Principles 1–3: Hazard Analysis, CCPs, and Critical Limits

Principle 1: Conduct a hazard analysis and identify control measures. This is the step where you think the process through, and it shapes everything that follows. At each process step on your flow diagram, list the biological, chemical, physical, and allergen hazards that could reasonably occur. Then decide which ones are significant — reasonably likely to happen, and able to cause illness or injury if not controlled. Significance comes down to likelihood plus severity: a hazard that is unlikely but severe (botulism toxin in low-acid canned food) is significant; one that is possible but trivial is not.

Base the judgement on evidence, not opinion. Your inputs: complaint and incident history, supplier non-conformance data, scientific literature, recall databases, audit findings, and the experience of the team. “We have never had a problem here” is not evidence — not finding a hazard is not the same as it not being there. For every significant hazard, identify the control measures that could prevent, eliminate, or reduce it. Codex is explicit in Principle 1: the hazard analysis and the control measures are developed together, not as separate exercises.

Put it in a hazard analysis worksheet with one row per hazard per step. Auditors read this worksheet first. They will pick a hazard you marked “not significant” and ask you to defend it. If your reasoning is written down and evidence-based, you pass. If it is a gut feeling, you fail. The worksheet is also where most weak plans show up: hazard lists copied from another plant, steps skipped, allergens forgotten, control measures listed that do not exist on the floor.

Principle 2: Determine the Critical Control Points

A CCP is a step where control is essential to prevent or eliminate a hazard, or reduce it to an acceptable level — and where losing control could mean unsafe food. Codex expects CCPs only for hazards your analysis marked significant. A typical process has two to five true CCPs. If your plan lists twenty, you have mixed up control points with critical control points. Every CCP costs monitoring time, records, calibration, and audit attention. Keep the word “critical” meaningful: spread it too thin and the real CCPs stop getting the attention they need.

The Codex decision tree is the standard tool for the determination. Work through the questions for one hazard at one step, in order:

1. Q1: Do control measures exist at this step? If yes — or a measure could be applied — move on. If no, the process or product must be modified to introduce control.
2. Q2: Does this step eliminate the hazard or reduce it to an acceptable level? Yes means this step is a CCP. A cooking step that kills the target pathogen answers yes here.
3. Q3: Could contamination occur at, or increase to, unacceptable levels at this step? If no, it is not a CCP. If yes, continue.
4. Q4: Will a later step eliminate the hazard or reduce it to an acceptable level? If yes, this step is not a CCP. If no, this step is a CCP.

Here is how it works on a real case: the cooking step for Salmonella in formed meat patties. Q1: control measures exist — time-temperature cooking. Q2: yes — cooking to the validated schedule eliminates Salmonella to an acceptable level. Answer: CCP. Contrast metal detection at the end of the line: Q1 yes, Q2 no (detection does not eliminate; it rejects), Q3 yes (metal fragments can exceed acceptable levels), Q4 no (no later step removes metal). Answer: CCP — a CCP does not have to be a kill step. A step that reduces the hazard to an acceptable level by rejection qualifies.

Two points practitioners get wrong. First, the tree is a tool, not a law — Codex says decision trees should be flexible, adapted to the sector, and that expert judgement is an acceptable alternative. Use the tree honestly and document each answer. Second, the arrangement is flexible: one CCP can control several hazards (cooking handles Salmonella, E. coli, and Listeria at once), and one hazard can need several CCPs (cooking kills the vegetative cells of sporeformers; controlled cooling stops the survivors from germinating).

Principle 3: Establish validated critical limits

Every CCP needs a critical limit: a maximum and/or minimum value for a biological, chemical, or physical parameter that separates safe from unsafe. Cooking poultry to an internal temperature of 74°C. Acidified foods held at pH 4.6 or below. A metal detector that must catch 2.0 mm ferrous test pieces. The limit must be measurable, and the result must be available in time to act — a lab result that arrives two days after the product shipped is no use as a critical limit.

Codex Principle 3 says “establish validated critical limits” — and validation is not optional. You need evidence that the limit actually controls the hazard: regulations, published scientific studies, challenge-study data, equipment manufacturer data, or your own validation trials run before the plan goes live. “The auditor at my last plant used 74°C” is not validation. Write the basis for each limit into the plan; auditors ask for it by name.

Keep the critical limit separate from the operating limit. The operating limit is your process target, set deliberately stricter than the critical limit so operators have room to react. Cooking target 76°C against a critical limit of 74°C: if the readout drifts to 75°C, the operator adjusts the cooker and no deviation has occurred — no product held, no corrective action report written. Without that buffer, every minor wobble becomes a deviation. Set the operating limit, train to it, and never cross the critical limit.