A critical control point (CCP) is a step in your process where control must be applied because it is the last realistic opportunity to prevent a food safety hazard, eliminate it, or reduce it to an acceptable level. Identifying CCPs is principle two of the seven HACCP principles set out in the Codex Alimentarius, and it is the step most UK kitchens get wrong — usually by declaring too many. A HACCP plan with fifteen critical points spreads attention so thin that the two or three genuinely critical ones stop being watched.
If you have not yet mapped your process from delivery to service, start with our guide to the seven principles of HACCP — CCP identification only works once your flow diagram and hazard analysis exist.
Control Measures, Prerequisites and CCPs Are Not the Same Thing
Most of what keeps food safe in your kitchen is a prerequisite programme: cleaning schedules, pest control, supplier approval, personal hygiene, maintenance. These run in the background regardless of the dish. A control measure is any action that controls a hazard. A CCP is the much rarer case: a step where, if control fails, no later step will catch the problem. Washing your hands is essential, but it is not a CCP — there is no critical limit you can measure and no later step it protects. Cooking a chicken breast to a safe core temperature is the classic CCP: if it fails, nothing downstream fixes it.
The Codex Decision Tree in Plain English
For each process step where your hazard analysis identified a significant hazard, ask four questions in order:
- Q1: Is there a control measure at this step? If no, and control is needed here for safety, you must redesign the step.
- Q2: Does this step specifically eliminate the hazard or reduce it to an acceptable level? If yes, it is a CCP.
- Q3: Could contamination occur, or increase, to an unacceptable level at this step? If no, it is not a CCP.
- Q4: Will a later step eliminate or reduce the hazard? If yes, this step is not the CCP — the later one is.
Question four is the one that keeps plans lean. Raw chicken arriving at the door carries Salmonella and Campylobacter, but delivery is not your CCP for them — cooking is, because cooking is the kill step. Delivery temperature is a CCP for something else entirely: ready-to-eat items where no kill step follows.
The CCPs Most UK Kitchens Actually Have
- Cooking: core temperature reaching a validated kill step — 75°C, or an equivalent time and temperature combination such as 70°C held for two minutes.
- Cooling: cooked food cooled quickly enough to limit spore-former growth — through the danger zone and into the fridge, ideally within 90 minutes.
- Hot and cold holding: 63°C or above for hot holding; 8°C or below (5°C as good practice) for chilled storage.
- Reheating: previously cooked food reheated until steaming hot throughout (82°C is the standard in Scotland).
- Freezing for parasite control: where you serve raw fish, the validated freezing time and temperature that destroys parasites — see our guide to raw-fish freezing requirements for the full rule.
Notice what is not on the list: handwashing, cleaning, supplier approval and use-by date checking. They matter — every food safety failure has at least one of them in the background — but they are prerequisites, not CCPs. If you treat everything as a CCP, nothing actually is.
Setting the Critical Limit and the Monitoring Plan
Every CCP needs a critical limit (a number you can measure), a monitoring frequency (how often you check it), the action you take if it fails, and a record. Write them on one page per CCP. Our HACCP template for restaurants gives you the standard layout EHOs expect — fill it in for the dishes you actually serve, not a generic menu.
Validate, Then Verify
Validation answers "would this critical limit actually control the hazard?" — backed by science, supplier data or recognised guidance. Verification answers "are we sticking to it?" — through records, calibration of probes and periodic review. EHOs will ask both. If you cannot say why 75°C is your limit, or why your last fridge check was three weeks ago, you have a plan on paper rather than in practice.
Our bespoke HACCP service builds the plan around your menu rather than handing you a template; if you would rather build internal capability, our Level 2 and Level 3 HACCP courses take supervisors through identification, validation and monitoring step by step.
Frequently Asked Questions
How many CCPs should a typical UK restaurant have?
For most catering kitchens, two to five — usually cooking, hot holding, cold storage, and reheating. Plans with ten or more CCPs are nearly always confusing control measures for CCPs and will be hard to monitor properly.
Is handwashing a CCP?
No. Handwashing is a fundamental prerequisite — essential, but not a measurable critical limit at a single step. It supports every CCP rather than being one.
Do I have to use the Codex decision tree?
You do not have to use it word-for-word, but UK EHOs expect you to demonstrate a structured method for identifying CCPs. The Codex tree, or an equivalent published method, is the simplest way to evidence that.
Not sure where your CCPs are? Book a HACCP consultation and we will walk through your process from delivery to service and tell you, in plain English, which steps the EHO will expect you to control.
Written by Carren Amoli, BSc (Hons), RSPH Registered
