CCP determination is where the theoretical structure of HACCP gets tested against reality. Get your hazard analysis right, and CCP determination becomes relatively straightforward. Get your hazard analysis wrong — missing hazards, misclassifying significance — and your CCP determination will be built on flawed foundations regardless of how carefully you apply the decision tree.
This guide covers Codex Principle 2 and Step 7 of CXC 1-1969 as implemented under BRC Issue 9 clause 2.8. It addresses the 2020 Codex revision and what it actually changed (less than some people think), how to use a decision tree correctly, and the CCP vs OPRP vs PRP distinction with real manufacturing examples.
What a CCP Actually Is
A Critical Control Point is a step in the process where a control measure can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. The definition sounds simple but contains several elements that matter in practice.
A measurable critical limit. A CCP must have a critical limit — the boundary between acceptability and unacceptability. That limit must be measurable or objectively verifiable. Temperature, time, pH, water activity, metal detector sensitivity setting, visual absence of bone fragments — these are measurable. "Adequate cooking""or "proper mixing""are not. If you can't define a critical limit that can be monitored in real time, what you're looking at probably isn't a CCP.
Real-time monitoring capability. A CCP must be monitored at a frequency that allows you to detect loss of control at that step and take corrective action before affected product leaves the site. This is what distinguishes a CCP from a verification activity. Microbiological testing is not real-time — by the time you have a result, the product may have shipped. Microbiological testing is a verification tool, not a CCP monitoring tool.
Immediate corrective action. When monitoring shows the critical limit has been breached, you must have a pre-defined corrective action. That action must address both the product (what do you do with product produced during the loss of control) and the process (how do you restore control). If there's no meaningful corrective action available at a step, question whether it's genuinely a CCP.
The 2020 Codex Revision: What Actually Changed
There's been some confusion in the industry about what the 2020 revision of CXC 1-1969 did to CCP determination. The short answer: it removed the original Codex decision tree from the main text of the standard, but explicitly confirmed that decision trees remain a valid tool and moved guidance on their use to the new Annex IV.
The original Codex decision tree had four questions (Q1 through Q4) and was widely used, widely misapplied, and widely criticised for producing too many CCPs when applied mechanically. The 2020 revision recognised that a decision tree is a tool to support expert judgement, not a substitute for it. Annex IV provides updated guidance, and many certification bodies and technical organisations (including Campden BRI) publish their own decision tree variants that are entirely acceptable under the revised standard.
What the 2020 revision did introduce that's genuinely new is the formal concept of a significant hazard — a hazard identified through hazard analysis that requires specific control beyond general hygiene practice. This is relevant to CCP determination because the systematic approach only applies to significant hazards. Non-significant hazards are managed through standard PRPs and don't require the CCP decision tree treatment at all.
BRC Issue 9 clause 2.8 does not mandate a specific decision tree but requires that a documented, systematic approach is used. Whichever approach you use, you must be able to show the reasoning for each significant hazard at each step.
Using a Decision Tree Systematically
The core questions in any decision tree approach follow the same logical structure as the original Codex version, even if the wording varies. The key questions are:
Q1: Is a control measure in place at this step for this hazard? If yes, proceed. If no — can one be put in place? If a control measure can be implemented, implement it and continue. If not, you have a fundamental product safety problem and may not be able to make the product safely at all.
Q2: Is this step specifically designed to eliminate or reduce the hazard to an acceptable level? This is the heart of the decision. A pasteurisation step is specifically designed to eliminate pathogens. A metal detection step is specifically designed to detect and reject metal contamination. A chilled storage step is not specifically designed to eliminate bacterial growth — it's designed to retard it, which is a PRP function, not a CCP function.
Q3: Could contamination with the hazard occur at this step, or could it increase to unacceptable levels? This question identifies steps where the hazard could appear or worsen in the absence of control. If yes, move to Q4. If no, the step is not a CCP for this hazard.
Q4: Will a subsequent step eliminate or reduce the hazard to an acceptable level? If yes, the current step is not a CCP — the control is downstream. If no, the current step must be a CCP.
The discipline in applying a decision tree is in the second question. Many HACCP teams answer yes to Q2 for steps that are not specifically designed to eliminate hazards — storage, mixing, portioning — because they're thinking about whether contamination could happen, not whether the step is designed as a control. Answer Q2 based on the intended function of the process step, not on whether contamination is possible.
CCP vs OPRP vs PRP: The Practical Distinction
BRC Issue 9 uses the terms CCP and PRP. ISO 22000 and FSSC 22000 introduce the OPRP concept — Operational Prerequisite Programme. BRC doesn't formally use the OPRP term, but the concept maps to what BRC calls a PRP with enhanced monitoring and corrective action requirements. Understanding the distinction matters because it determines the rigour of control required.
PRP (standard) — A foundational hygiene or operational practice that controls general contamination risks. Cleaning and sanitation schedules, pest control contracts, personal hygiene policies, maintenance programmes. PRPs are documented, implemented, and verified, but they don't have binary pass/fail critical limits in the CCP sense. If your cleaning programme fails an ATP swab, you re-clean; you don't put the production run on hold pending investigation.
OPRP / Enhanced PRP — A prerequisite programme that has been identified through hazard analysis as essential to controlling a significant hazard, but where the control mechanism doesn't meet the CCP definition (no binary critical limit, or control is achieved through multiple factors rather than a single measurable parameter). Allergen management is a good example. Allergen changeover procedures, segregation, and labelling control allergen cross-contact risk, but there's no single measurable critical limit in the same way a cooking temperature is a critical limit. The control is managed as an enhanced PRP with documented procedures, monitoring, and corrective actions.
CCP — A process step with a validated critical limit, real-time monitoring, and pre-defined corrective actions. Examples in real manufacturing: pasteurisation (temperature/time), retort processing (come-up time, sterilisation value), metal detection (test piece passage frequency and sensitivity settings), visual inspection for bone fragments in deboned poultry (screen mesh size and reject confirmation), acidification (pH at point of fill for preserved products).
The practical test is: can I define a measurable, binary critical limit and monitor compliance in real time? If yes, CCP. If the control requires a set of practices and judgements rather than a single measurable parameter, OPRP or enhanced PRP. If it's a general hygiene foundation, standard PRP.
Why Too Many CCPs Is a Problem
This point is underappreciated. In theory, more CCPs means more control. In practice, CCP overload creates systems that are too complex to manage effectively — monitoring burdens that exceed available resource, records that get filled in as a box-ticking exercise, and a diffusion of attention across too many "critical""points such that genuinely critical ones get lost in the noise.
When I see a HACCP system with 12 or 15 CCPs for a straightforward product, I look at each one carefully. Almost invariably, several of them are better managed as enhanced PRPs. The site ends up with a monitoring burden they can't sustain, and the corrective action records show deviations that aren't being followed up properly because the system is unmanageable. A good HACCP system for most food products should have somewhere between 1 and 5 CCPs. Complex multi-step processing with several distinct kill steps will have more; simple chilled ambient products may have only one or two.
Common Mistakes in CCP Determination
Making cleaning a CCP. Cleaning is a PRP — always. Cleaning controls contamination through a programme of procedures, training, verification, and audit, not through a single measurable critical limit. The absence of a clean food contact surface is controlled by your cleaning programme, your ATP monitoring, and your visual inspection procedures. Making cleaning a CCP creates an unmonitorable CCP and demonstrates a misunderstanding of the CCP concept. I've seen this in multiple audits — it's always a finding.
Making allergen labelling a CCP. Label accuracy is controlled through document control, label approval, version control, and pre-start checks — not through a process parameter with a critical limit. Allergen cross-contact in the process is legitimately managed as an OPRP or enhanced PRP. The label itself is managed through your labelling control programme. These are separate issues.
Applying the decision tree to non-significant hazards. The systematic CCP determination approach applies to significant hazards only. If your hazard analysis has determined a hazard is not significant, you don't run it through the decision tree to check whether it needs a CCP. The hazard analysis conclusion is that it doesn't require specific control; the decision tree is redundant for that hazard.
Having a CCP without validation evidence for the critical limit. This is probably the most common audit finding against CCPs. A critical limit must be validated — there must be evidence that the limit, if met, will actually control the hazard. "We've always cooked to 75°C""is not validation. Published kill curves for the relevant pathogen at that time-temperature combination, or regulatory guidance specifying the limit, or challenge testing data — that's validation.
What Auditors Look For
BRC Issue 9 clause 2.8 audits typically focus on: documented justification for each CCP designation (why is this step a CCP for this hazard?); documented justification for steps that were considered but not designated as CCPs; validation evidence for each critical limit; and consistency between the CCP determination records and what's actually being monitored on the production floor.
The most important thing an auditor is looking for is evidence that the decision was made by people who understood the science and the process, not by people filling in a template. A HACCP system where every significant hazard has been mechanically fed through a decision tree without any documented reasoning is technically compliant but unconvincing. Auditors know the difference between a system that was built to be certified and one that was built to manage food safety.
CCP determination is a judgement call informed by hazard analysis, process knowledge, and food science. The decision tree is a framework for that judgement — not a substitute for it.
SafetyCore's CCP determination module guides your team through a structured decision tree for each significant hazard, recording the reasoning at each question and automatically populating your CCP register with critical limits, monitoring requirements, and corrective action assignments.
Start Free Trial