.avif)
What Is an OPRP? Operational Prerequisite Programs vs CCPs and PRPs
OPRP stands for Operational Prerequisite Program. It is a control measure your hazard analysis identifies as necessary to control a significant food safety hazard, at a step where that control does not meet the criteria for a critical control point.
An operational prerequisite program controls a significant hazard without a measurable real-time limit. A critical control point controls a significant hazard at a step where you can measure a limit, monitor it in time to act, and where failure means the product is potentially unsafe.
That distinction sounds clean on paper. In a HACCP team meeting it produces an hour of argument over a metal detector, a changeover clean and an incoming ingredient check.
This guide covers what an OPRP actually is, the difference between a critical limit and an action criterion, a decision sequence you can apply consistently, six worked examples, and why auditors push back when a plan has too many CCPs.
What Does OPRP Stand For?
OPRP stands for Operational Prerequisite Program. You will also see it written as oPRP with a lowercase o, and as OPRP in full capitals. They all mean the same thing.
The term belongs to a small family of acronyms that food safety teams use constantly and mix up regularly:
- PRP is a Prerequisite Program: the baseline hygiene conditions that apply across your whole operation, such as pest control, handwashing and general cleaning.
- OPRP is an Operational Prerequisite Program: a control aimed at one named significant hazard at a specific step, where you cannot set and monitor a numeric limit in real time.
- CCP is a Critical Control Point: a step where you can measure a limit, monitor it in time to act, and where a failure means the product may be unsafe.
- CP is a Control Point: a step that matters for quality or process consistency but does not control a significant food safety hazard.
The OPRP category comes from ISO 22000 and carries through to FSSC 22000. Classical Codex HACCP does not use the term, which is why teams moving from a Codex-based plan to ISO 22000 meet it partway through implementation and have to reclassify controls they thought were settled.
One point of confusion worth clearing up: outside food safety, PRP most commonly refers to platelet-rich plasma, a medical procedure. If you searched for OPRP and landed on results about fertility treatment, that is the collision you hit. The two have nothing to do with each other.
Download the CCP vs OPRP Decision Matrix
We have built a free Excel decision matrix that turns this classification into five recorded answers and an automatic result.
Enter one row per control measure, answer five dropdown questions, and the matrix returns PRP, OPRP, CCP or Review. It includes a classification reference tab, common classification errors, and six completed worked examples.
The justification field matters as much as the result. Auditors rarely dispute a well-reasoned OPRP. They dispute an unexplained one.
What Is an OPRP?
An operational prerequisite program is a control measure identified by your hazard analysis as necessary to control a significant food safety hazard, where that control does not meet the criteria for a critical control point.
The term comes from ISO 22000, which introduced it to fill a real gap. Classical HACCP under Codex offered two options: something was a critical control point, or it sat in your prerequisite programs. That left a category of controls stranded, ones that clearly target a specific significant hazard but cannot be monitored against a hard numeric limit in real time.
Why the Category Exists
Consider allergen changeover cleaning. It targets a specific, named, significant hazard. It is unquestionably more critical than general sanitation. And it usually cannot be a CCP, because the verification swab result does not arrive fast enough to hold the line and there is no numeric limit measured at the moment of control.
Before OPRPs existed, teams either forced such controls into the CCP category, creating monitoring obligations nobody could meet, or buried them in prerequisite programs where they received insufficient attention. Neither served anyone well.
PRP, OPRP and CCP: The Three-Way Difference
| Attribute | PRP | OPRP | CCP |
|---|---|---|---|
| Purpose | Maintains a hygienic environment across the operation | Controls a specific significant hazard | Controls a specific significant hazard where control is essential |
| Hazard specificity | General, not aimed at one named hazard | Targeted at a named hazard | Targeted at a named hazard |
| Limit type | No limit; defined procedure and schedule | Action criterion, measurable or observable | Critical limit, measurable and validated |
| Monitoring | Scheduled checks and inspections | Defined monitoring against the criterion | Monitoring that detects loss of control in time to act |
| Failure consequence | Programme deficiency | Loss of control of a hazard; assess affected product | Product potentially unsafe; disposition required |
| Product disposition | Not normally triggered | Case by case | Always required |
| Validation | Not required | Required for the action criterion | Required for the critical limit |
| Typical examples | Pest control, hygiene, maintenance | Allergen changeover, COA review | Pasteurisation, metal detection |
Prerequisite Programs as the Foundation
Prerequisite programs are the conditions that make safe production possible at all. Pest control, employee hygiene, maintenance, glass and brittle plastic policy, waste management, water quality.
They are not aimed at one hazard. They lower background risk across everything you make. Our guide to HACCP prerequisite programs covers what belongs in this layer.
Critical Control Points
A CCP is a step where control is essential to prevent, eliminate or reduce a hazard to an acceptable level, with a measurable critical limit and monitoring capable of detecting loss of control in time to act on the affected product.
The definition comes from Codex and is carried into every GFSI scheme. Our guides to critical control points and the seven HACCP principles cover the framework.
Operational Prerequisite Programs
An OPRP sits between the two. It controls a named significant hazard, which lifts it above a PRP, but it fails one or more of the CCP tests, usually the measurable limit or the timeliness of monitoring.
An OPRP failure does not automatically mean the product is unsafe. It means control may have been lost and you now have to assess whether product was affected. That assessment step is the practical difference.
Critical Limits vs Action Criteria
This is the distinction that decides most classifications, and it is handled poorly almost everywhere.
A critical limit is a measurable value separating acceptable from unacceptable product. 72°C for 15 seconds. A metal detector rejecting a 2.0 mm ferrous test piece. Water activity at or below 0.83. You measure it at the moment of control and you know immediately whether you are inside or outside it.
An action criterion is a specification confirming the control measure was applied as intended. It might be numeric, but it does not have to be, and it does not have to be measurable at the moment of control. "Visual inspection pass plus a negative allergen protein swab at five defined points" is an action criterion.
| Attribute | Critical limit | Action criterion |
|---|---|---|
| Form | Always measurable, usually numeric | Measurable or observable |
| When checked | At the moment of control | May be after the fact, if still actionable |
| Breach means | Product potentially unsafe, hold and disposition | Control may have been lost, investigate and assess |
| Validation | Evidence the limit controls the hazard | Evidence the criterion is adequate |
If you find yourself writing a numeric critical limit for a control you cannot actually measure in real time, that is the signal you are looking at an OPRP.
How to Decide: The Classification Sequence
Work through these in order for each control measure. Your hazard analysis has to be complete first, because this sequence classifies controls rather than identifying hazards.
Is the Hazard Significant?
Significance combines likelihood and severity. A hazard that is reasonably likely to occur and severe enough to cause harm is significant. One adequately controlled by your prerequisite programs alone is not.
If the answer is no, stop. The control measure is a PRP.
Is There a Measurable Limit and Real-Time Monitoring?
Can you set a limit that is measurable or observable at the moment of control, and will monitoring detect loss of control in time to identify and hold the affected product before release?
Both halves matter. A limit you can measure but only get results for three days later fails the second half. That control is an OPRP regardless of how precise the measurement is.
Does Failure Make the Product Unsafe?
If this control fails, is the affected product potentially unsafe and therefore subject to a disposition decision? A yes here, combined with yes to the previous question, points firmly at a CCP.
Where the Codex Decision Tree Helps and Where It Misleads
The Codex decision tree, set out in the General Principles of Food Hygiene (CXC 1-1969), predates the OPRP concept and offers a binary outcome. It remains useful for identifying whether a step is a control point at all, and for forcing teams to consider whether a later step will eliminate the hazard.
Where it misleads is at the final branch. A control that fails the CCP test is not automatically a prerequisite program. Under ISO 22000 it may well be an OPRP, and the classic tree has no route to that answer. Use it as an input, not as the whole method.
Six Worked Examples
| Control measure | Hazard | Classification | Why |
|---|---|---|---|
| Metal detection at final pack | Metal fragment | CCP | Measurable reject sensitivity, real-time test pieces, failure means metal may have passed |
| Thermal pasteurisation | Vegetative pathogens | CCP | Validated numeric limit, continuous monitoring, product below limit is unsafe |
| Allergen changeover cleaning | Undeclared allergen | OPRP | Significant hazard, but swab result is not a real-time numeric limit |
| Daily sanitation of surfaces | General microbial build-up | PRP | General hygiene across the operation, not one named significant hazard |
| Incoming ingredient COA review | Mycotoxin above limit | OPRP | Relies on supplier documentation at receipt, not a measurement at a process step |
| Glass and brittle plastic control | Glass or hard plastic fragment | OPRP | Defined inspection points and a documented breakage response, but no real-time numeric limit per unit |
| Water activity control in drying | S. aureus growth and toxin | CCP | Validated numeric limit measured on every batch before release |
Metal detection is the example people assume. It usually is a CCP, but only because it normally satisfies all three tests, and the reasoning should be recorded rather than assumed. Our guide to metal detection in food packaging covers sensitivity setting and test frequency.
Allergen changeover is the example that most often gets misclassified. Teams want it to be a CCP because the hazard is serious. Seriousness is not the test. If you cannot monitor against a limit in time to hold product, it is an OPRP with a well-defined action criterion, and that is a perfectly defensible position.
Glass and brittle plastic control generates the other long argument, particularly in facilities filling glass jars. The breakage procedure targets a named significant hazard, which rules out treating it as general sanitation. But there is no numeric limit you measure on every unit as it passes, so it rarely satisfies the critical control point test.
An OPRP with a clear action criterion works here: defined inspection points, a documented breakage response, and a segregation rule. Where the line runs inline X-ray, that step can be a CCP while the surrounding glass register stays an OPRP.
Sanitation is the mirror image. Making general cleaning a CCP creates per-batch monitoring obligations nobody meets, and the records fall apart within a month. Keep it as a PRP, as covered in cleaning and sanitation in the food industry, with your environmental monitoring program providing verification.
Why Auditors Push Back on Too Many CCPs
A plan with fifteen CCPs looks thorough. To an experienced auditor it usually looks like a hazard analysis nobody worked through properly.
Every CCP carries obligations: a validated critical limit, defined monitoring at a defined frequency, records for every batch or period, documented corrective action on every deviation, and verification. Multiply that across fifteen points and something gives. Usually it is the monitoring records, and those are the first thing an auditor examines.
Over-designation also dilutes attention. When everything is critical, the two or three controls that genuinely protect the consumer compete for attention with a dozen that do not.
What a Defensible Justification Looks Like
Record the reasoning, not just the conclusion. Two sentences per control measure naming the hazard, stating which test it passed or failed, and explaining why the team reached its decision.
"Allergen changeover cleaning is classified as an OPRP. The hazard is significant and the control is necessary, but confirmation depends on a protein swab whose result is not available before the line restarts, so it cannot be monitored against a real-time critical limit. Controlled through a defined action criterion of a visual pass plus negative swabs at five validated sampling points."
That paragraph ends the conversation. An unexplained classification invites a full review of your hazard analysis.
Monitoring records, justification documents and the hazard analysis they came from often live in three different places, which is exactly the problem when an auditor asks to see the chain. Allera keeps monitoring records as digital forms with your limits built into the form itself, and documents under version control with a full audit trail. When a monitoring rule fails, a Corrective Action follow-up task is created automatically. See the food quality management software page for how that fits together.
Monitoring and Records: What Changes With the Classification
The classification is not academic. It changes what you have to do every day.
For a CCP, monitoring is continuous or at a defined frequency tied to batch or time, every result is recorded, a deviation triggers immediate product control and a documented corrective action, and verification includes record review and calibration.
For an OPRP, monitoring is defined against the action criterion, results are recorded, and a failure triggers investigation and an assessment of whether product was affected rather than automatic rejection. The assessment step is the meaningful difference, and it has to be documented when it happens.
For a PRP, you evidence that the programme is in place and effective through inspection and audit rather than per-batch records.
A deviation at a CCP always produces a product disposition decision. A deviation at an OPRP might not, but the reasoning for why not has to be written down. Our guide to building a corrective action plan covers what that record should contain.
What ISO 22000, FSSC 22000, BRCGS and SQF Expect
Terminology varies across the schemes, which causes genuine confusion for sites certified to more than one.
ISO 22000:2018 is the origin of the OPRP concept and defines the three categories of control measure explicitly. It requires validation of both critical limits and action criteria.
FSSC 22000 builds on ISO 22000 and inherits the OPRP category in full. The scheme is now at Version 7, published May 2026, and additional requirements sit on top of the ISO base. Our comparison of FSSC 22000 and ISO 22000 covers the relationship, and our guide to FSSC 22000 Version 6 covers the previous edition.
SQF Edition 10, published March 2026, uses Codex CCP terminology and does not adopt OPRP as a formal category. It still expects significant hazards to be controlled, so controls you would call OPRPs under ISO 22000 appear as documented control measures with verification. Our guide to SQF Edition 10 covers what changed.
BRCGS Issue 9 likewise uses Codex CCP terminology, with prerequisite programs handled through fundamental requirements. Our comparison of GFSI, SQF and BRCGS covers the structural differences, and food safety management system covers how the pieces assemble.
If you hold multiple certifications, classify once using the ISO 22000 framework and then map the output to each scheme's vocabulary. Maintaining two parallel classifications produces contradictions that auditors find quickly.
How This Maps to FSMA and Preventive Controls
US facilities under 21 CFR Part 117 work in a third vocabulary. The rule does not use CCP or OPRP. It uses preventive control, with categories for process, food allergen, sanitation and supply-chain controls.
A process preventive control maps closely to what you would call a CCP. Allergen and sanitation preventive controls often cover what ISO 22000 would treat as OPRPs. Supply-chain preventive controls cover incoming material verification.
The rule is outcome focused. It requires you to identify hazards requiring a preventive control, implement controls, monitor them, correct deviations and verify the system, without prescribing which label you attach. Our comparison of HARPC and HACCP covers the two frameworks side by side, and food safety plan covers what the written plan has to contain.
Bringing It Together
The OPRP category exists because the binary CCP-or-PRP choice left genuinely important controls in the wrong place. Using it properly means being honest about which controls you can actually measure and act on in real time, rather than assigning CCP status according to how serious the hazard feels.
Apply the same five questions to every control measure, record the reasoning, and revisit the classification when the process changes. A small number of well-monitored CCPs supported by clearly defined OPRPs is a stronger position than a long list of critical points nobody can evidence.
Start with the decision matrix above, and if your monitoring records and justification documents currently live in different systems, see how Allera's food quality management software keeps the evidence chain in one place.
FAQs
Is a metal detector a CCP or an OPRP?
Usually a CCP, because it normally has a measurable reject sensitivity, is verified in real time with test pieces, and a failure means metal may have reached saleable product.
It is not automatically a CCP. The classification should be reasoned against your own hazard analysis and the reasoning recorded, rather than assumed.
Does an OPRP need a critical limit?
No. An OPRP has an action criterion, which may be measurable or observable.
If you can set a genuine critical limit and monitor it in time to act on affected product, you are probably looking at a CCP. Writing a numeric critical limit for a control you cannot measure in real time creates an obligation the plant cannot meet.
What is an OPRP example?
Allergen changeover cleaning between production runs is the clearest example. The hazard is significant and the control is necessary, but the verification swab result is not a real-time numeric limit and often does not arrive before the line restarts.
Incoming ingredient certificate of analysis review is another. It controls a significant hazard but relies on supplier documentation reviewed at receipt rather than a measurement taken at a process step.
What does OPRP stand for?
Operational Prerequisite Program. It is sometimes written oPRP, with a lowercase o, in ISO 22000 documentation.
What are the three types of HACCP control measure?
Under ISO 22000 there are three categories: prerequisite programs, operational prerequisite programs and critical control points.
- PRP: general conditions that maintain a hygienic environment, such as pest control and employee hygiene
- OPRP: controls a named significant hazard through an action criterion
- CCP: controls a named significant hazard against a measurable, validated critical limit
What is OPRP and CCP?
A CCP has a measurable critical limit, monitoring that detects loss of control in time to act on the affected product, and failure means the product is potentially unsafe.
An OPRP controls a significant hazard through an action criterion that may not be measurable at the moment of control. Its failure triggers investigation and an assessment of whether product was affected, rather than automatic product rejection.
What is an Operational Prerequisite Program (OPRP)?
An OPRP is a control measure identified by your hazard analysis as necessary to control a significant food safety hazard, which does not meet the criteria to be a critical control point.
The term comes from ISO 22000. It exists because classical HACCP offered only two categories, which left controls stranded when they clearly targeted a significant hazard but could not be monitored against a hard numeric limit in real time.
.avif)
.avif)
.avif)
.avif)
%20(1).avif)
.avif)
.avif)
%20(1).png)
.avif)
.avif)
