Hi Martinblue,
The HACCP definition of a CCP is that it must be "a process step at which control is essential to eliminate a food hazard or reduce it to an acceptable level".
Any step or action that does either not reduce a hazard to an acceptable limit or eliminates it, is not a CCP, but must be included in the pre-requisite programme (PRP).
ISO 22,000 introduced an 'in-between' definition of "oPRP", which gives process steps that are important for food safety but do not allow a reduction of hazrads (or even the elimination) specific significance. Your "CCP" labelling/packaging is likely to be such an oPRP (or 'Quality Control Point'), as it does not reduce or eliminate hazards, but ensures that already eliminated hazards (in previous processes) do not re-appear in the product, ether through chemical, physical or microbiological contamination or the outgrowth of surviving microorganisms. The labelling provides (legally important) product information to the customer, but also does neither reduce nor eliminate hazards.
To find out, at which steps in your operation you need to establish a CCP (HACCP) or an oPRP (ISO 22,000), you must first establish your operational needs. It is possible that sifting flour to remove small foreign bodies (eliminate or reduce to an acceptable limit) might be a CCP, while decanting (removing of packaging to reduce the intake of microorganisms and foreign bodies) could be an oPRP. At the Receipt of Raw Material stage, you must again find out if there is anything you do that is essential to reduce the level of any hazard to an acceptable limit or to eliminate it (CCP) or if you do (or need to do) anything that controls hazards but is not essential for the safety of the final product, because of subsequent process steps (oPRP). If you test flour for presence of moulds at the time of delivery, this could also become a CCP (eliminate the hazard by rejecting delivery of contaminated product).
Your Baking step (to an internal temperature of min 75ºC) can be a CCP to control bacterial survival, if you have identified bacterial contamination of the raw doughs as a potential hazard in your operation, as this temperature is sufficient to kill viable bacteria cells (not spores, not toxins) in seconds. The reduction of moisture during baking has the potential to delay or stop bacterial growth in the finished product. This could also be considered in your process control system, if necessary.
Your cooling step (at room temperature) is likely to re-introduce hazards into the product if uncontrolled, so a number of oPRPs (e.g. covering to avoid airborne contamination) or even the introduction of a CCP 'Cooling Temperature' to control microbiological activity during the cooling process (if your baked products contain ingredients that allow bacterial growth) might be necessary here.
Do you fill baked goods (e.g. Eclairs, Jam Doughnuts)? Filling might also be an oPRP (or even a CCP, if temperature control is essential to eliminate or reduce bacterial growth, e.g. fresh cream fillings).
Finally, you are right: Metal Detection is probably your final CCP before distribution.
Hope this helps,
Matt