Evidence showing a control measure is effective


As a food business operator, describing the control measures you put in place to address each hazard identified in your hazard analysis is an essential part of your food safety system. Equally important is having solid evidence to show that your control measures are actually effective in controlling the hazards. This is often referred to as validation. There are a range of approaches that can be used to obtain such evidence so that you can be confident you are using validated measures. Generally the type and depth of evidence you need will be proportional to the level of risk associated with the hazard(s) being controlled. If your business has a HACCP-based plan implemented, you may already have completed the process to gather this evidence.


The Canadian Food Inspection Agency (CFIA) created this document as guidance to help food businesses comply with the requirements of the Safe Food for Canadians Regulations.

It's your choice

You may use other guidance that has been developed by provincial governments, industry associations, international partners, or academic. Always ensure that the guidance you choose is relevant for your particular business, product or products, and market requirements.

What is included

This document outlines the general principles and steps of the process to gather and document evidence that control measures used are validated. The information is based on the Codex Alimentarius document Guidelines for the validation of food safety control measures (PDF).

Refer to the Tell me more! section for additional sources of information that may help you obtain evidence on the effectiveness of the control measures applied.

What's not included

Detail related to the tools, techniques, and statistical principles used to validate specific food safety control measures are not included. The process of validation will be unique for each business and will need to be tailored for your particular business, product and market requirements.

Roles and responsibilities

Food businesses are responsible for complying with the law. They demonstrate compliance by ensuring that the commodities and processes for which they are responsible meet regulatory requirements. If a written Preventive Control Plan (PCP) is required, the food business develops a PCP with supporting documents, monitors and maintains evidence of its implementation, and verifies that all control measures are effective.

CFIA verifies the compliance of a food business by conducting activities that include inspection, and surveillance. When non-compliance is identified, CFIA takes appropriate compliance and enforcement actions.

General principles

The type and depth of evidence needed to show a control measure (or combination of control measures) is effective depends on the nature of the hazard(s) being controlled.

  • Control measures for the maintenance and operation of an establishment in a clean and sanitary condition (hygiene-based measures) do not generally have a quantitative effect on specific hazards. The types of control measures typically used (also known as pre-requisite programs under the Food Safety Enhancement Program (FSEP) and the Quality Management Program (QMP)), are based on Good Hygienic Practices (GHPs) and already have a history of good performance or are known to be effective. Some of these are outlined in the following references:

    For these hygiene-based control measures, it is important that you:

    • specify the reference you are basing each control measure on
    • confirm that the measure is effective when applied to your situation (your food and operation)
      • You could do this by observing the state and operation of the establishment, conducting product or environmental sampling and/or by the verification activities you conduct.
  • Control measures for significant hazards, such as those with critical limits at a critical control point (CCP), usually have a quantitative effect on specific hazards. The evidence for these types of control measures is more substantive and is often based on the collection and assessment of scientific, technical and observational information.
    • You can use pre-validated control measures (measures that have already been validated as effective). You may find helpful information on these by conducting a literature review of references such as:

      • publications issued by provincial, national or international governments, including CFIA guidance on recommended preventive controls for food on the web page Preventive controls for food businesses
      • scientific publications
      • recommendations from the manufacturer of a processing equipment or packaging material

      Note: When using pre-validated control measures, you don't need to re-validate them provided the conditions of application are the same. As mentioned above, it is important to:

      • specify the reference you are basing your control measure on
      • monitor that they are implemented as intended
      • verify that they are effective for your food and operation. For example, if using a pH or water activity (aw) level that is already validated as effective to control a pathogen, you would only need to show that you can consistently achieve that specified level in your food.
    • You can also use control measures considered new or alternative controls measures. These are control measures for which there is no current knowledge or history of effectiveness and no references available to show that they have been pre-validated. When applying these it is likely that you will need to complete a scientific validation study (involving study design and collecting/ analyzing your own scientific data) to generate the evidence needed to prove that these measures are effective.

The process

The process for obtaining evidence on the effectiveness of a control measure requires that you:

  1. know your food, the hazards and control measures
  2. obtain the evidence showing the control measures are effective
  3. document the evidence and where/how it was obtained

1. Know your food, the hazards and control measures

The first step in gathering evidence to show a control measure is effective is to identify and describe the following information which you should already have in your PCP (process and product description, and hazard analysis).

Identify the hazard or hazards that need to be controlled

Describe the hazard(s) in your food and operation for which a control measure is required. For example, Listeria monocytogenes in a ready-to-eat food.

Identify the food safety outcome or target

Identify what the control measures are meant to accomplish. For example, reduce the level of Listeria monocytogenes in a ready-to-eat food to below 100 cfu/g for the duration of the shelf-life.


Identify the control measure(s)

Identify the control measure(s) used to control the hazard(s) you identified. For example, cooking at "x" degrees Celcius for "y" minutes to achieve a 5-log reduction in numbers of Listeria monocytogenes.

Consider the following:

  • Has the control measure been validated already? (For example, by a competent authority or other national or international organization.)
  • Is its performance well established for the application you are considering?
  • Are the conditions of application in your operation the same as those under which the control measure was previously validated? (For example, are the raw materials, relevant hazards, combination of control measures, intended use, and distribution and consumption patterns the same.)
    Note: If you answer yes to all of these questions, you already have most of the evidence needed to show your control measure is effective. Now you only need to collect monitoring and verification data to confirm that your control measure is implemented as intended and is effective in achieving the desired outcome.

2. Obtain evidence that shows a control measure is effective

For each control measure:

a. Define the parameters and acceptance criteria


  • the parameters (for example, internal temperature, pressure, pH, concentration level or fill weight)
  • the acceptance criteria
  • the acceptable variability
  • the limit of precision or confidence level (for example, the ability of a metal detector to detect metal fragments greater than or equal to 0.5 mm at a 95% confidence level)

You can obtain the parameters and criteria from:

  • the instructions provided by the manufacturer of an equipment
  • peer reviewed publications
  • scientifically valid experimental data
  • government guidelines and standards

b. Determine the approach you will follow to obtain evidence

There is a range of approaches that can be used to obtain the evidence needed to validate the effectiveness of a control measure. The approach depends on the nature of the hazard, the nature of the raw ingredients and product, the type of control measure and the food safety outcome. Some control measures may require that you use multiple approaches. This work can be contracted out to technical experts, as appropriate. The approaches could include:

  • Literature review

    You should begin your validation exercise by reviewing:

    • existing scientific or technical information
    • previous validation studies
    • documented historical knowledge of the performance of the control measure

    Sources of information for a literature review include:

    • scientific publication
    • publications issued by provincial, national or international governments, including international standards or guidelines (such as Codex Alimentarius)
    • guidelines on GHP and HACCP-based control measures
    • validation studies completed by industry parties, including equipment manufacturers

    Note: You have to be able to demonstrate that the conditions of your specific operation are the same as those of the original study or publication, or that any differences with your application would result in a safer outcome. For example, you use the control measure in a more stringent manner than presented in the study or publication, or the hazards in your products would be more susceptible to the control measure (when compared to those in the study or publication).

  • Collection of data

    You can choose a set period of time during regular operating conditions to collect specific data to assess the effectiveness of your control measures. For example:

    • you collect data from environmental swabs, product testing, observations on the state and operation of the establishment and/or equipment measurements

    Note: When collecting data you should account for worst-case scenarios and use sampling techniques that will allow you to obtain data that are representative of your food operation and of the control measure you are assessing.

  • Challenge studies

    You can conduct a microbial challenge study to obtain scientifically valid experimental data showing the control measures are effective. For example:

    • You can use a challenge study to demonstrate and document the appropriate quantitative log reduction of a specified pathogen by a specific microbiocidal process.
    • For additional information refer to the Health Canada challenge study guidelines listed in the section Other references of this document.

    Note: The study would need to be appropriate for your specific food commodity and designed to mimic process conditions. You may outsource such studies to accredited laboratories or academic institutions, or you may collect and analyze scientific data that you gathered in-house.

    Typically, this approach is not applied for hygiene-based control measures.

  • Predictive modelling

    You can use mathematical models/equations to predict the growth and/or activity of a microorganism in a food product over time. Mathematical models are used extensively by industry. For example, pathogen growth models to assess the impact of changes in pH and water activity on the control of pathogen growth and z-value models to determine alternative thermal processing conditions

    An example of a commonly used predictive model for assessing pathogen growth over the shelf life of the product is Combase.

    Note: The effective use of mathematical modelling typically requires that a model be appropriately validated for a specific food application; usually by a specialist such as a process authority.

    Typically, this approach is not applied for hygiene-based control measures

  • Surveys

    You can use surveys under certain circumstances in conjunction with other approaches to show that a control measure is effective in achieving the food safety outcome. For example, an evaluation of consumers' understanding of food safety related instructions on the label prior to or during the design of a label can be considered an approach that provides evidence of effectiveness for labelling as a control measure.

    Care should be taken to ensure that the survey data obtained is accurate and appropriate for use by an individual food business operator.

c. Analyze results to confirm the effectiveness of the control measure

Analyze all of the scientific, technical and observational information and results from the approaches(s) you used, for example process records, test results, certificates of analysis. Based on this assess the ability of your control measure to consistently address the hazard and achieve the intended outcome. Always account for worst case scenarios. In some cases, you may need to conduct statistical analysis to assess the significance of the results or confidence in the control measure to achieve the intended outcome.

Re-validation of a control measures

Several factors could result in the need for you to re-validate a control measure or obtain new evidence on the effectiveness of a given control measure (or combination of control measures). These factors include, but are not limited to:

  • System failure
    • You observe repeated deviations which suggest that the control measures and associated equipment, chemical or process may no longer be safe.
  • Process / production changes
    • You introduce a new control measure, technology or piece of equipment.
    • You change a product formulation or control measure (for example, time or temperature).
  • New information from scientific, regulatory or in-house sources
    • A new food safety standard or outcome is set.
    • You find a hazard at a higher level than originally encountered and accounted for in the design of a control measure.
    • The response of a hazard to a control measure has changed (adaptation).

3. Document the evidence

It is important to document all the relevant information you reviewed and/or obtained as evidence to validate the effectiveness of your control measures. This should include where and/ or how you obtained the evidence. This information is maintained as part of your PCP and should include the following (as applicable):

  • Objectives
    • Description of the specific aspects of the control measures to which the evidence applies.
    • Food commodity and manufacturing process.
    • Name and qualifications of the person responsible.
  • Information used
    • All the literature (for example, scientific references) and other information and documents you used in the process.
  • Study design and methodology
    • Specific control measures that are studied.
    • Control measure parameters, including all criteria against which the effectiveness of the control measure is determined.
    • Qualifications of those involved in the design, such as the process authorities, and details regarding their competency
    • Names of technical experts or process authorities consulted.
    • Equipment used.
    • Type of data collected, such as time, temperature, humidity, moisture content and/or specific microorganisms identified.
    • Statistically based sampling plan, if applicable, including where, when and how the samples are taken.
    • Test methodology, including information on why the method was selected for the specific food commodity and control measure, the laboratory that conducted the testing and its qualifications
    • Study start and completion dates.
    • Method selected for analyzing study results.
    • Reference to challenge study guidelines, as applicable.
  • Results, analysis and conclusions
    • Results from process records, test results, certificates of analysis (tabulated, graphed or collated in a way that facilitates an easy review of the information).
    • Analysis and interpretation of the results.
      Note: If you consulted a technical expert to interpret the results, please summarize any discussion, advice or conclusion reached, including the date.
    • Conclusion regarding the effectiveness of the control measure.

Keep your evidence current

Your evidence of effectiveness has to be kept up to date and take into consideration changes in formulations, new processing equipment, and emerging new information or processing data.

Tell me more! Further reading

The following references contain information that helps explain food safety controls, demonstrates how to develop them, and provides examples. CFIA is not responsible for the content of documents that are created by other government agencies or international sources.

CFIA references

Other references