Understanding the difference between PRP, OPRP & CCP
If you are a food safety practitioner you will no doubt have heard of and may possibly even be confused by the terms PRP, oPRP and CCP.
In this piece, we will attempt to demystify and clarify these terms.
You would be familiar with Prerequisite Program (PRP) and Critical Control Point (CCP) which stems from HACCP (Hazard Analysis and Critical Control Point), a risk assessment management tool designed by the Pillsbury Company in collaboration with NASA in the 1960’s to help identify specific hazards within processes, determine their significance and develop appropriate controls to ensure they do not reach the consumer (or astronaut).
You will have heard the term Operational Prerequisite Program (oPRP) if your food safety system has been based on the ISO 22000.
During the intervening decades since the “launch” of HACCP, numerous food safety standards, codes of practice, and regulatory directives have adopted the principles of HACCP, and, in the process, put forth their own unique interpretation on how exactly these principles are affected.
The purpose of risk assessment and management
When we speak of HACCP, risk assessment and determination of control measures is an aspect which many people may find difficult, if not mystifying, on occasion.
To put it simply, the basic principle is to install within the process and operation some control measures which are appropriate for the specific hazards and the risk they pose to the final consumer.
HACCP requires you to identify these potential hazards and then determine the significance of these hazards by applying risk assessment techniques, the output of which is a measure of risk which then allows us to put in place appropriate control measures, such as PRP, oPRP, and CCP.
Over the decades, various standards have attempted to define how risk assessment is carried out and how to determine control measures.
In the process they have introduced their own unique terms, language, scope, methodology and workflows, and while some of these have been good, much of this work has served only to confuse people causing HACCP plans which are unnecessarily complex and hinder the effective management of food safety.
Various standards have attempted to define how risk assessment is carried out and how to determine control measures…only to confuse people causing HACCP plans which are unnecessarily complex and hinder the effective management of food safety
In the context of food safety, the International Standards Organisation (ISO) has defined a control measure as an action or activity that can be used to prevent or eliminate a food safety hazard or reduce it to an acceptable level.
This definition is general and can be used to describe virtually any action, step, activity, job, task, process or procedure which has the intention of addressing a food safety hazard.
As we look closer at the main food safety standards we can see that control measures become categorized.
Categories of Control Measures
Critical Control Point (CCP)
The CCP is perhaps the most commonly known of all the control measures, and the ISO defines it as a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.
This definition is similar to the general definition of a control measure, however, a CCP differs as it relates specifically to a step in the process such as cooking, cooling, or freezing, and not a general activity or action.
a CCP differs from a control measure as it relates specifically to a step in the process, and not a general activity or action
ISO also states that a CCP is a step at which control can be applied, which means that if a ‘CCP’ is unable to apply control, it cannot be considered a CCP.
In scenarios where control is subjective and cannot be measured accurately, this may be problematic as control is not able to be enforced.
If a CCP is unable to apply control, it cannot be considered a CCP
Finally, another factor relating to CCP’s is the risk posed by the hazard should the control not be exercised.
For instance, if salmonella were to be present in cooked meat, it would pose a significant risk to the consumer if cooking were not carried out to the required temperature and time specification.
In this situation, control is a critical step and is designed and enforced specifically to control the hazard.
Prerequisite Program (PRP)
Defined by ISO as the basic conditions and activities necessary to maintain a hygienic environment throughout the food chain which are suitable for the production, handling and provision of safe end products and safe food for human consumption.
There are a wide variety of PRPs depending on the particular product and process.
They are often described in certain sectors of the industry as Good Agricultural Practice (GAP), Good Veterinarian Practice (GVP), Good Manufacturing Practice (GMP), Good Hygienic Practice (GHP), Good Production Practice (GPP), Good Distribution Practice (GDP), and Good Trading Practice (GTP).
Examples of PRP’s in a food manufacturing environment would be:
- construction and layout of buildings and associated utilities
- lay-out of premises, including workspace and employee facilities
- supplies of air, water, energy and other utilities
- supporting services, including waste and sewage disposal
- the suitability of equipment and its accessibility for cleaning, maintenance and preventative maintenance
- management of purchased materials (e.g., raw materials, ingredients, chemicals and packaging), supplies (e.g., water, air, steam and ice), disposals (e.g., waste and sewage) and handling of products (e.g., storage and transportation)
- measures for the prevention of cross-contamination
- cleaning and sanitizing
- pest control
- personnel hygiene
PRP’s are usually general to the process and not focused on any particular step in the process.
For example, cleaning and sanitizing are activities which can apply to all steps, rooms, items and building fabric.
They also have the character that their failure does not necessarily lead to an immediate and imminent food safety risk.
Failure of a PRP does not necessarily lead to an immediate and imminent food safety risk
Generally, time and repeated failure are required to create a critical change in the safety of the product.
Stated another way, they usually manage more general and lower risk hazards.
oPRP
As a concept of control, it was introduced by the ISO in their food safety management standard ISO 22000 and is defined as a control measure identified by the hazard analysis as essential in order to control the likelihood of introducing food safety hazards and/or the contamination or proliferation of food safety hazards in the product(s) or in the processing environment.
What is striking about this control measure and its definition is the almost universal confusion users have in differentiating it from CCP’s and PRP’s.
The variation in the focus of the control measures appears to be based on a subtle difference in the description of hazards and risks.
In my day-to-day, I speak with others who have found it difficult to understand the nature of oPRP’s.
To try and clarify what exactly an oPRP is, it has been described as a specific action relating to the process, and, while not being critical for food safety, it is essential in reducing the likelihood of a specific hazard occurring.
oPRP’s are essential in reducing the likelihood of a specific hazard occurring
For example, a cooking step in a process may be critical to controlling the risk of a specific pathogen surviving such as E. coli.
This is an intrinsic step for producing a cooked product and its removal from the process is not possible and therefore it’s correct to say that control is critical.
Essentially, this means that the control applied at this step can be considered critical and is, therefore, a CCP.
Alternatively, metal detection in the same process is also designed to reduce the likelihood of a hazard reaching the consumer and arguably could be considered a CCP as well.
However, the key difference is that it is not an intrinsic step required for the production of safe cooked ham.
It can be removed from the process and a company can practically still produce relatively safe products.
Nonetheless, its presence may be deemed essential to reducing the likelihood of the hazard and therefore an oPRP.
It is important to realize that this is simply one possible definition of an oPRP which provides some working understanding.
When to determine and apply control points
GFSI Standards set out requirements for determining control points. The requirements under BRC v8 and ISO 22000:2018 do vary, so it’s important to understand each fully and how they apply to your specific situation.
| 2.8 | DETERMINE THE CRITICAL CONTROL POINTS (CCPS) (EQUIVALENT TO CODEX ALIMENTARIUS STEP 7, PRINCIPLE 2) |
|---|---|
| CLAUSE | REQUIREMENTS |
| 2.8.1 | For each hazard that requires control, control points shall be reviewed to identify those that are critical. This requires a logical approach and may be facilitated by use of a decision tree. Critical control points (CCPs) shall be those control points which are required in order to prevent or eliminate a food safety hazard or reduce it to an acceptable level. If a hazard is identified at a step where control is necessary for safety but the control does not exist, the product or process shall be modified at that step, or at an earlier step, to provide a control measure. |
| 8.5.2.4 | Selection and categorization of control measure(s) |
|---|---|
| 8.5.2.4.1
8.5.2.4.2 |
Based on the hazard assessment, the organization shall select an appropriate control measure or combination of control measures that will be capable of preventing or reducing the identified significant food safety hazards to defined acceptable levels.
The organization shall categorize the selected identified control measure(s) to be managed as OPRP(s) (see 3.30) or at CCPs (see 3.11). The categorization shall be carried out using a systematic approach. For each of the control measures selected, there shall be an assessment of the following: a) the likelihood of failure of its functioning; b) the severity of the consequence in the case of failure of its functioning; this assessment shall include:
In addition, for each control measure, the systematic approach shall include an assessment of the feasibility of: a) establishing measurable critical limits and/or measurable/observable action criteria; b) monitoring to detect any failure to remain within critical limit and/or measurable/observable action criteria; c) applying timely corrections in case of failure. The decision-making process and results of the selection and categorization of the control measures shall be maintained as documented information. External requirements (e.g. statutory, regulatory and customer requirements) that can impact the choice and the strictness of the control measures shall also be maintained as documented information. |
After specific hazards are identified at a process step, a risk assessment is required to determine if the hazard is significant or not.
If significant hazards are identified then a decision tree is required to help determine if the hazard requires control and, if so, should they be controlled as a CCP, PRP or oPRP.
Significance describes those hazards which present a real risk of impacting on the consumer.
It may be said that significance is essentially an expression of risk.
In food safety, risk is a measure of the combined severity of impact from a hazard and its probability of occurrence.
risk is a measure of the combined severity of impact from a hazard and its probability of occurrence
In its simplest form risk is expressed as being High, Medium or Low.
Below is an example of a 5 x 5 risk assessment model along with a risk rating which uses Safefood 360° to demonstrate.
If significant hazards are identified then a decision tree is required to help determine if the hazard requires control and if so should they be controlled as a CCP, PRP or oPRP.
There are large numbers of decision trees employed and cited in various standards, but arguably the most common decision tree is the CODEX standard decision tree for HACCP.
The CODEX tree focuses on whether the hazard should be controlled as a CCP or not, but it’s important to be aware that it doesn’t assist in determining what type of control shall be used where there is an outcome other than CCP.
Other robust models can account for oPRP and PRP.
Simple Decision Tree
CODEX Decision Tree
Robust Example
The more robust model really builds on the CODEX decision tree.
The tree allows for a solid and logical approach to determine control measures and will clearly show an auditor how you arrived at your decisions.
Risk assessment models and decision trees will help you to determine hazard management and controls.
It is clear that PRP’s are basic controls/activities within a production facility.
oPRP’s and CCP’s are specific and can be determined as being the control by using a decision tree.
Applying these steps in the future
A key point to keep in mind in this article when determining what Control Points are relevant to you and when they are applicable is understanding their application and definition under the scheme you are compliant with.
As this can vary under GFSI it is extremely important to read and understand these rules and how they relate to your situation in order to apply the information and your understanding of control most effectively.
Lastly, an effective control process is one step that can be taken that will help to mitigate against risk and help put forward safe quality food for your end customer.
While there are many other steps and approaches that these can be combined with to be applied most effectively, Safefood 360° offers a robust system that assists in their application in the context of your overall food safety management system.
If you would like to know more information about how you can benefit from this, please talk to our technical consultant here
