.png)
Last updated: October 2026
CCP stands for Critical Control Point. In HACCP food safety, a critical control point is a step where a control measure is essential to prevent, eliminate or reduce a food safety hazard to an acceptable level, such as cooking poultry to 165°F or metal detecting every pack. Each CCP has a measurable critical limit, monitoring and corrective action.
That is the definition used by both the FDA's HACCP Principles and Application Guidelines and the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969), which contains the internationally recognized HACCP annex. Not every processing step is a CCP. Identifying critical control points correctly is the second of the seven HACCP principles, and it's one of the most commonly misapplied parts of a HACCP plan.
What Makes a Step a Critical Control Point?
A step qualifies as a CCP only when two things are both true: a hazard that matters is reasonably likely to occur at or before that step, and no later step in the process will reliably eliminate or reduce that hazard to an acceptable level. If a later step - like a cook step, or a customer-side control - would catch the same hazard, the earlier step is usually a control point (CP) or a prerequisite program, not a CCP.
Most HACCP training programs apply a version of the CCP decision-tree logic built into the Codex HACCP annex: is there a control measure at this step; is the step specifically designed to eliminate or reduce the hazard to an acceptable level; could contamination occur or increase beyond an acceptable level at or after this step; and will a subsequent step eliminate the hazard or reduce it to an acceptable level. A 'yes/no' path through these questions, applied consistently for each hazard at each process step, is what most HACCP plans document as the CCP determination.
CCP Decision Tree: 4 Questions to Find a Critical Control Point
Ask these four questions, in order, for each identified hazard at each process step. The wording below follows the Codex decision tree as reproduced in the Canadian Food Inspection Agency's guidance on determining critical control points; Codex notes that its tree is guidance and that other approaches may be used.
- Do preventive control measures exist? If not, and control at this step is necessary for safety, modify the step, process or product. If control at this step is not necessary for safety, it is not a CCP for that hazard.
- Is the step specifically designed to eliminate or reduce the likely occurrence of a hazard to an acceptable level? If yes, and it is the best step at which to control the hazard, it is a CCP. If no, go to question 3. (CFIA notes this question applies to processing steps only; for incoming materials treat it as not applicable.)
- Could contamination with the identified hazard(s) occur in excess of acceptable level(s), or could the hazards increase to unacceptable levels? If no, it is not a CCP for that hazard. If yes, go to question 4.
- Will a subsequent step eliminate identified hazard(s) or reduce likely occurrence to acceptable level(s)? If yes, this step is not a CCP for that hazard (make sure the later step really controls it). If no, this step is a critical control point.
The HACCP team makes this call and records the reasoning. Auditors from SQF, BRCGS, or FSSC 22000 will expect to see the rationale documented, not just the final list of CCPs.
CCP vs. Control Point vs. Prerequisite Program
A control point (CP) is any step where a hazard could be controlled, but where losing control wouldn't lead to an unacceptable food safety risk on its own - a metal detector on a line that also has a downstream detector, for example, or a labeling check backed up by a second verification. A prerequisite program (like sanitation, pest control, or supplier approval under a documented food safety program) creates the conditions that let a HACCP plan work, but it isn't usually where the plan places its CCPs. Confusing a CP with a CCP is one of the most common reasons auditors flag a HACCP plan - either too many CCPs (which makes the plan unmanageable) or too few (which leaves a real hazard unmanaged).
| Term | What it controls | Example |
|---|---|---|
| Critical control point (CCP) | A significant hazard where control at this step is essential and no later step will catch it | The cook step for raw poultry |
| Control point (CP) | A hazard that is managed here, but where a failure alone would not make the product unsafe because another step backs it up | A labeling check with a second verification downstream |
| Prerequisite program (PRP) | The general hygiene conditions that let the plan work | Sanitation, pest control, supplier approval |
Common Critical Control Point Examples in Food Manufacturing
The exact CCPs in a plan depend on the product, process, and hazard analysis, but the following categories show up repeatedly:
- Cooking or pasteurization - where time and temperature are the only reliable way to achieve a required lethality for pathogens like Salmonella or Listeria monocytogenes.
- Cooling - when cooling rate is the sole control preventing spore-forming organisms like Clostridium botulinum or Clostridium perfringens from germinating and growing.
- Metal detection or X-ray inspection - when it's the last point in the process capable of catching a physical hazard before the product ships.
- pH or water activity adjustment - in shelf-stable or acidified products, where formulation is the control that prevents pathogen growth.
- Formulation of preservatives or curing agents - where a specific concentration is what prevents toxin formation.
Some programs also treat a final allergen or label verification step as a CCP, though many QA programs instead manage it as an operational prerequisite program with its own verification - this varies by facility and should be documented as part of the hazard analysis rather than assumed. For a worked example of cooling as a CCP, see our guide to cook-chill cooling limits, CCPs and records.
Critical Control Point Examples With Critical Limits
A critical limit is the measurable value that separates safe from unsafe at a CCP. The limits below are published reference values with their sources; your own limits must come from your hazard analysis and be validated for your product and process.
| Process step (CCP) | Hazard | Critical limit | Monitoring | Source |
|---|---|---|---|---|
| Cooking poultry | Salmonella, Campylobacter | 165°F (74°C) or above, instantaneous | Probe thermometer, each batch | FDA Food Code 2022, 3-401.11(A)(3) |
| Cooking ground beef | E. coli O157:H7 | 155°F (68°C) for 17 seconds | Probe thermometer, each batch | FDA Food Code 2022, 3-401.11(A)(2) |
| HTST milk pasteurization | Pathogens | 161°F (72°C) for 15 seconds (5°F higher for milk products with 10% or more fat or added sweeteners) | Recording thermometer | 21 CFR 1240.61(b) |
| Cooling cooked food | Clostridium perfringens, Bacillus cereus | 135°F to 70°F within 2 hours, and to 41°F or below within 6 hours total | Time and temperature log | FDA Food Code 2022, 3-501.14(A) |
| Acidification of acidified foods | Clostridium botulinum | Finished equilibrium pH of 4.6 or lower | Calibrated pH meter, recorded results | 21 CFR 114.80(a) |
| Metal detection | Metal fragments | Detector rejects ferrous, non-ferrous and stainless test pieces at the validated size on 100% of product; the size is set in the hazard analysis (FDA enforcement guidance treats hard or sharp objects of 7 to 25 mm in ready-to-eat food as a hazard) | Test-piece check at a set frequency, such as hourly | FDA CPG Sec. 555.425 |
| Cold holding | Pathogen growth | 41°F (5°C) or below | Continuous temperature logger | FDA Food Code 2022, 3-501.16(A)(2) |
Reference values differ by context. The Food Code limits above are written for retail and food service, and the FDA's HACCP guidelines use a different worked example for beef patties (a process equivalent to 155°F for 16 seconds). Meat and poultry plants regulated by USDA must set their own critical limits in the HACCP plan under 9 CFR Part 417. Always use the limit that applies to your product, process and regulator.
Critical Limits, Monitoring, and Corrective Actions at a CCP
Once a CCP is identified, HACCP Principles 3 through 5 require a measurable critical limit (a specific temperature, time, pH, or concentration), a monitoring procedure that checks the actual limit during production, and a corrective action plan for what happens when a limit is exceeded. The FDA's HACCP guidelines outline all seven principles together, since CCP identification only works as part of the full system - a CCP without a validated critical limit and a monitoring record isn't a functioning control, just a label on a step.
HACCP Plan Example: One CCP Filled In
The FDA's HACCP plan summary uses seven columns: CCP, hazards, critical limits, monitoring, corrective actions, verification and records. Here is one CCP filled in as an illustration (the values are an example, not a template to copy without validating them for your process). For the full build process, see our guide on how to write a HACCP plan.
| CCP | Hazard | Critical limit | Monitoring (what / how / frequency / who) | Corrective action | Verification | Records |
|---|---|---|---|---|---|---|
| CCP 1: Cooking (chicken) | Salmonella survival | 165°F (74°C) or above internal temperature | Core temperature of 3 pieces per batch, probe thermometer, every batch, line lead | Continue cooking to 165°F; hold and evaluate the product; find the cause | QA reviews logs daily; thermometer calibrated weekly | Cooking log, corrective action log, calibration log |
Validation vs. Verification at a CCP
Validation is proving the critical limit works. It is the part of verification focused on collecting and evaluating scientific and technical information (published research, in-house or laboratory studies) to show that the plan, when properly implemented, controls the hazard. You validate a limit before you rely on it.
Verification is checking that the plan is being followed and still works. Per the FDA's guidelines, it covers the activities, other than monitoring, that determine the validity of the HACCP plan and that the system operates according to it: record review, thermometer calibration and periodic reassessment.
Where CCPs Are Required: HACCP, FSMA and USDA Rules
HACCP is one of several food safety frameworks, and CCPs show up in each in a slightly different way. Seafood processors must have a written HACCP plan under 21 CFR Part 123, and juice processors under 21 CFR Part 120, whenever the hazard analysis finds hazards reasonably likely to occur. Federally inspected meat and poultry establishments follow 9 CFR Part 417, where the plan must list hazards, CCPs, critical limits, monitoring, corrective actions, verification and records. Under the FSMA preventive controls rule, 21 CFR Part 117, controls at CCPs are one kind of process preventive control, used if the hazard analysis identifies any CCPs, inside a broader written food safety plan.
How CCPs Fit Into a Complete HACCP Plan
CCP identification is one part of a seven-principle system that starts with hazard analysis and ends with verification and recordkeeping. For the full walkthrough of all seven principles, see The Smart Way to Meet All 7 HACCP Principles, and for a step-by-step build process, see How to Create a HACCP Plan: Step-by-Step Guide for Food Manufacturers.
FAQ
What does CCP stand for in food safety?
CCP stands for Critical Control Point. In a HACCP system it is a step where control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level. Outside food safety, the same letters mean other things, so look for the HACCP or food safety context.
What is an example of a critical control point?
Cooking raw poultry to an internal temperature of 165°F is a classic example: the cook step is specifically designed to destroy pathogens such as Salmonella, and no later step would. Other common examples are cooling cooked food, acidifying a product to a pH of 4.6 or lower, and metal detection when it is the last chance to catch a physical hazard. See the table above for critical limits and sources.
How many critical control points does a HACCP plan have?
There's no fixed number - it depends entirely on the product and process. A well-built plan typically has a small number of true CCPs (often 1-5 per process), not a long list. A plan with too many CCPs is often a sign that control points and prerequisite programs were mislabeled as CCPs. "The 7 critical control points" is a common mix-up with the seven HACCP principles, which are the steps of the system, not a count of CCPs.
What is the difference between a CCP and a CP?
A CCP (critical control point) is a step where losing control creates an unacceptable food safety risk with no later step to catch it. A CP (control point) is a step where a hazard is managed, but a failure there wouldn't, on its own, result in an unsafe product because another step or program backs it up.
Is cooking always a CCP? Is metal detection a CCP?
Not automatically. Cooking is a CCP when it is the step that controls a pathogen and no later step does, and metal detection is a CCP when it's the last opportunity to catch a physical hazard before the product reaches the consumer. If a later step or inspection would also catch the same hazard, the earlier step may instead be documented as a control point. The answer comes from the hazard analysis and the decision tree, not from the type of equipment.
What happens if a critical limit is exceeded at a CCP?
The HACCP plan's corrective action procedure (HACCP principle 5) takes over: affected product is identified and held, the cause is investigated, the process is brought back under control, and the event is documented. Product produced while the limit was out of control generally cannot be released without an evaluation of its safety.
A HACCP plan is only as strong as its CCP determinations. See how IONI's HACCP Builder identifies CCPs, sets critical limits, and keeps monitoring records tied to your actual process.
.png)
