Critical Control Points: How to Find Yours
Not every step is a critical control point. Most aren't. The skill isn't listing hazards — it's knowing which handful of steps are the last line of defence, and then setting a limit you can actually check with a probe at 11pm on a Friday.
The most common HACCP mistake I see isn't skipping a step. It's the opposite: a plan with fourteen critical control points, one for every station, every fridge, every process. It looks thorough. It's useless. Nobody monitors fourteen CCPs during a real service, so within a month the logs are being filled in from memory at the end of the shift, all ticks, all "OK", all fiction.
A working HACCP plan usually has two to five critical control points. Sometimes fewer. The whole point of finding your critical control points is narrowing down — separating the steps that genuinely stand between your food and a hospital visit from the steps that are merely good practice. This is how you do that separation honestly, and how you turn each surviving CCP into a limit a cook can read off a thermometer.
Control point vs critical control point
Everything in your kitchen is a control point in the loose sense — a place where something could go wrong and where you exert some control. Handwashing is a control point. Storing raw below cooked is a control point. Cleaning the slicer is a control point. All important. None of them are CCPs.
A critical control point has a specific, tighter definition, and it's worth committing to memory:
A step at which control can be applied and is essential to prevent, eliminate, or reduce a food-safety hazard to an acceptable level.
The load-bearing word is essential. If you skip this step or get it wrong, the hazard is not caught anywhere else — the food reaches the guest unsafe. Cooking chicken is a CCP because if you undercook it, nothing downstream fixes the salmonella. Washing your hands is not a CCP, because while it reduces risk, no single handwash is the last defence against a specific hazard reaching an unacceptable level. We manage handwashing through prerequisite programmes (your basic hygiene rules), not through the HACCP plan's control points.
That distinction — CCP handled in the HACCP plan, everything else handled by prerequisite programmes — is exactly what the international standard is built on. The framework comes from the FAO/WHO Codex Alimentarius General Principles of Food Hygiene, which nearly every national food authority adopts almost word for word. If you want the source of truth behind whatever your local inspector is quoting, that's it.
The Codex decision tree, in usable form
Codex gives a formal four-question decision tree for each hazard at each step. The official wording is stiff, so here it is in kitchen English. Run it for every significant hazard you identified in your hazard analysis — not for every step, only for the steps where a real hazard lives.
| Q | Question (plain) | What the answer means |
|---|---|---|
| 1 | Can you control this hazard here at all — is there a control measure at this step? | No → not a CCP (but ask: does safety require control here? If yes, redesign the step). Yes → go to Q2. |
| 2 | Is this step specifically designed to eliminate or reduce the hazard to an acceptable level? | Yes → it's a CCP. Done. (Cooking is designed to kill bacteria — yes.) No → go to Q3. |
| 3 | Could the hazard build up to an unsafe level here, or get worse? | No → not a CCP. Yes → go to Q4. |
| 4 | Will a later step eliminate or reduce the hazard to an acceptable level? | Yes → not a CCP (the later step is). No → it's a CCP. |
Work an example. Take cold storage of raw chicken. Q1: can you control temperature here? Yes, the fridge. Q2: is cold storage designed to eliminate the pathogen? No — cold slows bacteria, it doesn't kill them. Q3: could the hazard grow here? Absolutely, if the fridge drifts warm. Q4: does a later step fix it? Yes — cooking. So cold storage is not a CCP in a menu where the chicken gets cooked. It's a control point managed by your prerequisite fridge-monitoring, but the CCP is the cook step.
Now flip it. Take cold storage of a ready-to-eat item — a prepped prawn cocktail that will never see heat again. Q4 changes: there is no later kill step. Suddenly that chilled holding becomes a CCP, because temperature abuse here reaches the guest uncorrected. Same physical fridge, different answer, because the menu around it is different. This is why you can't copy someone else's CCP list — the tree depends on your process flow.
The classic critical control points
Run the tree across a normal mixed menu and you'll keep landing on the same short list. These are the usual suspects. Yours may differ, but if none of these show up you've probably made an error.
Cooking
The workhorse CCP. Heat is designed to destroy vegetative pathogens, so it passes Q2 immediately. Poultry, minced meat, rolled joints, stuffed items, reheated cook-chill — all rely on this being the step that makes them safe. Critical limit is almost always a core temperature held for a time.
Cooling
Cooked food you don't serve immediately has to get through the danger zone fast, or spore-forming bacteria (Clostridium perfringens, Bacillus cereus) that survived cooking wake up and multiply. There's usually no kill step afterwards big enough to fix a slow cool, so cooling is frequently a CCP in any kitchen doing batch cook-chill or holding stock overnight.
Hot-holding
Food sitting on a pass, in a bain-marie, or on a buffet is back in the danger zone's upper edge. Hold it too cool for too long and it becomes a growth medium. If nothing reheats it to a kill temperature before service, holding is the last defence — a CCP.
Receiving / chilled delivery
For high-risk chilled and frozen goods, the delivery temperature can be a CCP, particularly for ready-to-eat products with no later cook. If a van's fridge failed and the smoked salmon arrives at 12°C, no step in your kitchen brings it back. Receiving is where you reject it or accept the risk.
In ProChefDesk
The HACCP hub has a dedicated form for each of these classics — daily temperature logs, cook & cool records, receiving checks, and hot-holding — so the CCPs you land on with the decision tree already have a monitoring form waiting. It also builds a monthly Audit Pack that shows an inspector how consistently each one was logged.
Setting a critical limit you can actually monitor
Identifying the CCP is half the job. A CCP with no limit is a shrug. The critical limit is the exact boundary between safe and unsafe — and the discipline here is that it must be measurable at the point and in the moment. "Cook thoroughly" is not a critical limit. "Core 75°C" is.
Good critical limits share three traits: a number, a unit, and where relevant a time. Time-and-temperature pairs are the backbone, because pathogen kill is a function of both.
Here's a set of defensible starting limits for the classic CCPs. These are common in the UK/EU tradition; your national code may phrase them differently (the US uses 74°C/165°F for poultry, for instance), so anchor yours to whatever your inspector enforces.
| CCP | Critical limit | How it's monitored |
|---|---|---|
| Cooking (general) | Core 75°C, instant — or 70°C for 2 min | Probe the thickest part, every batch |
| Cooling | 63°C down to 5°C within 6 hours (ideally 90 min to 10°C) | Probe at start, at 2h, at end |
| Hot-holding | Above 63°C the whole time | Probe every 2 hours on the pass |
| Chilled receiving | At or below 8°C (aim 5°C); frozen at −18°C | Probe between packs at the door |
Notice the monitoring column matters as much as the limit. A limit you check "every batch" is real. A limit you check "continuously" is a fantasy — nobody stands at the pass with a probe for four hours. Set the frequency to something a busy human will genuinely do. Every two hours on the hot-hold, on the hour if you're being strict; every batch on the cook. If your monitoring plan can't survive a Saturday, it isn't a plan.
Corrective action: what happens when the limit is breached
This is the part people skip, and it's the part an auditor cares about most — because a breach isn't a failure of your plan, it's proof your plan is alive. A CCP without a written corrective action is just a place to record disasters after the fact.
Every CCP needs two things defined in advance:
- What you do to the food. The chicken probed at 68°C, not 75°C? Keep cooking and re-probe. Still short after a reasonable time? Reject the batch. Cooling stalled at 20°C after 6 hours? That food is discarded — you can't cook your way out of a cooling failure.
- What you do to the cause. Fridge running at 11°C? Move the stock, call the engineer, and record it. Fixing the food without fixing the fridge means you'll be here again tomorrow.
Write the corrective action next to the limit, in the plan, before service — not invented on the spot by a stressed cook. And the corrective-action note is what separates a closed issue from an open one at audit: a reading out of range with a blank action box is an open non-conformance. The same reading with "re-cooked to 78°C, held, re-probed OK — SC" is a closed loop and a point in your favour.
A worked example: chicken from delivery to service
Let's follow one bird through a real Friday and watch where the CCPs fall out. Menu: roast chicken, portioned, some served hot to order, the rest cooled and held for tomorrow's sandwiches.
| Step | CCP? | Limit & action |
|---|---|---|
| Delivery, 08:00 | Control point | Chicken arrives 3°C — fine. (CCP for RTE goods, not for this cook-later chicken.) Probe, log, put away. |
| Chilled storage | Control point | Fridge ≤5°C, prerequisite monitoring. Cooking will fix any drift. |
| Prep / portioning | Control point | Cross-contamination risk — managed by hygiene rules and separation, not a CCP. |
| Cooking, 11:30 | CCP 1 | Core 75°C. Probe thickest thigh. One reads 71°C → keep roasting, re-probe. Log the pass. |
| Hot-hold (to-order portions) | CCP 2 | Above 63°C on the pass. Probe every 2h. Drops to 58°C at 14:00 → discard or, if within 2h of cooking, one-time reheat. |
| Cooling (tomorrow's batch) | CCP 3 | 63→5°C in 6h. Probe at start, 2h, end. Stalled at 18°C at 15:30 → discard, review batch size. |
| Cold storage of cooled batch | CCP 4 | Now RTE — no later cook. ≤5°C, use within 48h, day-dot label. Temperature abuse here reaches the guest. |
Four CCPs from one ingredient, and every one earned its place through the decision tree. Notice how the same chicken flipped from "cold storage is not a CCP" at delivery to "cold storage is a CCP" after cooking — because cooking removed the later kill step. That's the tree doing its job. Notice too that the busy, obvious-looking steps — receiving, prep, putting things in the fridge — are control points, not CCPs. They matter, but they're not where you stake the plan.
Get the CCPs right and the rest of your food-safety system has a spine. Get them wrong — too many, too vague, or limits nobody can check — and you've built a binder that satisfies a filing cabinet and protects nobody. Two to five CCPs, a number-and-unit limit on each, a corrective action written in advance, and a monitoring frequency a real cook will actually keep. That's the whole discipline.