Here is the sequence that runs on thousands of lines every week. A peanut-containing product finishes. The line is cleaned to a written procedure. A supervisor signs a visual inspection. An ATP swab reads low, inside the pass band. The next product, declaring no peanut, is released.
Nothing in that sequence measured peanut protein.
The ATP swab measured organic residue: a general cleaning indicator, an irrelevant one for allergens. Nobody can say whether that procedure removes 99.9% of the allergenic protein load or 40% of it, because nobody ran the study. That site has a documented changeover clean, not a validated one — and under BRCGS Global Standard Food Safety Issue 9, where clause 5.3 on the management of allergens is one of twelve fundamental requirements, the gap between those words is the gap between a certificate and a failed audit.
Advanced Allergen Management & Validation is the 40-hour technical course that builds this evidence package — R3,450, self-paced, with a working validation toolkit.
Allergen cleaning validation: the key facts
| Definition | Documented evidence that a cleaning procedure removes allergenic protein below a risk-derived limit, on the worst case |
|---|---|
| Minimum demonstration | Three consecutive successful cleans on the worst case |
| Action level formula | Action Level (ppm) = Reference Dose (mg protein) ÷ Reference Amount (g) × 1000 |
| Swab recovery | Recovery (%) = (measured ÷ spiked) × 100; corrected result = raw ÷ (recovery % ÷ 100); 50–150% guidance window |
| Reference doses | Codex CXS 1-1985 Annex Tables A1/A2; VITAL 4.0 ED05 (Allergen Bureau, 28 August 2024), replacing ED01 |
| Codex position | CXC 80-2020: validation should be specific to the allergen, process and product matrix combination; the code sets no threshold |
| Valid methods | Allergen-specific ELISA, lateral flow (gatekeeping), LC-MS/MS (confirmation) |
| Not allergen evidence | Visual inspection alone, ATP bioluminescence, total protein swabs, PCR |
| Audit hooks | BRCGS Issue 9 clause 5.3 (fundamental); FSSC 22000 Version 7; IFS Food Version 8; SQF Edition 9 — all GFSI-benchmarked |
| Regulation | R146 of 2010 (SA labelling); R638 of 2018 (hygiene); draft R3337 not in force; EU 1169/2011; FASTER Act; Codex CXS 1-1985 |
What is allergen cleaning validation?
Allergen cleaning validation is documented scientific evidence that a defined cleaning procedure removes allergenic protein to below a risk-derived limit, demonstrated on the worst-case condition across three consecutive successful cleans, using an allergen-specific analytical method whose recovery from that surface and matrix has itself been measured.
Count the obligations. A risk-derived limit means two numbers, not one: an acceptance criterion set on demonstrated process capability, typically a low microgram-per-100-cm² figure or the method’s effective limit of quantification, which is what the runs are judged against; and an action level from a reference dose and a reference amount, against which the residue so demonstrated is confirmed to be comfortably safe. The acceptance criterion is never derived from the action level — do that and every clean passes. Worst case means you justified in writing why the condition tested is the hardest your line presents. Three consecutive cleans means one good result is not a validation. Miss one and you have a study, not a validation.
Why does a visual check and an ATP swab prove nothing about allergens?
A visual inspection resolves soil at roughly the limit of human vision; an ATP bioluminescence swab measures organic residue and microbial load. Neither detects allergenic protein. A surface can be visually clean and ATP-negative while carrying enough peanut or milk protein to trigger a reaction in a sensitised consumer.
ATP bioluminescence detects adenosine triphosphate, present in living cells and food residues — useful for confirming a general clean removed organic soil, and entirely non-specific. Two surfaces can return identical readings while one carries no milk protein and the other several hundred micrograms of casein. Total protein swabs fail one level up: they say protein is present, not whose. Codex is blunt about the eye’s limit: CXC 80-2020 defines “visibly clean” as “having no visible food, debris and other residues” — a floor, not a release criterion.
Validation, verification and monitoring — what is the difference?
Validation proves the procedure is capable, before routine use, on the worst case. Verification confirms it is still working, through ongoing scheduled checks. Monitoring records that the validated parameters were actually delivered during each execution. A signed cleaning record is monitoring evidence; it is not validation, and auditors know the difference.
In practice: validation is the protocol, the worst-case justification, the recovery study and the three datasets. Verification is periodic allergen-specific swabs and first-off testing. Monitoring is concentration, temperature, time and flow, recorded every run.
How do you select the worst case for an allergen cleaning validation?
The worst case is the hardest single combination your line can present: the highest allergenic protein load, the most inaccessible geometry, the longest production run with the most dried-on soil, the shortest or coolest cleaning cycle within specification, and the highest-fat matrix, because fat shields protein from detergent.
- Protein load — the item with the highest concentration of that allergen.
- Geometry — dead legs, unswept tees, gaskets and seal seats, valve internals, hopper corners, augers, filler nozzles. CXC 80-2020 is plain: equipment may need disassembly, and where it cannot be disassembled, the allergen management programme should account for that.
- Soil condition — longest permitted run and the longest delay before cleaning starts, when soil dries and fixes.
- Cycle severity — the lowest temperature, shortest time and concentration the specification permits. Validate the floor, not the middle.
- Matrix — the highest-fat product, because fat shields protein until the detergent saponifies it.
One chemistry point overturns established practice: hot water first on protein soil is a classic error. Heat above the protein’s denaturation range promotes thermal cross-linking and Maillard chemistry, fixing protein onto the steel. The correct sequence is product recovery, a cool-to-warm pre-rinse to lift gross soil without fixing it, then the hot alkaline wash, where caustic hydrolyses and solubilises protein and saponifies fat. Acid-first denatures and gels protein onto the surface instead of removing it. Denaturation onset is protein-specific, so no universal temperature applies — your site validates its own pre-rinse ceiling.
Why three consecutive successful cleans?
Three consecutive successful cleans demonstrate reproducibility rather than luck. One passing result shows the procedure can work once; three sequential passes on the worst case, executed by normal shift personnel to the written procedure, show the outcome is a property of the system and not of the individual who happened to clean.
The load-bearing word is consecutive. Three passes selected from five attempts is a sampling exercise designed to reach a conclusion. If a run fails, the validation fails: change something real and restart from run one. A validation run on a Saturday with unlimited time proves the technical manager can clean the line — not what your night shift does in forty minutes under changeover pressure.
Need a protocol that holds up? The advanced validation course includes a document-controlled Cleaning Validation Protocol template in Word and a swab recovery calculator in Excel — the two artefacts most sites are missing. R3,450, certificate on completion.
What is a swab recovery study, and why does it decide whether your result means anything?
A swab recovery study spikes a known mass of allergenic protein onto a representative coupon of the actual surface, then recovers and measures it. Recovery percentage equals measured divided by spiked, times one hundred. Without it, a negative swab result is an uncalibrated observation, not evidence of absence.
Almost nobody does this, and it determines whether every other number in the file means anything. Recovery is never 100%: protein binds to steel, swab buds retain analyte, and the matrix interferes with the immunoassay. The commonly taught window is 50–150%, guidance rather than regulation, with a correction factor applied outside a tight band around 100%. Below roughly 50% the method is not fit for purpose.
Worked example: from reference dose to a defensible release decision
A peanut-containing sauce runs on a shared line, then a sauce declaring no peanut. Portion 150 g, batch 300 kg, circuit area 60,000 cm², swab template 100 cm².
Step 1 — Calculate the action level
VITAL 4.0 gives peanut an ED05 reference dose of 2.0 mg of total peanut protein.
Action Level = 2.0 ÷ 150 × 1000 = 0.013333 × 1000 = 13.33 ppm peanut protein
Step 2 — Convert to a circuit limit
Maximum permissible peanut protein in the batch: 13.33 × 300 = 4,000 mg = 4.0 g
An engineering safety factor of 10 — convention, not law — gives 400 mg across the circuit: 400 ÷ 60,000 = 0.006667 mg/cm², or 666.7 µg per 100 cm² swab.
Notice what catches out every site attempting this. A result of 667 µg per 100 cm² would be a grossly soiled surface: the limit derived from the action level is far looser than any competent site should accept. So do not derive the cleaning acceptance criterion from the action level at all. Set it on demonstrated process capability — the method’s limit of quantification in that matrix on that surface, converted to mass per swab and divided by the fractional recovery — and then use the calculation above only in reverse, as a confirmation that the capability-based criterion scales to a residue comfortably below the action level. Work forward from the risk calculation alone and you have a criterion a dirty line can pass, and a validation that cannot fail.
Step 3 — The recovery study that fails
A technician spikes 10.0 µg of peanut protein onto a 100 cm² coupon, lets it dry, swabs and extracts. The ELISA reports 1.8 µg.
Recovery = (1.8 ÷ 10.0) × 100 = 18.0%. Implied correction factor = 1 ÷ 0.18 = 5.56.
Stop. At 18% this method, in this matrix, finds under a fifth of the protein present. Every “not detected” result this site has generated on this line is uninterpretable. Not reassuring, not borderline — uninterpretable. Fix the method; do not apply a factor of 5.56 to a number you cannot trust.
Step 4 — The recovery study that works, and the correction
Reworked method: spike 10.0 µg, recover 6.2 µg. Recovery = (6.2 ÷ 10.0) × 100 = 62.0% — inside the window, usable with correction.
Run 1 swabs the worst case, a visually clean valve seat. Raw ELISA result: 35 µg peanut protein per 100 cm².
Corrected = 35 ÷ 0.62 = 56.45 µg per 100 cm². The raw figure is 62% of the true value — it understates the surface load by 38%. A site reporting raw results under-reports its own residue, and has no idea by how much.
Step 5 — Scale to the circuit and to the product
Surface residue = corrected concentration × total area ÷ swabbed area = 56.45 × 60,000 ÷ 100 = 33,871 µg = 33.87 mg peanut protein
Concentration in the batch = 33.87 ÷ 300 = 0.11 mg/kg = 0.11 ppm
Against an action level of 13.33 ppm, that sits roughly 118 times below the threshold. What made that defensible was not the low number but the recovery study proving the method could see protein at all. One caveat: this assumes the residue disperses through the full 300 kg, whereas carry-over often travels as a slug in the first product, which is why first-off product testing is a separate control.
Which analytical method should you use for allergen cleaning validation?
Use an allergen-specific quantitative method, normally ELISA, for validation, with the reporting basis stated as total protein, commodity or marker protein. Lateral flow devices suit routine release gatekeeping. LC-MS/MS confirms difficult matrices. PCR detects DNA, never protein. ATP bioluminescence validates nothing allergen-specific at all.
| Method | Role | Principal limitations |
|---|---|---|
| ELISA | Primary validation method, quantitative | Matrix interference; heat denatures epitopes; fails on hydrolysates |
| Lateral flow | Release gatekeeping | No quantification; hook effect under-reads at high concentration |
| PCR | Speciation only | Detects DNA, not protein |
| LC-MS/MS | Confirmation | Limited standardisation; higher cost |
| ATP bioluminescence | Cleaning indicator | No allergen specificity; can never validate allergen removal |
The reporting basis silently corrupts comparisons. An ELISA result may be expressed as total allergen protein, as commodity (whole peanut, whole milk), or as a marker protein such as Ara h 2 for peanut or beta-lactoglobulin for milk — different numbers for the same surface. Codex Table A1 and VITAL reference doses are both mg of total protein, so a commodity result must be converted first. Gluten is reported as gliadin × 2. A certificate of analysis that omits the basis is not a comparable result.
Process history matters twice over, and CXC 80-2020, the Codex Code of Practice on Food Allergen Management, is explicit about the first half. Its Introduction states:
Treatments lethal for pathogenic microorganisms, such as heating, high pressure processing, etc. generally do not destroy allergenic proteins. Processes that degrade proteins, such as enzymatic or acid hydrolysis, should not be relied upon to eliminate or completely destroy allergenic proteins.
Read the grading exactly: “generally do not destroy”, not never; and hydrolysis “should not be relied upon”, a recommendation against reliance, not a prohibition. The second half is the measurement problem: the same processing degrades ELISA recovery, so a roasted or hydrolysed matrix can under-report while clinically relevant protein remains. Codex Section 6.5 follows through: a test should be fit for purpose for the targeted allergen (its own example — a casein test is not a whey test), should be validated to work with the matrix or food of concern, and the operator should know its limit of detection and specificity. Section 6.2.1 puts the same condition on the clean: validation “should be specific to the allergen, process and product matrix combination”. Section 6.5 also names CIP verification by “testing rinse samples or swabs”, and Section 6.2.1 asks that push-through material or the first product through the line be evaluated where allergen testing is feasible; high-pressure hosing is not a clean, because the code warns it can spread and aerosolise residues. One scope caution — CXC 80-2020 sets no reference dose, threshold or action level anywhere, so precautionary labelling practice must be cited to the CXS 1-1985 annex, not the code of practice.
What about CIP and surfaces a swab cannot reach?
The validated CIP levers are conventionally taught as TACT — Time, Action, Concentration, Temperature — validated together, since strengthening one does not licence weakening another. Concentration is the one lever with an optimum rather than a straight line: published work on protein deposit dissolution puts it in the region of 0.1 to 0.2 mol/L sodium hydroxide, with performance falling above roughly 0.25 mol/L because high ionic strength stabilises the interactions hydroxide has to break, so “add more caustic” is not a remedy for a failing clean. That is a published finding on model deposits to be confirmed on your own soil, not a specification. Turbulent flow carries solubilised protein away; a commonly cited benchmark is a minimum velocity in the order of 1.5 m/s, which each site confirms for its own geometry. Spray shadows behind agitators, baffles, dip tubes and manway ledges are the dominant vessel failure mode, and coverage is proven by riboflavin testing, never assumed from a drawing. The assay point unique to CIP is final rinse water, sampled at the return rather than the supply, because it integrates the whole wetted circuit.
What does an auditor actually ask for?
BRCGS Global Standard Food Safety Issue 9 makes clause 5.3, management of allergens, one of twelve fundamental requirements, and a fundamental failure ends the audit. Auditors therefore ask for validation evidence, not cleaning records: worst-case justification, three-run data, recovery studies and the method’s suitability in your matrix.
Issue 9 was published 1 August 2022 and remains current. FSSC 22000 Version 7 (May 2026) carries its own allergen requirements, with Version 6 audits permitted until 30 April 2027 and the V7 upgrade window 1 May 2027 to 30 April 2028. IFS Food Version 8 is mandatory since 1 January 2024 and SQF Edition 9 remains the audited edition. All are GFSI-benchmarked and all expect validation, not documentation. Six questions expose an unvalidated site:
- Show me your allergen cleaning validation report.
- How did you select the worst case, and what did you reject?
- Show me the three consecutive runs.
- Show me the recovery study for that method, surface and matrix.
- What is the reporting basis, and how does it compare to your criterion?
- What triggers revalidation, and when did you last revalidate?
The regulatory frame: R146 of 2010 governs South African allergen labelling (eight groupings plus sulphites, named inside compound ingredients); draft R3337 is not in force; R638 of 2018 covers premises hygiene; Regulation (EU) No 1169/2011 lists 14 allergens; the FASTER Act added sesame as the ninth US major allergen from 1 January 2023.
Frequently asked questions
Is an ATP swab acceptable for allergen cleaning validation?
No. ATP bioluminescence measures organic residue and microbial load, not allergenic protein. It is a valid cleaning-efficacy indicator and a real-time release check, but it cannot validate allergen removal. Presenting it as allergen evidence is a predictable audit finding.
How many swabs do I need for a cleaning validation?
There is no universal number. The plan must cover the worst-case sites you have justified, including non-visible and hard-to-reach locations, across three consecutive cleans, plus final rinse water where CIP applies.
What recovery percentage is acceptable in a swab recovery study?
The commonly taught guidance window is 50–150%, with a correction factor applied outside a tight band around 100%. This is industry guidance, not regulation. Recovery well below 50% means the method is not fit for purpose in that matrix.
Does a positive allergen swab mean the product must be recalled?
Not automatically. It triggers investigation and a risk-based decision: re-clean, re-swab, quarantine, assess carry-over against the action level, review labelling, and escalate to withdrawal or recall only where the assessment supports it.
Does cooking or processing destroy the allergen, so cleaning matters less?
No. Codex CXC 80-2020 states in its Introduction that treatments lethal for pathogens “such as heating, high pressure processing, etc. generally do not destroy allergenic proteins”, and that protein-degrading processes such as enzymatic or acid hydrolysis “should not be relied upon” to eliminate them. Worse, processing degrades the assays used to detect the allergen, so a processed matrix can under-report severely.
How does VITAL 4.0 relate to cleaning validation?
VITAL 4.0, released by the Allergen Bureau on 28 August 2024, supplies reference doses on an ED05 basis rather than VITAL 3.0’s ED01. Those doses set the action level your residue is checked against, so superseded doses mean a superseded safety check — but they do not set the cleaning acceptance criterion, which is established on process capability. Codex Table A1 is now a second published source.
Build the evidence before somebody asks for it
You can read about cleaning validation, or be able to do it. The difference is whether you can face an auditor with a protocol, a worst-case justification, three datasets, a recovery study and a recovery-corrected result.
Advanced Allergen Management & Validation. Nine modules, approximately 40 hours, self-paced, with Mthokozisi Nkosi.
- R3,450, no VAT charged
- The ASC Allergen Validation Toolkit in Excel — a multi-framework QRA calculator switching between Codex Table A1/A2, VITAL 4.0 ED05, VITAL 3.0 ED01 and Netherlands ED05 doses, plus a swab recovery calculator, a result interpretation tool, an allergen matrix and a changeover risk assessment
- A document-controlled Cleaning Validation Protocol template in Word
- A 90-question technical exam — 150 minutes, 80% pass mark, which is 72 of 90 — and a certificate of competence on passing
- FoodBev SETA accredited (587/00337/1900), HPCSA CPD accredited, SAATCA TC 065
Enrol in Advanced Allergen Management & Validation →
Training a wider team first? Start with Allergen Management in the Food Supply Chain, then send QA, laboratory and sanitation leads to the advanced validation course. See all courses or contact us.
Your line passed a visual check and an ATP swab. That is not evidence. Learn how to generate evidence that is.