Why This Confusion Causes Real Problems
Verification and validation. Two words that appear constantly across ISO standards, often in the same clause, sometimes in the same sentence. Most people treat them as interchangeable. Auditors know they are not, and that confusion regularly leads to nonconformities during certification audits.
On this page
If you are working towards ISO 9001, ISO 13485, ISO 22000, or virtually any other management system standard, you will encounter both terms. Getting them wrong in your documented processes is not just a technicality. It can mean your product leaves the factory before it should, your process is signed off without the right evidence, or your audit fails on a clause you thought you had covered.
This article breaks down the difference between verification and validation in plain terms, shows you where each one applies across common ISO standards, and gives you practical guidance on how to implement both correctly.
The Core Definitions: What ISO Actually Means
Let us start with what ISO itself says. ISO 9000:2015, the vocabulary standard for quality management, provides the official definitions that underpin ISO 9001 and many related standards.
What Is Verification?
Verification is the confirmation, through objective evidence, that specified requirements have been fulfilled. In simpler terms, verification asks: did we build it right?
You are checking that something conforms to a predefined specification, drawing, standard, or requirement. The product or output is compared against what was planned or specified. If it matches, verification is satisfied. If it does not, something has gone wrong in the process.
Think of verification as an internal check. You defined the requirements at the start. Verification confirms you met them.
What Is Validation?
Validation is the confirmation, through objective evidence, that the requirements for a specific intended use or application have been fulfilled. In simpler terms, validation asks: did we build the right thing?
Validation goes beyond the specification. It asks whether the output actually works as intended in the real world, for the actual user, in the actual conditions it will be used. A product can pass every internal specification check and still fail validation if it does not perform as the customer or end user needs it to.
Think of validation as an external check. You are confirming that what you produced actually serves its intended purpose.
A Simple Example to Make It Stick
Here is a scenario that makes the distinction very clear.
A manufacturer produces a custom steel bracket for a construction client. The drawing specifies dimensions, material grade, and load tolerance. The quality team checks the finished bracket against the drawing. All measurements are within tolerance. The material certificate matches the specification. This is verification. The bracket was built to the spec.
Now the bracket goes to site. The construction team installs it and tests it under real load conditions, in the actual environment, with the actual fasteners being used. It holds. The client confirms it works as intended for its specific application. This is validation. The bracket does what it was actually supposed to do.
Here is where it gets interesting. What if the drawing had an error? The bracket passes verification because it matches the drawing perfectly. But if the drawing was wrong, the bracket might fail on site. Verification alone would not have caught that. Validation would.
This is why both activities matter. They catch different types of failure.
Where Verification and Validation Appear in ISO Standards
ISO 9001:2015
ISO 9001 addresses both concepts primarily in Clause 8, which covers operational planning and control. Clause 8.3 on design and development is where verification and validation are most explicitly required.
Clause 8.3.4 requires design and development controls to include verification activities to ensure outputs meet input requirements. Clause 8.3.4 also requires validation to ensure the resulting products and services meet the requirements for the specified application or intended use.
Clause 8.5.1 on production and service provision also references validation of processes, specifically for processes where the resulting output cannot be verified by subsequent monitoring or measurement. These are often called special processes, such as welding, sterilisation, or heat treatment, where you cannot simply inspect the end product to confirm the process worked correctly. You must validate the process itself.
If you are working through the clauses of ISO 9001, our beginner's guide to ISO 9001:2015 gives you a solid foundation before diving into the more technical requirements.
ISO 13485 (Medical Devices)
In the medical device sector, the distinction between verification and validation is not just important. It is legally significant. ISO 13485 has very detailed requirements for both, and regulators including the TGA in Australia treat inadequate validation as a serious risk.
Verification in ISO 13485 confirms that design outputs meet design inputs. Validation confirms that the device performs as intended for its specified use, often requiring clinical evaluation or usability testing with actual users.
A device that passes all bench testing but causes problems when used by a nurse in a real clinical setting has passed verification but failed validation.
ISO 22000 (Food Safety)
ISO 22000 uses both terms in the context of food safety management. Verification activities confirm that the HACCP plan and prerequisite programmes are working as intended. They check whether the system is being implemented correctly.
Validation in ISO 22000 is about confirming that the control measures you have selected are actually capable of controlling the hazard to the required level. You validate before you implement, or when conditions change. Verification happens during and after implementation.
This is a subtle but critical difference. Validation asks: will this control measure work? Verification asks: is this control measure working?
ISO 27001 (Information Security)
While ISO 27001 does not use the terms verification and validation as frequently as quality or product standards, the concepts still apply. Controls are verified through internal audits and monitoring. The effectiveness of those controls in actually protecting information assets is closer to validation.
Our beginner's guide to ISO 27001 covers how the standard approaches control implementation and monitoring, which maps closely to these concepts.
The Key Differences Summarised
Here is a direct comparison to keep things clear.
- Verification checks conformance to specified requirements. Validation checks fitness for intended use.
- Verification is typically done against internal documents, drawings, or specifications. Validation is typically done against real-world conditions, user needs, or intended application.
- Verification can often be done by the manufacturer or developer. Validation often involves end users, customers, or real operating conditions.
- Verification asks: does this match what we specified? Validation asks: does this actually work as intended?
- Verification happens throughout development and production. Validation often happens at the end, before release or deployment.
- A product can pass verification and fail validation. It cannot logically pass validation without having met at least the requirements that matter for its intended use.
Common Mistakes Businesses Make
Treating Verification as Validation
This is by far the most common error. A business runs a series of checks against its internal specifications and calls it validation. When an auditor asks to see validation records, they are presented with inspection reports and measurement data. That is verification evidence, not validation evidence.
Validation requires you to demonstrate that the output works in its intended context. Inspection data alone does not prove that.
Skipping Validation for Special Processes
Many manufacturers know they need to verify product dimensions and material properties. Far fewer have proper validation records for their welding procedures, coating processes, or bonding operations. ISO 9001 Clause 8.5.1(f) is explicit: processes where outputs cannot be verified by subsequent monitoring must be validated. An auditor will look for this, and missing validation records for special processes is a common major nonconformity.
Confusing Validation with Customer Approval
Getting a customer to sign off on a product is not the same as validation. Validation requires objective evidence that the product meets the requirements for its intended use. A customer signature on a delivery docket does not constitute that evidence. You need documented testing, trials, or evaluation records that demonstrate fitness for purpose.
Not Revalidating After Changes
If you change a material, a process, a supplier, or a design parameter, your previous validation may no longer be valid. This catches businesses out regularly. The original validation was done correctly, but a subsequent change was not revalidated. The product now fails in the field, and the business has no documented evidence that the changed version was ever confirmed to work as intended.
This connects directly to the importance of controlled documents and change management within your management system. When documents change, the validation status of related outputs needs to be reviewed.
How to Document Verification and Validation Correctly
For Verification
Verification records should clearly show what was checked, against what requirement, by whom, using what method, and what the result was. Typical verification records include inspection reports, measurement records, test certificates, material conformance certificates, and drawing sign-offs.
The key is traceability. You should be able to trace any finished product back to the verification activities that confirmed it met its specifications.
For Validation
Validation records need to demonstrate that the output was tested or evaluated under conditions representative of its intended use. This might include:
- Documented user trials or field tests with results
- Performance testing under simulated real-world conditions
- Clinical evaluation reports for medical devices
- Process validation protocols and reports for special processes
- Customer acceptance testing with defined acceptance criteria
- Pilot production runs with documented outcomes
The validation record must show what was tested, under what conditions, against what acceptance criteria, and what the outcome was. It must be approved by someone with the authority to confirm the product or process is suitable for release.
Linking the Two in Your Quality Management System
In a well-structured QMS, verification and validation are not standalone activities. They are connected to your design and development process, your production controls, your nonconformity management, and your change control procedures.
When you design a new product, you plan both verification and validation activities upfront. Verification checkpoints are built into the development stages. Validation is planned for the end of development, before release. If a nonconformity is found during verification, it is addressed before validation begins. If validation fails, the issue is fed back into the design process.
Understanding how these activities fit into the broader system is part of what makes ISO 9001 genuinely useful rather than just a compliance exercise. Our article on Clause 4.4 and your quality management system processes explains how to map these activities into your overall process framework.
Practical Tips for Getting This Right
If you are implementing or maintaining a management system and want to get verification and validation right, here is what actually works in practice.
- Label your records correctly. Train your team on the difference and make sure inspection records are called verification records and fitness-for-use testing is called validation. Auditors notice when organisations mislabel these activities.
- Plan validation before you start design. Do not leave validation as an afterthought. Define your validation criteria at the same time you define your design inputs. This forces you to think about intended use from the beginning.
- Identify your special processes early. Map every process in your operation and flag any where the output cannot be fully inspected. These all need validation plans, not just verification.
- Build revalidation triggers into your change control process. Any change to materials, equipment, processes, or design parameters should automatically trigger a review of whether existing validation remains valid.
- Use objective evidence, not opinion. Both verification and validation require objective evidence. An engineer saying “it looks fine” is not acceptable. You need data, test results, or documented evaluation against defined criteria.
Why Auditors Focus on This Distinction
From an auditor's perspective, the verification versus validation distinction is a reliable indicator of how well a business actually understands its quality management obligations. Organisations that get it right tend to have fewer product failures, fewer customer complaints, and more robust processes overall.
Organisations that conflate the two tend to have gaps in their design controls, inadequate special process controls, and a higher risk of releasing products that technically meet the spec but fail in practice. These are not minor administrative issues. They represent genuine quality and safety risks.
When you sit down with an auditor for your Stage 2 certification audit, expect to be asked about both. You will need to show verification records for your products and validation records for your processes, particularly any special processes. If you are in design and development, you will need to show both for your design outputs.
Our guide on what to do before your ISO Stage 2 certification audit covers how to prepare your documented evidence across all the key clauses, including design controls.
Getting Help With Your Management System
Understanding the difference between verification and validation is one thing. Building it correctly into your management system documentation, processes, and records is another. Many businesses find that the conceptual understanding comes quickly, but translating it into practical, audit-ready systems takes experience.
If you are working towards ISO 9001, ISO 13485, ISO 22000, or any other standard where these concepts appear, getting the right guidance early saves significant rework later. A good ISO consultant will not just help you understand the definitions. They will help you map verification and validation activities to your specific products and processes, build the right templates and records, and ensure your system holds up under audit scrutiny.
At CertBetter, we connect businesses with verified ISO consultants and accredited certification bodies across Australia and globally. You submit one form, and you receive up to three competing quotes from vetted providers who understand your industry. The service is completely free for businesses seeking certification help. If you want expert guidance on getting your verification and validation activities right before your next audit, CertBetter is a good place to start.
