HACCP Plan Validation vs. Verification: The Difference Auditors Look For

Validation and verification sound alike, and many food safety plans blur them. Auditors notice. A plan that says "verified" when it means "validated" usually has a gap behind it: a critical limit with no scientific basis, or a control that is checked but was never proven to work. This guide is for QA and food safety staff at food and beverage manufacturers working under HACCP, an FSMA food safety plan, or a GFSI scheme such as SQF.

Short answer: Validation asks, "If we do this correctly, will it control the hazard?" It is evidence gathered before you rely on a control, or when something changes. Verification asks, "Are we actually doing it, and is it working?" It is ongoing: records review, calibration, testing and audits. You need both, and you need records that show which is which.

• Codex HACCP. Codex General Principles of Food Hygiene (CXC 1-1969, revised 2022) includes the seven HACCP principles. It defines validation of control measures as "obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome," and verification as "the application of methods, procedures, tests, and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended." Codex's Guidelines for the Validation of Food Safety Control Measures (CXG 69-2008) covers validation in more depth.
• FSMA preventive controls. For most FDA-registered human food facilities, the legal requirement is a food safety plan under 21 CFR Part 117, Subpart C. 21 CFR 117.160 requires validation of preventive controls. 21 CFR 117.165 requires verification that preventive controls are consistently implemented and effective.
• Mandatory HACCP rules. Classic HACCP plans are legally required for juice (21 CFR Part 120), seafood (21 CFR Part 123) and USDA-inspected meat and poultry (9 CFR Part 417). Each has its own verification and validation provisions (see 21 CFR 120.11, 21 CFR 123.8 and 9 CFR 417.4).
• Certification schemes. SQF and other GFSI-benchmarked schemes include HACCP-based food safety plan requirements; check your scheme's current edition for its validation and verification clauses.

Validation (21 CFR 117.160). You must validate that preventive controls are adequate to control the hazard. Validation must include obtaining and evaluating scientific and technical evidence, or conducting studies when that evidence is unavailable or inadequate (117.160(b)(2)). It must be performed or overseen by a preventive controls qualified individual (PCQI) before the food safety plan is implemented, or, when needed to show the controls can be implemented as designed, within 90 calendar days after production of the food first begins (or a longer, written-justified timeframe). It is also required when a change could affect whether a control works, and when reanalysis shows the need (117.160(b)(1)).

Validation is not required for food allergen controls, sanitation controls, the recall plan or the supply-chain program (117.160(c)). Those still need verification, as appropriate.

Verification (21 CFR 117.165). Verification activities include, as appropriate: calibration of monitoring and verification instruments; product testing (for a pathogen, an appropriate indicator organism, or another hazard); environmental monitoring, if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control; and review of records (117.165(a)). Monitoring and corrective action records must be reviewed by or under the oversight of a PCQI within 7 working days, or within a longer timeframe justified in writing (117.165(a)(4)(i)).

Reanalysis (21 CFR 117.170). The food safety plan as a whole must be reanalyzed at least once every 3 years, and sooner after significant changes, new hazard information, unanticipated problems, or a control found to be ineffective. New or changed controls must be validated as appropriate.

1. List every control and its type. Process, allergen, sanitation, supply-chain or other. Note which require validation and which do not.
2. For each validated control, name the evidence. Cite the specific study, guidance document or process authority letter. Record the parameters it supports (time, temperature, pH, water activity) and confirm your process matches them.
3. Fill evidence gaps. If no published source matches your product and process, plan an in-plant study or challenge study with a qualified lab or process authority.
4. Define verification for each control. What is checked, how often, by whom, and what happens if it fails.
5. Write down the schedule for revalidation and reanalysis. Tie it to change control so a new ingredient, line or supplier triggers a review.
6. Keep the two record sets separate and labeled. A validation file per control, and verification records in the routine system.

• Calling routine record review "validation"
• Critical limits with no cited source, or citing a source for a different product or process
• Validation done once at plan launch and never revisited after equipment or formula changes
• Thermometers used for monitoring with no calibration or accuracy checks
• Verification records signed on the same day for a whole month, which can raise questions about whether review happened within the required timeframe (7 working days for monitoring and corrective-action records, 117.165(a)(4)(i))
• Microbial testing listed as a verification activity with no written sampling plan, method or laboratory named (see 117.165(b)(2))

This is an illustrative scenario, not a client case. A plant cooks a ready-to-eat product to a set internal temperature and hold time. Validation: the plan cites a published lethality reference or a process authority study supporting that time and temperature for this product, plus in-plant data showing the oven delivers it at the coldest spot of the load. Verification: operators log temperatures each batch, a qualified person reviews those logs within 7 working days, the probe thermometers are checked for accuracy on a set schedule, and the plant runs periodic finished-product or environmental testing as its plan specifies. When the plant changes oven loading, it revalidates before the change goes live.

Outside help is useful when your critical limits lack documented sources, when a new product or line needs validation evidence, when an auditor has questioned your validation, or when you are preparing for a first SQF audit. Micro-Core's food safety and certification readiness services include review of validation files and verification programs, working with your food safety team and your PCQI. You can also start with the free pre-audit checklist.

Is HACCP validation required by law? It depends on what governs your facility. For FDA-registered human food facilities under 21 CFR Part 117, validation of preventive controls is required by 21 CFR 117.160, with listed exceptions. Juice, seafood and meat and poultry HACCP rules have their own provisions. Certification schemes such as SQF also expect it.

Who can perform validation under FSMA? Under 21 CFR 117.160(b)(1), validation must be performed or overseen by a preventive controls qualified individual. Studies or data may come from outside sources such as published research, process authorities or labs, but the rule requires that validation be performed or overseen by a PCQI.

Does verification testing prove my process is validated? No. Passing product or environmental tests shows the control appears to be working on the samples you took. It does not show the control is capable of controlling the hazard across normal variation. That is what validation evidence is for.

How often should we revalidate? There is no fixed calendar interval for revalidation under 21 CFR 117.160. Revalidate when a change could affect a control and when reanalysis shows the need. Reanalysis of the whole plan is required at least every 3 years (117.170(a)). Seafood and USDA meat and poultry HACCP rules require reassessment at least annually (21 CFR 123.8(a)(1); 9 CFR 417.4(a)(3)).

This article is general information, not regulatory or legal advice. Requirements depend on your products, markets and certifying bodies. Confirm against the current edition of each standard. No consulting engagement guarantees a regulator, customer, auditor or certification decision.

Request a consultation · Download the Pre-Audit Verification Checklist

1. 21 CFR 117.160, Validation: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.160 ↗
2. 21 CFR 117.165, Verification of implementation and effectiveness: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.165 ↗
3. 21 CFR 117.170, Reanalysis: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.170 ↗
4. 21 CFR 117.180, PCQI requirements: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.180 ↗
5. Codex CXC 1-1969 (rev. 2022), General Principles of Food Hygiene: https://www.fao.org/4/cc6125en/cc6125en.pdf ↗
6. Codex CXG 69-2008 (Adopted 2008; editorial amendments 2013), Guidelines for the Validation of Food Safety Control Measures: https://www.fao.org/input/download/standards/11022/CXG_069e.pdf ↗
7. FDA/NACMCF, HACCP Principles & Application Guidelines (1997): https://www.fda.gov/food/hazard-analysis-critical-control-point-haccp/haccp-principles-application-guidelines ↗
8. 21 CFR Part 120 (juice) §120.11: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-120 ↗ ; 21 CFR Part 123 (seafood) §123.8: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-123 ↗ ; 9 CFR Part 417 §417.4: https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417 ↗