The records were clean. The soup wasn’t.

The facility produced chilled ready-to-eat soups — beef and vegetable, chicken noodle, lentil — packed in 5-litre flexible pouches for the foodservice market. The HACCP plan was current, third-party certified, and had cleared two consecutive BRC audits without major findings.

The cook step was the flagship CCP: a hot water rotary pasteurisation retort validated at 85°C for 15 minutes. For a thin-bodied liquid soup under rotation, the tumbling headspace drives convective mixing through the product — the thermal centre equilibrates to within a few degrees of the process medium well inside the hold time. The cook step was technically sound and properly validated.

Then customer complaints came in — gastrointestinal illness, all linked to the same meal service, all pointing to the beef and vegetable soup. Internal microbial analysis confirmed C. perfringens. The root cause investigation started where it always starts: the cook step. Every log was clean. Every calibration record was in order.

It wasn’t the cook step.

Where the investigation stalled — and where it didn’t

The first instinct was recontamination. Post-process hygiene failure, a supplier ingredient, something on the line. The team swabbed. They audited. They reviewed supplier COAs. Nothing flagged.

It was the retained sample counts that redirected the investigation. The C. perfringens load in the product was too high to be explained by contamination at the point of fill — for that level to accumulate in a fully cooked product, there had to have been a window for growth after the kill step. The investigation shifted from contamination to temperature history.

Then someone pulled the batch cooling records. There weren’t any. The HACCP plan listed cooling as a control point — not a CCP — with a single procedural note: cool product to ≤5°C within 4 hours of filling. No monitoring protocol. No logging. No critical limit with an associated corrective action procedure. No verification schedule.

After each retort cycle, sealed 5-litre pouches were transferred by rack to a walk-in chiller. No forced cooling. No cold water immersion post-retort. No blast chilling. A datalogger study placed a probe at pouch core across a full cooling cycle: exit temperature from the retort was approximately 82°C; time to reach ≤5°C at the core was 5–6 hours. The 4-hour procedural target had never been validated for a sealed 5-litre pouch and had never been measured in production.

Run the cooling step through the Codex Alimentarius CCP decision tree: is there a control measure? Yes. Is the step specifically designed to eliminate or reduce the identified hazard to an acceptable level? Yes. The decision tree yields a CCP. The classification had been driven by what was convenient to monitor, not by what the hazard analysis required.

Why your cook step can’t protect you after the kill

Post-lethality cooling is a hazard control step, not a handling procedure — and the biology explains why. C. perfringens exists in two distinct states: vegetative cells and heat-resistant spores. The cook step targets vegetative cells. At 85°C in a rotary pasteurisation retort, vegetative cells are eliminated at high log reduction. That part of the HACCP plan was working.

Spores are not vegetative cells. They are not eliminated at 85°C. After the retort cycle ends, a viable spore population remains inside every sealed pouch. Whether those spores constitute a hazard is determined entirely by what happens during cooling — which is a separate biological control problem that requires its own CCP, its own critical limit, and its own monitoring method.

The monitoring challenge with post-retort cooling is that inserting a probe into a sealed pouch during routine production is not practical. The answer is to validate the cooling profile for the worst-case pouch format and fill volume during process establishment, then monitor the cooling environment against that validated baseline: chiller temperature, airflow, rack loading density, and dwell time. A chiller that passes its temperature calibration is not the same as a validated cooling system for a specific sealed format. This applies beyond the retort-to-chill sequence — any step involving heat treatment followed by cooling carries the same risk profile. The thermal history that matters is the full time-temperature curve, including the descent.

Check your cooling step before the auditor does

A validated cook step gives you a defensible kill. What happens in the six hours after it is what determines whether that defence holds. I built a Cooling Rate CCP Assessment Tool for this — dropping it on LinkedIn this Friday.