PRP vs OPRP vs CCP: Differences Explained

In ISO 22000, a prerequisite program (PRP) is the set of basic conditions and activities that keep the whole operation hygienic, whatever product is being made. PRPs are not tied to a single hazard or process step. They create the environment in which the hazard analysis can focus on the hazards that remain.

Typical PRPs include:

• Building, layout and maintenance of premises and equipment
• Cleaning and sanitation
• Pest control
• Personal hygiene, health and training
• Water, air and utilities
• Supplier approval and incoming material checks
• Waste management and segregation of materials
• Allergen management at site level

Codex also uses the term prerequisite programs and says they include Good Hygiene Practices (GHPs), along with practices such as good agricultural and good manufacturing practice (CXC 1-1969). In ISO 22000:2018, clause 8.2 is the clause on prerequisite programs (PRPs). ISO also publishes sector PRP specifications, the ISO/TS 22002 series, which are used in FSSC 22000.

Operational prerequisite program (OPRP) is a term from ISO 22000. In plain terms, it is a control that your hazard analysis shows you need for a specific significant hazard, but which you manage outside the CCPs. This is often because the control is hard to check against a firm limit in real time, or because a single failure does not by itself make product unsafe.

In practice, OPRPs are monitored against checks, often called action criteria. These can be measurable or observable, such as a visual inspection result or a cleaning verification check, which show whether the control is working.

Codex does not use the term OPRP. The current Codex General Principles of Food Hygiene (CXC 1-1969, last revised in 2022) instead describes GHPs that need "greater attention", for example more frequent application, monitoring and verification. These are hygiene practices that need closer monitoring and records because they control a significant hazard, and they fill a similar role to the OPRP in ISO 22000.

A critical control point (CCP) is a step in the process where a control measure is applied that is essential to prevent or eliminate a significant hazard, or reduce it to an acceptable level. Each CCP has one or more critical limits. Codex allows critical limits to be measurable (such as time, temperature or pH) or observable. If a critical limit is not met, the product is treated as potentially unsafe.

CCPs come from the HACCP principles in Codex CXC 1-1969, and they are central to HACCP based food safety plans under ISO 22000, FSSC 22000 and BRCGS Food Safety.

ISO 22000:2018

• Clause 8.2 is titled Prerequisite programs (PRPs).
• Clause 8.5.2 is titled Hazard analysis. This is where significant hazards and their control measures are worked out, and where you decide whether each control is managed as an OPRP or at a CCP.
• Clause 8.5.3 is titled Validation of control measure(s) and combinations of control measures.
• Clause 8.5.4 is titled Hazard control plan (HACCP/OPRP plan). In practice, a plan like this records limits or criteria, monitoring, what to do on a failure, who is responsible and the records kept.

Codex CXC 1-1969

• GHPs form the foundation for every food business.
• The hazard analysis decides whether a significant hazard can be controlled by prerequisite programs such as GHPs (routine, or needing greater attention), or whether it needs a CCP within the HACCP plan.
• The seven HACCP principles cover CCPs, critical limits, monitoring, corrective action, validation and verification, and documentation.

FSSC 22000

FSSC 22000 is built on ISO 22000, a sector PRP specification (such as ISO/TS 22002-1 for food manufacturing) and the FSSC Additional Requirements. The PRP, OPRP and CCP approach therefore follows ISO 22000, and auditors look for a clear, documented rationale for how each control measure was categorized.

BRCGS Global Standard for Food Safety

BRCGS Food Safety expects a HACCP based plan supported by prerequisite programs. Check the current issue of the Standard for its exact terms and requirements.

Critical limits apply only to CCPs. They are measurable or observable criteria, such as a core temperature or a time, that separate acceptable product from potentially unsafe product. Critical limits must be validated so you have evidence that meeting them controls the hazard.

Action criteria (sometimes called action limits) apply to OPRPs. They can be measurable or observable, such as "no visible residue after cleaning" or "swab result below the site's set threshold". Missing an action criterion means the control may not be working and triggers an assessment, but it does not automatically mean the product is unsafe.

Many sites also set tighter operating or target limits inside a critical limit. These are internal process settings that give an early warning before a critical limit is reached. They are useful, but they are not critical limits.

These two terms are often used as if they mean the same thing, but they do not.

• Correction: the immediate action to deal with the problem you found, such as stopping the line, holding affected product or recleaning equipment.
• Corrective action: the action to find and remove the cause, so the problem does not happen again, such as retraining, repairing a seal or changing a cleaning method.

In ISO 22000:2018, clause 8.9.2 is titled Corrections, clause 8.9.3 Corrective actions and clause 8.9.4 Handling of potentially unsafe products. As good practice, when a CCP critical limit is missed, identify the affected product and treat it as potentially unsafe. When an OPRP check fails, assess the effect on product safety before releasing anything.

These examples are illustrative. Your own hazard analysis decides how each control is categorized on your site.

Metal Detection

• Hazard: metal fragments from equipment or raw materials.
• Typical category: CCP, where it is the final step that removes the hazard.
• Critical limit: the detector rejects test pieces of a set type and size for the product, for example ferrous, non ferrous and stainless steel.
• Monitoring: test piece checks at start up, at set intervals and at the end of production, with a working reject system.
• If a check fails: stop the line, hold all product since the last good check, retest it through a working detector (correction), then find out why the detector failed (corrective action).
• Supporting PRPs: equipment maintenance, glass and hard plastics policy, tool control.

Allergen Cleaning at Changeover

• Hazard: allergen cross contact from a previous product on shared equipment.
• Typical category: OPRP (or a Codex GHP requiring greater attention), because the result is confirmed by inspection and verification rather than a real time critical limit.
• Action criteria: no visible residue on product contact surfaces, plus an allergen swab or test result within the site's validated threshold where used.
• Monitoring: visual inspection and sign off by a trained person at every changeover, with periodic swab verification.
• If criteria are not met: reclean and recheck before start up (correction), and review the cleaning method or training (corrective action).
• Supporting PRPs: site allergen management, cleaning schedules, labeling controls. See our allergen cleaning validation guide.

Cooking Step

• Hazard: survival of pathogens such as Salmonella or Listeria monocytogenes.
• Typical category: CCP.
• Critical limit: a validated core time and temperature combination, set by the site from its validation evidence or recognized guidance.
• Monitoring: probe or continuous oven records for every batch or at a set frequency.
• If the limit is missed: hold the product, then recook or dispose of it (correction), then investigate the cause, such as oven calibration or loading (corrective action).
• Supporting PRPs: calibration, segregation of raw and cooked areas, personal hygiene.

UK and EU

In the UK, Article 5 of retained Regulation (EC) No 852/2004 requires food business operators to put in place, implement and maintain a permanent procedure based on HACCP principles (legislation.gov.uk). EU food hygiene law also expects food businesses to base their food safety procedures on HACCP principles. Private standards widely used in these markets, such as BRCGS and FSSC 22000, build on the Codex HACCP principles, and ISO 22000 and FSSC 22000 use the PRP, OPRP and CCP model. Sources: Codex CXC 1-1969, FSSC 22000, BRCGS.

US: FDA Preventive Controls for Human Food

The FDA Preventive Controls for Human Food rule (21 CFR Part 117) does not use the term OPRP. Instead, the hazard analysis identifies hazards requiring a preventive control. 21 CFR 117.135 says preventive controls include controls at CCPs, if there are any, and controls other than those at CCPs. Named types are process, food allergen, sanitation and supply chain controls, a recall plan and other controls. Process controls must include, as appropriate, the parameters linked to the hazard and the maximum or minimum values they must be kept within. Monitoring is set out in 117.145, and corrective actions and corrections in 117.150. In our view, PRPs broadly match the Current Good Manufacturing Practice requirements in Subpart B. For more on the US approach, see HARPC vs HACCP.