Validation vs Verification: What Auditors Actually Want to See

The Two Words Auditors Always Test You On

Few questions expose a food safety system faster than “show me your validation and verification.” Teams that can answer fluently usually have solid systems. Teams that stumble usually don’t — because validation and verification are not paperwork exercises. They’re the two mechanisms that prove your system actually works, and they answer two different questions.

Codex defines them cleanly. Validation: obtaining evidence that a control measure, if properly implemented, is capable of controlling the hazard to a specified outcome. Verification: the application of methods, procedures, tests, and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended. Short version: validation asks “will this work?” before you rely on it; verification asks “is it working?” while you rely on it.

FSMA uses the same concepts. Under 21 CFR 117.160, you must validate that your preventive controls are adequate to control identified hazards — for process controls specifically, validation must be done by a Preventive Controls Qualified Individual (PCQI) or under their oversight, before implementation or within 90 calendar days of production start. Verification, under 21 CFR 117.155, includes calibration, records review, and reanalysis. ISO 22000:2018 splits them the same way: validation of control measures (clause 8.5.3) before they go into the HACCP plan or OPRPs, and ongoing verification activities (clause 8.7) to confirm the system performs as planned.

Validation: Proving the Science Before You Rely on It

Validation is done once — when you design the control, when you change the process, or when new information emerges. It answers: does this control, as designed, actually achieve the food safety outcome we need?

Classic examples:

• Cook step: You set a CCP of 70°C for 2 minutes in a poultry product. Validation is the thermal death time data (D-values, z-values for Salmonella) or the challenge study showing that 70°C for 2 minutes achieves your target log reduction — commonly a 7-log reduction for Salmonella in poultry per USDA-FSIS expectations. The published scientific literature counts as validation evidence if it matches your product and process conditions.
• Cooling: A cooling schedule from 57°C to 21°C in 2 hours and to 5°C in 6 more hours needs validation against Clostridium perfringens growth data (FDA Food Code 2022, 3-501.14) or your own cooling studies in the actual product.
• Acidification: A pH 4.6 or below target for an acidified food is validated by the product’s acidification study and scheduled process filed with FDA (21 CFR 114).
• Allergen cleaning: Claiming your clean-in-place procedure removes milk protein to a safe level requires validation — analytical testing (ELISA swabs or specific protein tests) showing the procedure works on your equipment with your residues.

What auditors check: is there documented scientific or technical evidence, specific to your product and process, that the control achieves the intended outcome? “We’ve always done it this way” is not validation. A study on a different product in different equipment is not validation. Your process authority’s letter — specific to your formulation and equipment — is.

The Verification Activities Auditors Expect to See Running

Verification is the ongoing proof the system operates as intended. It includes:

1. Calibration of monitoring equipment: your thermometer checks, metal detector test-piece verification, scale calibration — all the measurement integrity work that makes monitoring data trustworthy.
2. Records review: a designated person reviews monitoring and corrective action records within 7 working days (21 CFR 117.165(a)(4)(i)) to confirm completeness and that critical limits were met.
3. Product testing: finished product or in-process testing — environmental monitoring for Listeria in ready-to-eat plants, for example — as verification that controls are working.
4. Internal audits: systematic checks that procedures are followed as written.
5. Reanalysis: FSMA requires reanalysis of the food safety plan at least every 3 years (21 CFR 117.170), or sooner when there’s a significant change, a new hazard, or a control failure. ISO 22000’s management review and updating activities serve the same function.
6. Supplier verification: audits, COAs, and testing that confirm suppliers deliver what your hazard analysis assumes they do.

Notice the pattern: validation is the foundation pour, verification is the structural inspection schedule. One without the other is an incomplete building.

What Auditors Actually Want to See

Walk through an audit from the auditor’s side. They start with your hazard analysis and control measures, then ask the validation question: “How do you know this control works?” They want the study, the literature reference, the process authority letter — dated, specific to your product and process, and signed off by someone competent. For FSMA process controls, that means PCQI involvement. For thermal processes, it often means a process authority.

Then they move to verification: “Show me it’s working now.” Calibration records current. Records reviews signed within the required timeframe. Environmental monitoring data with trends, not just pass/fail. Internal audit reports with closed corrective actions. A reanalysis that’s actually been done, not just scheduled.

The most common findings are predictable. Validation gaps: a CCP with no scientific basis documented, a cleaning procedure validated by assumption, an allergen control with no analytical evidence. Verification gaps: calibration overdue, records reviews unsigned or late, environmental monitoring data that nobody trends, a food safety plan that hasn’t been reanalyzed in five years despite equipment changes.

The fix is a simple matrix. List every control measure down the left. Across the top: validation evidence, validation owner, validation date. Below that, the verification activities for each control with frequencies, owners, and record locations. One page per control, or one spreadsheet for the whole plan. Auditors love this because it answers both questions at a glance — and your team loves it because it turns “validation and verification” from an abstract audit topic into a concrete maintenance list.

Pay special attention to re-validation triggers — the events that should force you back to the “will this work?” question. Equipment changes, formulation changes, new suppliers of critical ingredients, changes in production volume or line speed, new scientific information about a hazard, and any control failure that suggests the original validation assumptions were wrong. Many audit findings trace back to a validated process that changed without re-validation: the oven was replaced with a faster model, the line speed went up 20 percent, and the original thermal study no longer describes the actual process. Build these triggers into your management of change procedure (ISO 22000 clause 8.5.1.2) so the question gets asked automatically, not discovered by an auditor two years later.

Monday morning: pick your highest-risk CCP. Find its validation evidence. If you can put your hand on a specific study or authority letter within five minutes, you’re in good shape. If you can’t, you just found your most important project this quarter.