What Is a Critical Limit in HACCP? Definition, Examples and How to Set One

A critical limit is the maximum or minimum value a critical control point has to meet for the food passing through it to be considered safe. On one side of the line you have acceptable product, and on the other you have a deviation. This guide is written for plants working under FDA's preventive controls rule (21 CFR 117) or USDA FSIS HACCP (9 CFR 417), so temperatures are in °F first. It covers cited US examples, how to write and validate a limit, and what to do when one is missed.

What Is a Critical Limit in a HACCP Program?

FDA's HACCP Principles & Application Guidelines define a critical limit as a maximum and/or minimum value to which a biological, chemical or physical parameter must be controlled at a CCP to prevent, eliminate or reduce a food safety hazard to an acceptable level. In plain terms, it is the line at a CCP that separates product you can ship from product you have to hold.

Every workable critical limit does three jobs:

1. It separates acceptable from unacceptable product at one CCP.
2. It can be checked in time to act, while the product is still under your control.
3. It is backed by scientific evidence. FDA's guidelines state that critical limits "must be scientifically based."

The critical control point is the step where control is applied, such as the cook, the chiller or the metal detector. The critical limit is the value that step has to hit. Establishing critical limits is Principle 3 of the seven HACCP principles, directly before monitoring, so a limit you can't monitor becomes a problem at the very next step.

Critical Limit Examples From US Regulations and Guidance

The table below gives each limit as it would be written in a plan, with its source. Check each figure against that source before you use it, because guidance is revised and your plan has to match the current version.

The Food Code is FDA's model code for retail and foodservice, so its poultry and cooling numbers are a reference point for a manufacturing plant (see who writes the FDA Food Code). USDA-inspected establishments support cooking and cooling with FSIS Appendix A and Appendix B or their own validation.

Why the cooling limit is two numbers, not one

Summaries often compress cooling into "135°F to 41°F within six hours," which drops the stage that matters most. Food Code §3-501.14(A) requires cooked food to reach 70°F within 2 hours and 41°F within 6 hours in total. The Food Code annex explains why: 70°F to 125°F is close to ideal incubation temperature for bacteria.

The annex also spells out the failure case. Product that reaches 41°F in 6 hours but took 3 hours to get to 70°F may not be adequately controlled. Write both stages into the limit and record a time and temperature at each.

Why "no metal in the product" isn't a critical limit

You can't confirm the absence of metal in product as it runs, so "no metal" can't be monitored. The limit is written as detector performance: the unit detects and rejects the specified ferrous, non-ferrous and stainless steel test pieces passed in product, and the reject device removes them.

Don't set the limit at FDA's enforcement threshold either. CPG Sec. 555.425 supports regulatory action for hard or sharp objects of 7 mm to 25 mm in ready-to-eat or minimally prepared food, and under 7 mm when a special-risk group such as infants is among the intended consumers. That is where FDA acts, far above what your detector should catch. See our guides to metal detection and physical contamination.

Why allergen cleaning rarely gets a critical limit

Some guides list allergen changeover cleaning as a CCP. The trouble is timing: cleaning has no single parameter you can read at the moment of control, and a swab or rinse result often arrives after the next product has started. Changeover cleaning is usually managed as a PRP or OPRP using action criteria for OPRPs instead. Our guides to prerequisite programs and allergen cross-contact cover how those controls are built.

How to Write a Critical Limit That Holds Up at Audit

A limit that holds up at audit reads the same way to every operator on every shift. That takes six parts:

1. Parameter: internal temperature, pH, water activity, chlorine concentration or test piece size.
2. Value and unit: 165°F (74°C), rather than "hot enough."
3. Direction: at or above, at or below, or a range with both ends stated.
4. Where and how it's measured: the thickest part of the largest piece, or finished equilibrium pH.
5. The time element: a hold time, "within 2 hours," or instantaneous.
6. An instrument that can resolve it, with accuracy fine enough to show which side of the line you're on.

Notice what the strong versions leave out: how often you check. Monitoring frequency belongs to Principle 4, so keep it in the monitoring column of your HACCP plan, not in the limit.

One CCP, several critical limits

A single CCP often needs more than one limit. CFIA's guidance on critical limits uses beef patties in a continuous oven, where the limits cover internal patty temperature, oven temperature, and time in the oven set by belt speed and patty thickness. Every parameter in a combination limit needs monitoring and a record, not just temperature.

A CCP can also carry separate limits for separate hazards. CFIA's vegetable wash example sets at least 100 ppm chlorine to control pathogens and no more than 150 ppm to prevent chemical residue.

Measurable vs observable limits

Codex allows a critical limit to be observable as well as measurable, so a visual check such as confirming a sieve is in place and intact can qualify. ISO 22000:2018 defines a critical limit as a measurable value, which rules observable limits out for ISO 22000 and FSSC 22000 plants. If you do use a qualitative limit, CFIA advises supporting it with written instructions so everyone monitoring the CCP reads it the same way.

Why a lab result is almost never a critical limit

Microbiological results arrive days after the product has moved on, and a critical limit has to trigger action while you can still control the product. That is why limits are written as physical and chemical measures such as time, temperature, pH and water activity, linked to the pathogen through validation.

Where Critical Limits Come From (and How to Validate Them)

The value in a critical limit should trace back to evidence. Roughly in order of strength, the usual sources are:

1. Regulation and agency guidance, such as 21 CFR 114 for acidified foods and FSIS guidelines for meat and poultry.
2. A scheduled process from a process authority, as 21 CFR 113 requires for low-acid canned foods.
3. Published guidance and peer-reviewed literature, such as pathogen growth limits for pH and water activity.
4. Third-party studies, such as an equipment manufacturer's lethality study for its oven.
5. In-house or contract-lab studies, such as a challenge study on your formulation.

Your hazard analysis identifies the hazard, and these sources give you the value that controls it.

Validation: proving the number works in your plant

Validation answers two questions. Is the limit scientifically capable of controlling the hazard, and can your process achieve it under worst-case conditions such as the largest piece and the fullest load? FAO's guidance on Step 8 says critical limits should be scientifically validated, and that existing studies from credible sources are often enough.

Validation proves the limit works before you rely on it, while verification confirms the plan is being followed and working. Our guide to HACCP verification covers the difference.

When to revalidate

A validated limit holds only while the process stays the same. CFIA's reassessment triggers are a change in line speed, adding or removing a process step, new or modified equipment, a formulation change, and new information about a hazard. Build these into change control so the limit is reviewed before the change goes live.

Critical Limit vs Operating Limit vs Target

Well-run CCPs have three lines, and mixing them up is a common source of audit findings:

• Target: the value you aim for in normal running.
• Operating limit: a tighter line inside the critical limit. Crossing it means you adjust the process, with no deviation and no product disposition.
• Critical limit: crossing it is a deviation, and corrective action is required.

FDA's guidelines warn that critical limits should not be confused with operational limits, which are set for reasons other than food safety. UF/IFAS Extension describes operating limits as more stringent than critical limits so they "allow a safety margin." For a cooler with an operating limit of 38°F and a critical limit of 41°F:

The 3°F between the two lines is your tolerance, the room to correct drift before it becomes a deviation. Our temperature danger zone guide uses the same figures.

Measurement uncertainty eats your margin

Your thermometer's accuracy comes out of that tolerance. If a probe is accurate to ±1°F, a reading of 40.5°F against a 41°F limit could be a true 41.5°F. Size the operating limit to cover instrument accuracy plus normal process variation, and keep the thermometer calibration records that prove the accuracy you're assuming.

Don't set the critical limit where the operating limit belongs

The opposite mistake is a critical limit tighter than the science requires. Write 38°F as the critical limit and every normal drift becomes a deviation needing a corrective action record, a product evaluation and a sign-off. When deviations happen every shift, teams stop taking them seriously, so keep the critical limit at the validated value and the margin in the operating limit.

A critical limit only works if it's enforced the moment the reading is taken. In Allera's Digital Forms, you can set the limit as a failure rule on the form field: when an Operator enters a value outside it, the Form Submission is flagged as Failed and a Corrective Action task is created automatically. The record holds the reading itself rather than a tick, and offline form capture keeps readings coming in at the line when the Wi-Fi drops. See how Allera's Digital Forms work.

What Happens When a Critical Limit Is Not Met

FDA defines a deviation as a "failure to meet a critical limit." ISO 22000:2018 adds the practical consequence: product affected by an exceeded critical limit is handled as potentially unsafe. From that moment you have two problems to solve, the process and the product.

What a corrective action has to cover depends on who regulates you:

• FDA/NACMCF guidelines: determine and correct the cause, determine the disposition of non-compliant product, and record the action taken.
• USDA FSIS, 9 CFR 417.3(a): the cause is identified and eliminated, the CCP is back under control, measures to prevent recurrence are established, and no injurious or adulterated product enters commerce.
• USDA FSIS, 417.3(b): for a deviation the plan didn't anticipate, segregate and hold the product, review its acceptability, act so no adulterated product enters commerce, and have a trained individual reassess the plan.
• FDA preventive controls, 21 CFR 117.150: correct the problem, reduce the likelihood of recurrence, evaluate all affected food for safety, and keep it out of commerce if you can't ensure it isn't adulterated.

In practice, a deviation runs through seven steps:

1. The reading is out of limit, and the record shows the actual value.
2. Hold the affected product back to the last good check.
3. Restore control by adjusting, repairing or stopping the line.
4. Evaluate the product, based on the size and duration of the deviation.
5. Decide disposition: release after evaluation, rework, divert or destroy.
6. Record the value, time, person, cause and action taken.
7. Verify through review by a trained person, including whether the plan needs to change.

Your corrective action plan should name a responsible role for each step before a deviation ever happens.

In Allera, failed CCP checks land in a Manager's Failures review queue, where the Manager can flag the submission for revision with required comments or escalate it to a specific person or to All Admins. A saved filter such as "all failed CCP checks at Plant 2 this week" replaces digging through binders, and submissions export as PDFs or a ZIP for the auditor. See how Allera handles failed checks.

Critical Limit Definitions Compared: Codex, FDA, USDA, ISO 22000 and FSMA

The frameworks don't define a critical limit the same way, and the differences matter at audit.

The gap that catches plants out is between Codex and ISO 22000: an observable limit such as a visual sieve check can be challenged under ISO 22000 or FSSC 22000, and the usual fix is to reclassify the control as an OPRP, which our comparison of critical limits and action criteria walks through. Our HARPC vs HACCP guide maps FSMA's "parameters and values" onto HACCP terms.

What SQF, BRCGS and FSSC 22000 auditors check

None of the certification schemes sets the numbers for you. SQF, BRCGS and FSSC 22000 auditors look for the same evidence: a limit for each CCP, a validation record behind it, monitoring records with actual values, and corrective action records for every missed limit. Clause numbers shift between editions, so map these expectations to the current version of your scheme's code.

Five Critical Limit Findings Auditors Write Up

1. A number with no validation reference. The plan says 0.85 water activity, but nothing in the file shows why. Our HACCP checklist lists the evidence auditors ask for.
2. An instrument that can't resolve the limit, or whose calibration has lapsed. Every reading taken with an out-of-calibration probe is open to challenge.
3. An operating limit written into the plan as the critical limit. Every routine adjustment becomes a deviation, and any handled without full records becomes a finding.
4. A retail or outdated number in a manufacturing plan. Examples include the Food Code used in a USDA plant instead of FSIS Appendix A or your own validation, "165°F for 15 seconds" for poultry when the Food Code says 165°F instantaneous, or 165°F used as a hot-holding limit when Food Code hot holding is 135°F or above (§3-501.16).
5. A tick or "OK" recorded instead of the value. For meat and poultry plants, 9 CFR 417.5 requires "the recording of actual times, temperatures, or other quantifiable values," entered at the time the event occurs.

Critical limits are only as good as the records that prove you met them. If your CCP checks still live on paper, start by capturing the actual value, the time and the person the moment the reading is taken, with a failed reading becoming someone's task. No Man's Land Beef Jerky, whose traditional dehydration process didn't fit off-the-shelf software, built its own digital forms with Allera and had the first stages live on the floor within 30 days. See how Allera turns CCP checks into records you can defend.