Bookmark and Share

From: Food Quality & Safety magazine, December/January 2012

Fine Tune Your Compliance

As the list of food safety requirements grows longer, effective time management is vital to effective auditing and validation

by Arthur Rumpf

HACCP systems have been required in a number of food manufacturing categories for many years and continue to expand as the standard model for all categories in the food industry and supply chain. Validation, an important component of HACCP Principle 6 verification, is not a new concept to the food industry. However, the subject of validation is not always well understood by those individuals who perform food safety and quality audits to determine compliance with current regulatory and industry standards.

Validation is the act of proving, in accordance with the principles of good manufacturing practices (GMP), that any procedure, process, equipment, material activity, or system consistently leads to the expected results. Documented evidence provides a high degree of assurance that a specific system, equipment, or process will consistently produce a product that meets its pre-determined specifications and quality attributes. Simply put, validation is nothing more than proving that a process works.

Validation is often confused with verification and monitoring. While the definitions of these three terms vary depending on the exact standards being used, the following plain English descriptions provide clarity:

  • Validation: Scientific and technical proof that a plan works
  • Monitoring: Taking measurements and actions following the plan
  • Verification: Independent confirmation that all monitoring was done according to plan

Validation and HACCP

HACCP is a food safety management system that is increasingly utilized in all aspects of the food industry and is the cornerstone of many food safety management system compliance

standards. HACCP, a preventive food safety system rather than a traditional quality control inspection system, relies on process controls to minimize food safety risks in the food processing industry. It is not zero risk and does not eliminate the possibility of a hazard getting into the food product. Instead, HACCP attempts to decrease that possibility to an acceptable level.

HACCP has been widely used by the food industry since the late 1970s and is internationally recognized as the best system for ensuring food safety. It is endorsed internationally by the Food and Agriculture Organization and the World Health Organization and in the U.S. by the National Advisory Committee on Microbiological Criteria for Foods.

The FDA used HACCP-based principles when setting up its low-acid food canning regulations in the 1970s. In 1995, the FDA issued regulations that made HACCP mandatory for fish and seafood products and, in 2001, the agency issued regulations for mandatory HACCP in juice processing and packaging plants. In addition, a voluntary HACCP program was implemented in 2001 for Grade A fluid milk and milk products under the cooperative federal/state National Conference on Interstate Milk Shipments (NCIMS) program.

The FDA has also implemented pilot HACCP programs for a variety of other food processing segments as well as for retail foods. In Section 103 of the Food Safety Modernization Act (FSMA)—Hazard Analysis and Risk-Based Preventive Control—all FDA-registered facilities subject to the requirements of the section must identify known or reasonably foreseeable hazards and implement preventive controls in a written plan to significantly minimize or prevent those identified hazards.

Facilities already in compliance with existing seafood, juice, and low-acid canned food regulations are considered exempt from this section of the act, because they are already required to have such plans in place. HACCP has also been implemented by the USDA. In 1998, the USDA’s Food Safety and Inspection Service (FSIS) mandated HACCP for the nation’s meat and poultry processing plants.

Validation is an important concept in HACCP systems, yet there are often situations in which it is inadequately implemented, overlooked, or omitted. In the FSMA’s Section 103, the word validation is not even mentioned.

On March 19, 2010, the FSIS issued a response letter with an attached guidance document to the meat and poultry industries outlining what it considers proper validation of HACCP systems, including clarification of the meaning of validation as required in 9 CFR 417.4. The regulation states that each establishment is required to validate the effectiveness of its HACCP plans in controlling those food safety hazards identified during the hazard analysis. The regulation also states that each establishment must conduct these validation activities during its initial experience with a new HACCP plan and that this must encompass additional activities that make up the entire HACCP system. In the guidance document, the FSIS indicated that validation should be a two-step process.

Validation is the process of demonstrating that the HACCP system as designed can adequately control identified hazards to produce a safe, unadulterated product. There are two distinct elements to validation:

  1. The scientific or technical support for the HACCP system obtained from any of the following areas:
    • Published processing guidelines;
    • A scientific article from a peer-reviewed journal;
    • A challenge or inoculated pack study;
    • Data gathered in house; or
    • Regulatory performance standards.
  2. The initial practical in-plant demonstration proving that the HACCP system can perform as expected. Examples of some controls that would need validation are CCPs, prerequisite program interventions that reduce the likelihood that a hazard will occur, purchase specifications, product formulations in which the formulation contributes to the safety of the product, and cooking instructions.
    Examples of incomplete validation include:
    • Presenting documentation that specifies the log reduction achieved by the process but does not include information about parameters, such as pH, that are critical to achieving that reduction. That information must be included in order for the process to be considered validated.
    • Having a validated process on file but not following the process described.
    • Validating a process for a specific log reduction of a pathogen in a product different than the one being considered. This validation could not be used as supporting documentation.

For example, a process that achieves a 5-log reduction of E. coli O157:H7 in apple cider could not be used as the sole supporting documentation for the reduction of E. coli O157:H7 in a beef product.

Validation and Manufacturing

A validation protocol is a written plan stating how validation will be conducted, including test parameters, product characteristics, production equipment, and decision points on what constitutes acceptable test results.

Generally, in conforming to HACCP validation requirements, every manufacturer must prepare a written validation protocol that specifies the procedures and tests that are conducted, along with the data collected. The purpose for which data are collected must be clear; the data must reflect facts and must be collected carefully and accurately. The protocol should specify a sufficient number of replicate process runs to demonstrate reproducibility and should provide an accurate measure of variability among successive runs.

The test conditions for these runs should encompass upper and lower processing limits and circumstances, including those within standard operating procedures, which pose the greatest chance of process or product failure compared to ideal conditions; such conditions have become widely known as worst-case conditions (they are sometimes called “most appropriate challenge” conditions). Validation documentation should include evidence of the suitability of materials and the performance and reliability of equipment and systems. The scientific support and initial in-plant validation documents that support the decisions made in the hazard analysis, as well as the adequacy of the process used to control those hazards, should be kept for the life of the process.

Validation is an important concept in HACCP systems, yet there are often situations in which it is inadequately implemented, overlooked, or omitted. In the FSMA’s Section 103, the word validation is not even mentioned.

Validation and Auditing

The Global Food Safety Initiative (GFSI) Guidance Document is a benchmark for many major food safety and quality management system schemes in place today. In the sixth edition of the GFSI Guidance Document, Part IV uses the following definitions:

  • Audit: A systematic and functionally independent examination to determine whether activities and related results comply with a conforming scheme, whereby all the elements of this scheme should be covered by reviewing the supplier’s manual and related procedures, together with an evaluation of the production facilities.
  • Verification: A confirmation, through the review of objective evidence, that requirements have been fulfilled.
  • Validation: An activity to obtain evidence that a requirement is controlled effectively.

As defined above, the auditing process involves verification that the requirements of a conforming auditing scheme have been met. When there is a requirement in the auditing scheme that something be controlled effectively, that requirement must be also validated by obtaining evidence through the auditing process.

Auditing for food safety and quality system compliance is usually a two-step process. Initially, the documentation system of a supplier is examined to see if all the requirements of the conforming scheme have been met. The second step is auditing the actual practices taking place at the supplier to see if they are in conformance with the documentation and scheme requirements.

One key to conducting effective audits is understanding that the term validation is used to cover not only the critical control points (CCPs) in a HACCP plan, but also all the applicable GMP-related activities that form the prerequisite programs underlying the HACCP system, such as:

  • Equipment used in manufacturing;
  • Equipment used to control the environment(s) where the product is manufactured or stored;
  • Utilities with product contact (e.g., water systems, compressed gases, air);
  • HVAC systems;
  • Alarm systems that monitor utilities and air handling for process and storage areas;
  • Analytical methods;
  • Analytical instruments;
  • Computerized systems (e.g., document control systems);
  • Cleaning processes; and
  • Manufacturing processes.

During the development of HACCP plans and the hazard analysis, decisions are typically made to exclude points as CCPs based on the fact that these activities are validated and are thus under control in the prerequisite programs. Typically, audits concentrate on the validation of the CCPs in the HACCP plan and do not fully consider the entire HACCP system and the requirement that all the related prerequisite programs be under control as well. Audit findings that any of these activities are not being controlled adequately can have a serious impact on the HACCP system, negating the original decisions in the hazard determination of a CCP in the HACCP plan.

For HACCP-based systems that have been implemented, change management is a critical process that must be well defined and followed for formal documented reassessment of the HACCP plan. An auditor should be looking for changes made to or omissions from the current HACCP plan in such areas as:

  • Raw materials or source of raw materials;
  • Product formulations;
  • Processing methods or systems, including computers and their software;
  • Packaging;
  • Finished product distribution systems or the intended use or intended consumers of the finished product; and
  • Rate or type of consumer complaints.

As an audit guide specific to reviewing initial and existing HACCP plan validations, the NCIMS HACCP Validation Checklist represents a generic model that can be used.


Conducting an effective audit for many of the food safety and quality system schemes today can be a difficult task due the sheer number of requirements that must be evaluated in a short period of time. There can be a tendency to give equal weight and time to evaluation of all the requirements, because there may be hundreds of line items that must be audited.

When auditing for compliance to any food safety scheme, a requirement that something must be controlled effectively should be a red flag for the auditor to budget sufficient time in his audit planning to obtain sufficient objective evidence to validate that the requirement is truly being met.

Arthur Rumpf is a senior technical consultant at UL-STR in Canton, Mass., a global provider of quality assurance testing and supply chain support services for the food industry. UL-STR provides third-party testing, inspection, audit, and responsible sourcing services for a wide range of consumer products. Rumpf can be reached at



Current Issue

Current Issue

February/March 2015

Site Search

Site Navigation