Hazard analysis, OPRPs and CCPs: building the ISO 22000 hazard control plan

Before any hazard is named: the preliminary steps

ISO 22000 starts not with hazards but with the information a hazard analysis depends on, and auditors test it first.

The food safety team

The team needs the combined knowledge to analyse the product and the process: production, quality, hygiene, engineering and, where relevant, microbiology or allergen management. Competence has to be shown with records of HACCP training and experience; our ISO 22000 training guide covers that evidence.

Product and process characteristics

Raw materials, ingredients and contact materials are described by what matters to safety: origin, composition, delivery and storage. The end product is described the same way, with shelf life, storage, packaging and labelling.

Intended use

The team records how the product will be used, who will consume it, and the handling or misuse that can reasonably be expected. A cooked chilled meal eaten without reheating by elderly or vulnerable consumers carries a different acceptable level of hazard from one sold to a caterer who will cook it again.

Flow diagrams confirmed on site

The flow diagram shows every step in sequence, including outsourced work, where materials and utilities enter, rework, and where product, by-products and waste leave. The team then walks the line with the diagram in hand, at different shifts if practice differs, and signs off that it matches reality.

Hazard identification, acceptable levels and assessment

With the preliminary information in place, the team works through the flow diagram step by step and identifies the biological, chemical (including allergens) and physical hazards that could reasonably occur.

For each hazard the team determines the acceptable level in the end product, wherever that is possible. The acceptable level is what the control measures are designed to achieve, so a hazard without one leaves nothing to validate against.

The assessment then decides which hazards are significant. The standard requires an evaluation of the severity of the adverse health effect and the likelihood of occurrence before any control is applied. Many plants use a simple matrix; what matters is recorded, consistent reasoning for each judgement. Hazards that are not significant are still recorded, with the justification.

Selecting control measures and categorising them as OPRP or CCP

Each significant hazard needs a control measure, or a combination of measures, able to bring it to its acceptable level. The team then categorises each measure. ISO 22000 requires a systematic approach that weighs, among other things, how likely the measure is to fail, how severe the consequence would be, whether the measure is specifically applied to reduce the hazard, whether it can be measured or observed and monitored in time to act, and where it sits relative to other controls.

The result is one of two categories. Prerequisite programmes sit beneath both and have their own guide.

An OPRP is not a lesser control: it still manages a significant hazard, sits in the plan and is validated.

What the hazard control plan contains

The hazard control plan brings the CCPs and OPRPs into one controlled document. For each one ISO 22000 expects:

• the food safety hazard or hazards it controls;
• the control measure;
• the critical limit at a CCP, or the action criterion for an OPRP;
• the monitoring method, frequency and the person who performs it;
• the correction and the corrective action when the limit or criterion is not met;
• responsibilities and authorities, including who may release or reject product;
• the monitoring records.

Monitoring at a CCP must be capable of detecting a failure in time for product to be isolated. Monitoring equipment is calibrated or verified, and the plan itself is verified, under the requirements grouped in clauses 8.6 to 8.8. Deviations lead into the handling of potentially unsafe product in clause 8.9, which is where the hold, evaluation and release records live.

Validation: proving the controls work before relying on them

Validation answers one question: will this control measure, or combination, achieve the acceptable level of the hazard? It happens before implementation and after any relevant change; verification, by contrast, later confirms the plan is followed and effective.

Evidence can come from scientific studies, regulatory guidance, manufacturer data backed by site trials, challenge or shelf-life studies and process history. The auditor looks for a clear link between each limit and evidence that applies to this product and this equipment.

A worked example: cooked chilled chicken pieces

The table below follows one product through four steps. It illustrates the structure of a plan rather than prescribing limits: the actual values come from the team's validation and the requirements of the applicable regulator, so they are described rather than stated.

A real plan adds columns for responsibilities and the record where each result is written at the time.

Mistakes that weaken a hazard control plan

• Copying a plan from another site or a template. The hazards, steps and limits belong to someone else's product and equipment, and nobody on the team can explain them.
• Too many CCPs. Declaring every step critical spreads monitoring thin.
• No acceptable levels. Without them, validation has no target and categorisation has no logic.
• Limits without validation. A figure lifted from guidance, never tested on the actual line, will not survive the auditor's question about where it came from.
• Monitoring that cannot act in time. A laboratory result that arrives after dispatch is verification, not CCP monitoring.
• A plan that is never revisited. New products, suppliers or equipment change the hazards, and the plan must follow. Our internal audit guide shows how to check it.

The hazard control plan: questions buyers ask