I'm no HACCP expert, but from all I've learned (mostly from the wonderful contributors to IFSQN), you have to think like a paranoid detective -- by asking yourself ---- AND THOSE WHO KNOW THE PROCESS AND THE INGREDIENTS - "how can my chocolate be unintentionally adulterated? You may want to start with the process flow diagram.
While you may be only one wearing an official QA/QC hat, the people around you have both knowledge and responsibility. Engage them by asking them lots of questions. In my facility (we deal with chocolate, too), we only have 2 CCPs -- the last filter in the liquid chocolate line, and metal detector for moulded pieces. But around that we have all of the prereq programs that are described in this thread -- allergens, GMPs, pest control, sanitation, warehouse management, stock rotation, incoming goods inspections (including COAs for all ingredients), etc. CCPs are (by definition) a last resort.