This is Dr GMO's (patent pending) method to explain and remember Validation vs. Monitoring vs. Verificiation.
Validation = can it work?
Monitoring = is it working?
Verification = independent evidence that it's working
Validation is before you start (ideally, you may have to do something retrospective if you have an existing system but that's not ideal.)
Monitoring is real time
Verification is often after the fact and infrequent.
So, validation is often theoretical. Think about it this way with the example of cooking a chicken. You know that if you don't cook it, you're likely to get Salmonella or Campylobacter right? So you cook it.
But how do you know that cooking kills these bacteria? What critical limit should you chose? It's not practical in a kitchen to do microbiological testing so how do you approach it? Well, if you're a geek or maybe a caterer you might look up in a microbiology book or refer to a business run scheme like Safer Food, Better Business. From either of these sources you're likely to be able to find that cooking kills these pathogens and the temperatures at which these vegetative bacteria will be killed. Therefore, you have now found some Validation information before you even unwrap the chicken.
So validation is all about designing your process to ensure the HACCP plan and CCPs are effective.
Validation though does not need to be theoretical. Here's another example. If you were designing a retort cooking process for a meal, you would refer to sources of informaiton on microbiology as before but because the retort has a cooling cycle and probing the packs is destructive, you decide to do some experimental monitoring of the retort programme to design the programme to ensure 90oC is achieved for minimum 10 mins for example. The product used for the trials wouldn't be sent out to customers because until you've designed your retort programme, you're not sure the product is safe.
Once you've set up everything you're going to do, you then do some monitoring. For your chicken, you could monitor by using a kitchen temperature probe. For the retort it might be monitoring of the programme itself (if you've validated that a certain programme temperature achieves an acceptable internal temperature).
Then verification, for this you can look at microbiological results (for your retort), customer complaints (did your wife complain the chicken made her sick?!) etc etc.