PRPs and CCPs Explained: The Building Blocks of Food Safety Control

Why PRPs and CCPs Matter in Food Safety Management

If you work in food manufacturing, food service, or any operation where food is handled, you have almost certainly encountered the terms Prerequisite Programme and Critical Control Point. These two concepts sit at the core of every credible food safety management system, including those built around ISO 22000 and HACCP principles. Yet despite how frequently they appear in audits and training materials, they are consistently misunderstood, misapplied, and mixed up.

This article breaks down what PRPs and CCPs actually are, how they differ, where they overlap, and what auditors look for when they assess them. Whether you are a quality manager building a food safety system from scratch, an internal auditor preparing to review your organisation's HACCP plan, or a compliance professional working toward ISO 22000 certification, this guide gives you the practical foundation you need.

What Is a Prerequisite Programme?

A Prerequisite Programme, commonly abbreviated as PRP, is a basic condition or activity that is necessary to maintain a hygienic environment throughout the food chain. PRPs are not specific to a particular hazard or product. They are the baseline hygiene and operational controls that apply across the board, regardless of what you are producing.

Think of PRPs as the foundation of your food safety house. Without them in place, your more targeted controls like CCPs become unreliable. A CCP that monitors cooking temperature is meaningless if the thermometer has not been calibrated, the kitchen is contaminated with pests, or staff are not following basic hygiene practices.

Common Examples of PRPs

PRPs cover a wide range of activities and conditions. Typical examples include:

• Cleaning and sanitation programmes for equipment and facilities
• Pest control management
• Personal hygiene requirements for food handlers
• Potable water supply and quality
• Temperature control for storage areas
• Supplier approval and raw material controls
• Allergen management procedures
• Waste and effluent management
• Maintenance and calibration of equipment
• Labelling and traceability systems

ISO 22000 references PRPs extensively in Clause 8.2, and the standard requires organisations to select, establish, monitor, and verify them based on the nature of the operation. The Codex Alimentarius General Principles of Food Hygiene provides much of the underlying guidance for what PRPs should cover.

Operational PRPs: The Middle Ground

ISO 22000 introduces a category that sits between standard PRPs and CCPs, known as Operational Prerequisite Programmes, or OPRPs. An OPRP is used when a PRP is essential to control a specific identified hazard, but the control does not meet the criteria of a CCP because the limit cannot be precisely defined or monitored in real time.

For example, a cleaning validation process that controls allergen cross-contact might be classified as an OPRP. It is more targeted than a general cleaning schedule, but it does not involve the kind of real-time measurable monitoring that defines a CCP. Understanding this distinction matters a great deal when you are designing or auditing a food safety management system under ISO 22000.

What Is a Critical Control Point?

A Critical Control Point, or CCP, is a step in the food production process where a control measure can be applied and is essential to prevent or eliminate a food safety hazard, or reduce it to an acceptable level. The word critical is doing real work here. A CCP is not just any important step. It is a step where failure to control a hazard would result in an unacceptable food safety risk to the consumer.

CCPs are identified through the hazard analysis process, which is the systematic examination of every step in the food production process to identify what could go wrong and how significant the risk is. The decision tree approach, originally developed by Codex Alimentarius, is a common tool used to determine whether a particular control measure qualifies as a CCP.

The Four Elements of a CCP

For a CCP to function properly, four elements must be in place and documented:

1. Critical limit: A measurable value that separates acceptable from unacceptable. For a cooking step, this might be an internal temperature of 75 degrees Celsius for a defined holding time.
2. Monitoring procedure: The method used to measure or observe the CCP at the frequency required to ensure the critical limit is consistently met. This must be specific about what is measured, how, and by whom.
3. Corrective action: What happens when monitoring shows the critical limit has not been met. This includes what to do with affected product and how to restore control.
4. Verification: Activities that confirm the monitoring system is working as intended. This might include periodic calibration checks, additional testing, or review of monitoring records.

Documentation of all four elements is not optional. Auditors reviewing a HACCP plan or an ISO 22000 system will look for records that demonstrate each CCP is being monitored, that deviations are being captured and acted upon, and that verification activities are being conducted at the specified frequency.

Real World CCP Examples

Common CCPs in food manufacturing include:

• Pasteurisation of liquid dairy products, where time and temperature are the critical limits
• Metal detection on finished product lines, where the detection threshold is the critical limit
• Cooking of ready-to-eat meat products, where internal temperature is the critical limit
• pH control in acidified foods, where the target pH prevents pathogen growth
• Water activity control in dried or preserved products

In an audit setting, the auditor will typically trace a specific CCP from the HACCP plan through to the monitoring records, corrective action logs, and verification activities. If any of these links are broken, you are looking at a nonconformity.

How PRPs and CCPs Work Together

PRPs and CCPs are not competing systems. They are complementary layers of control. PRPs create the stable, hygienic environment in which CCPs can function reliably. Without effective PRPs, the hazard load entering the process is unpredictable, which undermines the effectiveness of even well-designed CCPs.

Consider a ready-to-eat salad processing facility. The cooking step does not apply here, so there may be no thermal CCP. Instead, the food safety system relies heavily on PRPs such as water quality, surface sanitation, temperature-controlled storage, and personal hygiene. These PRPs collectively prevent contamination from occurring in the first place.

In a cooked meat facility, by contrast, the cooking step is a CCP that eliminates pathogenic bacteria. But the PRPs surrounding that step, including equipment cleaning before and after production, raw and cooked product segregation, and chiller temperature maintenance, are what prevent recontamination after the CCP has done its job.

This layered approach is sometimes described as the food safety system pyramid. PRPs form the base, OPRPs sit in the middle, and CCPs sit at the top. Each layer depends on the one below it.

Common Mistakes Auditors Find in Practice

In food safety audits, certain problems appear repeatedly. Knowing what auditors look for helps you avoid the most common pitfalls.

Treating Everything as a CCP

One of the most frequent mistakes is identifying too many CCPs. When organisations are uncertain about the distinction between a PRP and a CCP, they sometimes classify general hygiene controls as CCPs. This creates an unmanageable monitoring burden and dilutes the focus on the steps that truly require critical control. A well-designed HACCP plan for a straightforward food operation might have only two or three CCPs. That is not a sign of a weak system. It is a sign of a properly scoped one.

Critical Limits That Are Not Measurable

A critical limit must be something you can actually measure in real time. Statements like product must be thoroughly cooked or adequate temperature are not critical limits. Auditors will raise a nonconformity if critical limits are vague, unmeasurable, or not supported by scientific or regulatory justification.

Monitoring Records That Do Not Match the HACCP Plan

If the HACCP plan states that temperature at the cooking CCP is checked every 30 minutes by the line supervisor, the monitoring records should reflect exactly that. Auditors will sample these records and compare them against the documented procedure. Gaps in records, wrong frequencies, or records signed by people who were not on shift at the time are all red flags.

PRPs That Exist on Paper Only

A cleaning schedule that lists every surface in the facility but has no evidence of completion, no verification that cleaning was effective, and no corrective actions when deviations occurred is a PRP in name only. Auditors will observe actual practices during a site walkthrough and compare them against documented procedures. The gap between what is written and what is done is one of the most common sources of nonconformities in food safety audits.

No Corrective Action Process for CCP Deviations

When a critical limit is breached, there must be a documented corrective action process. This includes placing affected product on hold, investigating the cause of the deviation, and taking action to restore control. Organisations that rely on verbal instructions or informal practices at this point are exposed to significant nonconformities during certification audits.

What Auditors Check During a Food Safety Audit

When auditing a food safety management system, an auditor working through the PRP and CCP elements will typically follow this sequence:

• Review the hazard analysis to understand how hazards were identified and evaluated
• Check the justification for how PRPs, OPRPs, and CCPs were selected
• Verify that critical limits are measurable and scientifically justified
• Sample monitoring records across a representative period
• Trace corrective actions for any recorded deviations
• Confirm verification activities are being conducted and documented
• Walk the production floor and observe actual practices against documented PRPs
• Interview production staff about their understanding of CCPs and what they do when something goes wrong

The interview component is particularly revealing. When a line operator cannot explain what the critical limit is at their station, or does not know what to do if the temperature alarm sounds, it tells the auditor that the system exists on paper but has not been embedded in practice. For more on how to structure your food safety audit approach, the article on running effective food safety internal audits provides a practical walkthrough.

PRPs and CCPs Under ISO 22000

ISO 22000 takes a structured approach to PRPs and CCPs that goes beyond traditional HACCP. The standard requires organisations to establish a food safety team, conduct a hazard analysis, and use the results to determine which control measures should be managed as PRPs, OPRPs, or CCPs. This is covered primarily in Clause 8, which deals with operational planning and control.

The standard also requires a documented food safety management system that integrates PRPs and CCPs with broader management system requirements like internal audits, management review, corrective action, and continual improvement. This is what distinguishes ISO 22000 from a standalone HACCP plan. It places the technical food safety controls within a governance framework that ensures they are maintained, reviewed, and improved over time.

For organisations seeking to understand the full structure of ISO 22000 and how it maps to food safety operations, the article on ISO 22000 clause structure provides a clause-by-clause breakdown that complements the PRP and CCP content covered here.

Practical Advice for Quality Managers

If you are responsible for a food safety management system, here is what practical experience suggests works best when it comes to PRPs and CCPs:

• Start with a thorough hazard analysis before deciding what is a PRP and what is a CCP. The classification should follow the hazard analysis, not precede it.
• Document the justification for every CCP and every decision made using the decision tree. Auditors want to see the reasoning, not just the conclusion.
• Keep your HACCP plan current. If you change a process, a supplier, or a piece of equipment, revisit the hazard analysis and update your plan accordingly.
• Train your production team on the CCPs relevant to their area. They do not need to understand the full HACCP plan, but they do need to know their critical limits and corrective actions.
• Treat PRP verification as seriously as CCP monitoring. Schedule environmental swabs, cleaning validations, and pest control inspections with the same rigour you apply to CCP records.
• Review corrective action records regularly. Repeated deviations at the same CCP are a signal that the control measure itself may need to change.

Building Your Skills as a Food Safety Auditor

Auditing food safety systems requires a specific combination of technical knowledge and auditing skill. You need to understand what PRPs and CCPs are supposed to achieve, how hazard analysis works, and what good records look like. You also need the auditing skills to gather evidence effectively, ask the right questions, and communicate findings in a way that drives genuine improvement.

At Audit Workshop, our ISO 22000 training covers the food safety management system in practical depth, including how to audit PRPs, OPRPs, and CCPs against the standard's requirements. Whether you are an internal auditor looking to build your food safety capability or a quality professional preparing for a certification audit, our courses are built around real audit scenarios, not just theory. If food safety auditing is part of your professional development plan, explore our guide on adding ISO 22000 to your auditor skill set for practical next steps.