Templates and records · ISO 22000 · Clause 8.5.3

ISO 22000 validation of control measures template

Before relying on a heat treatment or a metal detector, you have to prove that it works. It is the record most often missing at audits and the one that carries most weight.

In one sentence

Validation of control measures demonstrates, before they are applied, that each measure — or combination of measures — chosen for a CCP or an OPRP is capable of bringing the hazard to its acceptable level, and clause 8.5.3 of ISO 22000 requires the validation methodology and the evidence obtained to be retained.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 22000 · Clause 8.5.3 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
Type of information: Mandatory record Methodology and evidence to be retained (8.5.3)
Who fills it in: The food safety team Often with support from a laboratory or an external expert, whose competence must be on record
When: Before applying the measure and after every change A new recipe, pack format, piece of equipment or line load requires revalidation
How long it is kept: Set by the organisation ISO 22000 only sets a minimum for traceability (8.3: the shelf life of the product). Covering the shelf life plus the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 22000 demands and what it leaves to your judgement

The food safety team validates that the chosen control measures achieve the intended control of the significant hazard. This is done before they are implemented in the plan and after any change that could affect them.

When validation shows that the measure is not sufficient, it must be modified or combined with others and reassessed. The standard does not impose a method: in-house studies, challenge tests, published scientific data, official guidance or historical process data are acceptable sources if they are justified.

Validating is not verifying: validation asks whether the measure can work; verification (8.8) asks whether it is being applied and working day to day.

Read it in context: Hazard control and the HACCP/OPRP plan, in the ISO 22000 Academy

Structure

Fields the template should include

Control measure validated and the hazard it targets
CCP or OPRP it belongs to
Objective: acceptable level to be achieved
Validation method and reference sources
Study conditions: product, format, equipment, load, worst case
Results obtained
Conclusion: valid, valid with conditions or not valid
Parameters carried into the plan: critical limit or action criterion
When it must be revalidated
Person responsible and date

Example

Example: validation of the pumpkin soup heat treatment

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Measure	Heat treatment in kettle · CCP-1
Objective	Reduction of vegetative pathogens to the acceptable level set in the hazard analysis
Method	Heat penetration study with probes at the kettle's cold spot, with reference to the scientific literature on Listeria
Worst case	Maximum load of 400 kg, starting product at 4 °C, highest viscosity in the range
Results	Three trials: the cold spot exceeds the target temperature for the set time in all three
Conclusion	Valid for loads of up to 400 kg
Carried into the plan	Critical limit for temperature and time at the core of the product, with continuous recording
Revalidation	If the kettle, the base recipe or the maximum load changes
Responsible	Food safety team leader · 9 January 2026

At the audit

Mistakes auditors commonly flag

The equipment manufacturer's data sheet is presented as validation of the company's own process.
The study does not consider the worst case: maximum load, coldest product, largest format.
Validation is confused with verification and only the daily temperature log is provided.
A change in recipe or format does not lead to revalidation.
OPRPs are left unvalidated because "they are not CCPs".

In Kimobox

How this record is kept in Kimobox

1Validation is a record linked to the control measure and to the CCP or OPRP in the plan.
2Studies and laboratory reports are attached with their date and version.
3A process change handled as a planned change flags the validations that need repeating.

Frequently asked questions

What people ask us before getting started

Do OPRPs also have to be validated?

Yes. Clause 8.5.3 applies to the control measures chosen for significant hazards, whether they are categorised as CCPs or OPRPs.

Is a published study enough?

It can be, if the study conditions are comparable to those in the plant. If the product, equipment or format differ, you must justify why the data still apply or supplement them with your own trials.

Keep your ISO 22000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 22000:2018 — Food safety management systems. Requirements for any organization in the food chain ISO · 2018 ed., with Amd 1:2024
General Principles of Food Hygiene, CXC 1-1969 Codex Alimentarius (FAO/WHO) · 2020 revision