HACCP verification vs validation: examples from South African food plants

Your auditor wrote “validation not demonstrated” against a CCP, and you thought the calibration records covered it. You are not alone: clear HACCP verification vs validation examples are what supervisors ask us for most in training, because the two words sound alike and get used loosely on the factory floor. Get them straight and a whole category of audit findings disappears.

Below we define each term plainly, then work through four controls we see in South African plants, with the record each one should produce.

HACCP verification vs validation examples: first, one sentence each

Validation asks: will this control measure, set up this way, actually control the hazard? You get the evidence before you rely on the control, or when you first put it in place, and again when something changes.

Verification asks: are we doing what the plan says, and is it working? It is ongoing, through reviews, checks, calibration, sampling and audits.

The Codex General Principles of Food Hygiene, revised in 2020, put both into Principle 6: validate the HACCP plan, and then establish procedures for verification to confirm that the HACCP system is working as intended. SANS 10330 follows the same logic. A simple way to remember it: validation is about the right control, verification is about the control done right.

Worked example: cooking chicken portions to a critical limit

A meat processor in the Western Cape cooks marinated chicken portions in a continuous oven. The hazard is survival of vegetative pathogens such as Salmonella and Campylobacter. The CCP is the cook step, with a critical limit for core temperature and hold time.

• Validation: the critical limit comes from a recognised scientific reference or regulatory guidance for poultry. The team then runs trials on the actual oven, at the largest portion size, the highest belt speed and the coldest product loading, logging core temperature at the slowest heating point. The validation file holds the reference, the trial data and a signed conclusion that the oven settings reliably achieve the limit.
• Verification: a supervisor reviews and signs the CCP monitoring sheets each shift, probe thermometers are checked against a reference every day and calibrated by an outside lab on a schedule, and finished product is sampled for micro testing.

Worked example: metal detection on a packing line

A snack packer runs a metal detector after sealing. The hazard is metal fragments from slicers, sieves and screens.

• Validation: evidence that the detector, at the chosen sensitivity, finds test pieces of each metal type and size in the actual product, at line speed, in the least favourable position in the pack, and that the reject system removes every contaminated pack into a locked bin. Product effect matters here: a salty, moist product can mask small pieces, so the sensitivity has to be proven on that product.
• Verification: test pieces passed through at start up, at set intervals and after changeovers, with each result recorded; supervisor review of those records; annual service by the supplier; and a check that the reject bin is locked and its contents reconciled.

Worked example: drying biltong to a safe water activity

A biltong producer in Gauteng relies on salt, vinegar and drying to make the product shelf stable. The hazards include Salmonella, E. coli and Listeria monocytogenes on raw meat.

• Validation: evidence that the full process (vinegar dip, salt and spice level, drying room conditions and drying time) reduces pathogens and brings the product to a water activity target set from published research or a challenge study. The producer tests water activity on trial batches at the thickest cut and the end of the drying room with the least airflow. Without that work, the drying time on the wall is a habit, not a validated control.
• Verification: water activity testing on each batch or a defined sample, daily calibration checks on the water activity meter with reference standards, review of drying room humidity and temperature logs, and periodic micro testing of finished product.

Worked example: sanitiser strength at a boot dip and a CIP set

Sanitiser controls are usually prerequisite programmes rather than CCPs, but the same two questions apply.

• Validation: the supplier’s data sheet and efficacy test reports show that the product, at the stated concentration and contact time, kills the target organisms. For a CIP system, the cycle (detergent concentration, temperature, flow and time) is shown to clean the circuit, often with swab results and inspection of opened fittings after the cycle.
• Verification: titration or test strips at the boot dip each shift and after it is topped up, conductivity and temperature charts from the CIP, ATP or micro swabs after cleaning, and a supervisor who signs the records.

A common gap: the boot dip is filled at the right strength at 06:00 and checked once. By midday it is full of mud, and the organic matter has used up much of the available chlorine. The validation was fine; the verification frequency was not.

The records that prove each one, and who signs them

Record	Validation or verification	Typically signed by
Scientific reference for a critical limit	Validation	HACCP team leader
Process trial or challenge study report	Validation	HACCP team, approved by management
CCP monitoring log	Monitoring (not verification on its own)	Operator
Review of CCP logs	Verification	Supervisor or QC
Thermometer and meter calibration	Verification	QC or external lab
Product and environmental testing	Verification	QC, with lab report
Internal audit and annual HACCP review	Verification	Internal auditor, HACCP team

Notice the third row. The operator filling in the temperature sheet is monitoring. Verification starts when someone else checks that the monitoring was done, was correct and was acted on. Templates that separate these columns help a lot, and the HACCP and PRP Document Templates Toolkit includes validation and verification records built around SANS 10330.

Five mix ups auditors write up

1. Calling calibration “validation”. Calibrating a probe proves the probe reads correctly. It does not prove the cook step kills the hazard.
2. Using the supplier’s brochure as validation. A metal detector brochure lists what the machine can do in ideal conditions. Your validation must be on your product, at your line speed.
3. No revalidation after a change. A new oven, a thicker portion, a new recipe or a new sanitiser means the old validation may no longer apply. Record the decision either way.
4. Treating monitoring as verification. If the only signature on the CCP log is the operator’s, the verification step is missing.
5. Verification with no follow through. A supervisor signs a log that shows a deviation and no corrective action. The signature proves only that nobody read the sheet.

Internal audits are where these gaps should be caught first. If you would like an independent view before your certification audit, our internal food safety audit service looks specifically at whether validation and verification records stand up.

What to do this week

• List every CCP and its critical limit, and next to each write the source of the validation evidence.
• Mark any CCP where that source is “we have always done it this way”.
• Check that every CCP log has a second signature from someone who is not the operator.
• Check the date of the last validation against the date of the last change to equipment, product or recipe.
• Put one validation and verification example on the agenda for your next HACCP team meeting.

If your HACCP team needs a shared, practical grounding in this, our HACCP course for supervisors and HACCP teams works through critical limits, monitoring, validation and verification with plant examples like these.

Frequently asked questions

Does every prerequisite programme need validation?

Not in the same depth as a CCP, but you still need evidence that the control is suitable, such as a sanitiser efficacy report or pest control specification. The effort should match the risk the programme controls.

How often should we revalidate a CCP?

Whenever something that could affect the control changes, and look at it again at every periodic HACCP review (most sites review at least once a year). Your certification scheme may set further expectations, so check with your certification body. If you are building the plan from scratch, our HACCP implementation consulting includes a validation plan for each CCP.

Can the same person validate and verify?

Yes, a HACCP team leader often does both. What matters is that verification is done by someone other than the person doing the monitoring, and that both are recorded and signed.