ISO 22000 Critical Control Points - best practise in ARIS?

Hi,

ISO 22000 is a food safety standard. IT references process flows (which ARIS very nicely models as VACDs/eBPMNs). ISO 22000 also uses the term CCP (Critical Control Point).

Anyone with a good practise for modelling them? I am currently thinking along the lines of using Risks in the VACDs and then  Business Controls Diagrams. 

Any experience contributed is of value.