What Is a CCP in HACCP

If you’ve ever looked at HACCP and thought “this seems complicated,” you’re not alone.

One of the trickiest parts? Understanding what a Critical Control Point (CCP) actually is, and why it matters for your food business.

Here’s the thing: get your CCPs wrong, and you’re not just risking a poor inspection score. You could be risking a food safety incident, a costly product recall, or worse: someone getting seriously ill.

Let me explain what CCPs are, how to identify them, and what you need to do to manage them properly in your UK food business.

What Is A CCP In HACCP?

A Critical Control Point (CCP) is a specific step in your food operation where you must apply control to prevent, eliminate, or reduce a food safety hazard to an acceptable level.

Think of it this way: CCPs are the make-or-break moments in your food production.

If you lose control at a CCP, a hazard could reach your customer and cause harm. These are not “nice to have” controls; they’re essential.

The key word here is “critical.” Not every control point in your business is a CCP. But every CCP is critical to food safety.

HACCP is all about prevention, not detection. Rather than testing every finished product (which wastes time and product), CCPs let you control hazards at the point where they can actually be prevented or eliminated.

That’s why cooking temperature is a CCP for raw chicken. You’re killing bacteria in real-time. That’s prevention.

Are HACCP and CCP the Same?

No, and this trips people up all the time.

HACCP (Hazard Analysis and Critical Control Point) is the entire food safety management system. It’s the framework you use to identify, evaluate, and control food safety hazards throughout your operation.

A CCP is just one part of that system. It’s a specific step where control is essential.

Think of HACCP as the map. CCPs are the critical junctions on that map where you absolutely cannot take a wrong turn.

You’ll typically have multiple CCPs in your HACCP plan: cooking, cooling, chilling, metal detection, and so on. Each CCP is a point where a hazard must be controlled.

CCP vs Control Point: What’s the Difference?

Not every control in your business is a CCP. Some are just good practice. Others are what we call Prerequisite Programmes (PRPs).

So how do you tell the difference?

The Critical vs General Distinction

A Critical Control Point (CCP) is where control is essential to prevent or eliminate a food safety hazard.

If you lose control at a CCP, there’s a significant risk of harm to your customer.

A Control Point (CP) is where you can control a hazard, but it’s not the last or most effective step. Losing control here is not ideal, but the hazard can still be managed later in the process.

And a Prerequisite Programme (PRP) is a general good practice that creates the foundation for food safety: things like handwashing, cleaning schedules, and pest control. Important? Absolutely. But not specific to a single hazard at a single step.

Here’s the test: If you don’t control it, can a hazard reach the customer? If yes, it’s a CCP.

Example: Cold Storage in a Restaurant

Let’s say you run a café that serves pre-made sandwiches.

You store cooked chicken in the fridge before assembling the sandwiches.

Is cold storage a CCP?

Yes.

If the fridge fails and the chicken sits at room temperature for several hours, harmful bacteria like Salmonella or Listeria can multiply to dangerous levels. There’s no further “kill step” after this. The sandwich is served cold.

Cold storage is your last chance to control the hazard. That makes it a CCP.

Now let’s say you also store raw chicken in the fridge before cooking.

Is that cold storage also a CCP?

Possibly not.

Yes, you want to keep raw chicken chilled. But even if the temperature creeps up slightly, the bacteria will be killed during cooking (your next step). Cooking is the CCP. Cold storage of raw chicken is a control point or prerequisite: good practice, but not critical because cooking comes next.

See the difference? It’s all about whether control at that step is essential, or whether a later step will sort it out.

Real-World CCP Examples Across Food Businesses

CCPs vary depending on what you do and what hazards you face. What’s a CCP in a restaurant might not be a CCP in a bakery.

Let me give you some real-world examples.

Restaurants and Cafés

Cooking raw meat or poultry: This is almost always a CCP. You’re killing bacteria like Salmonella, E. coli, and Campylobacter. The critical limit is usually a core temperature of 75°C for at least 30 seconds (England and Wales best practice) or 82°C (Scotland regulation).

Cooling cooked food: If you’re batch-cooking food and cooling it for later service, cooling is a CCP. Food must pass through the danger zone (8°C to 63°C) quickly to prevent bacterial growth. Typical critical limit: cool from 63°C to below 8°C within 90 minutes.

Reheating previously cooked food: Another CCP. You need to reheat to at least 75°C (or 82°C in Scotland) to kill any bacteria that may have grown during storage.

Cold holding of ready-to-eat food: If you serve cold sandwiches, salads, or desserts, keeping them at 5°C or below is usually a CCP. Legal maximum in England, Wales, and Northern Ireland is 8°C, but best practice is 5°C or below.

Catering Companies

Hot holding during transport: If you’re delivering hot food to an event or care home, maintaining temperature above 63°C during transport is often a CCP. Drop below that, and bacteria can multiply.

Chilled storage of pre-prepared meals: For businesses preparing meals in advance, chilled storage at 5°C or below is a CCP, especially if there’s no further cooking before service.

Food Manufacturing

Heat treatment (pasteurisation, sterilisation): For manufacturers of dairy, juices, or ready meals, thermal processing is a CCP. Critical limits include time and temperature combinations validated to kill target pathogens.

pH control in acidified products: For products like pickles or sauces, maintaining pH below 4.6 prevents Clostridium botulinum (the bacterium that causes botulism). pH control is a CCP.

Metal detection: If you’re packaging products, metal detection is often a CCP to prevent physical contamination (broken machinery, foreign objects).

Retail Food Businesses

Cold display units: If you sell pre-packed sandwiches, chilled ready meals, or dairy, maintaining display fridge temperatures at or below 5°C is typically a CCP.

Date labelling on short-life products: For some retailers, correct use-by date labelling is considered a CCP to prevent the sale of unsafe food.

The common thread? CCPs are where control is essential and there’s no later step to catch the hazard.

How to Identify CCPs: The HACCP Decision Tree

So how do you actually identify your CCPs?

The most common tool is the CCP Decision Tree: a series of questions that help you work out whether a control point is critical or not.

The Four Key Questions

The traditional Codex decision tree (used in HACCP training worldwide) asks four questions for each potential control point:

Q1: Do preventive control measures exist at this step or subsequent steps?

In other words: Can you control the hazard here or later? If no control exists anywhere, you need to redesign your process. If yes, move to Q2.

Q2: Is this step specifically designed to eliminate or reduce the hazard to an acceptable level?

Is this step’s primary purpose to control the hazard? If yes, it’s a CCP. If no, move to Q3.

Q3: Could contamination occur at this step, or could the hazard increase to an unacceptable level?

Could the hazard get worse here? If no, it’s not a CCP (just a control point). If yes, move to Q4.

Q4: Will a later step eliminate or reduce the hazard to an acceptable level?

Is there a “kill step” coming later? If yes, this step is not a CCP; the later step is. If no, this step is a CCP.

Let’s apply it to cooking chicken in a restaurant:

• Q1: Yes, control measures exist (cooking).
• Q2: Yes, cooking is specifically designed to kill bacteria. It’s a CCP.

Now let’s apply it to washing salad leaves before serving them raw:

• Q1: Yes, control measures exist (washing).
• Q2: Yes, washing is designed to reduce contamination.
• Q3: No further “kill step” exists (salad is served raw).
• Q4: No later step will eliminate the hazard. Washing is a CCP.

The decision tree is a structured way to think through each step logically.

Decision Tree Limitations (and Alternatives)

Here’s what most HACCP training courses won’t tell you: the decision tree isn’t perfect, and it’s not mandatory.

The 2020 revision of the Codex Alimentarius General Principles of Food Hygiene made a significant change. The traditional decision tree was removed as the sole method for identifying CCPs.

Why?

Because the decision tree is a classification tool, not a substitute for expert knowledge. The Codex revision explicitly states that “the decision tree is no longer the sole option for establishing CCPs.”

What else can you use?

• CCP Determination Worksheets: structured tables where you list hazards, controls, and justify whether each is a CCP
• Risk-based matrices: scoring hazards by severity and likelihood, then determining which need CCP-level control
• Expert judgement: using industry guidance, regulatory standards, and your own hazard analysis to identify CCPs

Small businesses often find worksheets and matrices easier to use than the decision tree, especially when the questions feel ambiguous.

The key is that your logic must be consistent, documented, and based on sound hazard analysis. How you get there is up to you.

If you’re using Safer Food Better Business (SFBB), the FSA’s simplified HACCP pack for small caterers, you don’t even need to formally identify CCPs. SFBB builds them into the safe methods, so you’re managing them without the jargon.

But if you’re running a larger operation or need a full HACCP plan, understanding CCPs is essential.

What Happens When A CCP Fails?

CCPs are critical for a reason. When they fail, the consequences can be serious.

Corrective Actions in Practice

If monitoring shows that a CCP has lost control (for example, your fridge temperature has risen above 8°C, or a batch of chicken hasn’t reached 75°C), you must take immediate corrective action.

1. Stop the process. Don’t let the affected product continue or reach the customer.

2. Assess the risk. How long was the CCP out of control? What’s the food safety risk?

3. Isolate the affected product. Separate it from safe product. Label it clearly.

4. Decide what to do with it. Rework (re-cook), downgrade (pet food), or destroy.

5. Bring the CCP back under control. Fix equipment, retrain staff, adjust the process.

6. Document everything. Under Regulation 852/2004, you must keep records of monitoring results, corrective actions, and what happened to the affected product. The FSA recommends keeping records for at least 2 years.

Example: Your walk-in fridge fails overnight and hits 12°C for six hours. Inside: cooked chicken, pre-made sandwiches, dairy. All ready-to-eat with no further cooking. Cold storage was a CCP, and it’s failed.

Your corrective action? Destroy the affected batches.

You also need to record why the failure happened (fridge motor fault), what you did (destroyed product, repaired fridge), and how you’ll prevent recurrence (install temperature alarm).

That’s what demonstrates “confidence in management” during an EHO inspection.

UK Recall Data: The Cost of CCP Failures

CCP failures don’t just affect one batch. In the worst cases, they lead to product recalls, and recalls are expensive.

In the first half of 2025 alone, nearly 150 food recalls were announced in the UK, an increase compared to the same period in 2023 and 2024. 35% of all FSA alerts in 2025 were the result of allergen-related labelling errors.

Testing data shows that 4% of products tested for allergens had undeclared allergens, with milk being the most common.

And it’s not just allergens. In 2024, allergen-related labelling errors accounted for 23% of recalls, with Listeria contamination coming in second at 10%.

Broader analysis shows that contamination and allergen issues together account for more than 90% of UK food recalls (FSA, 2023).

Why does this matter for CCPs?

Because many of these recalls trace back to failures at critical control points: inadequate heat treatment, poor temperature control, cross-contamination during processing, or labelling errors that should have been caught.

A single recall can cost a small business tens of thousands of pounds. For larger manufacturers, it can run into the millions, not to mention the reputational damage.

That’s why managing your CCPs properly isn’t just about compliance. It’s about protecting your business.

Monitoring Your CCPs: What Does It Look Like Day-to-Day?

Identifying your CCPs is one thing. Monitoring them day-to-day is where the real work happens.

Monitoring Frequency and Methods

Monitoring means checking that your CCP is in control, meaning it’s meeting the critical limit you’ve set.

Codex HACCP guidance is clear: if monitoring is not continuous, the frequency must be sufficient to guarantee the CCP is in control.

Continuous monitoring is ideal (e.g., automated sensors in manufacturing). But most small food businesses monitor at a frequency appropriate to the risk:

• Cooking: Check core temperature of every batch. Use a calibrated probe thermometer.
• Cold storage: Check fridge temperatures at least twice daily (start and end of shift).
• Hot holding: Check temperatures every 2-4 hours if holding food above 63°C.
• Cooling: Monitor time and temperature at regular intervals (e.g., every 30 minutes).
• Metal detection: Test at the start of each shift with test pieces.

The key: your monitoring method must detect a failure before the hazard reaches the customer.

Recording and Documentation

Every time you monitor a CCP, record the result.

Under Regulation 852/2004, you must keep records that demonstrate your HACCP system is working. During an EHO inspection, you’ll be asked to produce evidence.

What to record: date and time, what you checked, the result, who checked it, any corrective action taken.

You can use paper logs, digital records, or automated data logging systems. The FSA accepts digital records as long as they’re complete, tamper-evident, and producible during an inspection.

Keep CCP monitoring records for at least 2 years (FSA guidance), or 12 months past the product’s shelf-life if that’s longer.

Prerequisite Programmes vs CCPs

Here’s something that surprises many food businesses: most food recalls don’t happen because a CCP failed. They happen because something else in the food safety system broke down.

Research suggests that over 90% of food recalls are caused by failures in prerequisite programmes, not CCP failures (FSNS, 2020).

Prerequisite programmes are the foundation of your food safety system: cleaning schedules, pest control, staff training, supplier controls, equipment maintenance, allergen management.

These aren’t CCPs. But if they fail, your CCPs might not be enough.

Example: You’re monitoring cooking temperatures perfectly. But if staff aren’t washing hands, or cleaning has lapsed, or pests are present, contamination can still reach the customer, even with your CCPs under control.

HACCP isn’t just about CCPs. It’s about building a complete food safety culture where prerequisite programmes and CCPs work together.

The 7 HACCP Principles: Where CCPs Fit

CCPs don’t exist in isolation. They’re part of the full HACCP system, which is built on seven internationally recognised principles.

Here are the 7 HACCP principles:

1. Conduct a hazard analysis. Identify potential biological, chemical, and physical hazards at each step of your process.

2. Determine your Critical Control Points (CCPs). Use the decision tree or another method to identify where control is essential.

3. Establish critical limits for each CCP. Set measurable limits (e.g., 75°C core temp, pH below 4.6) that must be met.

4. Establish monitoring procedures. Decide how, when, and by whom each CCP will be checked.

5. Establish corrective actions. Plan what you’ll do if a CCP fails.

6. Establish verification procedures. Regularly check that your HACCP system is working (e.g., calibrate thermometers, review records, test finished product).

7. Establish record-keeping and documentation. Keep records of everything: hazard analysis, CCP monitoring, corrective actions, verification.

CCPs are at the heart of Principles 2-5. But all seven principles work together to create a robust system.

And in the UK, implementing a HACCP-based system isn’t optional. It’s a legal requirement under Regulation 852/2004 Article 5.

Do You Need HACCP Training to Manage CCPs?

Short answer: yes.

Long answer: it depends on your role and your business.

Under Regulation 852/2004, all food businesses must implement and maintain procedures based on HACCP principles.

You (or someone in your business) needs to understand HACCP well enough to identify hazards, determine CCPs, set critical limits, monitor CCPs, and take corrective action.

For small caterers, the FSA offers Safer Food Better Business (SFBB), a simplified pack that satisfies your HACCP obligations without the jargon. You don’t need formal training to use SFBB, though a Level 2 Food Hygiene course helps.

For larger businesses or complex operations, proper HACCP training is essential. Get it wrong, and you could be managing the wrong CCPs (or missing critical ones altogether).

HACCP training gives you the confidence to carry out hazard analysis, identify CCPs correctly, set science-based critical limits, design monitoring systems that work, and document everything properly for EHO inspections.

We offer a CPD-accredited HACCP course that’s designed specifically for UK food businesses. It covers all seven HACCP principles, gives you hands-on practice identifying CCPs, and shows you how to implement HACCP in real-world settings, whether you run a café, a care home kitchen, or a food manufacturing operation.

100% online. Instant digital certificate on passing. EHO accepted. And if you’re training a team, we offer bulk discounts from 10+ learners and a group management portal so you can assign courses and track progress in real-time.

If you’re serious about managing your CCPs properly and meeting your legal obligations under UK food law, HACCP training is one of the best investments you can make.

Get CPD-accredited, EHO-approved online training from Essential Food Hygiene. Instant digital certificates. Bulk discounts for teams. View our courses.