The investigation that started in the wrong place

The counts shouldn't have been there.

A beverage facility running an HTST pasteuriser had a clean validation history — F-value targets met, log-reduction data signed off, process filed and approved. Six months into production, a routine environmental pull downstream of the pasteuriser flagged elevated mesophilic counts. Not a recall-level event, but enough to trigger a full internal investigation. The team started where investigations always start: post-process contamination. Swabs across filler heads, gaskets, seals, and heat exchanger plates. Three weeks of sampling. Everything clean. The pasteuriser itself was cleared early — it was validated, after all. The focus shifted to packaging material, then operator hygiene, then air handling upstream of the filler.

It wasn't any of those. It was the flow rate. And nobody had looked at it because it wasn't on the monitoring sheet.

What the maintenance log eventually showed

The contamination investigation followed a familiar pattern. Environmental teams ruled out the filler zone first — the most common source of post-process counts in beverage lines — then worked backward through the packaging area and operator contact points. Each hypothesis generated a sampling plan. Each sampling plan came back clean. By week three, the investigation had effectively eliminated every post-process source without finding the root cause. The pasteuriser remained off the table. It had been validated twelve months earlier. The validation records were complete. No one raised it as a candidate.

When someone finally pulled the pump flow rate records — not the operator checklist, the actual data logger output — the pattern was immediate. Following a scheduled maintenance intervention seven months earlier, the pump had been running 8% above the validated maximum flow rate. Not a fault condition. Not an alarm. The pump was operating within its mechanical limits. It just wasn't operating within its validated process limits.

On most production days, the temperature running 1–2°C above setpoint provided enough thermal buffer to compensate for the reduced residence time. On cooler days — particularly in winter, when incoming product temperature was lower and the pasteuriser took longer to reach equilibrium — that buffer disappeared. The process was delivering the validated kill step on warm days and falling marginally short on cold ones. The operator logs showed nothing. The product release records showed nothing. The environmental monitoring data was the only signal, and it took three weeks to connect it to the right variable.

The maintenance team had no instruction to return the pump to its exact pre-intervention flow rate setting. There was no revalidation trigger in the process control documentation for a pump service event. The validation was accurate. It just described a process that no longer existed.

Validation proves a moment. Control proves a process.

This gap is built into how validation studies are designed — not an oversight, but a scope limitation. A validation study demonstrates that a defined set of process conditions delivers the required log reduction under the conditions studied. It is a point-in-time proof. What it cannot do is guarantee those conditions persist through six months of production, maintenance interventions, seasonal variation, and equipment wear. That is not a flaw in the methodology. It is simply not what validation is designed to prove.

The conditions that deliver the kill step are not the kill step. They are upstream of it. Flow rate determines residence time. Residence time, combined with temperature, determines the delivered F-value. If flow rate drifts and is not monitored against its validated limit, the process can appear fully controlled — temperatures on target, operator checklists signed, no alarms triggered — while the actual thermal treatment degrades silently. The kill step is intact on paper. The conditions required to deliver it are not.

This applies beyond HTST. Tunnel pasteurisers depend on belt speed and zone temperatures held within validated ranges. Retort processes depend on come-up time and cooling profiles staying within qualified limits. In each case, the validation study fixes the process envelope — and production then has to maintain it. The study tells you what works. Your monitoring system has to prove it is still working, every shift, every batch.

What to check before you sign off this week

The fix is not a new validation study. It is a monitoring sheet that reflects what the validation study actually assumed. Every parameter held constant during validation — flow rate, hold tube temperature range, minimum inlet temperature, CIP verification status — belongs on the production monitoring record, with defined limits and a revalidation trigger if those limits are breached. That includes maintenance events that touch flow-critical equipment.

I've built a Pasteurisation Process Monitoring Checklist that maps directly from validation assumptions to production controls — covering HTST and tunnel pasteuriser configurations. Dropping it on LinkedIn on Friday. If you want it before then, reply to this email.