Verify") all their suppliers for the effectiveness of their food safety programs. This has the effect of drafting companies into the FSMA enforcement effort, since the Supplier Verification and Foreign Supplier Verification programs require that the suppliers provide written proof that they have Prerequisite Programs, and Preventive Controls systems which include their own supplier vetting program.^[12][13]
• FSMA-compliant Food Safety Plans rely on Prerequisite Programs such as GMPs, allergen controls, Integrated Pest Management and vetting suppliers far more than HACCP plans, since these programs tend to be preventive.^[14][15]
• FSMA-compliant Hazard Analyses address radiological hazards in addition to the chemical, biological and physical hazards covered by HACCP systems.^[16]
• FSMA explicitly requires a Food Defense component, with both terrorism and Economically Motivated Adulteration addressed. Businesses with less than $10,000,000 a year in sales are exempt.
• FSMA-compliant Food Safety Plans de-emphasize Critical Control Points in favor of Preventive Controls. Preventive Controls do not require specific Critical Limits.^[17]
• FSMA-compliant Food Safety Plans allow Corrections in place of Corrective Actions when the public health is not threatened.^[18] Corrections are not as strict regarding paperwork as Corrective Actions. The FDA believes that companies might have been avoiding making minor improvements because they felt that the paper trail of a Corrective Action would open them to legal risk due to discovery during investigations or lawsuits.
• FSMA-compliant Food Safety Plans are to be reviewed once every three years, as opposed to yearly with HACCP.