Critical Control Points and Operational Prerequisite Programs

Cooking chicken to the validated core temperature is a critical control point. Controlling allergen changeovers on a shared line may be an operational prerequisite programme. Both control significant hazards, both are monitored, and both appear in the hazard control plan, yet they are managed differently when a check fails. Confusing the two leads to two errors: treating a critical failure as a minor deviation, or burying a useful control under critical control point paperwork until nobody can run it.

ISO 22000:2018 requires significant hazards to be controlled by control measures, or combinations of measures, categorised as either CCPs or OPRPs. Categorisation is a technical decision made during hazard control planning in clause 8.5, based on assessment, feasibility of monitoring, and consequences of failure. As an auditor, your job is to test that decision and then check that the site operates the control exactly as categorised.

Where CCPs and OPRPs come from

Start earlier in clause 8.5. Preliminary steps produce product descriptions, intended use, flow diagrams confirmed on site, and descriptions of process steps and existing controls. Hazards are identified and assessed for likelihood and severity, considering the chain before and after your site and the effectiveness of existing measures. Significant hazards then need control measures selected for them. Each measure, or combination, is categorised.

Categorisation considers factors such as the effect of the measure on the hazard, its feasibility for monitoring, its place in the system relative to other measures, the likelihood of failure, the severity of consequences if it fails, whether the measure is specifically established to reduce the hazard to an acceptable level, and synergistic effects between measures. A decision tree can support this thinking, but ISO 22000 does not mandate a specific tree. A tree answer that contradicts the technical facts is still wrong, and auditors should probe reasoning, not just the recorded outcome.

Critical control points in practice

A CCP is a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. Each CCP has critical limits: measurable values that separate acceptability from unacceptability, such as a minimum core temperature, a maximum time, a pH value, or a water activity level. Critical limits must be measurable and validated. Monitoring must be able to detect failure in time to isolate affected product, because product made since the last good check is suspect when a limit is breached.

Failure at a CCP has defined consequences. The affected product is potentially unsafe. It must be handled under clause 8.9: identified, evaluated, and released only where evidence shows it is safe, otherwise reprocessed, diverted where safe, or destroyed. Corrections and corrective actions in the hazard control plan are triggered. An operator who simply re-checks, finds a passing result, and continues without addressing product made during the failure has not followed the plan.

Action criteria for OPRPs

An OPRP controls a significant hazard too, but through action criteria rather than critical limits. Action criteria can be measurable values or observable criteria, such as a specified cleaning verification result, a sieve integrity check, a label verification at changeover, or a defined allergen swab outcome. Monitoring an OPRP shows whether it stays within its criterion. When an action criterion is not met, corrections and corrective actions apply, and product safety is evaluated based on the consequences of the failure. Not every OPRP failure automatically makes product unsafe in the way a breached critical limit does, but it must never be shrugged off: the plan states the response, and the evaluation must be recorded.

Prerequisite programmes underneath both

PRPs sit below both categories. They maintain general hygienic conditions and are not selected to control a specific significant hazard: pest control, cleaning schedules for general areas, maintenance, personal hygiene rules, and supplier approval are typical. PRPs are controlled through their own programmes with monitoring and verification suited to them. Promoting a PRP item into the hazard control plan without a significant hazard behind it dilutes the plan. Leaving a significant hazard in a PRP, such as relying on general cleaning alone for allergen cross-contact on a shared line, under-controls the risk.

Validation, verification, and common audit findings

Before implementation, combinations of control measures must be validated under clause 8.5.3 in substance: evidence that the measures, when properly implemented, are capable of controlling the hazard to the defined acceptable level. Cooking instructions from equipment trials, published scientific data, or challenge studies can provide that evidence. After implementation, verification under clause 8.7 confirms the system works as planned, through activities such as record review, calibration checks, sampling, and internal audit.

Frequent findings include critical limits copied from another site without validation, OPRP action criteria written so vaguely that two operators judge them differently, monitoring intervals too long to isolate affected product, and categorisation records that state a conclusion with no reasoning. Each finding should cite the specific step in clause 8.5 where the chain failed, so the site can repair the decision rather than just edit a form.

Key points

• Significant hazards are controlled by measures categorised as CCPs or OPRPs during clause 8.5 planning.
• CCPs use measurable critical limits; breaching one makes affected product potentially unsafe and triggers clause 8.9 handling.
• OPRPs use action criteria, which may be measurable or observable; failure requires correction, corrective action, and a product safety evaluation.
• PRPs maintain general hygiene and do not control a specific significant hazard.
• Control measure combinations must be validated before use and verified in operation.
• Categorisation must show technical reasoning; a decision tree alone is not evidence.