EthicalHub

HACCP & PRPs

CCP deviations: what to do in the first hour

A critical limit has just been missed. The steps to take, in order, who makes each call, and the record your auditor will ask to see.

4 min read
The short answer

Stop, hold, fix, decide, record. Stop the line or the step. Hold every product made since the last good check. Bring the CCP back under control and confirm it with a fresh check. Then a person with the authority decides what happens to the held product, and everything goes on one record. That’s HACCP Principle 5, and it’s what auditors check.

The first hour

Five steps, in this order

Times are a guide. The order is what matters.

0–5 min

Stop

Stop the step, or divert product, so no more is made out of control. The person monitoring has the authority to do this without asking first.

5–15 min

Hold

Find the last check that was within the critical limit. Everything made since then goes on hold: tagged, separated and logged by batch, so none of it moves.

15–40 min

Restore control

Fix the immediate problem: adjust the setting, repair or replace, recalibrate. Restart only when a fresh check is within the limit, and record that check.

40–60 min

Decide on the product

A named person with the authority decides: re-process, test, downgrade or dispose of. Release only with evidence it’s safe.

Same shift

Record and escalate

Complete the corrective action record, tell the QA lead, and open a root cause investigation. That part can take days; the first-hour steps can’t wait.

Worked example

A cook step that ran cold

At 10:40 the operator probes a batch and finds the core temperature below your critical limit. The last check within the limit was at 10:10.

  • Stop: the operator stops unloading the oven and calls the supervisor.
  • Hold: everything cooked since 10:10, three batches, is tagged and moved to the hold area.
  • Restore: a door seal has failed. Maintenance replaces it, and the next batch probes above the limit at 11:05.
  • Decide: the QA lead approves re-cooking the three batches to the limit under the validated process, with the re-cook probed and recorded.
  • Record: one corrective action record covers what happened, the batches, the fix, the decision and who signed it. The root cause review asks why the seal wasn’t caught on the maintenance schedule.

Illustrative only. Your critical limits and permitted re-processing come from your own validated HACCP plan.

The record

What the corrective action record needs

If any of these is missing, an auditor can’t see that the deviation was controlled.

What happened

The CCP, the reading, the critical limit, the time, and who found it.

Which product

Batch or lot numbers from the last good check onwards, quantities, and where they were held.

How control came back

What was fixed, by whom, and the first check back within the limit.

The product decision

Re-processed, tested, downgraded or destroyed, with evidence and the name of who authorised it.

The cause

The root cause and what changes to stop it happening again. “Operator error” alone rarely satisfies an auditor.

Verification

A supervisor or QA sign-off that the actions were done and worked.

Common mistakes

What auditors pick up

  • Re-checking until the reading passes, and recording only the pass.
  • Holding only the batch that failed, not everything since the last good check.
  • Releasing held product without evidence, or without a named person authorising it.
  • A corrective action plan in the HACCP plan that says “notify supervisor” and nothing else.
  • Fixing the symptom every time and never asking why it keeps happening. Repeated deviations at the same CCP are a finding on their own.

Working through the root cause and evidence? See how to close out findings on time, which includes a worked 5 Whys example.

Where EthicalHub fits

The deviation starts the record

When a reading falls outside the critical limit, EthicalHub flags it straight away and the deviation feeds into a corrective action for QA to review. You add the held batches, the fix and the product decision, and the closed record goes into your audit pack. Repeated deviations at the same point are spotted automatically.

See a deviation handled end to end

A walkthrough using one of your own CCPs.

Book a walkthrough

Related guides

The prerequisite programs explained →The foundations that keep CCPs in control. Closing out audit findings →Root cause, evidence and a four-week plan. The 10 records auditors ask for first →Corrective actions are on the list. Paper HACCP records →Why deviations get missed on paper.
Questions

CCP deviations: common questions

What is a CCP deviation?
A CCP deviation is when monitoring shows a critical control point has gone outside its critical limit, such as a cook temperature below your limit or a metal detector that fails its check. It means product made since the last good check may be unsafe until you show otherwise.
What should a CCP corrective action include?
Under HACCP Principle 5, it should bring the CCP back under control, identify and hold the affected product, decide whether that product is reworked or disposed of, name who is responsible and who can authorise release, investigate the cause, and record all of it.
Which product is affected by a CCP deviation?
Everything made since the last monitoring check that was within the critical limit. That’s why monitoring frequency matters: the longer the gap between checks, the more product you have to hold.
Can held product be released after a CCP deviation?
Only if someone with the authority to release it has evidence it is safe, such as a valid re-process or test results, and the decision is recorded. If you can’t show it’s safe, it shouldn’t be released.

Catch it fast. Record it once.

See how EthicalHub flags deviations and builds the corrective action record as you go.

Book a walkthrough Check your readiness
Scroll to Top