Allergen Cleaning Change on a Shared Cookie Line: Validation Versus Verification
A bakery makes two cookie lines: one containing milk powder and one labeled 'milk-free.' Both run on the same conveyor and depositor. The allergen preventive control is a wet cleaning procedure followed by a quaternary ammonium sanitizer and an ELISA swab for milk on food-contact surfaces. The cleaning validation study, performed two years ago, used the quaternary ammonium sanitizer and showed milk protein below the ELISA limit of detection (5 ppm) after worst-case runs. Because of a sanitizer shortage, the bakery switches to a peracetic acid-based sanitizer. The cleaning detergent, contact time, and swab locations are unchanged. Three consecutive changeovers after the switch show milk swabs below 5 ppm. Production wants to skip revalidation and rely on the three swab results. The PCQI also learns that the swab locations do not include the conveyor's worn edge, where product buildup has been observed.
1. Does changing the sanitizer require revalidation of the allergen preventive control? Explain the difference between validation and verification in this scenario.
Read the worked answer
Not every change automatically requires revalidation, but this change requires a documented revalidation decision. The allergen preventive control depends on cleaning and sanitizing to remove milk protein. Changing the sanitizer can affect protein removal, surfactant action, or residue, even if the detergent and contact time are unchanged. The original validation was specific to quaternary ammonium; the firm cannot assume equivalence without evidence.
Validation asks whether the control, as designed, can consistently achieve the intended effect-here, removal of milk allergen to below a health-relevant level. Verification asks whether the control is working day to day-the ELISA swabs are verification. Three swabs are verification data, not a validation study.
The PCQI should either revalidate with peracetic acid, including worst-case product, worn equipment, and hard-to-clean locations, or document a scientific basis for equivalence. Until then, the change should be treated as unvalidated.
2. The three swab results are below the ELISA limit of detection. How much weight should they carry? What additional verification or validation would you require?
Read the worked answer
Three swab results below 5 ppm are useful but limited. ELISA has a detection limit and may not detect allergen at low but clinically relevant levels; swab recovery depends on the surface and technique; and three changeovers may not cover worst-case buildup, different product matrices, or the worn conveyor edge. The fact that the swab locations omit the worn edge is a gap: the worst-case location should be included.
The results do not prove that the peracetic acid procedure is capable; they only show that those three sampled areas passed at that time. Additional work should include:
- A validation challenge with the new sanitizer.
- Sampling the worn edge and other hard-to-clean sites.
- Repeating over multiple production runs.
- Confirming the ELISA method is suitable for the surface and allergen.
If validation is not done, the firm should use the old validated sanitizer or add a validated cleaning step. The PCQI should also verify that swab results are reviewed and that corrective actions are taken for any positive.
3. What records must be created and retained, and what triggers reanalysis?
Read the worked answer
Records should include the validation protocol and report, the scientific basis for the sanitizer change, the cleaning procedure, sanitizer concentration and contact time, monitoring records such as visual inspection and detergent concentration, verification swab results with locations and limits, corrective actions for any failures, training records, and the reanalysis decision. The food safety plan should be updated if the change is validated.
Reanalysis is triggered by a significant change in the cleaning or sanitizing procedure or a change that could affect the allergen control; the switch to peracetic acid is such a change. Reanalysis is also triggered if verification shows the control is not effective-for example, a positive swab at the worn edge.
The firm should retain records for at least two years, or longer if required by other regulations, and make them available to FDA on request.