PRP vs OPRP vs CCP: Understanding Food Safety Controls in HACCP and ISO 22000
An effective food safety system does more than list hazards and record temperatures. It explains why a control is necessary, how that control operates, and what the organization must do when it fails.
The distinction between PRP, OPRP and CCP is central to that explanation. These terms describe different arrangements for managing food safety, but they are often misunderstood or assigned without sufficient justification.
From an audit perspective, the key question is not simply whether a control has been labelled correctly. It is whether the classification is supported by the hazard analysis and reflected in day-to-day operations.
What Is the Difference Between PRP, OPRP and CCP?
PRPs establish the basic conditions needed for safe food operations. OPRPs and CCPs control significant food safety hazards identified through hazard analysis. OPRPs use measurable or observable action criteria, while CCPs use measurable critical limits.
| Aspect | PRP | OPRP | CCP |
|---|---|---|---|
| Full term | Prerequisite programme | Operational prerequisite programme | Critical control point |
| Primary role | Establish suitable conditions for food safety | Control a specific significant hazard | Control a specific significant hazard at a process step |
| Control criteria | Defined programme requirements | Measurable or observable action criteria | Measurable critical limits |
| Typical records | Hygiene, maintenance and programme records | Results of checks against action criteria | Results of measurements against critical limits |
| Basis for classification | Operational needs and applicable PRP requirements | Hazard analysis and assessment of control measures | Hazard analysis and assessment of control measures |
This terminology is used in ISO 22000:2018. OPRP is specifically an ISO 22000 concept; organisations should not assume that every HACCP framework uses the same three-category structure.
What Is a PRP — Prerequisite Programme?
A prerequisite programme establishes the hygienic environment and operating conditions that food safety controls depend on.
Before a business can rely on a cooking process, for example, it needs suitable premises, maintained equipment, effective cleaning and appropriate employee hygiene. A carefully controlled process cannot compensate for uncontrolled contamination elsewhere in the operation.
Typical PRP areas include:
- Cleaning and sanitation.
- Personal hygiene and staff facilities.
- Pest prevention and control.
- Equipment and premises maintenance.
- Waste management.
- Prevention of cross-contamination.
Codex places good hygiene practices at the foundation of food safety and HACCP. These arrangements must be appropriate to the operation and effectively implemented.
Practical Example: Routine Premises Cleaning
Consider a food warehouse with a documented cleaning programme covering floors, loading areas and storage spaces.
The programme identifies what requires cleaning, who performs the work, which methods are used and how completion is checked.
A useful audit would compare the programme with the condition of the premises. If records show that cleaning is complete but residue remains around damaged flooring, the record alone does not demonstrate effective implementation.
Auditor’s perspective: A PRP should be assessed through observed conditions, staff understanding and records together.
What Is an OPRP — Operational Prerequisite Programme?
An OPRP is a targeted control, or combination of controls, used to manage a significant food safety hazard.
Unlike a general hygiene arrangement, an OPRP has a specific connection to the hazard analysis. Its action criteria establish the conditions against which the control is checked.
An OPRP should not be described simply as a “medium-risk control.” Its classification requires consideration of how the measure operates, the consequences of failure, and the feasibility of detecting and correcting that failure.
Practical Example: Allergen Changeover Controls
Imagine a production line handling products with different allergen profiles.
The food safety team may identify a significant risk of allergen cross-contact during changeovers. Depending on its assessment, a defined combination of cleaning, line clearance and pre-start checks may be managed as an OPRP.
The procedure should make the required checks clear enough for staff to apply consistently. An instruction such as “check the line is ready” leaves too much open to interpretation.
An auditor would ask the team to explain:
- Which allergen hazard is being controlled?
- What must be checked before production starts?
- What evidence supports the effectiveness of the arrangement?
- What happens if a check fails?
- How is potentially affected product identified?
This example illustrates a possible classification. It does not mean that every allergen control or cleaning activity is automatically an OPRP.
What Is a CCP — Critical Control Point?
A CCP is a process step where a significant food safety hazard is controlled using defined critical limits.
A critical limit separates an acceptable condition from an unacceptable one. It must provide a clear basis for deciding whether the process remains under control.
Practical Example: A Validated Cooking Step
A cooking step may be identified as a CCP where it is necessary to reduce a biological hazard to an acceptable level.
The selected time-and-temperature conditions need supporting evidence applicable to the actual product and process. A business should not copy a limit from another operation without establishing its suitability.
FAO guidance stresses that externally developed critical limits must apply to the specific operation and products concerned.
In a practical audit, the discussion would extend beyond the temperature written in the HACCP plan:
- Where and how is the measurement taken?
- Does the operator follow the documented method?
- Can the result be traced to the relevant batch?
- Is a failed result recognized and escalated?
- Does the record show what happened to affected food?
Auditor’s perspective: A critical limit is useful only when the monitoring method and response arrangements allow it to be applied effectively.
Critical Limits vs Action Criteria
This distinction is particularly important when comparing CCPs and OPRPs.
| Critical limits | Action criteria |
|---|---|
| Apply to CCPs | Apply to OPRPs |
| Must be measurable | May be measurable or observable |
| Establish the boundary used to judge control at the CCP | Establish whether the OPRP is operating as intended |
Observable criteria still need to be specific. For example, a documented line-clearance check with clearly identified inspection points is more consistent than a general instruction to confirm that an area “looks satisfactory.”
Neither type of criterion should be selected merely because it is convenient to record. It needs to support control of the identified hazard.
How Should PRPs, OPRPs and CCPs Be Determined?
Classification should follow an assessment of the operation, rather than a generic list of process names.
For controls addressing significant hazards, the assessment considers matters such as:
- The likelihood that the control could fail.
- The consequences of that failure.
- The control’s position relative to other measures.
- Whether it operates alone or as part of a combination.
- Whether monitoring can detect failure in time for action.
A decision tree can help structure the assessment, but it does not replace competent judgement or documented reasoning.
For example, two facilities may both use chilled storage, but their products, storage periods and subsequent processing may differ. The food safety team needs to explain its own decision rather than treating another facility’s classification as proof.
Common Weaknesses to Check Before an Audit
The following are useful review questions for a food safety team:
| Potential weakness | Question to ask |
|---|---|
| A classification copied from a template | Can we explain why this classification suits our operation? |
| A vague monitoring instruction | Would two trained operators perform the check in the same way? |
| Records without clear product identification | Can we identify what food was affected by a failed check? |
| A procedure that differs from actual practice | Which method are staff following, and why? |
| Repeated deviations with identical responses | Have we investigated why the problem keeps returning? |
| Criteria without supporting justification | Can we show the basis for accepting these conditions? |
These questions help turn a document review into an assessment of how the system actually functions.
Connecting Classification to Validation and Verification
After selecting a control, the organisation needs evidence that it can achieve the intended result.
Validation establishes that capability. Monitoring checks the control during operation. Verification evaluates whether the arrangements are being followed and remain effective.
Validation and verification in food safety serve complementary roles: validation establishes whether a control can achieve the intended result, while verification evaluates whether it is being followed and remains effective. Monitoring checks the control during operation.
Preparing Your Food Safety System for Independent Assessment
Review one control from beginning to end: identify its purpose, examine the classification rationale, observe the task and trace the resulting records.
This approach helps reveal whether the documented food safety system reflects actual practice.
Frequently Asked Questions
No. Both address significant food safety hazards. Their different classifications describe how the controls are managed; they do not justify giving an OPRP less attention.
Routine cleaning commonly forms part of a PRP. A specific cleaning measure selected to address a significant hazard may require different treatment following assessment.
Yes. Classification depends on the hazard, product, process and role of the control. The activity’s name alone does not establish its classification.
A clear connection between the identified hazard, the assessment, the chosen control, its operating criteria and the evidence of implementation. The team should be able to explain that connection without relying solely on the wording of a template.
