How to Define Critical Control Points Under ISO 22000

What Are Critical Control Points and Why They Matter in ISO 22000

If you work in food production, processing, or distribution and you are pursuing ISO 22000 certification, you will quickly discover that Critical Control Points are one of the most important concepts you need to get right. Get them wrong and you are not just risking a non-conformity during your audit. You are risking a food safety incident that could harm consumers and destroy your business reputation.

A Critical Control Point, commonly referred to as a CCP, is a specific step in your food production process where a control measure can be applied to prevent, eliminate, or reduce a food safety hazard to an acceptable level. The key word there is “critical.” Not every control point in your process is a CCP. The distinction matters enormously, and it is one of the areas where many businesses struggle during implementation.

ISO 22000 integrates HACCP principles directly into its food safety management system framework. This means the process of identifying and managing CCPs is not optional. It is a core requirement. Understanding how to define them correctly will determine whether your food safety management system is genuinely protective or just a collection of documents that look good on paper.

How ISO 22000 Structures Food Safety Controls

Before you can define a CCP, you need to understand how ISO 22000 organises its food safety controls. The standard uses a layered approach that distinguishes between three types of control measures.

Prerequisite Programmes

Prerequisite Programmes, or PRPs, are the foundational hygiene and operational conditions that are necessary before you even start thinking about CCPs. These include things like pest control, cleaning and sanitation, personal hygiene, supplier management, and allergen controls. PRPs manage general food safety conditions across your facility. They are not point-specific controls for identified hazards in your process flow.

Operational Prerequisite Programmes

Operational Prerequisite Programmes, known as OPRPs, sit in the middle. They are more specific than PRPs and are used to control hazards that have been identified through hazard analysis but where the loss of control does not necessarily lead to immediate unacceptable risk. A good example is temperature monitoring during cold storage. If your cold room drifts slightly above the target temperature, you have a procedure to investigate and correct it. The hazard is controlled, but not at a step where failure would immediately result in a dangerous product reaching the consumer without detection.

Critical Control Points

CCPs are the highest-priority controls. They apply to process steps where a specific hazard has been identified, the hazard could cause serious harm if not controlled, and this is the last or most effective point in the process to prevent or eliminate that hazard. A classic example is a cooking step in a meat processing facility. If the internal temperature of the product does not reach the required level, pathogenic bacteria will survive. There is no downstream step that will catch this. The cooking step is therefore a CCP.

Understanding this distinction is critical because ISO 22000 requires you to document and justify why each control measure is classified as it is. Auditors will probe this during your certification assessment.

The Hazard Analysis: Your Foundation for Identifying CCPs

You cannot define a CCP without first completing a thorough hazard analysis. This is non-negotiable under ISO 22000 and it is where many food businesses underinvest their effort. A superficial hazard analysis produces a superficial HACCP plan, and that creates real risk.

Step 1: Map Your Process Flow in Detail

Start with a complete and accurate process flow diagram. This needs to cover every step from raw material receipt through to dispatch or service. Include rework loops, hold points, and any steps where product could be exposed to the environment or to other products. Walk the floor and verify the diagram against what actually happens. It is surprisingly common for the documented process flow to differ from what workers do in practice.

Step 2: Identify All Potential Hazards at Each Step

For each step in your process flow, identify all potential biological, chemical, and physical hazards. Biological hazards include pathogens like Salmonella, Listeria, and E. coli. Chemical hazards include pesticide residues, cleaning chemical contamination, allergens, and naturally occurring toxins. Physical hazards include glass, metal, bone fragments, and hard plastic.

Do not limit yourself to hazards you have experienced before. Consider what could plausibly occur at that step based on the nature of the materials, the equipment used, the environment, and the people involved. Use your team's knowledge, industry data, regulatory guidance, and scientific literature to build this list.

Step 3: Conduct a Risk Assessment for Each Hazard

Once you have a list of potential hazards, assess each one for two factors: the likelihood of occurrence and the severity of the consequence if the hazard is not controlled. ISO 22000 requires this assessment to be systematic and documented. Most organisations use a risk matrix or scoring system to make this consistent and defensible.

Hazards that score high on both likelihood and severity are the ones that will require the most robust control measures. These are the candidates for CCP designation. Hazards with lower risk scores may be adequately managed through PRPs or OPRPs.

Applying the CCP Decision Tree

The HACCP decision tree is the most widely used tool for determining whether a control measure should be classified as a CCP. The Codex Alimentarius Commission, which forms the technical basis for the HACCP principles embedded in ISO 22000, provides a structured decision tree that walks you through a series of questions for each identified hazard at each process step.

Question 1: Do Control Measures Exist for This Hazard?

If yes, move to the next question. If no, ask whether control is necessary at this step for food safety. If it is necessary and no control exists, you need to modify the step, the product, or the process before continuing. This is an important outcome. Sometimes the answer is to redesign the process rather than accept an uncontrolled hazard.

Question 2: Is This Step Specifically Designed to Eliminate or Reduce the Hazard?

If the primary purpose of the step is to address the identified hazard, it is a strong candidate for CCP designation. A pasteurisation step exists specifically to destroy pathogens. A metal detection step exists specifically to detect and remove metal contamination. These steps are designed around controlling the hazard, not just incidentally affecting it.

Question 3: Could Contamination Occur at or Exceed Acceptable Levels?

This question asks whether the hazard could be introduced or increase to an unacceptable level at this step. If the answer is yes, and there is no subsequent step that will address it, you are likely dealing with a CCP.

Question 4: Will a Subsequent Step Eliminate or Reduce the Hazard?

This is the question that separates many CCPs from OPRPs. If a later step in your process will effectively deal with the hazard, then the current step may not need to be a CCP. For example, if raw vegetables are contaminated with soil bacteria but will undergo a validated cooking step later, the contamination at the raw preparation stage may be managed as an OPRP rather than a CCP, because the cooking step is where the hazard is actually controlled.

Work through this decision tree for every significant hazard at every relevant process step. Document your reasoning at each question. This documentation is what your auditor will review to confirm your HACCP analysis is sound.

Setting Critical Limits for Each CCP

Once you have identified your CCPs, you must establish critical limits for each one. A critical limit is the measurable boundary that separates acceptable from unacceptable. It is the line you must not cross.

Critical limits must be based on science, not guesswork. They should come from regulatory requirements, validated scientific studies, industry standards, or your own validated process data. For a cooking step targeting Salmonella in poultry, the critical limit might be an internal product temperature of 74 degrees Celsius maintained for a specified time. For a pH control step in an acidified product, the critical limit might be a maximum pH of 4.6.

Critical limits must be measurable and monitorable in real time. If you cannot monitor it during production, it cannot function as a critical limit. This is a common mistake. Some businesses set critical limits based on outcomes that can only be tested after the fact, like microbiological counts. These are not suitable as real-time critical limits. You need a parameter you can measure during the process, such as temperature, time, pH, water activity, or chlorine concentration.

Monitoring, Corrective Actions, and Verification

Defining CCPs and their critical limits is only part of the requirement. ISO 22000 also requires you to establish how each CCP will be monitored, what corrective actions will be taken when a critical limit is breached, and how you will verify that the system is working.

Monitoring Procedures

Your monitoring procedure must specify what is measured, how it is measured, how often, by whom, and using what equipment. Monitoring frequency should be sufficient to detect deviations in time to prevent unsafe product from proceeding further in the process. For continuous processes, continuous monitoring with automated alarms is often the most appropriate approach. For batch processes, monitoring at defined intervals may be acceptable if justified.

Corrective Actions

When a critical limit is breached, you need a predefined corrective action. This must address two things: what happens to the affected product, and what is done to bring the process back under control. The affected product must be identified, segregated, and evaluated before any decision is made about its disposition. It cannot simply be released. The process must be corrected before production resumes. All of this must be documented.

Verification Activities

Verification confirms that your HACCP system is actually controlling the hazards it is designed to control. This includes reviewing monitoring records, conducting periodic testing of finished product, calibrating monitoring equipment, and reviewing corrective action records. Internal audits of your HACCP system are a key verification activity, and they should be conducted by someone who was not involved in implementing the system. For more on running effective internal audits, see our guide on how to run ISO internal audits that actually find problems.

Common Mistakes When Defining CCPs

Having reviewed many HACCP plans during audits and consulting engagements, the same mistakes appear repeatedly. Knowing these in advance will save you significant rework.

Too Many CCPs

More is not better when it comes to CCPs. If you designate every control measure as a CCP, you dilute the focus on the steps that truly matter. You also create an unmanageable monitoring burden that is likely to result in poor compliance in practice. Be disciplined about applying the decision tree. If a hazard can be adequately managed through an OPRP, classify it as such.

Critical Limits Not Based on Validated Science

Setting a critical limit of “cook until done” or “refrigerate at cold temperature” is not acceptable. Every critical limit must be specific, measurable, and scientifically justified. If you are operating in a novel process or with a new product, you may need to conduct or commission process validation studies to establish your critical limits.

Monitoring Records That Are Clearly Fabricated

This sounds obvious but it happens. When monitoring records show every single measurement hitting exactly the target value with no variation, auditors become suspicious. Real processes have natural variation. Your records should reflect that. Equally, monitoring records should be completed in real time, not reconstructed at the end of a shift.

Failing to Review CCPs When Processes Change

Your HACCP plan is a living document. Any time you introduce a new product, change a raw material supplier, modify a process step, or change equipment, you must review whether your existing CCP designations and critical limits remain valid. Many businesses complete their initial HACCP analysis and then fail to update it as their operations evolve. This is a significant non-conformity under ISO 22000.

Integrating CCPs Into Your Broader ISO 22000 System

Your CCP analysis does not exist in isolation. It sits within a broader food safety management system that includes management commitment, communication, traceability, and continual improvement. ISO 22000 requires that your HACCP plan be supported by documented information, that your team is competent to implement and monitor it, and that top management is engaged in reviewing its effectiveness.

If you are also considering how ISO 22000 compares to other food safety certification schemes, it is worth reading our comparison of ISO 22000 and SQF certification to understand where each standard has different expectations around HACCP documentation and verification.

Traceability is another area that intersects directly with your CCP system. If a critical limit is breached and product needs to be recalled, your traceability system must be capable of identifying exactly which batches are affected. For a deeper look at how traceability requirements work across the food chain, our guide on ISO 22005 traceability in the feed and food chain is worth reviewing.

Getting External Help With Your HACCP Analysis

For businesses going through ISO 22000 certification for the first time, the hazard analysis and CCP identification process is often the most technically demanding part of the entire implementation. It requires food science knowledge, process understanding, and familiarity with the regulatory environment in your sector. If your internal team does not have this expertise, bringing in an experienced food safety consultant is a sound investment.

A good consultant will not just complete the paperwork for you. They will work with your team to build genuine understanding of why each CCP has been designated and how to monitor it effectively. That knowledge needs to live within your organisation, not just in a folder of documents. If you are unsure how to find the right consultant for this kind of work, CertBetter connects food businesses with verified ISO consultants and accredited certification bodies. You submit one form and receive up to three competing quotes from vetted providers, at no cost to you. It is a straightforward way to find someone with genuine food safety and ISO 22000 expertise without spending weeks searching and comparing.