HARA Is Not HACCP With Another Name: What It Is and How to Analyze Hazards in a Packaging Plant
One of the patterns I see most in packaging plants is a HARA that is really a food HACCP with a new title: hazards designed for a food line, a copied matrix and not a single line about inks, adhesives or the artwork printed on the bag.
It is easy to see why it happens. When a packaging plant goes for BRCGS, the most tempting move is to take an existing HACCP and rename it. It works until the audit. In this article I explain what HARA is, who it is for, why it matters more today than before and how to build one that actually works, without getting lost in the fine print.
What is HARA?
HARA stands for Hazard Analysis and Risk Assessment. It is the system BRCGS requires from sites that do not manufacture food, such as packaging plants, to identify, assess and control the hazards that can affect the safety, quality and legality of the product.
One thing worth clarifying from the start: there is no HARA standard. You will not find a "HARA 2024" in any store. HARA is the Codex Alimentarius method (the same 12 steps and 7 principles HACCP uses) applied with the requirements of section 2 of the BRCGS standard that applies to you. In a packaging plant, that standard is the BRCGS Global Standard Packaging Materials, currently at Issue 7.
If you already know HACCP, you are halfway there. The other half is understanding how it differs.
Who is it for?
Any plant that manufactures materials that will be in direct or indirect contact with food and certifies to BRCGS Packaging Materials:
- Flexible packaging: bags, laminates, films.
- Rigid packaging: bottles, trays, closures, thermoformed containers.
- Board and paper, including recycled.
- Labels and sleeves.
- Glass and metal.
The term is also used by other BRCGS standards for sites that do not manufacture food: consumer products, storage and distribution, and agents and brokers.
An important clarification: if your packaging plant certifies to FSSC 22000 (category I) rather than BRCGS, you are not talking about HARA. The hazard analysis is done with the ISO 22000 HACCP and the ISO 22002-4 prerequisites. The substance is very similar; the name and the requirements are not.
Why does it matter so much?
Because packaging is food safety too. Your product is not eaten, but it ends up touching something that is. Some examples of what can go wrong in a packaging plant and reach the consumer:
- A polyurethane adhesive that did not fully cure and leaves aromatic amines that migrate into the food.
- Printing solvents trapped in the laminate that give the snack an off odor.
- Wrong or outdated artwork that omits an allergen. The food is fine; the bag lies.
- Blade fragments from slitting that travel inside the reel all the way to your customer's line.
None of these hazards shows up in a food HACCP. And all of them can end in a recall of your customer's product, which is the worst way to lose that customer.
What changed in Issue 7
Audits against BRCGS Packaging Materials Issue 7 started on April 28, 2025, and section 2 was rewritten in line with Codex and GFSI requirements. For the HARA, four changes are noticeable in the audit:
- All of section 2 is fundamental. In Issue 6 only one clause of the section had that status. Now all 11 do. A major non-conformity there can cost you the certificate.
- CCPs are now called "critical control measures". More than a name change, it is a change in focus: identify which controls are critical and support them with validated, justified limits.
- Review comes before the change, not after. The HARA is reviewed at least once a year and before any change that affects the hazards or their controls: supplier, material, process, equipment, customer use or legislation.
- A leader who can demonstrate competence. The HARA team is multidisciplinary and its leader must be trained and able to demonstrate competence and experience.
HARA vs HACCP: the three differences that cost the most
If you ask me where plants go wrong most often, I would say these three things.
| Aspect | HACCP (food) | HARA (packaging) |
|---|---|---|
| Scope | Food safety | Safety, quality and legality of the packaging |
| Hazards | Biological, chemical, physical and allergens | The same, plus migration, recycled material, unintended use, functional integrity, malicious intervention and fraud |
| Assessment | Codex, almost always with a matrix | No matrix is imposed: likelihood and severity are assessed and acceptable levels are justified |
| Critical controls | Several CCPs | Few critical control measures; the weight is on prerequisites |
1. The scope is broader. A HACCP looks at the consumer. A HARA looks at the consumer of the packed food and at your customer: if the bag does not seal on their line, if the barcode does not scan or if the declaration of compliance does not exist, that is also a hazard for the HARA.
2. The hazards are different. Clause 2.5.1 asks you to consider, beyond microbiological, physical and chemical hazards, migration, the use of recycled material, limitations of use, unintended but foreseeable use, critical defects, functional integrity, malicious intervention, raw material fraud and allergens. If your hazard list fits in three columns, something is missing.
3. The method is yours, but you have to defend it. The standard does not give you a matrix. It asks you to assess likelihood and severity and to justify what you consider acceptable. That freedom is a trap if you do not use it well: the auditor will not argue about the scale you chose, they will ask why you chose it and whether you apply it the same way at every step.
How to build a HARA
I will not go into every detail here (that is what the full HARA guide at Beira is for, in Spanish, with scales, matrix and a worked example), but the path is this:
- Form the team. Quality, production, maintenance and product engineering, with a trained leader.
- Define the scope. Products, processes and hazard categories covered by the study.
- Describe the product as packaging. Structure (layers, resins, inks, adhesives, coatings), contact type, target food (fatty, acidic, dry), conditions of use (microwave, hot fill, freezing), shelf life and applicable legislation.
- Define the intended use. Who uses your packaging, for which end consumer and what the reasonably foreseeable misuse is.
- Draw the flow diagram and verify it on the floor. From receiving to dispatch, with rework, outsourced processes and waste. It is verified at least once a year.
- Analyze hazards step by step and assess them.
- Decide which controls are critical. The Codex decision tree helps and, above all, leaves the justification in writing.
- Set limits, monitoring and corrective actions for each critical control measure.
- Validate, verify and document.
- Review: at least once a year and before every change.
A rule that saves you many findings
Assess the inherent risk: with your general prerequisites in place, but without the specific control measure you are analyzing. The standard says it this way for likelihood: it is assessed without counting additional controls.
Why does it matter? Because if you assess with the control already applied, almost everything comes out low. The hazard "disappears" from the study just because it is under control today, and the day the control fails, nobody was watching it as critical. Write this criterion into your procedure: it is one of the first things the auditor asks.
A second rule I like: any hazard with maximum severity goes through the decision tree even if its likelihood is low. If the team concludes it is not critical, fine, but the reason has to be in writing.
The mistakes we see most on the floor
- Copying a food HACCP. The problem is not the title, it is what is missing: migration, printing, legality.
- Ignoring printing hazards. Outdated artwork can turn your bag into the source of an undeclared allergen recall. In many plants, artwork release is the critical control measure.
- Assessing with the control in place. The inherent risk mistake. Everything scores "low" and the study does not help you prioritize anything.
- Confusing prerequisites with critical controls. Either everything is critical and monitoring becomes impossible, or nothing is, even when there is a serious hazard with no other barrier.
- An annual review that copies last year's. You changed adhesive supplier, a new structure came in, a customer started putting your bag in the microwave... and the HARA never found out. Issue 7 requires reviewing before the change.
Documents to consult
- Codex CXC 1-1969, General Principles of Food Hygiene (2022 revision). It is the basis of the method and it is free: the FAO/WHO edition can be downloaded at no cost. The 2022 revision includes, in an annex, the tools to determine critical controls, including the decision tree.
- BRCGS Global Standard Packaging Materials, Issue 7. The requirement, in section 2. BRCGS also publishes an interpretation guideline (paid) that is the best read to understand what the auditor expects.
- ISO 22002-100:2025 and ISO 22002-4:2025. Watch out here: ISO/TS 22002-4:2013, the one many plants still cite in their procedures, was withdrawn in July 2025. Packaging prerequisites are now covered by part 100 (common to the whole chain) together with the new part 4. If your documents cite the 2013 version, you already have a correction pending. I explained it in this article on the ISO 22002:2025 series.
- Food contact materials regulation for the market your customer exports to: FDA 21 CFR parts 174 to 186 in the United States and Regulation (EC) 1935/2004 with its implementing regulations in the European Union. Many of your chemical and legality hazards come from here.
Frequently asked questions about HARA
Is HARA the same as HACCP?
No. They share the Codex method, but HARA also covers the quality and legality of the packaging, includes its own hazards such as migration or functional integrity, and in Issue 7 CCPs are called critical control measures.
What does HARA mean in BRCGS?
Hazard Analysis and Risk Assessment. It is the content of section 2 of BRCGS Packaging Materials.
How often is the HARA reviewed?
At least once a year and before any change that could affect the hazards or their controls.
Does the HARA team need training?
The standard requires the leader to be trained and able to demonstrate competence, and the team to demonstrate it too. The most direct way to leave that evidence is formal training for the team.
In summary
A HARA is not paperwork for the audit. Done well, it is the document that tells you where your packaging can fail and what you are doing to prevent it. Done poorly, it is a food HACCP with another title that the auditor takes apart in minutes.
My recommendation: start with the criterion (how you will assess and why) before listing a single hazard, describe your product as packaging and not as food, and let the review be triggered by every change, not by the calendar.
Want to see the full method, with the severity and likelihood scales, the significance criterion and a worked flexible packaging example? It is in Beira's HARA guide for packaging (in Spanish).
If you need to train your team, we offer the In Company HARA Interpretation course for packaging (12 hours, on site or live online). And if you would rather build the study with us, there is our HARA implementation consulting, and if you are starting BRCGS from scratch, we implement the full standard. We are here to help.