A critical control point, or CCP, is a step where a specific, measurable control can be applied to eliminate a food safety hazard or reduce it to an acceptable level. Not every step in a process qualifies. Identifying the right ones depends on a structured decision tree, a validated critical limit, and a monitoring plan precise enough to catch a deviation in real time.
A CCP list overloaded with steps that don't actually meet the decision tree's criteria dilutes attention from the points that really need it. Every step incorrectly labeled critical is monitoring effort spent somewhere it isn't actually required, while a potential hazard elsewhere gets less scrutiny than it deserves. This guide walks through the decision tree logic that separates a CCP from everything else, how to set correct critical limits, and what monitoring needs to look like in practice. It is written by Maria Falbo, a Lead Auditor with decades of experience auditing food safety management systems.
A critical control point is a step where a control can be applied that prevents, eliminates, or reduces a hazard to an acceptable level, and where that control is the deciding factor in whether the hazard reaches the consumer. That last part matters. A step can be important to food quality or general hygiene without being a CCP in the HACCP sense, if a different, later step ultimately controls the hazard instead. For the broader context of how CCPs fit into the full HACCP framework, see our What Is HACCP? guide.
This is where CCPs get confused with prerequisite programs most often. A prerequisite program control addresses baseline conditions across the whole facility, regardless of the product in question. A CCP addresses a specific, identified hazard at a specific point in a specific process. For the full breakdown of what prerequisite programs cover, see our Prerequisite Programs guide.
A CCP decision tree exists to apply this distinction consistently, rather than leaving it to individual judgment on a case-by-case basis. The logic generally works through a sequence of questions for each identified hazard.
First, does a control measure exist at this step, or could the process be modified so one does? If no control is possible at a step, the process itself needs to change, since an uncontrolled significant hazard can't simply be accepted.
Second, is control at this specific step actually necessary for food safety, or does something else — a later step or a prerequisite program — already handle it? If control here isn't necessary, this step isn't a CCP.
Third, is this step specifically designed to eliminate the hazard or reduce it to an acceptable level? If yes, this step is a CCP. If the step only reduces risk without fully controlling it on its own, move to the next question.
Fourth, could the hazard increase to an unacceptable level at or after this step? If not, this step isn't a CCP.
Fifth, will a later step in the process eliminate the hazard or reduce it to an acceptable level? If yes, that later step is the CCP instead, not this one. If no later step will control it, this step is the CCP by default, since nothing downstream will catch what gets missed here.
This is Principle 2 of the seven-principle framework. For the full technical depth on all seven principles, see our 7 Principles of HACCP guide, and for how this step fits into the complete twelve-step sequence, see our 12 Steps of Applying HACCP guide.
The question teams struggle with most is the second one — whether control at this specific step is actually necessary given everything else already in place. It's tempting to mark a step as a CCP simply because something important happens there — cooking, cooling, packaging — without genuinely asking whether a later step or an existing prerequisite program already handles the risk. A decision tree applied honestly sometimes produces fewer CCPs than a team initially expected, and that's usually a sign it's working correctly, not a sign something was missed.
Our HACCP Training course covers hazard analysis, CCP determination, and monitoring from the ground up.
A critical limit needs to be a specific, measurable value, not a general description of an acceptable condition. "Cook thoroughly" isn't a critical limit. "Reach an internal temperature of 165°F for at least 15 seconds" is.
The number itself also has to be defensible under real scrutiny, not a figure someone remembered from a previous job or assumed would transfer cleanly from a different product line. A validation study, published research specific to the actual hazard, or documented regulatory guidance are legitimate sources.
Once a critical limit is set, it needs to be observable or measurable in real time, during actual production, not confirmed after the fact through a lab result that arrives days later. A limit that can't be checked while production is still happening usually can't actually function as a control.
Take a cooking step with a critical limit of 165°F. Many operations run the actual process at 170°F as an internal target, treating anything that drifts below that, but still above 165°F, as an early signal to check equipment before the process ever gets close to the number that actually matters for food safety.
This buffer isn't mandatory, but it's a practical way to keep a deviation from happening in the first place, rather than relying entirely on catching and correcting one after it's already occurred. The critical limit remains the actual line for food safety purposes. The operational target is simply an internal management tool for early detection.
Monitoring needs to answer one question reliably: is this CCP currently within its critical limit? The method has to be fast enough to catch a problem while the affected product can still be contained, not discovered once it's already left the facility.
Continuous monitoring — an automated temperature logger, for instance — catches a deviation the moment it happens and is generally preferable wherever it's technically feasible. Periodic monitoring, a manual check at defined intervals, works when continuous monitoring isn't practical, but the interval has to be tight enough that a problem is unlikely to escape undetected between checks.
Whoever performs the monitoring needs authority to act the moment a deviation is found, not just the responsibility to record it and escalate later. A monitoring system that identifies a deviation but has no immediate path to corrective action is monitoring in name only.
The monitoring gap I see most often isn't the frequency or the method — it's authority. I've reviewed plans where the person checking a CCP is required to record a deviation and then wait for a supervisor to actually decide what happens next, and sometimes this reaction is not timely. By the time anyone with real authority responds, an entire production run has often already been completed and shipped.
There's no fixed number, and fewer is often a sign the decision tree was applied correctly rather than a sign something was missed. A process with two or three CCPs, each backed by a solid critical limit and monitoring plan, is generally stronger than one with a dozen loosely justified ones.
No. A CCP is always a specific step in the process. Personnel behavior — handwashing, protective clothing — is addressed through prerequisite programs, not treated as a CCP in its own right.
This triggers the corrective action principle: the affected product needs to be identified and dealt with appropriately, and the actual cause of the deviation needs to be investigated and corrected, not just the immediate symptom.
Yes. Any meaningful change to the process, equipment, ingredients, or facility can affect whether an existing critical limit is still valid.
Maria Falbo has over 25 years of experience working as a Lead Auditor for certification bodies worldwide. She founded Logix ISO with the mission of making expert-level ISO training accessible to organizations of all sizes. Her work spans Quality, Environmental, Occupational Health and Safety, Food Safety, Automotive, and Energy management systems.
Learn more about Maria →Self-paced · 365-day access · Training certificate included