Critical control points (CCP) in food service — how to identify and monitor them

Critical control points (CCPs) are the heart of every HACCP plan — and at the same time the place where theory and practice most often part ways. On paper everything is written down: the process step, the critical limit, the monitoring frequency, the corrective action. In a real kitchen it turns out that "monitoring every two hours" slides to the bottom of the list at peak time, and the boxes get filled in from memory at the end of the shift. In this article we show how to identify critical control points according to HACCP logic, and how to make a system — rather than the diligence of the busiest person on site — keep watch over them.

What a critical control point (CCP) is

A critical control point is a step in the process at which control can be applied that is essential to eliminate a food safety hazard or reduce it to an acceptable level. The key word is "critical": if something goes wrong here and isn't caught, the hazard travels on down the chain — all the way to the guest's plate. That's what distinguishes a CCP from an ordinary control point (sometimes labelled CP or oPRP): at a CCP, loss of control means a real health risk, not just a drop in quality.

In food service, the vast majority of critical control points concern temperature and time, because it's these two parameters that govern microbial growth. Hence a simple conclusion: if you can reliably measure and document the temperature at every CCP, you have most of your HACCP plan under control.

How to identify critical control points — the decision tree

Identifying CCPs is not guesswork. The classic Codex Alimentarius method uses a decision tree which, for each identified hazard, asks in turn:

1. Do control measures for the hazard exist at this step? If not — is control even necessary here for safety? If it is, the step or the process needs modifying.
2. Does this step eliminate the hazard or reduce it to an acceptable level? If yes — it's a CCP.
3. Could the hazard increase to an unacceptable level at this step? If not — it's not a CCP.
4. Will a subsequent step eliminate the hazard or reduce it to an acceptable level? If yes — the current step is not a CCP; if not — it is.

In practice, for small and mid-sized food service the tree usually leads to the same recurring set of points. It's worth walking through it once, thoroughly, and then keeping watch over the points you've identified.

Typical CCPs in a food service establishment

Although every HACCP plan is individual, a few classic critical control points recur across food service:

• Goods receipt. Chilled and frozen goods must arrive within the right range — typically around 0–4 °C for chilled and roughly −18 °C for frozen. It's the first moment you make the "accept or refuse" decision.
• Chilled and frozen storage. Fridges, display counters and freezers run 24/7, making this the CCP where continuous manual supervision is hardest — a compressor failure at night or over the weekend tends to be discovered only in the morning.
• Cooking. Reaching core temperature in the product (around 75 °C is commonly adopted) eliminates most vegetative forms of microorganisms.
• Cooling after cooking. The dish must pass through the danger zone (roughly 5–60 °C) as quickly as possible — the classic time-and-temperature CCP.
• Hot and cold holding (service counter, bain-marie, buffet). Cold below and hot above the danger-zone boundary, with exposure time under control.

The full temperature monitoring deployment scenario for an establishment — from goods receipt to the service counter — is laid out on our food service solution page.

Critical limits, monitoring and corrective actions

The list of points is only half the job. For each CCP, the HACCP plan must define:

• The critical limit — the boundary value that must not be exceeded (e.g. fridge ≤ 4 °C, freezer ≤ −18 °C, product core ≥ 75 °C).
• The monitoring procedure — what is measured, with what, how often and by whom.
• The corrective action — what you do when the limit is exceeded (e.g. holding back the dish, moving the goods, a disposal decision).
• The record — proof that the monitoring actually took place.

And this is exactly where the paper log is the weakest link. Spot checks three times a day leave long windows with no supervision, entries made "from memory" don't survive an inspection, and the lack of real-time reaction means you learn about a failure after the fact. We write more about the move from notebook to automatic records in HACCP in practice — automatic temperature monitoring.

Automatic CCP monitoring instead of rounds

Automatic supervision of critical control points comes down to three elements: a sensor at every point, thresholds mirroring the critical limits, and notifications that reach a human before the hazard travels on.

At each control point a battery sensor measures temperature cyclically — typically every 10–30 minutes — and sends the reading over long-range radio to a single gateway (range reaches about 2 km in town and up to 15 km in open terrain, so one gateway covers the entire establishment, basement and store room included). The sensors buffer measurements locally and send them on after a connectivity gap — an internet outage doesn't punch a hole in the records, which is critical for the credibility of CCP documentation.

The heart of the supervision is the alert rules: for each metric you set up to four thresholds (warning and critical, lower and upper). The critical limit from your HACCP plan maps onto a critical threshold, and you add a warning threshold with margin for reaction — for a fridge run at 0–4 °C, typically a warning at 5 °C and a critical alarm at 8 °C. Every exceedance opens an event with a unique ALM code and moves through the active → acknowledged → resolved cycle, with the team's comments serving as the corrective-action record: you can see who reacted and when.

Hardware for refrigerated points

For the typical refrigeration CCPs, the Nextriv Probe Solo is a good fit — a recorder with a detachable probe on a cable and EN 12830 certification (the standard for temperature recorders in the cold chain). The food-grade 316 stainless-steel probe goes inside the fridge, counter or chamber while the transmitter stays outside — the metal enclosure doesn't break the link. The probe can sit in a thermal buffer so that it tracks the product's temperature rather than the air's — then a door opened for a moment stops generating false alarms, while a real excursion still triggers one. A buffer of 4,000 timestamped measurements with retransmission closes out the record-continuity requirement.

Where the CCP concerns the temperature deep inside a stored product or raw material, reach for the Nextriv Probe Food — a 40 cm spike probe in 316 stainless steel that measures the temperature inside the material, not the air around it, and also alarms on a sudden change in the reading.

CCP documentation ready for inspection

Automatic supervision yields evidence a notebook can never provide:

• Measurement history — raw data available for a full year even on the free plan, up to 5 years (1825 days) at most.
• PDF reports — a summary and charts, and in the extended variant statistics, percentiles, a threshold-compliance section and a schedule of daily or weekly reports.
• Signed documents — reports with a SHA-256 signature, a QR code and a verification address, so anyone can check that the document hasn't been altered since it was generated.
• XLSX and CSV exports — for when the auditor wants to run their own numbers.

Alarm events with their status timeline and comments become a ready-made record of supervision over each CCP: you can see when the limit was exceeded, who acknowledged the alarm and when the parameter returned to normal.

What does it cost?

Starting is free: the FREE plan includes 10 sensors, 1 gateway, 2 users, 5 alert rules and a full year of measurement history — for a small establishment with a few critical control points that's often the complete kit. The PRO plan (99 PLN net per 30 days or 990 PLN net per year, excl. VAT) removes the limits and adds, among other things, escalation policies, a schedule of signed reports and 5 years of history.

Compare both plans in detail in the pricing — or book a short demo, where we'll show CCP supervision running on live data.