Validation has always been part of the Hazard Analysis and Critical Control Point (HACCP) system, but it is an even greater issue in today’s food safety management systems. HACCP has mandated the validation of CCPs since the introduction of the seven principles in 1989. Food safety management standards also require that some or all of the food safety system be validated. Even though this has been required since “day 1,” it is surprising how many companies’ HACCP plans contain no validation data.

The ISO 22000[1] and PAS 220[2] standards require formal validation of CCPs and operational prerequisite programs (oPRPs). In addition, cleaning and sanitizing programs must also be validated. Organizations must properly design, document, implement and maintain prerequisite programs, even if the standard does not specify a validation requirement for this part of the food safety system.

One way to think of the differences among validation, verification and monitoring is to use the following questions that are linked to basic grammar:

•    Monitoring: Are the operations being done as intended? (present)
•    Verification: Was the work done according to plan? (past)
•    Validation: Will the plan work? (future)

Validation is not a new concept to the food processing industry. In the early days of the low-acid canned-food regulations, protocols were established to validate the processing conditions for canning low-acid products. Parts of the protocol could be classified as general, such as critical factors that established the time-temperature relationship to process a specific food product, including cook times, cook temperatures, head space and drain-fill weight. These critical factors could be established and validated in a pilot plant with proper processing equipment. This requirement did not make the European manufacturers of aseptic systems very happy in the early 1980s. When FDA approved hydrogen peroxide as a sterilant, those manufacturers learned that history was not enough. They had to gather data to validate that the processing and packaging equipment not only could be sterilized, but also would remain sterile during operations.

Today, different types of validation need to be done on the manufacturing equipment that is used to produce the product. In canning low-acid foods, this includes identifying the cold spot in a retort-packaged food product, which is critical in determining the schedule for the process.

A recent example in the U.S. that has cropped up as direct result of a foodborne outbreak has been the requirement that almonds must be processed to reduce Salmonella by 4–5 logarithms. The systems used for this must be validated by a process authority recognized by the Almond Board of California as able to achieve the required bioburden limit.[3] Many times, process authorities will establish a minimum process to ensure safety, but operating parameters exceed this minimum. Thus, the process has built-in safety factors. The scheduled processes are somewhat excessive, which will minimize the potential for process deviations, yet ensure both quality and safety. However, the minimum processing parameters are determined as a result of studies that utilize “worst-case scenario” processing conditions.

In 2008, Codex Alimentarius (hereafter referred to as Codex) published the standard, “Guidelines for the validation of food safety control measures,” [4] which represents a major benchmark because it separates “validation” from “verification” in the practice of HACCP. It is an excellent document with respect to the validation that is needed to follow HACCP procedures and with respect to its scope. It can be applied to many of the existing control measures, as it incorporates a five-step process that can be used for validation. The five steps are:

1.    Decide on the approach (or approaches) that will be used as a control measure.

2.    Define the parameters and decision criteria that are capable of controlling the hazard to the specific outcome.

3.    Collect any relevant information and conduct studies needed to fill any gaps in the relevant information.

4.    Analyze the results.

5.    Document the validation study. The documentation should be written in sufficient detail to allow a food scientist to understand the conditions for the study so that the individual can repeat the study.

The Codex standard recognizes five approaches that can be used for validation. Those approaches are:

1. Reference to scientific and technical literature, previous validation studies or historic knowledge of process performance of the control measures. Care must be used with this approach. Past studies are done on specific pieces of equipment, using an underlying set of assumptions. Process authorities must ensure that all of these assumptions are either met or exceeded for future validation studies.

2. Scientifically valid experimental data that demonstrate the adequacy of the control measures. Process authorities must address sources of variation that can affect the process. Most validation studies are conducted over a limited span of time; this typically decreases the number of sources and extent of variation that affect the process. An example of this would be a challenge study designed to determine how a specific processing system or a formulation affects a target organism.

3. Collection of data during the food operation. Codex suggests that this type of study last three to six weeks, and that sufficient data be collected for statistical analysis. Critical questions regarding this strategy include: What is being done with the product that is produced during this study? How does the company ensure that the food produced is safe to eat? Processors may also use this approach to modify an existing CCP.

4. Mathematical modeling to assess how control measures affect the ability to achieve the intended results. Mathematical modeling holds a lot of promise for the future. Currently, the main limitation to this method is the small number of models that have been derived. However, any operation that relies exclusively on a model is asking for trouble. That model must be tested in actual practice.

5. Statistically valid surveys. Statistical surveys are an effective tool to evaluate consumer understanding of food safety information on labels. Surveys need to be appropriately designed and executed to ensure valid data.

A critical aspect of the protocol is to understand the limitations of any study conducted. These limitations define a set of underlying assumptions. A critical assumption is determining if a validation study was conducted under a worst-case scenario. If this did not occur, then it is essential to analyze both the monitoring (present) and verification (past) results to determine if any negative trends are occurring and whether corrective actions have been taken prior to having a failure of a food safety control measure.

For example, when determining critical factors for retort processes, the process authority may conduct studies on containers that are intentionally overfilled—the assumption being that this is a worst-case scenario.

One question that crops up frequently is “Who should do the validation?” The HACCP regulations for juice (21 CFR Part 120) state, “The validation of the hazard analysis shall be performed by an individual or individuals who have been trained in accordance with Sec. 120.13, and records documenting the validation shall be subject to the recordkeeping requirements of Sec. 120.12.”

Codex states that verification activities should be done by someone other than the person doing the monitoring. Neither Codex, the U.S. HACCP regulations, nor the National Advisory Committee on Microbiological Criteria for Foods (NACMCF) guidelines state that third parties must verify and validate the HACCP plan. Ironically, several of the company audits now require that a plan be validated by a third party that are happy to do so—for a fee.

The Codex guidelines describe a validation scenario for a Sanitation Standard Operating Procedure (SSOP).[4] In this scenario, environmental monitoring samples were taken daily on food-contact surfaces over a period of three to four weeks. The results of the environmental samples were then compared to established microbiological criteria. Statistical tests were used to determine the efficacy of the SSOPs. If the results met the established criteria, then the SSOP was considered to be validated.

In general, this Codex validation procedure for sanitation is good. The study was conducted over a long period of time, which allowed for some process variation. But there are a number of questions that can be asked about this protocol, such as:

•    What was done with the product during the validation study? Will the product be held until the study is completed before it is released into the market?

•    What are the published, accepted criteria for cleaning and sanitizing?

•    What happens if one or more outlying factors are present in the data, but do not statistically affect the outcome of the validation study? Can the conditions that caused the outliers affect the safety of the product?

•    Was the validation study conducted during times when it is expected that the largest bioburden levels would occur?

One of the authors was involved in validating a cleaning procedure. Essentially, the Codex procedure was used. However, there were several critical modifications. This study was conducted over consecutive days for two weeks. Environmental swabs were collected before and after the cleaning process. During the first week, the validated cleaning chemicals were used to clean the equipment. This established a baseline for the validated cleaning process.

During the second week, new cleaning chemicals were used in accordance with the distributor’s recommended cleaning instructions. Environmental samples were collected before and after the cleaning procedures. Following the cleaning process using the new cleaning chemicals, the equipment was re-cleaned using the validated cleaning chemicals. The number of environmental samples was determined by a process authority with experience in environmental design. Analysis of the environmental samples revealed that the proposed cleaning chemicals were as effective as the existing cleaning chemicals. Thus, the cleaning process was validated for the use of the proposed cleaning chemicals.

Other prerequisite programs are even more difficult to validate. The question can be asked, “How does one validate a training program?” Is a test adequate? Some people are excellent test takers, but does that really mean they have “learned” and understand the material? Another that crops up is, “How does one validate the handwashing process in a plant?”

Some training companies will utilize procedures to determine the qualifications of the instructors and then evaluate the instructors during the sessions that the instructors provide. In addition, the training material may be reviewed by a peer group and some of the organizations may test during or after the training. These are all good practices and should be followed.

However, in the strict context of the definition for validation, a top-to-bottom validation process has not been completed. Parts of the analysis are conducted after the service was performed and if a failure occurred in the training process, the participants should be retrained.

If an outside training organization was used, there may have not been any tests conducted to ensure that the participants were competent to use on the job the skills that they learned in training. These issues do not negate that training should be properly developed, implemented and maintained. In addition, those professionals involved in training should be aware that they can always improve their training techniques and materials. Obtaining informal feedback during the training process is one way to accomplish this.

Food processing conditions are always changing. As a result, the underlying assumptions for the production of safe food are changing as well. To meet this challenge, the food safety management system needs to be reevaluated to ensure its effectiveness. The reevaluation may lead to revalidation of some parts of the system.[4]

Potential issues that can trigger a revalidation include:

•    System failure. This can occur if there are multiple failures in the food safety system and the corrective actions either cannot be identified or do not address the root cause of the failure.

•    Process and product changes. There are multiple changes in processing that can potentially signal a need to revalidate. These include changes in raw materials, the manufacturing process or the product formulation. Whenever a product or process change is made, the HACCP plan should be evaluated to ensure it is still effective. This review should include a determination of whether there is a need to revalidate the control measures. Online monitoring and observations may also identify weaknesses in the food safety system that will change the food safety control processes and trigger a revalidation study.

•    Changes in the distribution system or customer handling practices can cause the need for validation. For example, a chicken pot pie recall identified the need to improve the cooking instructions on the pot pie packages. Of course, providing proper cooking instructions does not necessarily mean that the consumer will follow them. Over 30 years ago, several outbreaks of botulism that were traced to pot pies almost led to regulation of this product.

•    New scientific or regulatory information. Food processors need to be aware of changes in food safety knowledge. For example, three years ago, peanut butter was considered a low-hazard food. Recent outbreaks in the peanut industry have caused many food manufacturers to rethink food safety control measures for low-moisture foods. As an example, many peanut processors felt that a 2–3 log reduction in Salmonella was adequate. In light of the outbreak and what has happened with the U.S. almond industry, the minimum log reduction will undoubtedly increase.

Validation is a critical part of the food safety management system. Proper validation studies not only ensure that the process parameters or prerequisite programs properly control a hazard, but they also provide confidence to the food processor’s customers that the food safety system has been designed to ensure that foods are safe.

Read the sidebars: What Is an Operational Prerequisite Program? and Definitions

John G. Surak, Ph.D., is the principal of Surak and Associates and provides consulting on food safety and quality management systems, auditing management systems, validating manufacturing processes, designing and implementing process control systems and implementing Six Sigma and business analytics. His Web site is www.stratecon-intl.com/jsurak.html. He can be reached at jgsurak@yahoo.com.

Richard F. Stier is a consulting food scientist with international experience in HACCP, food plant sanitation, quality systems, process optimization, GMP compliance and food microbiology. Stier has worked in Asia, Africa, Australia, Central and South America and Europe. He has done projects in over 30 countries.

References:
1. ISO, 2005. ISO 22000: Food safety management systems—Requirements for any organization in the food industry. (International Organization for Standardization, Geneva, Switzerland).

2. BSI, 2008. PAS 220:2008: Prerequisite programmes on food safety for food manufacturing. (British Standards, London, UK).

3. www.almondboard.com/Programs/content.cfm?ItemNumber=890&snItemNumber=450.

4. Codex, 2008. CAC/GL 69: Guideline for the Validation of Food Safety Control. (Codex Alimentarius Commission, Rome, Italy).
 

What Is an Operational Prerequisite Program?
oPRP is a term unique to ISO 22000.1 In many ways, the oPRPs are similar to the Control Points (CPs) that are present in the U.S. definition of HACCP. Codex, and thus, the rest of the world, does not define CPs in their HACCP literature.

oPRPs are identified by the hazard analysis. If a loss of control occurs, actions need to take place to bring the process back into control. However, controlling an oPRP does not prevent or eliminate a food safety hazard or reduce it to an acceptable level. Controlling an oPRP does reduce the likelihood of introducing a food safety hazard or the proliferation of an existing food safety hazard in the products or the processing environment. oPRPs must be validated, verified and monitored to ensure effectiveness of the food safety system. For example, a poultry further-processing plant purchases boneless chicken breasts and processes them into a ready-to-eat product. As part of the food safety control plan, there is a receiving specification that requires that all raw chicken breast be received at temperatures less than 40 °F. In addition, the processing specification requires that chicken be cooked in an oven to a minimum of 185 °F before freezing and packaging. The receiving temperature could be classified as an oPRP, and the final cook temperature would be a CCP.
 

Definitions
The terms validation and verification can be confusing terms. Part of this confusion may be caused by the way Codex is currently codified. In the current seven principles of HACCP, validation is classified as a subset of verification (Principle 6). In 2008, Codex Alimentarius issued a validation standard that separates the principles of validation from verification. ISO 22000:20051 formally separated the concepts of validation from verification. The ISO 22000 uses the following for validation, verification and monitoring:

Verification is conformation through the provision of objective evidence that specific requirements have been fulfilled.

Validation is obtaining evidence that control measures managed by the HACCP plan and by the operational prerequisite programs are capable of being effective.

Monitoring is conducting a planned sequence of observations or measurements to assess whether control measures are operating as intended.