21 CFR 117.155 requires covered food facilities to conduct verification activities to confirm that preventive controls are consistently implemented and effectively controlling the identified hazards. Verification is distinct from monitoring: monitoring is the routine real-time check that a control is being applied; verification is the higher-level confirmation that the monitoring system itself is working and that controls are effective.

Required Verification Activities

Under 21 CFR 117.155, verification activities include:

1. Calibration of Process Monitoring Instruments

Equipment used to monitor critical limits (thermometers, pH meters, water activity meters, scales) must be calibrated at specified frequencies to ensure accuracy. Calibration records must be maintained.

• Calibration frequency should be established based on equipment manufacturer recommendations, regulatory standards, and the criticality of the measurement

• Out-of-calibration equipment that was used to monitor a critical control point triggers a corrective action and product disposition assessment

2. Product Testing

Testing of finished or in-process products to verify that controls are effective. Examples:

• Pathogen testing of finished product lots from facilities with environmental pathogen programs

• Allergen testing of finished products after changeovers involving allergen-containing products

• Nutritional testing for products making nutrition content claims

Under Part 117, product testing is a verification activity — it confirms that process controls worked. It is not a substitute for process controls.

3. Environmental Monitoring

For ready-to-eat (RTE) products where Listeria monocytogenes is an environmental hazard, an environmental monitoring program is required. Under 21 CFR 117.165, environmental monitoring must:

• Monitor for indicator organisms (e.g., Listeria species) or pathogens on food-contact surfaces and in the processing environment

• Use a written sampling plan specifying sampling sites, frequency, methods, and action levels

• Include corrective actions when pathogens or unacceptable indicator levels are detected

Environmental monitoring is one of the most important and enforcement-sensitive verification activities — Listeria-related recalls and FDA 483 observations are among the most common enforcement actions for food facilities.

4. Records Review

The PCQI must review records of monitoring activities, corrective actions, and verification results to confirm they are:

• Complete and accurate

• Consistent with the food safety plan procedures

• Reviewed in a timely manner (typically within 7 days of the activity for monitoring records)

Records review is not administrative overhead — it is a required verification activity. A PCQI who does not review records within the required timeframe creates an independent compliance gap.

Verification vs. Validation

FDA's Part 117 framework distinguishes between verification and validation:

Validation is addressed under 21 CFR 117.160 — it must be performed for process controls before or early in implementation, and whenever a critical limit or process parameter changes.

Supply-Chain Verification Activities

Verification activities for supply-chain preventive controls are addressed specifically under 21 CFR 117.155(b). When hazards are controlled by a supplier, the manufacturer must verify the supplier's controls through:

• Onsite auditing: Annual audits are required for high-risk foods or when the hazard and the supplier's control are critical

• Sampling and testing: Testing of raw materials or finished food for the controlled hazard

• Review of supplier's food safety records: Reviewing the supplier's monitoring, corrective action, and verification records

• Review of supplier's relevant food safety plan records: Reviewing the hazard analysis and preventive controls documentation

Frequency of Verification Activities

The frequency of verification activities must be appropriate to ensure that controls are consistently implemented:

Corrective Actions Triggered by Verification Failures

When verification activities reveal that a preventive control is not being consistently implemented or is not effective, 21 CFR 117.150 corrective action procedures apply. The corrective action must:

• Address the immediate situation (disposition of affected product)

• Identify and correct the root cause

• Restore the preventive control to effectiveness

• Evaluate whether affected product poses a risk and take appropriate action

• Prevent recurrence

How Truli Helps with Verification Activity Compliance

• Calibration schedule tracking: Truli tracks calibration schedules for monitoring equipment and alerts when calibration is due or overdue

• Environmental monitoring program review: Truli evaluates environmental monitoring sampling plans for completeness against FDA guidance for the product type and facility risk profile

• PCQI records review tracking: Truli tracks records review completion timelines and flags when reviews are late under the 7-working-day window

• Supplier audit scheduling: Truli tracks supplier audit schedules and flags high-risk suppliers approaching their annual audit deadline

Related Regulations

• 21 CFR Part 117 — FSMA Preventive Controls — Full FSMA rule overview

• 21 CFR 117 Preventive Controls — The preventive controls that verification activities confirm are working

• 21 CFR 117 Hazard Analysis — Identifying hazards that require preventive controls and verification

• FDA FSVP — Foreign Supplier Verification — Supplier verification requirements for importers

Frequently Asked Questions

Do we need to test every lot of finished product?
Not necessarily — the frequency of finished product testing should be based on the hazard, the effectiveness of preventive controls, and the risk profile of the product. A facility with a robust process control and consistent monitoring history may not need to test every lot. The written food safety plan should specify the testing frequency and the basis for it.

What is the difference between monitoring and verification in practice?
Monitoring is the routine activity that happens during production — a line operator checks and records the cooking temperature every 30 minutes. Verification is the PCQI reviewing those monitoring records within 7 working days to confirm the records are complete, that critical limits were met, and that corrective actions were taken when deviations occurred. Monitoring is real-time; verification is retrospective.

Our supplier gives us a certificate of analysis (COA) for each lot. Is that sufficient supplier verification?
A COA alone is generally not sufficient for a high-risk hazard — FDA expects that verification of supplier controls goes beyond reviewing documents the supplier provides. For high-risk hazards (e.g., Salmonella in botanical powders, heavy metals in botanical ingredients), onsite audits or independent testing are more appropriate verification activities than relying solely on supplier-issued COAs.

A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.

Last updated: April 2026. Reflects 21 CFR 117.155 as of April 2026. Book a demo to see how Truli monitors food safety compliance.