Validation vs. Verification in Food Safety: A HACCP Guide

Validation vs. Verification at a Glance

• 90 daysWindow FDA and USDA both allow to finish some validation after production starts21 CFR 117.160; 9 CFR 304.3, 381.22
• 7 work daysFDA's default deadline to review monitoring and corrective-action records (longer only with a PCQI's written justification)21 CFR 117.165(a)(4)
• 3 yrs vs 1 yrFDA reanalysis interval vs USDA FSIS HACCP reassessment21 CFR 117.170; 9 CFR 417.4
• 232 vs 4FY2025 citations of hazard analysis vs process-control validation on FDA's system-generated Forms 483 (not a complete count)FDA Inspection Observations

Checked October 1, 2026, against the current eCFR, FSIS and Codex texts, SQF Edition 9 and 10, BRCGS Issue 9, IFS Food Version 8 and FSSC 22000 Version 6.

What Is Validation in Food Safety?

Validation means getting scientific and technical evidence that a control measure, or the whole food safety plan, can control the hazard when it is properly implemented.^[1] Codex frames it the same way: evidence that a control measure can control the hazard to a specified outcome.^[2]

Good validation has two halves. USDA's Food Safety and Inspection Service (FSIS) calls them design and execution: scientific or technical support showing the process parameters work, and in-plant data showing your plant actually meets those parameters.^[3] FDA's rule likewise asks for scientific and technical evidence or, where that evidence is unavailable or inadequate, new studies.^[1]

Codex says the approaches can be used individually or in combination; surveys are used alongside others. Relying on someone else's validation is fine only if you confirm your conditions match the ones they validated.

Codex also lets a business lean on outside work: published literature, regulations, competent-authority guidance or an equipment manufacturer's study, instead of commissioning every study itself.^[2][4]

What Is Verification in Food Safety?

Verification means using methods, procedures, tests and other evaluations, beyond monitoring, to determine whether a control is or has been operating as intended.^[1][2] It is the evidence that you did what the plan says, every day, and that the plan still works.

• Calibration or accuracy checks of the instruments used for monitoring and verification
• Records review of monitoring and corrective-action records
• Direct observation that monitoring and corrective actions are done as written
• Product testing and environmental monitoring for a pathogen, indicator organism or other hazard
• System review, including internal audits and third-party audits

Codex adds a practical rule: verification should be done by someone other than the person who did the monitoring and corrective actions, and often enough to confirm the system works.^[2] Monitoring itself, the planned sequence of measurements at each control, is not verification.^[1]

What's the Difference Between Validation and Verification?

Validation is about the design of a control; verification is about whether it is working in practice. NACMCF's 1997 HACCP guidelines described validation as "that element of verification" focused on scientific evidence, and FDA's rule still lists validation as one of its verification activities.^[5][1] Codex now separates them more clearly: its revised HACCP Principle 6 reads "validate the HACCP plan and then establish procedures for verification," and its validation guideline says validation comes first, with monitoring and verification following once the validated controls are in place.^[2][4]

For cooked poultry, FSIS requires a 7-log reduction of Salmonella, or an alternative lethality that gives an equivalent probability that no viable Salmonella remain. Its Revised Appendix A shows that reaching 165°F needs no dwell time for chicken or turkey at any fat level, while 160°F needs roughly 14 to 27 seconds depending on species and fat. Come-up time and relative humidity are critical operating parameters at every temperature.^[9] So a 165°F endpoint on its own is not the validation: the design support and your in-plant data together are. FDA makes the same point for its own controls table, warning that general control information does not mean a control has been validated for a specific pathogen in a specific food.^[10]

What Does FDA Require for Validation and Verification?

The preventive controls rule for human food (21 CFR Part 117, published September 2015) brought validation and verification requirements to FDA-registered human food facilities, unless an exemption in 21 CFR 117.5 applies.^[1]

Qualified facilities are exempt from these subparts but must meet modified requirements (21 CFR 117.201). A qualified facility is a very small business (under $1 million a year in human food sales, adjusted for inflation) or a facility with under $500,000 in food sales that sells mostly to consumers and nearby restaurants and retailers. Activities covered by seafood or juice HACCP, the microbiological hazards covered by the low-acid canned food rule and some other operations are also exempt; acidified foods get no such exemption (21 CFR 117.3, 117.5). FDA's dedicated validation chapter of its preventive controls guidance is still listed as coming soon, and the guidance overall remains a draft.^[11]

Other FDA rules set their own clocks. Juice HACCP requires validating the HACCP plan within 12 months of implementation and at least annually after that, and its controls must deliver at least a 5-log reduction of the pertinent microorganism.^[8] Seafood HACCP calls it reassessment and also requires it at least annually.^[7] For low-acid canned and acidified foods, scheduled processes must be established by qualified people with expert knowledge, the role usually called a process authority, and filed with FDA; filing is not FDA approval.^[12][13][14] Our guide to getting a sauce onto grocery shelves covers what a process authority letter does.

How Do USDA FSIS Rules Differ?

USDA-inspected plants follow 9 CFR 417.4, titled "Validation, verification, reassessment." Every plant with a HACCP plan must validate that the plan controls the hazards and verify that it is implemented effectively.^[15] A new plant or a new product has 90 days to complete initial validation.^[16] Plants can generally keep producing and shipping during that period; the exception is ready-to-eat product whose in-plant microbiological data are still being gathered to support that it is ready to eat. FSIS encourages, but doesn't require, in-plant microbiological data when a plant follows its scientific support and shows it meets those parameters.^[3]

FSIS's 2015 validation guideline spells out what the agency expects: scientific support matched to your actual process, and in-plant data showing you meet its critical operating parameters. Small and very small plants should use records from at least 13 production days within those 90 days, and FSIS says a process that hasn't run for a year or more is most likely no longer validated.^[3] Since December 14, 2022, FSIS no longer accepts the 1999 or 2017 versions of Appendix A and B as scientific support.^[17]

From 21 CFR 117.160-117.180; 9 CFR 417.2-417.7, 304.3, 381.22 and 590.149; and FSIS's 2015 HACCP Systems Validation guideline.^{[1][15][16][3]}

What Do SQF, BRCGS, IFS and FSSC 22000 Require?

Every GFSI-benchmarked scheme builds on Codex HACCP, so every one asks for validation and verification. They go further than FDA where FDA's rule exempts controls from validation. FSSC 22000 requires allergen control measures to be validated and verified; SQF and BRCGS require allergen cleaning to be validated and verified; and BRCGS also requires cleaning to be validated where it is part of a prerequisite plan for a specific hazard, and every CIP system to be validated.^{[18][19][20][1]}

Clause numbers from the SQF Food Manufacturing Code Editions 9 and 10, BRCGS Issue 9 Part II, IFS Food Version 8 and the FSSC 22000 Version 6 scheme; ISO 22000:2018 clause numbers from FSSC's Version 7 audit report annex. None of the SQF, BRCGS or IFS texts sets a daily or per-shift calibration frequency.^{[19][21][22][20][23][18][24]}

SQF also changed its definitions for Edition 10. Edition 9's glossary still calls validation "that element of verification"; the Edition 10 glossary defines validation as using scientific, technical and system data to show controls work as intended, and verification as confirming the system complies and operates as intended.^[19][21] ASI Food Safety, LLC, part of Kiwa ASI, is an SQFI-licensed, ANAB-accredited SQF certification body. BRCGS audits are delivered as a listed office of Kiwa Agri Food (UKAS) and Kiwa España (ENAC), and FSSC 22000 certificates are issued by a Kiwa group certification body licensed by Foundation FSSC.

When Do You Need to Re-Validate?

Validation isn't a one-time event, but outside juice HACCP it isn't an annual ritual either. The rules separate re-validation, which follows changes, from the periodic review of the whole plan. Not every change needs new validation: FSIS notes that a reassessment after a supplier change may find nothing to re-validate.^{[1][8][7][15][3][4][19][20]}

One distinction trips sites up: SQF Edition 9 requires critical limits to be reviewed annually and re-validated, or justified by regulatory standards, when changes occur, which is not the same as re-validating every year.^[19] FSIS adds a practical trigger worth borrowing: a process unused for a year or more is most likely no longer validated.^[3]

What Do Inspectors and Auditors Actually Cite?

We counted how often these sections of 21 CFR Part 117 were cited on system-generated Forms FDA 483 in FDA's published inspection observation data, which covers inspections by FDA and its representatives. Under Part 117 the pattern is clear: process-control validation and records review are rarely cited; the hazard analysis is. Seafood HACCP is the exception: in FY2025, FDA cited seafood verification requirements (21 CFR 123.6(c)(6) and 123.8) 74 times, and juice HACCP plans that hadn't been validated (120.11(b)) 4 times.^[25]

FDA notes that these spreadsheets are not a comprehensive listing of all inspectional observations. They count citations on Forms 483 generated by FDA's electronic inspection tools, and some 483s are prepared manually. Each observation reflects an investigator's judgment that a condition may violate FDA requirements.

Certification audit data points the same way. SQFI says the food safety plan has always been on its top non-conformance list, with missing hazard analysis, incomplete ingredient hazard analysis and misidentified CCPs as common pitfalls.^[26] In BRCGS's 2021 top 10, the only HACCP clause was 2.7.1, hazard identification, in sixth place; internal audits (3.4.1), which BRCGS lists as a verification activity, ranked ninth.^[27][20] FSSC 22000's first published Version 6 data, from 1,437 audits, had neither validation nor verification of the food safety plan in its top 15; the closest item was control of monitoring and measuring (calibration), at number 10.^[28] The lesson: you can't validate a control for a hazard you never identified. Fix the hazard analysis first.

What Are the Most Common Mistakes?

These gaps come from the regulations, scheme standards and guidance cited in this article.

• Treating a table value as the whole validationFSIS expects in-plant data that your process meets every critical operating parameter, including come-up time and humidity.^[3][9]
• Borrowing someone else's validation without checkingCodex allows it only if your conditions match the ones that were validated.^[4]
• Assuming FDA rules are the whole storySQF and BRCGS require validated allergen cleaning, and FSSC 22000 validated allergen controls, even though FDA doesn't.^[19][20][18]
• Letting the operator verify their own recordsCodex says verification should be done by someone other than the person who monitored.^[2]
• Calibrating without a written frequencyFDA requires written procedures for calibration method and frequency, as appropriate to the facility, the food and the preventive control.^[1]
• Calling lab methods validationFDA's Bacteriological Analytical Manual sets out FDA's preferred laboratory methods for microbiological analysis of foods. A test method tells you how to analyze a sample; on its own, it isn't evidence that your process controls the hazard.^[29][4]
• Validating once and forgetting itChanges that could affect whether a control works, such as a new ingredient, equipment or process, trigger re-validation, and FSIS says a process unused for a year or more is most likely no longer validated.^[1][3]
• Missing the 7-day records reviewFDA's preventive controls rule requires monitoring and corrective-action records to be reviewed within 7 working days, unless a PCQI documents a written justification for a longer, reasonable timeframe. Juice and seafood HACCP require a signed, dated review within 1 week.^[1][8][7]

How Kiwa ASI Can Help

ASI Food Safety, LLC, part of Kiwa ASI, is an SQFI-licensed, ANAB-accredited SQF certification body. When it audits your site, the auditor looks for evidence that your plan is validated and followed. As a certification body, it can't validate, design or write your plan, or advise you on how to fix it. Preparing for SQF? See our SQF audit preparation guide.

PCQI preventive controls training (21 CFR 117 validation, verification and reanalysis), HACCP online training (the seven principles) and internal auditing training are offered through ASI Training and Consulting, LLC, which operates separately from the certification body and has no effect on audit outcomes.

Frequently Asked Questions