Honest question, I have no problem which you use as an auditor but why does not finding a CCP mean you shouldn't use HACCP?
GMO - in general it does not, however we produce corrugated packaging for non-contact applications only. I have been through both HACCP and HARA training and the trainers have confirmed that in our industry the likelihood of a CCP is very low and without it HACCP is overkill. Even for the couple of sites that do packaging for direct contact with food, there still aren't CCPs and all risks are controlled through PRPs or other standard processes.
Our sites are certified to BRC for Packaging and the requirement of that standard is a HARA team and HACCP only come in if there is a critical control. Our products do not have things like dwell time or hot/cold limits for the safety of the product. Many of the settings are adjusted based on environmental conditions (things run differently in the cold, dry winter months than the hot, humid summer months) and the "risks" are quality issues, not the safety of the product or the customers product going in it.
The OP stated cardboard packaging which is either corrugated or single layer paperboard (which we also do, those sites just aren't GFSI certified at this time). I've been in the industry for over 25 years and many auditors have stated it's overkill for our business. We started with HACCP back in the days of AIB inspections when that's what was called out and the thought was that at some point we would become an ingredient. That school of thought seems to have shifted to HARA, understanding that HACCP may be too much for what we are doing.
I could understand HACCP for flexible plastic packaging or vacuum sealed containers where they have to be heated to a specific temp to ensure integrity, that just isn't the case in our industry.