HACCP Principles

CCP vs OPRP vs PRP: Understanding the Differences

Critical Control Points, OPRPs, and PRPs: A Clear Comparison

Food safety controls exist on a spectrum, from general baseline hygiene measures to highly specific, continuously monitored critical points. Understanding the three tiers - Prerequisite Programmes (PRPs), Operational Prerequisite Programmes (OPRPs), and Critical Control Points (CCPs) - is essential for building a HACCP system that is both thorough and manageable. Misclassifying a control measure leads to either under-monitoring of genuine critical points or over-monitoring of routine hygiene steps. This article explains each tier clearly with practical examples from UK hospitality.

Key takeaways

PRPs are baseline hygiene measures managed through SOPs and periodic auditing.

OPRPs control specific significant hazards through documented procedures but without full CCP-level monitoring.

CCPs require measurable critical limits, real-time monitoring, and immediate corrective actions.

Correct classification prevents both under-monitoring of critical hazards and over-monitoring of routine controls.

Document your classification reasoning so auditors can follow your logic.

PRPs: The Baseline

Prerequisite Programmes are the fundamental conditions and activities that maintain basic hygiene throughout your operation. They are not specific to any particular hazard or product but provide the general sanitary environment needed for safe food production. Examples include: general cleaning and sanitation schedules, pest management contracts, personal hygiene policies (handwashing, protective clothing), staff food safety training, premises maintenance, supplier approval and incoming goods procedures, potable water supply, and waste management. PRPs are typically managed through standard operating procedures (SOPs) with periodic checks. They do not require the intensive monitoring associated with CCPs. A cleaning schedule is verified through regular audits and visual inspection, not by monitoring every cleaning event against a critical limit. PRPs are required by EC Regulation 852/2004 Annex II and form the foundation of your food safety system. If your PRPs are robust, your HACCP system can focus on the genuinely critical points. If your PRPs are weak, you end up with too many CCPs because baseline hygiene failures create additional significant hazards.

OPRPs: The Middle Ground

Operational Prerequisite Programmes are a category defined explicitly in ISO 22000 but widely used in practice even by businesses not certified to that standard. An OPRP is a control measure identified through the hazard analysis as necessary to control a specific significant hazard to an acceptable level, but which is managed within the prerequisite programme framework rather than the full CCP monitoring system. OPRPs have: specific documented procedures, defined responsibilities, defined action criteria (similar to critical limits but sometimes termed "action limits"), monitoring and recording, and corrective actions when criteria are not met. The key difference from a CCP is that OPRPs do not necessarily require real-time continuous monitoring and the consequences of deviation, while significant, may not be immediately critical. Allergen management in many restaurants is a good example: it requires specific procedures, training, and documentation, and failures can cause serious harm, but it is typically managed through documented processes (labelling, separate storage, communication protocols) rather than continuous real-time monitoring of a measurable parameter.

CCPs: The Critical Points

A Critical Control Point is a step at which a control measure can be applied and is essential to prevent, eliminate, or reduce a significant food safety hazard to an acceptable level. CCPs represent the steps where failure would directly result in an unacceptable food safety risk with no subsequent step to catch it. CCPs have: measurable critical limits (temperature, time, pH), continuous or frequent real-time monitoring, documented monitoring procedures (who, what, when, how), pre-defined corrective actions for deviations, and full documentation and record keeping. In a typical restaurant, CCPs include cooking (achieving 75°C core temperature), cooling (from 63°C to below 8°C within 90 minutes), cold storage (maintaining below 8°C), and hot holding (maintaining above 63°C). Each requires specific, measurable monitoring at defined frequencies with immediate corrective action when limits are breached. The intensive nature of CCP management is why it is important not to over-classify: if you treat 15 steps as CCPs, the monitoring burden becomes unsustainable and quality suffers.

HACCP Principles

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Classifying Your Controls Correctly

To classify a control measure, work through this logic: First, is the hazard significant (identified through your hazard analysis with a risk score above your threshold)? If no, manage it through basic PRPs. If yes, proceed. Second, apply the Codex decision tree (or equivalent method). Is this step a CCP? If yes, apply full CCP management. If the decision tree says it is not a CCP but the hazard is still significant and requires specific documented controls beyond general PRPs, classify it as an OPRP. If the hazard is adequately controlled by general PRPs, leave it as a PRP. A practical test: if you need to measure a specific parameter (temperature, time, pH) at a specific frequency and take immediate action if the measurement is out of range, it is probably a CCP. If you need specific documented procedures and periodic verification but not real-time monitoring of a measurable parameter, it is probably an OPRP. If general good practice and periodic auditing are sufficient, it is a PRP. Document your classification decisions and the reasoning behind them. An EHO or auditor should be able to understand why you classified each control at the level you did.

What to do next

Review your current control classifications

List all your control measures and check whether each is classified as PRP, OPRP, or CCP. Verify that the classification matches the monitoring intensity actually applied.

Identify controls that may be misclassified

Look for CCPs that are managed like PRPs (insufficient monitoring) or PRPs being treated as CCPs (excessive monitoring creating an unsustainable burden).

Document your classification logic

For each control measure, record why it is classified at its current level. Reference your hazard analysis, decision tree outcomes, and practical monitoring feasibility.

Common mistakes to avoid

Mistake

Treating allergen management as a PRP when it should be at least an OPRP

Instead

If you serve customers with severe allergies, allergen management requires specific documented procedures, training, and verification beyond general hygiene - classify it appropriately.

Mistake

Classifying every control as a CCP

Instead

Over-classification makes the system unmanageable. Most businesses should have 3 to 7 CCPs. If you have more, some are likely better classified as OPRPs or PRPs.

Mistake

Not recognising OPRPs as a valid category

Instead

OPRPs fill an important gap between general PRPs and intensive CCPs. Use them for hazards that need specific controls but not real-time measurable monitoring.

Frequently asked questions

Are OPRPs recognised in UK food law?

UK food law (EC 852/2004) requires HACCP-based procedures and prerequisite measures, but does not explicitly use the term OPRP. OPRPs are formally defined in ISO 22000. However, the concept is widely used in practice and accepted by UK enforcement officers. Many food safety professionals use OPRPs even without ISO 22000 certification because the three-tier classification makes the system more practical to manage.

How many of each should a typical restaurant have?

A typical restaurant might have: 8 to 12 PRPs (cleaning, pest control, training, maintenance, water, waste, supplier management, personal hygiene, etc.), 2 to 5 OPRPs (allergen management, raw/ready-to-eat separation, thawing procedures), and 3 to 7 CCPs (cooking, cooling, cold storage, hot holding, delivery acceptance). The exact numbers depend on your operation, menu, and risk profile.

Can a control move between categories?

Yes. A change in your operation might elevate a PRP to an OPRP or CCP. For example, if you start serving raw fish (sushi, ceviche), your incoming fish quality control might need to move from a PRP to a CCP because there is no subsequent cooking step. Review classifications whenever your operation changes.

What monitoring is required for an OPRP?

OPRPs require documented procedures, defined action criteria, periodic monitoring (not necessarily continuous or real-time), records of checks, and corrective actions when criteria are not met. The intensity is less than CCP monitoring but more structured than general PRP verification. For allergen management, for example, this might mean documented cross-contact prevention procedures, staff competency assessments, and periodic allergen audits.

HACCP Principles