FSMA and HARPC Compliance: The Case for Digital QMS

The FDA's Food Safety Modernization Act turned 15 this year, and something interesting has happened across the food manufacturing space. The companies managing compliance most effectively aren't necessarily the ones with the most experienced quality teams — they're the ones that decided early on to treat their Food Safety Plan as a living system rather than a document they dust off before inspections.

That distinction matters more than it might seem.

What Changed When FSMA Arrived

Before FSMA, food safety regulation in the U.S. was largely reactive. The FDA's authority centered on responding to outbreaks, not preventing them. The 1938 Federal Food, Drug, and Cosmetic Act — the framework FSMA replaced as the primary food safety law — was designed for a different era of food production and a much simpler global supply chain.

FSMA, signed into law in January 2011, flipped that logic. The central idea was preventive controls: food manufacturers should be identifying hazards before they cause harm, not documenting what went wrong after someone got sick. The CDC estimates that roughly 48 million Americans experience a foodborne illness each year, with approximately 128,000 hospitalizations and about 3,000 deaths annually. Those numbers are the backdrop against which FDA designed FSMA's requirements.

The most operationally significant piece of FSMA for food manufacturers is the Preventive Controls for Human Food rule — commonly called HARPC (Hazard Analysis and Risk-Based Preventive Controls). Under HARPC, any facility that manufactures, processes, packs, or holds food for human consumption in the U.S. must develop and implement a written Food Safety Plan that includes a hazard analysis, documented preventive controls, monitoring procedures, corrective action processes, verification activities, and a supply-chain program.

That's a significant documentation and operational burden. The question isn't whether HARPC compliance is required — it is. The question is what kind of system can actually carry that burden without collapsing under its own weight.

The Problem With How Most Companies Try to Comply

Here's what happens more often than it should: a food manufacturer has a Food Safety Plan. It's in a binder — maybe two binders. The document was carefully written and it checks every box the regulation requires. Then the company changes a supplier, modifies a process step, or brings in a new ingredient — and the binder doesn't get updated for six months.

That gap is where FDA investigators find problems. HARPC requires that the Food Safety Plan reflect current operations. If your documented hazard analysis covers an ingredient source you stopped using eight months ago, or describes a process step that no longer exists, you have a compliance problem — not because you did something unsafe, but because your records don't match reality.

Under FSMA, food manufacturers are legally required to maintain a written Food Safety Plan that documents hazard analysis, preventive controls, monitoring procedures, and corrective actions — and that plan must reflect current operations at the time of inspection, not just when it was last written.

Paper-based food safety systems are structurally vulnerable to this gap. Updating a paper Food Safety Plan requires someone to identify that an operational change happened, remember that it triggers a documentation requirement, locate the right section of the plan, revise it, and ensure the right people sign off. In a busy manufacturing environment, each of those steps is a failure point — and they get missed.

How a Digital QMS Changes the Architecture

A digital QMS doesn't eliminate these challenges. But it does restructure where the friction lives.

When a food manufacturer uses a digital QMS to manage their Food Safety Plan, operational changes can be linked directly to documentation requirements. A supplier change triggers a supplier verification review. A new ingredient flags a hazard analysis update. A process modification prompts a reassessment of the associated preventive controls. The system won't let the plan fall out of sync quietly.

HARPC shifts the compliance burden from documenting what went wrong to proving, in advance, what you've done to prevent it — a fundamentally different document architecture than most food companies were built for.

That's the core advantage: the plan stays current because operational data and documentation data can't live independently of each other.

Here's a practical comparison of how paper and digital approaches handle core HARPC requirements:

The "FDA inspection readiness" row is worth sitting with for a moment. Under FSMA, investigators can request records on-site and those records need to be accessible within a reasonable timeframe. Companies on paper systems often spend two to three days before a scheduled inspection pulling documentation together. An unannounced inspection — which FSMA expanded FDA's authority to conduct — leaves no runway for that kind of preparation.

Digital QMS platforms that maintain living records reduce inspection preparation from days to hours by keeping food safety documentation synchronized with operational reality.

The Supply-Chain Program: Where Most Companies Have Gaps

HARPC's supply-chain program requirement is, in my view, the piece of the regulation that paper-based systems handle worst. Under the rule, food manufacturers are responsible for verifying that their suppliers are controlling hazards the receiving facility won't control — raw ingredients that arrive with biological, chemical, or physical hazards the manufacturer relies on the supplier to have addressed.

This requires maintaining approved supplier lists, documented verification procedures, and records of verification activities. For a manufacturer with 50 or 100 ingredients from multiple suppliers, that's a meaningful ongoing administrative process.

Quality managers who track supplier verification on spreadsheets will tell you it works until someone goes on vacation, a certificate of analysis expires over a long weekend, or a new ingredient gets sourced without triggering the supplier approval workflow. The manual version is perpetually one overlooked step away from a gap.

A digital QMS that integrates supplier management handles the administrative layer automatically: certificate expirations trigger review, new suppliers require documented approval before use, and verification records are stored alongside the hazard analysis entries that reference them. The connection between the supply-chain program and the Food Safety Plan becomes explicit rather than implied.

What FDA Inspectors Are Actually Looking For

FSMA gave FDA enhanced inspection authority, including the ability to conduct risk-based inspections of domestic food facilities. The frequency of domestic inspection has been increasing as FDA implements the law's mandate.

When investigators arrive, they're consistently looking for a few things. First, they want to see that the Food Safety Plan is current and complete. Second, they look for evidence that monitoring is actually happening — not just that procedures are documented, but that logs exist and reflect what the procedures say. Third, they evaluate whether corrective actions were properly documented and resolved when monitoring found a deviation.

The pattern in FDA warning letters to food facilities reveals a consistent set of findings: Food Safety Plans that don't reflect current operations, monitoring records with unexplained gaps, corrective action documentation that's incomplete or missing, and supply-chain program records that don't cover all required supplier types. These aren't findings that require sophisticated analysis to avoid — they're documentation and process discipline failures.

A well-configured digital QMS addresses these patterns structurally. Monitoring logs can't go unrecorded if the system prompts the activity. Corrective actions can't close without documentation if the workflow requires it. The Food Safety Plan can't fall behind current operations if every operational change triggers a documentation review.

What This Means for Smaller Manufacturers

FSMA created tiered compliance timelines, and HARPC includes accommodations for very small businesses (under $1 million in annual food sales) and small businesses (fewer than 500 full-time equivalent employees). But accommodation doesn't mean exemption — most food manufacturers still need a documented Food Safety Plan.

For smaller manufacturers, the compliance burden per employee is actually higher, not lower. A 50-person food company doesn't have a dedicated food safety compliance team. It has a quality manager who also handles supplier relations, training, customer complaints, and production coordination. That person needs systems that do more of the administrative work automatically.

The QMS conversation for food safety often goes wrong here. Digital QMS tools get presented as enterprise software — complex, expensive, and built for companies with teams of quality professionals to administer them. That framing leaves smaller manufacturers with the impression that the only alternative to complex enterprise software is a well-organized binder. It doesn't have to be that binary.

The real value proposition of a purpose-built food safety QMS for a smaller manufacturer is less about capability breadth and more about operational simplicity — does the system make it easy for one overloaded quality manager to keep a compliant Food Safety Plan current without turning maintenance into a full-time job? That's a different design goal than capability breadth, and it's worth asking explicitly when evaluating options.

You can explore how Nova QMS approaches this tradeoff for food manufacturers at novaqms.com.

The Records Question

HARPC specifies records retention requirements. Most preventive controls records must be retained for at least two years; records associated with certain higher-risk activities carry longer retention requirements.

Paper records have a preservation problem that compounds over time. They get misfiled, damaged, or lost. They're not searchable. They can't be cross-referenced automatically. Under digital systems, retention becomes a background process — records are created, timestamped, and stored in a format that's both durable and retrievable.

There's also a legal dimension worth noting. In the event of a recall or a regulatory enforcement action, the quality of your records becomes evidence. Well-maintained, timestamped, unaltered digital records tell a clear story about what your monitoring found, what corrective actions you took, and when. Paper records that show signs of after-the-fact modification tell a different kind of story.

What Capabilities Actually Matter

If you're evaluating a QMS for food safety compliance, a few capabilities tend to matter more than the feature count implies.

Document control with change management. The Food Safety Plan is a living document. The system needs to enforce version control, capture revision history, and require review and approval before changes take effect. A system that stores documents without governing their change cycle is just a filing cabinet.

Linked hazard and control documentation. Hazard analysis records should connect to the preventive controls that address each identified hazard, which connect to the monitoring procedures designed to verify those controls are working. The architecture of the system should reflect the architecture that HARPC requires — not just store the same information in digital form.

Supplier management integration. Not a separate system, not a spreadsheet that lives outside the QMS. Supplier verification records should live in the same environment as the Food Safety Plan that references them, so the connection is navigable rather than assumed.

Complete audit trail. Every record entry, modification, and review should be timestamped and attributed to a named user. This matters for regulatory compliance, but it also matters for internal accountability — knowing who changed what and when is how you manage quality at the process level, not just the document level.

Corrective action workflows. When monitoring finds a deviation, the system should prompt a corrective action process, track it to closure, and retain the full record. A deviation that doesn't generate a corrective action record is a compliance gap waiting to be found. More than that, it's an operational signal that went unaddressed — which is the kind of pattern that leads to recalls.

These aren't exotic capabilities, and they don't require enterprise-scale investment to implement. What they do require is a system whose structure was designed around the architecture of HARPC, not retrofitted to accommodate it. A QMS that organizes documents without enforcing the connections between hazard analysis, preventive controls, monitoring, and corrective action records is a more organized binder. That's better than a disorganized one — but it's not quite the same thing as building compliance into the operational workflow itself.

For a broader look at how digital QMS tools are changing compliance infrastructure across regulated industries, the Nova QMS resource library at novaqms.com is worth exploring.

Frequently Asked Questions

What is HARPC, and how is it different from HACCP?

HACCP (Hazard Analysis and Critical Control Points) is a science-based system for identifying and controlling food safety hazards, developed in the 1960s and widely adopted globally. HARPC, established under FSMA's Preventive Controls for Human Food rule (21 CFR Part 117), builds on HACCP principles but adds broader requirements: preventive controls that go beyond critical control points, a formal supply-chain program, a recall plan, and additional verification activities. HARPC is a legal requirement for most FDA-registered food facilities; meeting HACCP principles alone doesn't satisfy HARPC's documentation and program requirements.

Does a digital QMS guarantee FDA compliance?

No QMS — digital or otherwise — guarantees compliance. What a digital QMS does is make compliance more maintainable: it structures your documentation, keeps records current, and reduces the administrative gaps where compliance tends to break down under operational pressure. The quality of your compliance is still determined by the quality of your hazard analysis, the rigor of your preventive controls, and the consistency of your monitoring activities. The QMS is infrastructure, not a substitute for food safety expertise.

How long does implementation typically take for a food manufacturer?

It depends on where you're starting. A manufacturer with an existing Food Safety Plan transitioning from paper to digital typically takes 30 to 90 days to migrate core documentation and train staff. A manufacturer building a Food Safety Plan from scratch while implementing a QMS will take longer — 90 to 180 days is realistic. The limiting factor is usually internal: getting the right people to validate the hazard analysis and preventive controls, not the software implementation itself.

What FSMA records do food manufacturers need to keep?

Under HARPC, food manufacturers must retain records related to their Food Safety Plan, hazard analysis, preventive controls and monitoring, corrective actions, verification activities, and supply-chain program. Most records must be kept for at least two years, with longer requirements for specific record types. Records must be available for FDA inspection throughout the retention period, accessible on-site or within a reasonable timeframe upon request.

Can smaller food manufacturers benefit from a digital QMS?

Yes — and in many ways smaller manufacturers benefit more from a well-designed QMS than larger ones, because the compliance burden per person is higher. The key is choosing a system designed for the operational context: one that doesn't require a dedicated QMS administrator to function. Purpose-built food safety QMS platforms that embed HARPC structure into the workflow can make compliance manageable for a quality team of one or two people, which is where a significant portion of the U.S. food manufacturing sector actually operates.

Last updated: 2026-06-19