For many food products, validating and verifying a process sounds like a simple task if the product has been made for years and is considered very safe. In many of these cases, one immediately thinks about the time and temperature of a cook step. In other cases, one might think there is no process because the product is not heated or subjected to a heat treatment. As we discuss below, even in these cases, there is a process or procedure for making the product that can be validated and verified. In some cases, the cook step has been replaced by an alternative kill step such as ultrahigh pressure treatment or radiation. In others, the drive for fresher, less-processed foods has resulted in many products without a recognized kill step. We will thus consider how to verify and validate any process, including some of these nontraditional processes. Unfortunately, this discussion is not the final answer regarding process validation and verification, because accepted best practices are still evolving and the regulatory framework is not fully in place. It is likely that this discussion will raise more questions than answers.

Some Definitions
Before moving on to discuss some examples, it is appropriate to establish the scope of this discussion with some explanatory definitions. First, validation of a process is the collection of knowledge and experience that allows one to know how to produce a safe food product, which must allow identification of the potential hazards and concerns. It must also provide the tools and metrics for monitoring and controlling these hazards and concerns. For this discussion, we will largely ignore the quality aspects that can impact processes. Second, verification is the process by which one can know that a process is operating as designed. For this term, verification is a process because it must be an ongoing effort that monitors the validated process while product is produced. Finally, a food process includes everything that can impact the safety of a food product. A food process extends from field to fork. It must address all reasonable potential hazards.

Due to space constraints, it is impossible to consider all types of food manufacturing processes. A mental walk through the grocery aisles and departments should draw up pictures of the deli, frozen food cabinets, canned aisle, baking supplies, snack foods and many more. Each class of products brings its own manufacturing challenges. Instead of trying to be overly general, some specific products will be considered to illustrate the general approach and stimulate thought. This discussion refers to suppliers and internal efforts as convenient for the narrative. These assignments do not reflect how a product is produced by a particular supplier.

Canned Pineapple Juice—A Traditional Product
To set the stage, we can consider a traditional product, canned pineapple juice. This is a product with a long history of “safe” manufacture, and there is a large body of experience and knowledge regarding the process. As such, one might expect it to be very easy to develop a validated process and establish procedures to verify that the process was done properly. However, I believe that the following discussion of some of the process parameters and control features will dispel the notion that this is a simple process and set the stage for discussing situations where knowledge of a product is more limited and there is greater uncertainty. To be brief, the following narrative about canned pineapple juice will not focus on specific numbers and specifications. It will instead highlight where metrics and standards of performance are needed.

For canned pineapple juice, the key ingredient is generally pineapple juice concentrate to avoid shipping water. The product could be made at the source from pineapple juice, but we need only consider the more common path from concentrate for this discussion. Pineapple juice has a standard of identity whose provisions must be met when the concentrate is diluted to juice. Other attributes also must be considered, including the presence of heat-resistant mold or Alicyclobacillus. High nitrate levels are also important. Nitrate is important as a depolarizer that can cause toxic levels of dissolved tin. Pineapple is a nitrate accumulator, so the fertilization regime is an important factor in determining the nitrate level of the concentrate. One needs specifications or metrics for these parameters to ensure that the canned product is not negatively impacted and ways to ensure that affected concentrates do not enter the process. Obviously, there are numerous quality specifications such as Brix acid, degree of oxidation and levels of insoluble solids that also need to be considered, but these are largely quality aspects that are outside the scope of this discussion. Nevertheless, we have identified concerns that force the verification process to start in the field or at least prior to the processing plant.

The water used for reconstituting the juice will be the largest volume of the product. The product will be heat-processed, but a heat process will not remove all the potential hazards. Heavy metals and various organic materials must be considered. These concerns often motivate processors to use municipal water supplies, where these hazards are presumably managed. However, one should consider the potential for a failure on the part of the water supplier. How can we ensure that such a failure has not happened?

For the primary package, the can, there are also a number of concerns including the integrity and oxygen barrier properties of the pull tape, the absence of thin spots in the tin coating of the steel and the quality of the seams and the side weld. If the oxygen barrier is inadequate, heat-resistant mold spores can grow in areas proximal to the peel tape. Imperfections in the tin coating can lead to spot corrosion and pinholing. Presumably at this point, the tin plate is made with low-lead tin to avoid this reproductive toxicant. Do we simply trust the supplier that all of these concerns are covered, or should we be doing some of our own verification?

The can, concentrate, water and probably vitamin C need to be put together in the portion of the effort that is normally considered a process. There is a blending operation that must ensure the right proportions of all the components. Foreign materials are not appropriate. The materials need to be mixed to homogeneity and kept homogeneous during the filling operation to ensure that the insoluble solids and other components are evenly distributed throughout the production lot. If the operation is continuous, this can be even more difficult. The blended juice should be deaerated to avoid exposing the steel of the can to higher-than-normal detinning. The blended product must then be heated to a steady temperature and delivered to a filler. The appropriate temperature is selected based on a challenge study and perhaps the D- and z-values of a particular organism. Fortunately, pineapple juice is an acid product, avoiding the complications of pressure retorting to control botulism. It is desirable to minimize the extra time that juice is at this elevated temperature but critical that no cans are filled at lower than the target fill temperature. The headspace of the cans must be flushed with steam and/or nitrogen to minimize oxidation and detinning. This is especially important with the reduced tin layers in use today. Finally, the cans must be cooled after an appropriate amount of time to preserve product quality.

After this quick tour of the concerns that must be encompassed by the validation effort to produce this product, we need to remember that for each concern, we wish to have a verification process. We need to somehow monitor and control metrics for each of the concerns or potential hazards mentioned above to ensure that the validated process has been executed. Sometimes, this means ensuring that a best practice is being followed, such as the fertilizer regime to control nitrate in the fruit. Even with this type of control, it is probably prudent to monitor the nitrate level in the incoming concentrates as a secondary check. The nitrate in the concentrate is an analytical check and is not really amenable to continuous assay. It will be important to determine the appropriate number of tests to avoid problems. It may be necessary to test each lot or perhaps each bin, depending on how variable this metric proves to be. A similar process is needed for all of the noncontinuous measurements. This type of reasoning applies to the blending process. It is good to assert that the blending process is under control, but it must be verified as well. The verification should probably include at least vitamin C determinations and Brix. Brix can be monitored as a flow measurement, but vitamin C determinations are best done as discrete measurements.

Some metrics are hard to monitor directly at process. Sometimes, there are indirect measurements that can be followed at the time of process, but for others, time is required. In these cases, it is prudent to have a retain program and confirm the desired product performance has been achieved. Given the 2- to 3-year shelf life of canned pineapple, there are options that can be taken if certain lots should be moved faster through the marketplace. However, it is always better to avoid such issues. Headspace oxygen is an example of this type of concern. Steam pressure and/or nitrogen flow when the can is being sealed are indirect measurements of the process that can be monitored to show that the process is operating as intended. The headspace oxygen is almost immediately consumed by reaction with the product and with the tin of the can during the thermal process. Thus, the damage is done and the headspace oxygen is gone, preventing later analysis. One can measure only the results of excess oxygen: for example, increased levels of dissolved tin and the loss of vitamin C. If the oxygen levels are extremely high, premature color change is also observed.

A Dry Beverage Mix—A Less-Processed Product
Turning our attention to a “nonprocessed” traditional product, let us consider a powdered, fruit-flavored beverage mix. A product of this type is a dry mix of sugars, organic acids, flavors and color components, colloids and perhaps some preservatives. The safety and purity of the ingredients must head our list of concerns. Our suppliers can hopefully convince us that they have done their job correctly. The key checkoff is to know that it is done. If we mix these ingredients under hygienic conditions to avoid contamination, the product should be safe. How do we verify hygienic conditions? Environmental and equipment swabs? Is the product tested directly for pathogens or indicator organisms? The correct answer is probably some mix of all of the above. Fortunately, the low moisture content of a dry powder will not support microbial growth. However, what happens after the product is prepared for consumption? Will the diluted beverage support microbial growth? The question of how do we verify that we have faithfully executed a safe process for this product will take some thought. The tendency to try to just test the product fails to recognize the limited value of negative testing results. As proof of safety, the value of a pathogen test that shows less than some number of colony-forming units (CFUs)/g or a presence/absence test showing no pathogens in a larger sample is of limited benefit on a lot-by-lot basis or for releasing lots. It is not practical to test enough product to show safety. However, in aggregate, such testing can help verify that a process is functioning normally.  

A Cold-Brewed Product—A Modern Product?
Moving on, we can consider a much less traditional product, a shelf-stable, cold-brewed beverage. Many of the hazards will be similar to those for the canned juice above. Water is again an important ingredient. However, in this case, it will not receive a thermal process. The material to be extracted must be free of foreign material. And the package must be appropriate. These are the normal hazards of a beverage process and can be addressed in normal ways.

The challenge for this process is addressing the microbial hazards without a thermal process. The most direct avenue for controlling this hazard would be an alternate kill step such as ultrahigh pressure or a chemical treatment. This kill step could be validated with an appropriate challenge study. Such a kill step would make the validation and verification process similar to the canned pineapple juice process in the first example. This process becomes much more interesting to consider if an alternative kill step is not included.

When considering a beverage without a kill step, one must remember that Pasteur was right: Spontaneous generation does not occur. Microorganisms can be killed, removed or excluded. Without a kill step, a process must consider removal and exclusion. For our cold-brewed product, the ingredients and therefore the cold-brewing process can be clean but probably not sterile. This necessitates a removal process or another control mechanism. The common choice is microfiltration, which removes particles as small as the organisms of interest. This filtration process must be verified in some way. This is usually done after a batch has been filtered by demonstrating that the filter is intact. Is filter integrity a pass/not pass test or is it a continuous variable? A processor using this technology must address this verification need. The filter supplier should be very helpful in this area. If the product will not support microbial growth, it is advantageous as a second hurdle.

This sterile-filtered beverage needs to be packaged. A variety of packages and filling systems are available. Any such system must be validated to ensure that it excludes microorganisms. This is challenging because it is hard to prove a negative. One can test and swab and always get negative results, but this will not guarantee that microorganisms have been excluded. Nevertheless, a processor needs both validation and verification of this portion of their process. Here again, the equipment supplier should have metric and verification tools.

Ready-to-Eat Spinach—A Bigger Challenge
To further increase the challenge, we can turn our attention to a product where neither a removal step nor a kill step is available. Value-added produce falls into this category. For this discussion, we will consider washed, ready-to-eat spinach. In this process, we must rely on exclusion to do the heavy lifting. We have limited ability to kill bacteria. This means that the whole process must work in concert.

Given that spinach is the only ingredient in this product, it is important to ensure that foreign matter is not commingled with the spinach at harvest. There is an opportunity to sort out foreign matter at the processing plant, but it is better to prevent such materials from entering the plant. There must be a full working Good Agricultural Practices (GAP) program in place. This science-based program will limit the maximum average level of pathogens that can enter the processing plant by controlling identified and potential causes of infection. All aspects of the GAP program must be verified. Testing programs to monitor the effectiveness of the GAP program are the norm and are expected to detect an extreme breakdown of the program. Most testing programs are N = 60/c = 0 programs where sixty 2.5-g specimens are collected and composited for a presence/absence test. With one sample, this testing will ensure with a 95 percent confidence interval that not more than 5 percent of specimens will exceed 1 CFU/2.5 g of the pathogens of interest to the extent that the sampling represents the lot from which it was taken. Fortunately, GAP programs are largely effective, resulting in very few positive tests and a very low general background for pathogens. However, a strong argument can be made for increasing the preharvest testing in lieu of testing later in the process to reduce the potential maximum average infection level entering the processing facility. The sensitivity of a testing program is tied to the number of grams tested that are used to make each decision. Therefore, lots of tests do not necessarily provide a good program. Multiple tests to make a decision will provide more assurance that an exceptional infection is detected and rejected.

In the processing plant, the spinach is washed and dried before packaging. The wash system has some ability to reduce pathogen load, but its most important role is dirt or grit removal, which must occur without allowing cross-contamination. There are no generally recognized procedures for validating and verifying wash systems. There is no generally recognized procedure for measuring cross-contamination. This is in sharp contrast to the body of knowledge regarding heat penetration and thermal lethality. There are numerous experts to design challenge studies for thermal processes. The measurement of cross-contamination is critical for validating its control. Unfortunately, given the current state of knowledge, it is likely that these procedures will need to be applied to the actual equipment in use, because extrapolation to other systems is beyond our understanding at this time. This may mean developing tests that can be run in actual processing plants where inoculated studies are not a good choice.

In terms of validating a wash system, there are some generally accepted parameters. The sanitizer level and pH are critical for chlorine-based systems. The presence of wash adjuvants can substantially alter the wash system efficacy. Manual dosing of chlorine fails when organic loads exceed the ability of manual dosing to sustain the desired chlorine levels. Automated control and dosing can overcome this limitation and mitigate the impact of organic load. Monitoring pH and chlorine continuously may be necessary to verify that a validated process has been done. However, the chlorine level necessary to control cross-contamination is not defined because there is no standard metric to measure cross-contamination. The idea that cross-contamination should not be detectable is an untenable standard. With most-probable-number procedures and other techniques, detection limits are quite fluid.

There are three candidate approaches for verifying the performance of a wash system with regard to cross-contamination control. Each approach relies on knowledge that is not yet available. The most direct approach is confirming that a wash system controls cross-contamination directly under the most challenging conditions expected to be used and showing that these most challenging conditions are never exceeded. To apply this approach, one needs to measure cross-contamination, a problem as mentioned above, and understand the most challenging conditions. A direct approach for measuring cross-contamination based on using a 1 percent-inoculated contaminant that is distinguishable from the product is showing great promise as an assay for cross-contamination on a research basis but is far from a standard procedure. The most challenging conditions are still far from defined. A second verification concept would be to show that all places in a process line exceed some chlorine level under all operating conditions. This chlorine level is undefined and cannot be defined until there is a standard procedure for measuring cross-contamination. There are some people who argue that 10 ppm is this critical level. However, the data are exceedingly weak. Finally, if one can show that all chlorine levels across a wash system track the level at a control point and then maintain the chlorine level at the control points to some undefined level, this would verify that the wash system is operating as designed. All three of these approaches have scientific merit, but at present, the validation data are lacking to set the control parameters.

Given that this process relies heavily on exclusion, other aspects of the process become more important and challenging. The transportation system for bringing product from the field to the plant is an area of potential concern. The plant environment and personnel are of concern. The validation effort must include these areas so that the verification process can also include them. These will be challenging as we are proving the negative. All concerns and hazards must be addressed. 

Parting Shot
Finally, we can consider a vertical urban farm where a leafy green is grown in a controlled environment. The process in this case is to exclude pathogenic microorganisms throughout the growing cycle and avoid contamination at harvest. Again, Pasteur was right, so the process should work. However, validation is challenging because it will all be about proving negatives. There is no amount of testing that can prove the system is working. One can achieve a practical validation over time, but there will be lingering doubts. In fact, at some point, it is likely that a pathogen will be found on the product if enough testing is done.

Going back to the basics, the safe manufacture of food products requires diligence and follow-through. It requires recognizing the scope of the process, including all aspects from field to fork. The steps are easy to summarize:

•    Identify the hazards or concerns

•    Identify the control mechanisms that can mitigate the hazard

•    Identify how to confirm that control mechanisms are operating

•    Implement the control mechanism and the monitoring systems

Steps 1 and 2 are the validation process. Steps 3 and 4 are the verification process. Unfortunately, as with many things, it is too easy to lose track of the big picture when there are so many details to track. However, this is our job. The food industry is doing it well and is striving to continually do better. Those manufacturers that do not keep up with the rising standards of validation and verification will fail.   

Eric Wilhelmsen, Ph.D., is an Institute of Food Technologists-certified food scientist, serving over 30 years in academic and industrial positions. He can be reached at the Alliance of Technical Professionals.