I did a presentation on some work that I had done, looking at the need to specify the roasting step for coffee as a CCP (critical control point) for HACCP (hazard analysis and critical control points). There's a lot of cost related to labelling a process step a CCP, and I prefer that focus is on those steps where control for safety is, just that, critical. I used risk assessment approaches (as defined by Codex and accepted by regulators worldwide) to demonstrate that roasting does not need to be a CCP. Click on the graphic below and each following slide to view the presentation - happy to hear from you if you want some more information, you disagree, or even agree!
Click graphic to view