PRP, OPRP and CCP: the three levels of hazard control in an ISO 22000 plan

One question comes up in ISO 22000 audits more often than any other: “why did you classify this control measure as an OPRP rather than a CCP?” Many teams have no written answer. They copied a plan from elsewhere, multiplied CCPs “to be safe”, or filed anything that did not fit neatly as an OPRP. The standard, however, defines three levels of hazard control with very concrete consequences for monitoring, records and the fate of your batches. Here is how to hold the line.

Three levels, one logic

ISO 22000:2018 organises hazard control in successive layers. Prerequisite programmes (PRPs) form the permanent foundation. Operational prerequisite programmes (OPRPs) and critical control points (CCPs) make up the hazard control plan, which in the 2018 edition replaced the earlier split between an HACCP plan and separate OPRPs. What separates the last two is neither importance nor severity: it is how they are driven.

PRPs: the foundation that does not target one specific hazard

PRPs are the basic conditions and activities needed to maintain a hygienic environment: building design, water and air supply, maintenance, cleaning and sanitation, pest control, personnel hygiene, management of purchased materials, prevention of cross-contamination, waste management.

They are not selected from the hazard analysis to control a significant hazard at a given step: they are cross-cutting and permanent. In food manufacturing, the historical reference is ISO/TS 22002-1:2009, the technical specification detailing these requirements. It was revised and replaced in 2025 by ISO 22002-1:2025, published this time as a full International Standard, with a new modular architecture: requirements common to the whole food chain moved into ISO 22002-100:2025. Worth checking before any audit if you are FSSC 22000 certified, since that scheme mandates a sector PRP specification from the ISO 22002 series on top of ISO 22000 — we compare both routes in our article on ISO 22000 or FSSC 22000.

OPRPs: an action criterion, not a critical limit

An OPRP is a control measure — or a combination of measures — selected from the hazard analysis to prevent or reduce a significant food safety hazard to an acceptable level, and where an action criterion together with measurement or observation allows effective control of the process or the product.

The action criterion is a specification that is measurable or observable. That is the key point: where a critical limit is always a value, an action criterion can be a documented visual check, a confirmed machine setting, or an incoming inspection result. Common examples: allergen control through production sequencing, supplier approval against an identified hazard, sieving, control of an intermediate storage temperature.

CCPs: a measurable critical limit and the ability to correct

A CCP is a process step at which a control measure is applied, where a measurable critical limit is defined and where measurement enables corrections to be applied. Two cumulative conditions, then: the limit must be measurable, and monitoring must detect failure in time to isolate and evaluate the affected product.

A pasteurisation time/temperature pair, a core cooking temperature, a metal detection threshold: those are CCPs. A requirement you cannot measure in production cannot be a CCP — at best an OPRP, at worst an intention. We walk through the underlying Codex logic in our guide to the 7 HACCP principles applied in practice.

Table: what actually changes

	PRP	OPRP	CCP
Origin	Baseline conditions, independent of the hazard analysis	From the hazard analysis, for a significant hazard	From the hazard analysis, for a significant hazard
Driven by	Programmes and procedures	Action criterion, measurable or observable	Critical limit, measurable
Monitoring	Planned, no batch criticality	Proportionate to likelihood of failure and severity	Method and frequency enabling timely detection
If breached	Nonconformity handled, condition restored	Correction plus evaluation of consequences on product	Product not released, treated as potentially unsafe
Prior validation	Not required as such	Yes, before implementation	Yes, before implementation
Examples	Cleaning, pest control, maintenance, personnel hygiene	Allergen sequencing, sieving, supplier approval	Cooking, pasteurisation, metal detection

The decision tree: a tool, not an obligation

ISO 22000:2018 requires categorisation of control measures to rest on a systematic approach, assessing in particular the likelihood of failure of the measure, the severity of the consequences of that failure, and the feasibility of establishing measurable critical limits and of applying timely corrections. The standard mandates no specific decision tree.

The Codex Alimentarius tree — whose General Principles of Food Hygiene (CXC 1-1969) were revised in 2020, now splitting good hygiene practices and the HACCP system into two separate chapters — remains a sound support. But an auditor will not ask which tree you used: they will ask for the trace of the reasoning, measure by measure. A categorisation table with a “rationale” column is usually enough, provided the column is actually filled in.

Monitoring, corrections, product: the practical consequences

This is where the distinction stops being theoretical.

Monitoring. For a CCP, method and frequency must detect any breach of a critical limit in time to isolate and evaluate the product. For an OPRP, method and frequency must be proportionate to the likelihood of failure and the severity of the consequences. Two different regimes, so two different written justifications.

Corrections and corrective actions. The hazard control plan must state in advance what happens when a critical limit or an action criterion is not met. A correction acts immediately on the product or the process; a corrective action eliminates the cause to prevent recurrence. Confusing the two is a classic audit finding: a record that says only “product destroyed” demonstrates no corrective action at all.

The fate of the product. Product made while a critical limit at a CCP was not met cannot be released: it is handled as potentially unsafe, with evaluation, disposition and traceability of the decision. Product affected by an unmet action criterion is first subject to an evaluation of causes and consequences; it may be released if you can demonstrate the acceptable level is still met. That asymmetry explains why artificially multiplying CCPs is paid for in blocked batches, decision time and write-offs.

Validation and verification: two exercises audits keep apart

Validation means demonstrating, before implementation, that the control measure is capable of achieving the acceptable level for the hazard concerned — a pasteurisation schedule backed by scientific data, challenge testing, a documented study, equipment supplier data. Validation is redone whenever the measure changes.

Verification means confirming, after the fact, that the system works: record review, calibration, microbiological testing, internal audits, analysis of verification results. ISO 22000 requires both, under distinct clauses, and missing validation for OPRPs is one of the most frequently raised findings. The research backs this up: Pieternel Luning and co-authors, in “Systematic assessment of core assurance activities in a company specific food safety management system” (Trends in Food Science & Technology, 2009), show that validation and verification activities are precisely what separates a robust assurance system from a declarative one (see the study).

Measuring actual performance is a different exercise from documentary compliance: Liesbeth Jacxsens and co-authors proposed an indicator grid for exactly that purpose in “Food safety performance indicators to benchmark food safety output of food safety management systems” (International Journal of Food Microbiology, 2010), validated across nine European food businesses (see the study).

The mistakes that turn into findings

• Multiplying CCPs. Ten poorly monitored CCPs are worth less than three that are genuinely held. Every surplus CCP creates a lot-blocking obligation the company will not honour — and the gap will show up in the records.
• OPRPs with no validation evidence. Classifying a measure as an OPRP without demonstrating it actually reduces the target hazard is an immediate finding.
• Treating PRPs as CCPs. Cleaning and pest control belong to PRPs. Elevating them to CCPs dilutes monitoring onto points that have no workable critical limit.
• Action criteria that are neither measurable nor observable. “Staff vigilance” is not an action criterion.
• No nonconformity recorded in two years. That is not a sign of control, it is a sign that nothing is being recorded.
• A frozen plan. New recipe, new supplier, new equipment: the hazard analysis and the categorisation must be revisited, as the surveillance audits described in our article on ISO 22000 renewal and surveillance make clear.

The root cause is often the same: team competence. Carol Wallace, Susan Powell, Louise Holyoak and Fiona Dykes documented this in “Re-thinking the HACCP team” (Food Research International, 2012), showing that HACCP teams are built on operational skills more than on mastery of the method, and that collective decisions tend to settle at an average level of knowledge rather than at the best level present in the room.

What this means for a training provider

A provider delivering food industry training is directly concerned, on two counts.

As a course designer. Teaching “CCPs” without teaching categorisation produces learners who will repeat the ten-CCP mistake. A credible ISO 22000 module covers the decision logic, the critical limit versus action criterion distinction, and the handling of potentially unsafe product. That translates into operational, assessable learning objectives — what Qualiopi indicator 5 expects — and into assessment that tests the ability to classify, not just to recite definitions.

As a certified organisation. Trainers must be competent on the texts currently in force: ISO 22000:2018, the 2020 Codex revision, the 2025 overhaul of the ISO 22002 series. A dated watch on these developments is as much a quality requirement as a commercial argument. If your catalogue also covers regulatory hygiene, our comparison of the 14-hour food hygiene training and HACCP training sets out what each format actually covers.

Take action

Open your hazard control plan and add two columns against every control measure: “rationale for categorisation” and “validation evidence”. The blank rows are your future audit findings. For the full picture — approach, steps and costs — see our ISO 22000 page, and for the regulatory foundation everything rests on, the HACCP and food safety plan page along with our guide to writing your food safety plan.