I just got an email from a co-man customer who requested a documentation audit, floor audit, and HACCP/Process SOPs. In the same email, the customer casually noted they would "add or subtract CCPs as needed", and asked for a list of QCCPs (I've learned a lot here, and I'm familiar with oPRPs, CPs, CCPs, and QCPs, but never a QCCP).
They have a prestigious name and it would be great for our business....but I don't understand how to justify adding CCPs if the HACCP team doesn't see it as a risk, and I'm not interested in taking away control on a risk the team has identified. Is there an approach to documentation for this? I can't imagine a note on the HACCP review - "Removed CP, customer thought it was unnecessary." "Added QCCP and RTCP at step 29 and TFMVZP at step 7". I understand wanting to do business with someone with a metal detector, and I've had auditors & consultants give advice about modifying the HACCP program, which our HACCP team reviews, but I've never given control of it from the HACCP team to the customer before.