HACCP Principles

HACCP Principle 2: How to Identify Critical Control Points

Identifying Critical Control Points in Your Food Safety System

A Critical Control Point (CCP) is a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. The challenge for most food businesses is not finding CCPs - it is avoiding the trap of declaring too many. If everything is critical, nothing is critical, and your monitoring system becomes unmanageable. This article explains how to correctly identify CCPs using the Codex Alimentarius decision tree, with worked examples relevant to UK hospitality operations.

Key takeaways

A CCP is the last step where you can prevent, eliminate, or reduce a significant hazard to an acceptable level.

Use the Codex decision tree as a guide, but apply professional judgement and document your reasoning.

Most hospitality businesses should have 3 to 7 CCPs - more than that suggests over-identification.

Context determines whether a step is a CCP: the same step may or may not be critical depending on your menu and processes.

What Makes a Control Point "Critical"?

A control point becomes critical when it is the last opportunity to prevent, eliminate, or reduce a significant hazard to an acceptable level. The word "critical" is doing heavy lifting here. Consider cooking chicken: this is the final step where Salmonella and Campylobacter can be eliminated. If cooking fails, no subsequent step (holding, plating, service) will remove those pathogens. That makes cooking a CCP. Contrast this with vegetable washing: while it reduces bacterial load and removes soil, it is not the last line of defence if those vegetables will subsequently be cooked. In that case, vegetable washing is a control point but not a critical one. However, if you serve raw salad leaves, washing becomes far more significant because there is no subsequent kill step. Context matters enormously when determining CCPs, and this is why you cannot simply copy another business's HACCP plan.

Using the Codex Decision Tree

The Codex Alimentarius decision tree asks four sequential questions for each process step where a significant hazard has been identified. Question 1: Do control measures exist? If no, modify the step, process, or product. If yes, proceed. Question 2: Is this step specifically designed to eliminate or reduce the hazard to an acceptable level? If yes, it is a CCP. If no, proceed. Question 3: Could contamination occur at unacceptable levels or increase to unacceptable levels? If no, it is not a CCP. If yes, proceed. Question 4: Will a subsequent step eliminate or reduce the hazard to an acceptable level? If yes, it is not a CCP. If no, it is a CCP. This decision tree is a guide, not an absolute rule. The FSA and most local authorities accept that professional judgement is needed alongside the tree. The key is to document your reasoning so that anyone reviewing your plan can follow your logic.

Common CCPs in Hospitality

In a typical restaurant or hotel kitchen, the most common CCPs are: cooking (ensuring core temperatures reach at least 75°C, or 70°C for 2 minutes), chilling/cooling (bringing cooked food from 63°C to below 8°C within 90 minutes, then to below 5°C within a further 4 hours), cold holding (maintaining chilled food below 8°C, or below 5°C as best practice), hot holding (maintaining food above 63°C), and receiving deliveries (checking that chilled goods arrive at or below 8°C and frozen goods are at or below -18°C). Some operations will have additional CCPs depending on their menu. Sous vide cooking requires precise time-temperature combinations validated against pathogen reduction tables. Smoking and curing introduce hazards around Clostridium botulinum that require specific controls. Allergen management at the point of order-taking and plating may be treated as a CCP in businesses serving customers with severe allergies, though many manage this through prerequisite programmes instead.

HACCP Principles

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Avoiding the Over-Identification Trap

A common mistake, particularly among businesses writing their first HACCP plan, is to identify too many CCPs. When a kitchen has 15 or 20 CCPs, monitoring becomes impractical and records become superficial tick-box exercises. The whole point of HACCP is to focus attention on the steps that truly matter. Most hospitality businesses will have between 3 and 7 CCPs. If your hazard analysis yields significantly more, ask yourself: are some of these actually managed by prerequisite programmes? Could some be grouped (e.g. all cooking steps under a single CCP with different critical limits by product)? Are some control points rather than critical control points? Remember that Operational Prerequisite Programmes (OPRPs) exist as a middle ground - steps that are important but not CCPs, managed with defined controls but without the full CCP monitoring framework.

What to do next

Apply the decision tree to each significant hazard

For every significant hazard identified in Principle 1, work through the four Codex decision tree questions and record the outcome.

Review your CCP count

If you have more than 7 CCPs, critically assess whether some are better managed as OPRPs or through prerequisite programmes.

Create a CCP summary table

Build a clear table listing each CCP, the hazard it controls, the control measure, the critical limit, and the monitoring method. This becomes the core of your HACCP plan.

Common mistakes to avoid

Mistake

Declaring every step as a CCP

Instead

This dilutes focus and makes monitoring impractical. Only steps where control is essential and there is no subsequent step to catch failures should be CCPs.

Mistake

Ignoring prerequisite programmes when identifying CCPs

Instead

Well-implemented PRPs (cleaning, pest control, supplier approval) eliminate many hazards before they reach a CCP. Factor these in.

Mistake

Applying the decision tree mechanically without context

Instead

The decision tree is a tool to structure thinking, not a substitute for understanding your own operation. Professional judgement is essential.

Frequently asked questions

How many CCPs should a typical restaurant have?

Most restaurants have between 3 and 7 CCPs. Common ones include cooking temperature, cooling, cold storage, hot holding, and delivery acceptance. The exact number depends on your menu complexity and processes. A simple sandwich shop might have 2 to 3; a hotel with banqueting, room service, and multiple restaurants might have 6 to 8.

Is allergen management a CCP?

It depends on your operation. Many businesses manage allergens through prerequisite programmes (staff training, labelling systems, dedicated equipment). However, if you serve customers with severe allergies and the point of meal assembly is the last opportunity to prevent allergen cross-contact, it may warrant CCP status. The key test is whether failure at this step could cause serious harm with no subsequent step to catch it.

What is the difference between a control point and a critical control point?

A control point (CP) is any step where a hazard can be controlled. A critical control point (CCP) is a step where control is essential because it is the last opportunity to prevent, eliminate, or reduce a significant hazard. Washing vegetables before cooking is a CP; cooking to 75°C is a CCP because cooking is the kill step.

Can I have a CCP at the delivery stage?

Yes. Checking delivery temperatures is a common CCP because accepting chilled goods above 8°C introduces a significant biological hazard. If you have no subsequent step to eliminate that hazard (you are not going to cook everything that arrives), then delivery acceptance is your last line of defence and qualifies as a CCP.

HACCP Principles