Thermal Process Validation: The HACCP Records Auditors Need
How Article 5 requires documented review after product or process changes.
A 90°C for 10 minutes heat treatment, or equivalent lethality at the slowest-heating point, is one control identified by the Food Standards Agency for non-proteolytic Clostridium botulinum in certain chilled vacuum-packed and modified-atmosphere-packed foods with a shelf-life above 10 days.
That figure illustrates what auditors need from thermal process validation food safety records: a defined hazard, a justified safety target, proof that the least-treated product achieves it, and routine records confirming that production stayed within the validated conditions.
A displayed oven temperature, pasteuriser setpoint or retort programme is not enough. Product size, loading, pack format, initial temperature, viscosity, flow rate and equipment position can alter the treatment the food receives. Thermal validation establishes the technical basis for a HACCP critical control point. Monitoring then proves that each batch or continuous run met that basis.
For technical managers and HACCP leads, the task is to create an evidence trail linking the hazard analysis to the product on the factory floor.
What UK HACCP law requires from thermal process records
Regulation (EC) No 852/2004 requires food businesses to put in place, implement and maintain permanent procedures based on HACCP principles. Article 5 requires businesses to identify hazards, determine critical control points, establish critical limits, monitor those limits, take corrective action, verify that controls work, and maintain appropriate documents and records.
In England, the Food Safety and Hygiene (England) Regulations 2013 provide the domestic enforcement route for these requirements.
Article 5 also requires review and necessary changes when a product, process or process step changes. Businesses must keep HACCP procedure documents up to date and retain records for an appropriate period. Thermal validation is therefore central to HACCP compliance, not simply a commissioning exercise.
Validation, monitoring and verification are separate activities
Factories sometimes hold extensive daily temperature charts yet cannot show why the selected critical limit controls the relevant hazard. That usually means validation, monitoring and verification have been merged into one poorly defined activity.
| Activity | Question answered | Typical evidence |
|---|---|---|
| Validation | Can the defined process control the identified hazard? | Temperature distribution study, heat penetration data, process rationale |
| Monitoring | Did this production run meet the critical limit? | Batch record, chart-recorder trace, operator check |
| Verification | Does the HACCP system remain effective over time? | Record review, calibration review, audit, trend analysis |
Validation comes first. It establishes that a specified process, operated within a defined envelope, achieves the intended safety outcome. Monitoring captures production evidence against that approved process. Verification checks whether the system continues to operate as intended.
A pasteuriser outlet-temperature chart does not validate a process by itself. The business needs evidence that the probe location, product flow, holding time, product properties and control arrangements deliver the required treatment to the food.
Change review must protect the validated process
A HACCP review should follow any change that could affect heat transfer, lethality, cooling or post-process contamination risk. Relevant changes include:
- New recipes, ingredient suppliers or particle sizes
- Different fill weights, pack formats, closures or headspace
- Revised oven, retort, pasteuriser or cooling programmes
- Altered belt speeds, pump rates, retort loading patterns or agitation settings
- Probe relocation, control-system replacement or significant equipment repair
- New shelf-life claims, storage conditions or packaging methods
The review record should identify whether the change remains within the validated process envelope. Where it does not, additional validation must take place before routine production resumes. A statement that a change is low risk has little value unless the record explains its technical basis.
Map every energy and material flow in your process with detailed heat and mass balance calculations — the foundation for any optimisation or design project.
Start thermal process validation with the food-safety target
Thermal process validation food safety starts with a defined hazard and safety objective. The target must fit the product formulation, packaging, intended storage conditions and shelf-life.
A chilled ready-to-eat meal may require control of vegetative pathogens. A low-acid food in a hermetically sealed pack requires consideration of spore-forming organisms and commercial sterility. For chilled vacuum-packed or modified-atmosphere-packed food, non-proteolytic C. botulinum can determine both the required heat treatment and permitted shelf-life.
Records that define the validation basis
The validation protocol should document the following before testing begins:
- Product description and intended use
- Full formulation, including pH, aqueous-phase salt and water activity where relevant
- Pack specification, fill weight, headspace and closure method
- Storage, distribution and shelf-life conditions
- Hazard analysis and target organism or safety outcome
- Required time-temperature treatment or equivalent lethality
- Technical justification for the target
- Process conditions that the study will test
For chilled VP/MAP foods with a shelf-life above 10 days, FSA guidance identifies possible controls for non-proteolytic C. botulinum. These include a heat treatment of 90°C for 10 minutes, pH of 5.0 or below, aqueous-phase salt of 3.5% or above, water activity of 0.97 or below, or a demonstrated combination of controls that prevents growth and toxin production.
Those values are not interchangeable settings. A product’s formulation, heat-transfer behaviour and storage conditions determine whether a particular control applies. Where a business relies on an alternative time-temperature combination or combined hurdles, the dossier must demonstrate that the approach delivers the required outcome.
Define worst-case conditions before the study
Auditors will ask whether the study represents the least favourable conditions likely in routine manufacture. A thin product layer, lightly loaded oven or favourable pack position does not prove control at the edge of normal operation.
For an oven, worst case may involve the largest product piece, maximum loading, lowest permitted product inlet temperature, coldest belt position and minimum permitted steam condition. For a retort, it may involve the coldest basket position, maximum fill weight, most viscous formulation and approved loading configuration. For a continuous pasteuriser, maximum permitted flow rate and the lowest inlet temperature may be significant.
The protocol should declare these conditions before data collection. The report should explain any deviation, repeat run or excluded result.
Temperature distribution and heat penetration records
Thermal equipment can underperform in two distinct ways. Heat may not be distributed uniformly through the equipment, or the product may not absorb heat rapidly enough. Validation records must address both risks.
Temperature distribution identifies the coldest equipment position
Temperature distribution studies map conditions within a process zone. They identify cold areas, variation between positions and the repeatability of the heating or cooling environment.
In a retort or tunnel pasteuriser, the study can identify the least severe basket, lane or zone before product testing begins. In a multi-zone oven, mapping can identify variation between belt edges, rack positions, zones and production loads. In a cooling operation, it can expose locations where products cool more slowly.
A temperature distribution report should include equipment identification, process settings, actual operating conditions, sensor placement, calibration status, loading pattern, data-logging interval, raw readings and the identified coldest position. It should also record deviations and authorised conclusions.
Temperature distribution does not demonstrate product lethality. It establishes where process conditions are least severe.
Heat penetration shows what happens inside the food
Heat penetration studies measure product temperature through the full process. They should focus on the slowest-heating point under the declared worst-case conditions.
That point is not automatically the geometric centre. Product composition, viscosity, particulate distribution, container geometry, headspace, orientation and convection can move it. A layered prepared meal, thick sauce and particulate soup may each heat differently.
The report should record the product batch, formulation, initial product temperature, fill weight, pack type, seal or lid, probe insertion method, loading arrangement and equipment settings. It should preserve the heating and cooling profiles and compare the cold-spot outcome with the approved safety target.
Campden BRI Guideline G74 provides a relevant industry reference for validation of cookers, pasteurisers and sous-vide systems. It distinguishes equipment temperature distribution, product heat penetration, cooling and continuing process records.
Build a clear record hierarchy
A well-organised dossier gives an auditor a direct route from the hazard analysis to an individual production batch:
- The approved validation protocol defines what will be tested and why.
- Raw data files preserve the original measured values.
- The technical report interprets the results against the safety target.
- The HACCP plan sets the critical limit, monitoring method and corrective action.
- Routine production records show continuing control.
Version control matters. An obsolete process specification, a revised programme with no change assessment or a validation report referring to discontinued packaging weakens the evidence chain.
Retort, hot-fill and hermetically sealed food records
Annex II, Chapter XI of Regulation (EC) No 852/2004 applies to food placed on the market in hermetically sealed containers. It requires heat treatment to bring all parts of the product to a specified temperature for a specified time and to prevent contamination during processing.
Food businesses must regularly check relevant parameters, particularly temperature, pressure, sealing and microbiology, including through automatic devices.
Retort documentation must cover the complete cycle
A retort dossier needs more than a temperature chart. Pressure control, venting, come-up, loading configuration, cooling and pack integrity can affect the safety conclusion.
Auditors commonly expect records covering:
- The authorised process specification and programme version
- Retort temperature and pressure records for each cycle
- Correct programme selection and equipment identification
- Loading pattern, basket arrangement and pack orientation
- Venting details where applicable
- Temperature-indicating device checks and calibration records
- Closure or seal-integrity checks
- Cooling controls and prevention of post-process contamination
- Deviation, product-hold and release decisions
- Trend reviews of alarms and recurring cycle variation
The validation applies only to the specified product, pack, fill, loading pattern and programme. A larger pouch, altered tray, revised headspace or more viscous recipe may change heat transfer or pack behaviour enough to require reassessment.
Hot-fill records must demonstrate pack-surface treatment
Hot filling uses heated product to treat the inside of the container and closure. A satisfactory product outlet temperature does not prove that the least-heated pack surface received the intended treatment.
A hot-fill validation should record the lowest permitted fill temperature, filling and closure sequence, pack orientation where relevant, contact period at pack surfaces, product acidity and cooling conditions. Where a tunnel pasteuriser contributes heat after filling, the validation should quantify that contribution under worst-case conditions.
Routine records must capture the variables that represent the validated process. If safety depends on an inversion period, fill-temperature records alone do not demonstrate control.
Map every energy and material flow in your process with detailed heat and mass balance calculations — the foundation for any optimisation or design project.
Cooling validation completes the thermal food-safety case
A heat step does not complete the HACCP case if cooling permits growth or post-process handling reintroduces contamination. Cooling requires the same structured validation as cooking or pasteurisation.
Prove the slowest cooling conditions
Cooling performance can vary with product mass, fill depth, pack geometry, batch loading, initial temperature, air circulation and chiller condition. The validation should establish:
- Maximum permitted delay before chilling starts
- Product positions that cool most slowly
- Time and temperature profile to the required endpoint
- Maximum batch size and loading pattern
- Chiller performance at realistic production loading
- Routine monitoring method and frequency
- Corrective action when cooling is delayed or the endpoint is missed
For cook-chill products, the cooking record, cooling profile, chilled storage condition and release decision should remain traceable to the same batch. A cooling sheet with no batch link provides weak evidence during a complaint, audit or incident investigation.
Control post-process contamination
A validated heat treatment can be undermined by poor segregation, condensation, contaminated cooling water or unsuitable pack handling. The HACCP plan should identify the controls that preserve the safety outcome after processing.
For hermetically sealed food, that includes closure integrity and cooling controls. For products handled after cooking or pasteurisation, relevant controls may include hygienic transfer, sanitation, time before packing and environmental management. The HACCP team must define whether a control is a critical control point, operational prerequisite programme or prerequisite programme, then document why that classification fits the hazard.
The HACCP records auditors will expect
Auditors need records that are complete, legible, current and traceable. Electronic records can support rapid retrieval and trend review, provided access control, review, corrections and retention are managed properly.
| Record | What it demonstrates |
|---|---|
| Current HACCP plan | Hazard analysis, CCP decision, critical limit, monitoring and corrective action |
| Validation report | The process achieves the required safety outcome under defined worst-case conditions |
| Approved process specification | Product, pack, loading and settings within the validated envelope |
| Calibration records | Temperature, pressure and timing measurements are reliable |
| Routine batch or continuous-process record | Production met the applicable critical limit |
| Deviation and corrective-action record | Affected product was identified, assessed and controlled |
| Verification records | Reviews, audits and trends support continuing control |
| Change-control record | Product or process changes were assessed and validation was reviewed |
| Training records | Operators and reviewers understand their responsibilities |
Each record should show the date, product or batch identifier, equipment identity, actual result, acceptance criterion, responsible person and review status. Missing time periods, overwritten entries, unexplained alarms and unsigned checks are common audit concerns because they interrupt the evidence trail.
Deviation records need a technical conclusion
A deviation record should establish what happened, how long it lasted, which product was affected and whether the validated critical limit was met. Recording that an alarm occurred is only the start of the investigation.
The assessment should document the measured time, temperature, pressure or cooling profile; product quantity and codes; containment actions; technical assessment; authorised disposition; root cause; corrective action; and an effectiveness check. The review should also determine whether the event exposes a weakness in the HACCP plan, process specification or validation.
Thermal process validation records must join up
Thermal process validation food safety depends on a consistent relationship between hazard, safety target, validated process, routine monitoring and response to failure. Auditors need evidence that the process running on the line matches the process shown to control the hazard.
The record system must show which hazard is controlled, what treatment is required, where the worst case occurs, how each run is checked and how the business controls product when the process falls outside the validated limit.
This article reflects the independent analysis and editorial opinion of EnerTherm Engineering. Product names, trademarks, and brands mentioned belong to their respective owners. EnerTherm Engineering is not affiliated with, endorsed by, or a licensee of any third-party software or product mentioned unless explicitly stated.
Technical Manager — EnerTherm Engineering
John Naranjo is Technical Manager at EnerTherm Engineering, bringing specialist expertise in chemical and environmental engineering. He recently led the implementation of Omni Vision, EnerTherm's real-time energy and utility monitoring platform. He holds an MSc in Environmental Engineering from the University of Huelva and a BSc in Chemical Engineering, with memberships in both the Energy Institute and IChemE.
