21 CFR 117.155 requires covered food facilities to conduct verification activities to confirm that preventive controls are consistently implemented and effectively controlling the identified hazards. Verification is distinct from monitoring: monitoring is the routine real-time check that a control is being applied; verification is the higher-level confirmation that the monitoring system itself is working and that controls are effective.
Required Verification Activities
Under 21 CFR 117.155, verification activities include:
1. Calibration of Process Monitoring Instruments
Equipment used to monitor critical limits (thermometers, pH meters, water activity meters, scales) must be calibrated at specified frequencies to ensure accuracy. Calibration records must be maintained.
Calibration frequency should be established based on equipment manufacturer recommendations, regulatory standards, and the criticality of the measurement
Out-of-calibration equipment that was used to monitor a critical control point triggers a corrective action and product disposition assessment
2. Product Testing
Testing of finished or in-process products to verify that controls are effective. Examples:
Pathogen testing of finished product lots from facilities with environmental pathogen programs
Allergen testing of finished products after changeovers involving allergen-containing products
Nutritional testing for products making nutrition content claims
Under Part 117, product testing is a verification activity — it confirms that process controls worked. It is not a substitute for process controls.
3. Environmental Monitoring
For ready-to-eat (RTE) products where Listeria monocytogenes is an environmental hazard, an environmental monitoring program is required. Under 21 CFR 117.165, environmental monitoring must:
Monitor for indicator organisms (e.g., Listeria species) or pathogens on food-contact surfaces and in the processing environment
Use a written sampling plan specifying sampling sites, frequency, methods, and action levels
Include corrective actions when pathogens or unacceptable indicator levels are detected
Environmental monitoring is one of the most important and enforcement-sensitive verification activities — Listeria-related recalls and FDA 483 observations are among the most common enforcement actions for food facilities.
4. Records Review
The PCQI must review records of monitoring activities, corrective actions, and verification results to confirm they are:
Complete and accurate
Consistent with the food safety plan procedures
Reviewed in a timely manner (typically within 7 days of the activity for monitoring records)
Records review is not administrative overhead — it is a required verification activity. A PCQI who does not review records within the required timeframe creates an independent compliance gap.
Verification vs. Validation
FDA's Part 117 framework distinguishes between verification and validation:
Term | Definition | Example |
|---|---|---|
Verification | Confirming that preventive controls are consistently implemented and effective | Reviewing monitoring records, environmental monitoring results, calibration logs |
Validation | Confirming that the preventive controls are capable of controlling the identified hazard (scientific basis for the control itself) | Process validation study showing that X temperature for Y minutes achieves pathogen reduction; allergen swab study confirming cleaning protocol removes allergen residue |
Validation is addressed under 21 CFR 117.160 — it must be performed for process controls before or early in implementation, and whenever a critical limit or process parameter changes.
Supply-Chain Verification Activities
Verification activities for supply-chain preventive controls are addressed specifically under 21 CFR 117.155(b). When hazards are controlled by a supplier, the manufacturer must verify the supplier's controls through:
Onsite auditing: Annual audits are required for high-risk foods or when the hazard and the supplier's control are critical
Sampling and testing: Testing of raw materials or finished food for the controlled hazard
Review of supplier's food safety records: Reviewing the supplier's monitoring, corrective action, and verification records
Review of supplier's relevant food safety plan records: Reviewing the hazard analysis and preventive controls documentation
Frequency of Verification Activities
The frequency of verification activities must be appropriate to ensure that controls are consistently implemented:
Activity | Typical Minimum Frequency |
|---|---|
Calibration of critical monitoring instruments | Per manufacturer recommendation or regulatory standard |
PCQI records review | Within 7 working days of the activity being documented |
Environmental monitoring | Per written sampling plan (frequency depends on hazard and product type) |
Supplier audits (high-risk suppliers) | Annually |
Product testing | Per written testing plan |
Food safety plan reanalysis | At least every 3 years |
Corrective Actions Triggered by Verification Failures
When verification activities reveal that a preventive control is not being consistently implemented or is not effective, 21 CFR 117.150 corrective action procedures apply. The corrective action must:
Address the immediate situation (disposition of affected product)
Identify and correct the root cause
Restore the preventive control to effectiveness
Evaluate whether affected product poses a risk and take appropriate action
Prevent recurrence
How Truli Helps with Verification Activity Compliance
Calibration schedule tracking: Truli tracks calibration schedules for monitoring equipment and alerts when calibration is due or overdue
Environmental monitoring program review: Truli evaluates environmental monitoring sampling plans for completeness against FDA guidance for the product type and facility risk profile
PCQI records review tracking: Truli tracks records review completion timelines and flags when reviews are late under the 7-working-day window
Supplier audit scheduling: Truli tracks supplier audit schedules and flags high-risk suppliers approaching their annual audit deadline
Related Regulations
21 CFR Part 117 — FSMA Preventive Controls — Full FSMA rule overview
21 CFR 117 Preventive Controls — The preventive controls that verification activities confirm are working
21 CFR 117 Hazard Analysis — Identifying hazards that require preventive controls and verification
FDA FSVP — Foreign Supplier Verification — Supplier verification requirements for importers
Frequently Asked Questions
Do we need to test every lot of finished product?
Not necessarily — the frequency of finished product testing should be based on the hazard, the effectiveness of preventive controls, and the risk profile of the product. A facility with a robust process control and consistent monitoring history may not need to test every lot. The written food safety plan should specify the testing frequency and the basis for it.
What is the difference between monitoring and verification in practice?
Monitoring is the routine activity that happens during production — a line operator checks and records the cooking temperature every 30 minutes. Verification is the PCQI reviewing those monitoring records within 7 working days to confirm the records are complete, that critical limits were met, and that corrective actions were taken when deviations occurred. Monitoring is real-time; verification is retrospective.
Our supplier gives us a certificate of analysis (COA) for each lot. Is that sufficient supplier verification?
A COA alone is generally not sufficient for a high-risk hazard — FDA expects that verification of supplier controls goes beyond reviewing documents the supplier provides. For high-risk hazards (e.g., Salmonella in botanical powders, heavy metals in botanical ingredients), onsite audits or independent testing are more appropriate verification activities than relying solely on supplier-issued COAs.
A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Last updated: April 2026. Reflects 21 CFR 117.155 as of April 2026. Book a demo to see how Truli monitors food safety compliance.
