Home›Toolkits›Development Program HACCP
FSSC Development Program · HACCP
The CCPs and OPRPs the assessor will test
A bakery HACCP study taken through the Annex 3 decision tree, with the limits, monitoring, corrections and records an assessor checks under section 3 of the Food and Feed Manufacturing requirements.
The short answer. The assessor tests whether every significant hazard went through the decision tree to land as a CCP or an OPRP, and whether the plan for each one works on the floor. In a bakery that usually means baking as the CCP for Salmonella and Shiga toxin producing E. coli from raw flour and egg, metal detection as the CCP for metal, and OPRPs for controls that are checked at intervals, such as the intake of nuts and seeds, flour sifting, allergen changeover and pack checks. Then the assessor asks for the validation, the monitoring logs, the deviation records and the verification signatures that prove it.
What section 3 of the requirements asks for
The HACCP part of the Assessment Requirements for Food and Feed Manufacturing V2.0 (May 2025) is section 3, built on the seven HACCP principles and the 12 steps of Codex. Requirements 3.1.2 to 3.1.6 cover the preliminary tasks, from the team to the onsite check of the flow diagram. Requirement 3.2.2 is the hazard analysis per process step. Requirement 3.2.4 brings in the decision tree. Requirements 3.2.6 to 3.2.11 cover limits, validation, monitoring, corrections, verification and records, and 3.2.12 pulls them into a documented hazard control plan. For how the whole assessment day runs, read our post on what the assessor asks to see.
The example bakery and its hazards
I use the bakery that runs through ASC’s Food and Feed Manufacturing toolkit (TKDP-M). It has a bread line with a tunnel oven, a rusk line with rack ovens and a biscuit line with a band oven. The biscuit line makes shortbread and an almond and sesame range, with the almond and sesame products run last before a full clean.
The study has 74 hazard rows over 39 process steps. The biological hazards are Salmonella and Shiga toxin producing E. coli (STEC) in raw flour and egg, Bacillus cereus and rope spores that survive baking, and moulds after baking. The chemical hazards include mycotoxins, aflatoxins in almonds, residues in sesame and acrylamide. The physical hazards are metal, hard plastic, string and paper. Allergen hazards come from cross contact, rework and the wrong bag.
Each hazard is scored for severity and likelihood on a 1 to 5 scale, and a score of 8 or more is significant. Thirteen rows reach 8. One rule saves a lot of argument with an assessor. Score each hazard at the step where its control is applied. Pathogens in flour are scored at the oven. At intake the real hazard is an unapproved mill, and supplier approval manages that.
The Annex 3 decision tree in plain words
Annex 3 of the Program holds the HACCP (CCP/OPRP) decision tree as a diagram. FSSC calls it an “example decision tree” for categorising the control measures for significant hazards, and requirement 3.2.4 links CCP and OPRP identification to its outcome. The four questions below are my summary of the tree, not FSSC’s wording, so read the Annex itself before you run your study. Writing your answer to each question against every significant hazard is the clearest way to show the assessor how each control was categorised.
- Q1, is the hazard significant? If not, a PRP manages it and you name which one.
- Q2, is a control measure in place? Can a control, or a combination, eliminate the hazard or reduce it to or keep it at an acceptable level? If not, put one in place and ask again.
- Q3, is it the final step designed for this hazard? Is the control the final step in the process specifically designed to eliminate or reduce the hazard? If not, it is an OPRP.
- Q4, can it be monitored continuously? Can a failure be picked up and corrected in time to stop unsafe product moving on? If yes, it is a CCP. If no, it is an OPRP.
Q4 settles most bakery debates. An oven controller that records zone temperatures and band speed all the time and alarms on a drop is continuous monitoring. A sifter screen checked twice a shift is not.
The worked table
Here is how the significant hazards come out of the tree, with two PRP rows for contrast. The score is severity times likelihood.
| Step and hazard | Score | Q2 | Q3 | Q4 | Result |
|---|---|---|---|---|---|
| Step 16, tunnel oven, Salmonella and STEC | 15 | Yes | Yes | Yes | CCP 1a |
| Step 24, rack ovens, the same pathogens | 15 | Yes | Yes | Yes | CCP 1b |
| Step 32, band oven, the same pathogens | 15 | Yes | Yes | Yes | CCP 1c |
| Steps 19, 27 and 34, metal detection, metal fragments | 9 | Yes | Yes | Yes | CCP 2 |
| Step 4, almond and sesame receipt, aflatoxins and residues | 8 | Yes | Yes | No | OPRP 1 |
| Step 10, flour sifting, string, plastic, wood and insects | 9 | Yes | Yes | No | OPRP 2 |
| Steps 29 and 31, biscuit mixing and rework, almond, sesame and egg into shortbread | 15 and 10 | Yes | Yes | No | OPRP 3 |
| Steps 20 and 35, bagging and flow wrap, wrong bag or film | 10 | Yes | Yes | No | OPRP 4 |
| Step 18, slicing, metal from a broken blade | 6 | N/A | N/A | N/A | PRP, with CCP 2 at the next step |
| Step 26, rusk drying, acrylamide | 6 | N/A | N/A | N/A | PRP, process control verified by testing |
The three ovens are one CCP with three parts, with limits that differ by equipment. The almond and sesame check answers yes at Q3 because nothing later in a bakery reduces aflatoxin or a residue, and no at Q4 because a certificate check per lot is not continuous.
Critical limits and action criteria
Requirement 3.2.6 wants measurable critical limits at CCPs and measurable or observable action criteria for OPRPs, and 3.2.7 wants both validated and documented. Every value below is an illustrative default from the toolkit. Your site validates its own values for its own ovens, products and detectors.
| Control | Limit or action criterion (illustrative default) | Validation |
|---|---|---|
| CCP 1a, tunnel oven | Slowest heating loaf at least 92 °C core at the oven exit, 3 loaves per check, band speed and zones within the validated profile | Data loggers in the slowest loaves across the band |
| CCP 1b, rack ovens | At least 92 °C core in 3 rusk loaves from the mapped slowest positions of each rack | Temperature mapping of each rack oven |
| CCP 1c, band oven | Bake time at least 8 minutes and every zone at or above 180 °C, or the recipe card values | Travelling logger, with published Salmonella inactivation data or an Enterococcus faecium surrogate study |
| CCP 2, metal detection | Rejects 2.5 mm ferrous, 3.0 mm non-ferrous and 4.0 mm stainless steel test pieces at leading edge, middle and trailing edge | Manufacturer validation per product and a reject trial at line speed |
| OPRP 1 | Lot held until a certificate from an ISO/IEC 17025 accredited laboratory shows results within the maximum levels of the country of sale | Review of the supplier sampling plan and laboratory scope, confirmed by an independent test of one lot of each material per year |
| OPRP 2 | 1.5 mm screen fitted and intact at every check | Sifter data and the tailings trend |
| OPRP 3 | Almond and sesame after shortbread, no visible residue, allergen swab pass, rework only into the same product on the same day | Three changeovers with laboratory tests of the first shortbread |
| OPRP 4 | Bag or film matches the approved reference pack, no other packaging at the line | Challenge with a wrong reel at the line |
Never copy a number into your plan without the oven profile or detector study behind it. The assessor asks for that study first.
The full study is already built. The Food and Feed Manufacturing toolkit (TKDP-M) includes the HACCP workbook with all 74 rows, the Annex 3 decision tree questions and every log named here, in 247 editable Word and Excel documents. R3,750, about USD 231 · EUR 200 · GBP 172 · AED 843.
Monitoring, correction and verification
Requirement 3.2.8 wants each monitoring procedure to state the method or device, the frequency, the results, who monitors and who evaluates, with trained deputies. In the bakery the Production Supervisor monitors the CCPs, with the other shift’s supervisor as deputy, and both appear on the CCP and OPRP Monitor Training and Sign-off Record. Tunnel oven cores are probed at start-up, every 30 minutes and after every stop or product change. Metal detectors are tested at start-up, every hour, at product changes, after repairs and at the end of production, with test pieces among unpacked product and never on a closed pack.
Requirement 3.2.9 asks that a correction keeps unsafe product from release, finds the cause, restores the parameter and prevents recurrence. After an oven or detector failure the line stops and everything since the last good check is held. After an oven failure the Quality and Food Safety Manager assesses the held product and destroys it where the limit cannot be shown to have been met. After a detector failure held bread is destroyed, and biscuits and rusks are re-screened only where unpacking does not damage them. Each event goes on the CCP and OPRP Deviation and Corrective Action Record, and held stock on the Hold and Release Register.
Under requirement 3.2.10 the supervisor confirms each shift’s checks before dispatch, and the Quality and Food Safety Manager signs each CCP log within 1 working day. Probes are verified monthly, detectors serviced yearly and oven profiles repeated yearly. The first shortbread after a changeover goes to the laboratory each quarter.
The records the assessor will ask for
- Preliminary steps. Food Safety Team Appointment and Competence Record, Product Description and Intended Use, Process Flow Diagrams and the Process Flow Diagram Onsite Verification Record.
- Study and plan. The HACCP hazard analysis with tree answers on every row, and the Hazard Control Plan, CCP and OPRP.
- Validation. Validation Record for Critical Limits and Action Criteria and Allergen Cleaning Validation Record.
- Monitoring. Oven Baking CCP Monitoring Log, Metal Detector CCP Verification Log, OPRP Monitoring Log and Line Start-up and Changeover Label Check Record.
- Deviations and verification. CCP and OPRP Deviation and Corrective Action Record, Hold and Release Register, HACCP Verification Schedule and Record and Thermometer and Probe Verification Record.
- Review. Hazard Control Plan Review Record, as requirement 3.2.13 asks after any change.
Where bakery HACCP plans come unstuck
- Pathogens scored significant at intake as well as at the oven, which leaves a phantom CCP nobody monitors.
- A critical limit copied from a textbook with no oven profile behind it.
- Metal detector test pieces placed on a sealed pack, which tests the pack and not the product.
- A deputy signing CCP logs who is not on the training record.
Other food factories
The tree works the same in a dairy, meat plant or feed mill, but the answers change. Chilled products, products without a lethal step and sites with CIP end up with different CCPs. The toolkit’s Food Chain Category Adaptation Guide covers BIII, C0, CI, CII, CIII, CIV, D and K.
Questions people ask
Frequently asked questions
Is the Annex 3 decision tree compulsory under the FSSC Development Program?
Requirement 3.2.4 links CCP and OPRP identification to the outcome of the decision tree, and Annex 3 is the example tree FSSC publishes for it. Writing the answer to each question against every significant hazard is the simplest way to show the assessor how each control was categorised.
Is baking always a CCP in a bakery?
Not automatically. It is a CCP when pathogens from raw flour or egg are significant, baking is the final step designed to destroy them and the oven can be monitored continuously. The study has to show this for each oven.
Why is flour sifting an OPRP and not a CCP?
The sifter is the final step designed to remove non-metallic foreign matter, so it passes Q3. The screen is checked at set times rather than continuously, so it fails Q4 and becomes an OPRP.
Are 92 °C and a 2.5 mm ferrous test piece legal limits?
No. They are illustrative defaults in the toolkit, and the Assessment Requirements do not prescribe them. Each site validates its own limits and documents the validation, as requirement 3.2.7 requires.
How often must the HACCP plan be reviewed?
Requirement 3.2.13 asks for a review whenever materials, packaging, processes, infrastructure or equipment change, and 3.1.6 asks for an onsite check of the flow diagrams at least once a year.