It started as a routine microbiological check. The kind your QA team runs on a Monday morning without expecting anything back.

The swab result came back positive.

The first reaction on any site is to assume something went wrong with the execution. A step was missed. The tank wasn't fully drained. Somebody cut the cycle short at the end of a shift. You pull the CIP records and look for the gap. This team pulled the records. Every cycle for the past eleven months had run to completion. Nothing was missing.

Six months earlier, the site had quietly extended the line. A reformulated variant — new recipe, different fat base, same product format — had been approved through NPD and added to the schedule. Same line, same CIP programme. It seemed like a straightforward addition. Nobody had raised a revalidation question.

The investigation started where it always starts. The records.

The first instinct was the equipment. It usually is. Engineering walked the line looking for the obvious suspects — worn seals, blocked spray devices, a dead leg that might have opened up after a recent maintenance intervention. They found two spray balls with partial scaling. Both were cleaned, re-inspected, signed off. A credible find. The team had reasonable confidence they'd closed it.

The line ran again. The next microbiological swab came back positive.

That second result changes the situation entirely. When the same failure repeats after you've fixed the obvious mechanical issue, the problem isn't the equipment — it's the assumption the cleaning programme was built on. That's a harder thing to accept on a line that has been running without incident for nearly a year, because it means the line was never fully clean, and you've been approving product on the basis of records that looked right but weren't telling the full story.

A process technologist sat down with two documents: the original CIP validation study and the product specifications for both the legacy product and the new variant. The comparison took less than twenty minutes. What the original validation had actually been built around was a product with a moisture activity above 0.96, moderate fat content, and a protein level of around 3.2 g per 100g. The new variant had a different matrix: higher fat concentration, lower moisture activity at 0.91, and a protein fraction that behaved differently under the alkaline cleaning conditions the programme had been designed for.

The detergent chemistry that worked cleanly against the original soil was not achieving equivalent removal against the new one. Not enough of a gap to trip a conductivity alarm. Enough of a gap to leave residue building up at critical hygiene inspection points — the balance tank outlet, the recirculation return elbow, two low-flow horizontal runs — with every cycle.

Swabbing of those points confirmed it.

Conductivity, temperature, and cycle time are process parameter checks — they confirm the procedure ran. They say nothing about whether the soil came off. That gap is where periodic verification belongs: structured swabbing at critical hygiene inspection points, on a defined frequency, against defined acceptance criteria. Process parameters tell you the CIP executed. Verification sampling tells you it worked.

This is the distinction that most CIP validation programmes are built around in principle and collapse around in practice. A CIP validation study demonstrates that a defined procedure achieves acceptable cleanliness when challenged against a defined worst-case soil under defined worst-case conditions. Change the soil and the validation no longer covers the new situation — regardless of whether the procedure ran correctly.

The reason comes down to how cleaning actually works at the surface. Soil removal under CIP conditions is governed by three competing forces: the chemical affinity of the detergent for the soil components, the thermal energy driving diffusion and denaturation, and the mechanical shear from turbulent flow stripping loosened residue from the surface. These three forces don't act independently — they interact with the soil matrix. A fat-heavy soil requires surfactant action to emulsify and lift lipid layers before the alkaline component can reach the protein fraction underneath. A high-protein soil under heat forms denatured surface films that resist alkaline hydrolysis until contact time is sufficient to penetrate them. Lower moisture activity concentrates the soil, increases adhesion to the stainless steel surface, and reduces the rate at which the detergent solution can solubilise residue.

Change the balance of fat, protein, and moisture in your soil matrix and you change the dominant removal mechanism — which means the validated time, temperature, and concentration combination may no longer be sufficient, even if the programme runs identically to the original study.

The revalidation triggers most facilities document focus on equipment changes — new pipework, modified spray coverage, relocated components. Product change, particularly a line extension that looks similar on paper, rarely appears on that list. The working assumption is that if the format is the same and the CIP programme is the same, the original validation still applies. It applies only if the worst-case soil hasn't changed. If the new product introduces a more challenging matrix, the gap exists from the first production run — not from the first audit finding.

The practical rule: revalidation scope should follow soil matrix change, not label change. The decision test that holds up in practice runs across three parameters:

One final point on study design that often gets missed: worst-case in a validation context means worst-case for cleaning, not worst-case for production. That means aged soil — not fresh product residue — applied at the maximum realistic loading, run at the minimum temperature the programme is designed to hold, with the detergent at its lower specification concentration. A study run on freshly deposited soil at nominal temperature and mid-range detergent concentration will pass. It won't tell you whether the programme holds when conditions drift toward their limits, which is exactly when you need it to.

The comparison between new product soil matrix and validated worst-case needs to happen at the NPD gate — not as a retrospective triggered by a non-conformance. By the time a failed swab forces the question, you've already run product on an unvalidated process.

If this is something your site is working through, reply and let me know — always happy to hear how others are handling revalidation triggers in practice.