ISO 22000 clause 8.5.2.4: select controls and distinguish CCPs from OPRPs

What clause 8.5.2.4 requires in practice

Having found the significant hazards, the organisation selects a control measure, or a combination of measures, that can prevent or reduce each of them to the defined acceptable level. It then sorts the selected measures into those managed as OPRPs and those managed at CCPs, using a systematic approach. For each measure the assessment looks at how likely it is to fail and how serious the consequence of failure would be, including its effect on the hazard, its position relative to other measures, whether it is specifically set up to reach the acceptable level, and whether it works alone or in combination. The organisation also checks that measurable limits or measurable or observable criteria can be set, that failure can be detected by monitoring, and that timely correction is possible. The reasoning and results, and relevant outside requirements, are kept as documented information.

Select the measure before deciding its label

Begin with the significant hazard and required outcome established in the hazard assessment. Identify an appropriate measure or combination. Understand what each measure is intended to achieve and the conditions necessary for that performance.

Where several measures contribute, explain the relationship. One may prevent introduction while another addresses a later stage. Do not assume that several weak measures automatically form an adequate combination. Capability needs the appropriate validation basis.

Keep relevant external requirements visible. Authority or customer requirements can affect the choice and strictness of control and must be maintained as documented information where relevant.

Why clause 8.5.2.4 matters to the business

The CCP or OPRP label decides how a control is monitored, what happens when it fails, and how much attention it receives every day. A wrong category is costly in both directions: too many CCPs overload operators with records that nobody uses, while an important control placed too low may be watched too loosely. Customers and certifiers often challenge category decisions, and a clear record of the reasoning protects the business when they do. The same discipline reveals measures that look good in principle but cannot be monitored in time to protect product, which is better learned on paper than during an incident.

How to implement clause 8.5.2.4

Treat categorisation as a technical decision made after selection, with the reasoning written down. Treat any worksheet or decision tree as a prompt for discussion, and make sure the written reasoning, rather than the tool's output alone, explains why each category was chosen.

1. Start from each significant hazard and its acceptable level, and list candidate measures and combinations.
2. For each measure, assess the chance of failure and the consequence, including its effect on the hazard and its place among other measures.
3. Check whether a measurable limit or a clear measurable or observable criterion can be set, and whether failure can be detected quickly enough to act.
4. Use a decision tool if it helps, but make sure the underlying questions are answered and the tool does not replace judgement.
5. Decide the category, and record the reasons, including those that depended on customer or regulatory requirements.
6. Pass the selected measures to validation and to the hazard control plan.
7. Revisit categories when processes, equipment or monitoring capability change.

Evidence an auditor expects for clause 8.5.2.4

Examine failure and its consequences

Check whether the measure can be managed effectively

Assess the feasibility of measurable critical limits or measurable or observable action criteria. Consider whether monitoring can detect failure to remain within the relevant limit or criterion, and whether timely corrections can be applied.

These questions connect technical capability with operating practicality. A measure may appear effective in principle but lack a usable monitoring arrangement under the actual process conditions. That issue needs resolution before the plan relies on it.

CCPs use measurable critical limits. OPRPs use measurable or observable action criteria. The detailed limits and criteria and monitoring requirements explain how the categorisation becomes an operating arrangement.

Illustrative food-manufacturing example

Illustrative catering example

A caterer reviews a control based partly on observation. The team considers whether an observable action criterion can be defined clearly, whether staff can apply it consistently and whether failure can be detected and corrected in time.

If the proposed method is too subjective or late to support the intended control, the team revises the arrangement. Calling it an OPRP does not remove the need for meaningful criteria and monitoring.

Keep a defensible decision record

Maintain the decision process and results of selection and categorisation. The record should connect the hazard, measure, required considerations and conclusion. It should also identify relevant external requirements affecting the choice or strictness.

Common mistakes include classifying controls by department, setting a desired CCP count and treating OPRPs as unimportant PRPs. Another is categorising a measure before examining whether its monitoring and correction arrangements can work.

Revisit decisions after relevant changes. A changed process or monitoring capability can affect the basis of categorisation even when the measure's name remains the same.