Annual Review Finds a Plan That Was Never Validated

Validation (obtaining evidence, before the activity, that the control measure can achieve the intended outcome)

• (a) The file supports a different, thinner product. Validation is product- and process-specific. Heat penetration depends on thickness, mass, composition and load configuration, so evidence for 40 mm and 120 g does not validate 55 mm and 180 g. This matters more than any of the other findings because everything else rests on it: if the cooking step is not validated, the critical limit of 74°C has no demonstrated lethality behind it.

Verification (confirming, by objective evidence, that the plan is working)

• (b) 47 days of exactly 74.0°C is a pattern, not a coincidence. It suggests the target is being reached and recorded rather than measured at the true cold spot, or that values are rounded or copied. Nobody reviewing the records caught it, which is also a verification failure.
• (c) Checking a probe against itself is circular and verifies nothing. The reference must be independent and traceable, and the check must include an ice-point or comparable fixed point.
• (d) A corrective action without disposition does not close. A deviation record is complete only when someone has decided what happened to the product and someone else has verified that decision.
• (b) through (d) together show that verification was a paper exercise: it happened on schedule but changed nothing.

Recordkeeping

• (e) Records outside the HACCP record system cannot be reviewed, trended, or used in a verification decision. Environmental results are part of the evidence base for an RTE plant and belong in the plan's records, even though environmental monitoring is a prerequisite activity, not a CCP.

Answering "they are all recordkeeping problems" misses the point. The distinction determines the remedy: validation needs evidence, verification needs a reviewer with authority, and records need control.

It is not validated. A generic reference to 74°C does not demonstrate lethality for this product, because lethality is a function of time and temperature, and the cold spot in a 55 mm, 180 g piece needs come-up time that a 40 mm piece did not.

To close the gap, the plant needs:

1. Heat penetration data for this product. Thermocouples in the cold spot of the thickest, largest piece, under the worst-case load in the oven, showing come-up and the time spent above the target temperature. Do this at the lowest oven setpoint permitted by the process.
2. A lethality basis. Either a documented time/temperature schedule for Salmonella in chicken with a justification for how the accumulated lethality of the come-up plus hold meets it (for example an accumulated lethality calculation rather than a single end-point reading), or an inoculated pack or surrogate study. The reasoning must be written down, not just cited.
3. A critical limit expressed in measurable terms that match the evidence. If the evidence supports 74°C plus a defined hold, the record must capture the hold time, or an equivalent such as 71°C for one minute, whichever the data support.
4. Worst-case boundaries. Define the maximum piece weight and thickness the validation covers, and revise the plan if product size changes.

Until this is done, the plant has two defensible interim options. Either adopt a conservatively longer schedule that is supported by published lethality tables with a written rationale, and monitor time as well as temperature, or treat affected production as unvalidated and hold it. What it cannot do is keep signing records against a limit it cannot defend. This is a revalidation, and it should be signed off before the next production run of the 55 mm product.

Output of the review. A written report with each finding, its risk ranking, a corrective action with owner and date, and a conclusion on whether the plan must be reassessed and revalidated. The review itself is a verification activity; if it ends in a list of observations with no decisions, it has failed. Escalate the validation gap (a) as the priority item, since the other findings sit on top of it.

The 47 records. Do not accept them as valid evidence of a met critical limit. Handle them as a records-based risk assessment:

• Trend them first. Are they clustered on particular operators, shifts, ovens, or product sizes? Clustering points to a behavioural or equipment cause and narrows the population of concern.
• Record the assumption that these are potential deviations, and assess exposure. If the underlying validation, once completed, shows the accumulated lethality at 74°C is comfortably sufficient even without a hold, the risk may be low; if not, the population needs individual evaluation.
• Fix the form. Require time at temperature, a second reading, and a cold-spot probe position, and add a review step with a reviewer who must initial the record.
• Only if the trend analysis and the completed validation together show a plausible safety gap should withdrawal or recall be considered. Say so explicitly and record the reasoning, because "we decided not to" without a rationale is the finding an auditor will write up.

The nine deviation records. Complete them retroactively: product disposition, who decided, who verified, and the basis for each. Record that the decision was made late, and say why. Then change the workflow so that release is blocked until a disposition and a verification signature exist. Add the nine records to the trend analysis alongside the 47, since both speak to whether the cooking step is actually being controlled.