HACCP Decision Tree: How to Identify CCPs (with Example)

A HACCP decision tree is a short sequence of yes/no questions that helps a HACCP team decide whether a process step is a critical control point (CCP) for a specific significant hazard. You apply it step by step, hazard by hazard, after the hazard analysis, and the answers show whether control at that step is essential or whether the hazard is handled elsewhere.

Getting CCPs right matters. Too few and a genuine hazard goes uncontrolled; too many and monitoring becomes box-ticking. Auditors in India and the GCC routinely ask the HACCP team to justify each CCP.

Start with a proper hazard analysis

The decision tree only works on significant hazards, so it cannot replace a hazard analysis. For each step on the confirmed flow diagram, the team lists the biological, chemical (including allergen) and physical hazards that could reasonably occur, then assesses each one for likelihood of occurrence and severity of harm if it is not controlled.

Codex describes a significant hazard as one identified by the hazard analysis as reasonably likely to occur at an unacceptable level without control, and for which control is essential given the intended use of the food. Only those hazards go through the tree. Low-risk hazards are managed by Good Hygiene Practices (GHPs) and other prerequisites. If you need a refresher on this stage, read How to build a HACCP plan step by step.

The classic Codex decision tree: four questions

The four-question tree below, from the Codex HACCP text, is the version most widely taught. Apply it to each significant hazard at each step.

What each question is really asking

• Q1 checks that control is possible here. If not, and control is essential, the process or product must change.
• Q2 identifies steps whose purpose is control, such as cooking, acidification or metal detection.
• Q3 asks whether the hazard can enter or grow here to a level that matters.
• Q4 looks downstream. If a later step reliably controls the hazard, the CCP belongs there.

Apply it with judgement

The current Codex General Principles of Food Hygiene, CXC 1-1969 (rev. 2020), presents a decision tree only as an example of a logical approach. It stresses that the tree must be applied flexibly, using the team's knowledge of the process, and that other logical methods may be used instead. Many experienced teams use the tree as a discussion prompt and then record their reasoning in a CCP determination table.

CCP, OPRP and GHPs requiring greater attention

Not every significant hazard control has to be a CCP. Codex 2020 recognises that some GHPs need greater attention because of their impact on safety, for example cleaning a slicer used for cooked, ready-to-eat meat. ISO 22000:2018 uses the term operational prerequisite programme (OPRP) for a control measure that manages a significant hazard but is monitored against an action criterion rather than a critical limit.

For the full comparison, see CCP vs OPRP in food safety management.

Worked example: cooked chicken sandwiches in a Dubai central kitchen

A central kitchen in Al Quoz produces chilled cooked chicken sandwiches for airline lounges and corporate canteens. The sandwiches are eaten cold, with no reheating by the consumer. The hazard analysis identified Salmonella and Campylobacter in raw chicken, growth of spore-formers such as Clostridium perfringens and Bacillus cereus during cooling, recontamination with Listeria monocytogenes and Staphylococcus aureus after cooking, sesame and egg allergens from bread and mayonnaise, and metal fragments from slicer blades.

The slicing row shows why judgement matters. The questions lead to a CCP, but no measurable limit can be monitored in time to act on the product, so the team documents the step as a GHP requiring greater attention (an OPRP under ISO 22000), with pre-use cleaning checks, environmental swabbing and supervisor verification, and records why.

Chilled storage before dispatch would also go through the tree; some teams make it a CCP with a maximum product temperature, others an OPRP. Either can be defended if the reasoning is sound. Critical limits must be validated and meet your authority's requirements, such as Dubai Municipality.

Common mistakes

• Too many CCPs. Turning every temperature check into a CCP dilutes attention; keep CCPs for steps where control is essential and measurable.
• Using the tree before the hazard analysis. Running every hazard through the tree, significant or not, produces meaningless results.
• Ignoring allergens. Allergen cross-contact and labelling errors are significant hazards and must be assessed like any other.
• Calling cleaning a CCP. Cleaning is a GHP; where it is critical, manage it as a GHP requiring greater attention or an OPRP.
• Not recording the reasoning. A CCP list without justification will not satisfy an auditor.
• Never revisiting decisions. New equipment, recipes or suppliers can change the answers.

Key takeaway: The HACCP decision tree is a thinking tool, not a vending machine. Apply it only to significant hazards from a sound hazard analysis, challenge every answer with process knowledge, and record why each step is or is not a CCP.

Frequently Asked Questions

What are the four CCP decision tree questions?

Q1: do control measures exist for the identified hazard at this step? Q2: is the step specifically designed to eliminate or reduce the likely occurrence of the hazard to an acceptable level? Q3: could contamination occur in excess of acceptable levels or increase to unacceptable levels? Q4: will a subsequent step eliminate the hazard or reduce it to an acceptable level? The answers lead to a CCP or not-a-CCP outcome.

Is the HACCP decision tree mandatory?

No. Codex CXC 1-1969 (rev. 2020) presents the decision tree as an example tool and says it should be applied flexibly, with other logical approaches acceptable. What auditors and inspectors expect is a clear, documented and justified basis for each CCP. Some customers, schemes or authorities may prefer a particular format, so check their requirements.

How many CCPs should a HACCP plan have?

There is no correct number. A simple process may have one or two CCPs, a complex one several. The number should follow from the hazard analysis, not a target. A plan with dozens of CCPs usually means prerequisites or OPRPs have been misclassified, which weakens focus.

Can one CCP control more than one hazard?

Yes. A single step can be a CCP for several hazards, for example cooking controlling both Salmonella and Campylobacter in chicken. Equally, one hazard may need more than one CCP, such as cooking followed by cooling for spore-forming bacteria. Each hazard still needs to be assessed through the decision process and linked to its critical limits.

Next steps

If you are a supervisor or QA team member who builds or verifies HACCP plans, the Highfield Level 3 International Award in HACCP covers hazard analysis and CCP determination in depth. If you lead the HACCP team or own the system, the Highfield Level 4 International Award in HACCP Management goes further into validation, verification and management. Innoryx is a Highfield Approved Centre and offers both online to learners in India and the GCC.

Continue with The 7 HACCP principles explained with examples, How to build a HACCP plan step by step and CCP vs OPRP in food safety management. Unsure which level fits your role? Speak to a counsellor.