CCPCritical Control Point

A Critical Control Point is a specific step in your process where you can apply a control that will prevent, eliminate, or reduce a food-safety hazard to an acceptable level — and at which loss of control would result in an unacceptable risk to the consumer because no later step will fix the problem. The 'no later step will fix it' clause is what makes a CCP critical rather than merely useful. A pre-cook wash that reduces microbial load is a control point; the cook step that delivers the kill is the critical control point. The wash is helpful; the cook is non-negotiable.

Cooking is a CCP for pathogen control in ready-to-eat product. Metal detection is a CCP for physical contamination. Allergen changeover verification is a CCP for cross-contact. pH and water-activity control are CCPs for acidified and shelf-stable foods. Cold-chain temperature is a CCP for refrigerated growth control. Each one has a critical limit; each one is monitored on a defined cadence; each one has a corrective action defined in advance if the limit is breached; each one is verified independently of the operator running it.

CCP identification flows from the hazard analysis, which is itself driven by the product description, the intended use, the process flow diagram and the on-floor verification of that diagram. The Codex decision tree (CXC 1-1969 Annex Diagram 2) is the canonical method, applied at each process step in turn. The output is one of: not a CCP / CCP / process modification required.

1. Q1 — Do preventive measures exist for the identified hazard at this step? If no, control is not necessary here for safety; modify the process or move the control elsewhere. If yes, proceed.
2. Q2 — Is the step specifically designed to eliminate or reduce the likely occurrence of the hazard to an acceptable level? If yes, this step is a CCP. If no, proceed.
3. Q3 — Could contamination with identified hazards occur in excess of acceptable levels, or could these increase to unacceptable levels? If no, not a CCP. If yes, proceed.
4. Q4 — Will a subsequent step eliminate the identified hazard or reduce the likely occurrence to an acceptable level? If yes, not a CCP (the subsequent step is the CCP). If no, this step is a CCP.

Under FSMA preventive controls (21 CFR 117 Subpart C) the equivalent concept is the Preventive Control — broader than CCP because it explicitly includes allergen controls, sanitation controls and supply-chain controls in addition to process controls. Process Preventive Controls behave operationally identically to classic CCPs: critical limit, monitoring, corrective action, verification. The terminology is different; the operational pattern is the same.

Every CCP has at least one critical limit — a measurable value that separates safe from unsafe. Critical limits are scientifically justifiable, validated against the underlying hazard, and unambiguously measurable in real time by the operator at the kiosk using a calibrated instrument. A critical limit that cannot be measured at the moment of production is not a critical limit; it is a hopeful belief about a downstream test.

• Cook step — internal temperature ≥ 71.1 °C for at least 15 seconds (or the equivalent FSIS lethality-table time/temperature combination for the specific pathogen target).
• Metal detector — rejection at ≥ 2.0 mm Fe, ≥ 2.5 mm non-Fe, ≥ 3.0 mm SS, verified by test-piece challenge at start-up, every 4 hours during the run, after every change-over, and at end of run.
• Acidified-food pH — equilibrium pH ≤ 4.6 within 24 hours, validated by a Process Authority letter under 21 CFR 114.
• Allergen changeover — ATP-bioluminescence swab < 100 RLU on direct food-contact surfaces (specific RLU threshold validated against the actual allergen and the swab method in use).
• Cold-chain hold — product temperature ≤ 4 °C throughout storage, continuously logged at the chamber and per-pallet verified daily.
• Water-activity (a_w) for shelf-stable — a_w ≤ 0.85 measured per batch on a calibrated water-activity meter.
• Retort process for low-acid canned food — F₀ ≥ scheduled-process value validated by Process Authority, with the per-cycle thermal record retained.

A CCP without all three of these is not a CCP; it is a hopeful belief about the process. The three are independent activities with different actors, cadences and records, and every audit will sample each of them.

• Monitoring — a scheduled observation or measurement against the critical limit. What is measured, by whom, with what instrument, how often, recorded where. The record must be made at the time of monitoring (ALCOA+ contemporaneous principle), signed or initialled by the named individual performing the check, and retained for the period required by the applicable regime (typically 2 years under 117 / 120 / 123, 1 year under FSIS 417 for slaughter and refrigerated product, 2 years for everything else).
• Corrective action — what happens when the critical limit is breached. The pre-defined action covers four elements per Codex Principle 5: bring the process back into control, identify the affected product and isolate it pending evaluation, evaluate the affected product for safety, and prevent recurrence by addressing the root cause. The corrective-action record must capture all four.
• Verification — periodic activities, performed by someone other than the routine monitor, that confirm the system as a whole is operating as designed. Calibration of monitoring instruments, review of monitoring records (typically QA review within 7 days under 117.165(a)(3) and within 1 week of generation under FSIS 417.5(c)), end-product or environmental sampling, internal audits of the HACCP plan, and the annual reassessment of the plan under 117.170 / 417.4.

The two words are confused often enough that they're worth separating explicitly. They answer different questions and require different evidence.

• Validation — evidence that the chosen critical limit, when met, actually controls the hazard. Answers: 'is the limit right?' Done once at HACCP-plan development, and re-done on every significant change (new product, new line, new ingredient, new supplier, new piece of equipment, new pathogen reassessment). Evidence is scientific literature, validated process-authority calculations (for retort, acidification, hot-fill), challenge studies, or published kill-step lethality tables (FSIS Appendix A for cooking, for example).
• Verification — on-going evidence that the system is operating as designed. Answers: 'is the plan running as written?' Done routinely on a defined cadence. Evidence is calibration records, monitoring-record review by QA, end-product or environmental sampling, internal audits, and the annual reassessment.

Auditors will ask for both, separately. A CCP with a critical limit pulled out of a textbook with no underlying validation is unvalidated and will fail an FDA preventive-controls audit (117.155 — written hazard analysis and reanalysis on a defined cadence). A CCP with routine monitoring but no record review by anyone other than the operator is unverified and will fail any GFSI scheme audit (BRCGS / SQF / FSSC) on the management-review and internal-audit clauses.

1. Too many CCPs. Every step becomes a CCP because nobody on the team wanted to argue the decision tree. The plan becomes unmanageable, monitoring becomes tick-box, and the actual safety-critical step gets the same attention as the cosmetic ones. Fix: re-run the Codex tree with a multidisciplinary team and demote control points that are not truly critical.
2. Too few CCPs. Hazards left to 'good practice' without a measurable control. Common in plants where the team is reluctant to commit to a critical limit because of the operational consequence of hold-on-breach. Fix: hazard analysis must precede CCP identification — if a hazard is identified, it must have a control somewhere, and that control needs a limit.
3. Critical limits not validated. Limits chosen by analogy ('we've always run it at 75°C') or copy-pasted from a generic HACCP template. Fails 117.130(b) on hazard-analysis written documentation. Fix: each critical limit traces to a scientific basis — literature, Process Authority letter, validated challenge study, or FSIS lethality table — and the basis is referenced in the HACCP plan.
4. Monitoring captured on paper only with no real-time hold capability. Operator records a temperature on a clipboard at end of shift from memory; if the temperature was out of spec at 11:14 nobody finds out until the QA review on Tuesday. Fix: monitoring at the kiosk in real time with hard auto-hold on out-of-spec — paper monitoring is not Part-11 traceable and is not contemporaneous.
5. Corrective actions documented as 'informed supervisor' with no product disposition. Half the four-element Codex Principle 5 requirement is missing — the affected product was never isolated or evaluated. Fix: corrective-action template enforces all four elements (process restored, product isolated, evaluation outcome, recurrence prevention) before the record can close.
6. Verification skipped during busy periods. Calibration deferred, record review deferred, internal audit deferred. The audit cycle that catches everything quietly stops running. Fix: verification tasks are scheduled with hard due-dates and overdue items block downstream activities (e.g. a metal detector cannot run production after a calibration is overdue).
7. Calibration of CCP monitoring equipment not on schedule. The thermocouple drifted, the metal-detector test pieces are worn, the pH meter is reading 0.3 units low. The monitoring records look fine but the underlying measurement is wrong. Fix: every CCP instrument is on a calibration schedule with auto-task generation, the instrument is locked out at the kiosk when the calibration is overdue, and the calibration certificate is retained for at least 2 years.

• Codex Alimentarius CXC 1-1969 Annex — the 7 HACCP principles and the CCP decision tree. The international baseline that every national rule references.
• 21 CFR 117 Subpart C — US FSMA preventive-controls rule for human food. CCPs are the Process Preventive Controls (117.135), with monitoring (117.140), corrective actions (117.150), verification (117.155–165) and reanalysis (117.170) explicitly defined.
• 21 CFR 117 Subpart G — Supply-chain Program (FSMA preventive controls for hazards requiring supplier control).
• 21 CFR 120 — Juice HACCP. Explicit CCP requirements for pathogen reduction, allergen labelling and patulin in apple juice.
• 21 CFR 123 — Seafood HACCP. Per-product CCPs for histamine, parasites, pathogens and chemical hazards.
• 21 CFR 114 — Acidified Foods. Scheduled-process letter and equilibrium pH ≤ 4.6 as the canonical acidified-food CCP.
• 21 CFR 113 — Low-Acid Canned Foods. Scheduled retort process with F₀ as the canonical CCP, requires a Process Authority and a Better Process Control School-trained operator.
• 9 CFR 417 — USDA-FSIS HACCP for meat and poultry. CCPs identified per FSIS Appendix A (lethality), Appendix B (stabilisation) and similar.
• ISO 22000:2018 §8.5 — internationally-recognised food-safety management system. CCPs sit alongside Operational Prerequisite Programmes (OPRPs) — OPRPs are similar but apply where the consequence of loss-of-control is significant but not necessarily catastrophic.
• GFSI benchmarked schemes (BRCGS Food Safety Issue 9, SQF Edition 9, FSSC 22000 v6, IFS Food v8) — all require a documented HACCP plan with CCPs, monitoring and corrective actions. Audit nonconformities on CCP programmes are typically Major or Critical.
• 21 CFR Part 11 / EU Annex 11 — monitoring records, corrective-action records and verification records are all electronic records subject to ALCOA+ data-integrity and Part-11 signing where applicable.

• Monitoring-task completion rate — share of scheduled CCP monitoring tasks completed within the scheduled window. World-class: 100%. Below 99% means the cadence or the operator workload is wrong.
• Critical-limit breach rate — share of monitoring observations outside the critical limit. World-class: very low single digits; trending upward indicates a process drift that warrants engineering attention.
• Auto-hold-to-resolution time — median minutes from auto-hold to the corrective-action record being signed off. World-class: under 60 minutes for line-side CCPs. Long resolution times indicate the corrective-action workflow is unclear or the responsible-individual assignment is wrong.
• QA verification-review currency — share of monitoring records reviewed by QA within 7 days (117.165(a)(3) / FSIS 417.5(c) baseline). World-class: 100%.
• Calibration-on-schedule rate — share of CCP monitoring instruments with current calibration. World-class: 100%. Any overdue calibration is itself a CCP failure waiting to happen.
• HACCP-plan reanalysis currency — share of plans reanalysed within the required cadence (annually or on change, per 117.170 / 417.4). World-class: 100%.
• Inspection findings on 117 Subpart C / 120 / 123 / 417 — mature sites: zero in any inspection cycle. Any finding here is a structural process gap, not a one-off.

1. CCPs are configured against the HACCP plan record — each CCP carries the hazard, the critical limit (typed-number with units, lower-bound, upper-bound, or set-point with tolerance), the monitoring cadence, the responsible role, the required instrument type, and the corrective-action template.
2. Operational limits are configured separately from critical limits — the kiosk shows both, in different colours, with explicit semantics ('adjust the burner' vs 'hold the batch').
3. Monitoring tasks auto-spawn at the kiosk on the configured cadence (every N minutes, every N batches, at start-up + every 4h + after changeover + at end-of-run, etc.) with the operator role-gated to those qualified on the relevant SOP.
4. Entry is typed-number with range enforcement against the critical limit — free-text out-of-spec recording is structurally impossible.
5. On critical-limit breach, the system auto-holds the affected lot range (configurable: just this batch / all batches since last successful monitoring / all batches on the line since last cleaning), opens a deviation routed to the responsible role, and surfaces the hold on the QA controller dashboard and the operator's kiosk home tile.
6. The corrective-action workflow enforces all four Codex Principle 5 elements — process-restored, product-isolated, evaluation-outcome, recurrence-prevention — and cannot close without each being signed off (Part 11 §11.50 manifest).
7. QA verification review (117.165 / FSIS 417.5(c)) is a daily QA task — the QA controller sees every monitoring record from the prior period in chronological order with breach events highlighted, and signs review within the 7-day window.
8. Calibration of every CCP instrument is on a separate schedule — the instrument is locked out at the kiosk when calibration is overdue, and the calibration certificate is attached to the calibration record.
9. Annual HACCP-plan reanalysis (117.170 / 417.4) is a scheduled QA task with the previous plan, the period's deviations, the period's CAPAs and the period's complaint history pre-attached for the reanalysis team.
10. Reports — daily monitoring summary, breach trend, auto-hold trend, corrective-action closure rate, QA verification currency, calibration currency — render through the @react-pdf/renderer Worker-safe pipeline into the regulated-reports bucket. Mobile-safe ≤390px on every kiosk surface.