The long acronym CCP is not a sign of a strict system. It usually indicates that one shelf is used to hold everything.
Teams that are newly establishing food safety systems often push every critical step to become a CCP. Each line then demands critical limits, monitoring, recording, and corrective actions. On paper, it looks very organized. On the production floor, no one can implement it.
ISO 22000 actually breaks down control into three shelves, not two.
Three shelves, one hazard analysis
The first shelf, PRP. Prerequisite programs are not chosen to tame a specific hazard. Their task is to maintain a hygienic production environment: buildings, water supply, waste flow, personnel habits.
The second shelf, OPRP. This control arises from hazard analysis as important for significant hazards, but is not managed through CCP.
The third shelf, CCP. Critical control points, where controls must be applied to prevent, eliminate, or reduce hazards to an acceptable level.
All three are connected by one common element, which is hazard analysis. So the question is not "is this step important or not," but rather "what hazard is being controlled, and by what means."
Critical limits versus action criteria
This is where the classification bites into daily work.
CCP is locked by critical limits: maximum or minimum values for biological, chemical, or physical parameters. They are numerical. Exceeding those numbers is called a deviation, and deviations call for corrective actions.
OPRP does not use that term. ISO 22000:2018 intentionally defines "action criteria" as a new term in Clause 3, along with "acceptable level" and "significant food safety hazard." This edition also clarifies the definitions of CCP, OPRP, and PRP, and introduces hazard control plans as a single document.
If everything is placed on the CCP shelf, you are promising numbers for things that do not have numbers. Auditors will find this out.
One date that is often overlooked
The foundation of PRP has just changed, and many teams are still unaware of it.
ISO/TS 22002-1:2009, the technical specification that has been the reference for food manufacturing PRP, has been withdrawn since July 29, 2025. Its replacement, ISO 22002-1:2025, will be published in July 2025 and will elevate to a full international standard.
Two other parts will follow in the same month: ISO 22002-4:2025 for food packaging manufacturing, and ISO 22002-100:2025 which summarizes the cross-sector PRP approach.
The old document still refers to ISO 22000:2005 in its body text. If your procedures still cite the 2009 number, your reference is already outdated by two layers.
What to check this week
Try opening your control list, and check four things.
First, each CCP line has a number, not a sentence. Second, controls without numbers have moved to the OPRP shelf with their own action criteria. Third, PRP references in procedures now point to ISO 22002-1:2025. Fourth, validation and verification are not mixed. Validation gathers scientific evidence that the plan will work. Verification checks whether the plan is actually working.
ISO 22000 certification is voluntary, and ISO does not issue certificates. The assessment is done by independent certification bodies.
However, the swapped shelves are usually discovered long before the auditor arrives, namely when operators on the line are asked to monitor something that cannot be measured.
Sources
- HACCP Principles & Application Guidelines, U.S. Food and Drug Administration
- ISO 22000 Food safety management systems: Worth knowing, ISO/TC 34/SC 17
- ISO 22000:2018 Food safety management systems: A practical guide, ISO and UNIDO
- ISO/TS 22002-1:2009, status withdrawn July 29, 2025, ISO
- ISO 22000 explained, ISO