Maybe I reworded what I do wrong? I'm not sure, all i know is the approach I described I have done and actually received a glowing review from our auditor on it. Now that was one auditor and who knows what the next one will say.
I used to say we validated such programs through the use of internal audits and that was always shaky during audits. Received a lot of questions from auditors on it and was just a lot of explaining. I consulted and auditor friend of mine and they mentioned that I need to define how the use of audits and observations are showing that what we have in place is working. I asked if we defined metrics (like I described above in my post) and used the audits and observations in turn to show that the results were within defined metrics would that help, and the response was 'now you are understanding what they are most likely looking for to link your validating of programs through the use of audits and observations'. Switched to doing it that way and documenting it and have had no questions.
Everyone needs to find a way that works best for them, their audit scheme, their program and their company. We all know how different auditors react to different things. So what worked this year for one auditor, may not work next year for a different one.
Hi Scotty,
I agree with the ending of yr 2nd paragraph above except, predictably, for the one word highlighted in "blue".
The discussion that has been revolving in this thread has now been repeated several times in the last few years and every time seems to ultimately reach the same sad conclusion as noted in yr last paragraph.
The cause of all this confusion should IMO definitely not be laid on you. IMO the buck stops with "SQF" due their implementation of the SQF Standard and, seemingly, their inability to "standardize" their Auditors over the handling of this topic.
This (Codex Validation 2008) re-quote was also contained in the (2017) post linked in Post 9 -
Validation is performed at the time a control measure or a food safety control system is designed, or when changes indicate the need for re-validation (see section VII). Validation of control measures is, whenever possible, performed before their full implementation.
There is often confusion among the concepts of validation, monitoring and verification. Validation of control measures as described in this document is different from monitoring and verification, which both take place after the validated control measures have been implemented. Monitoring and verification are the tools used to check whether the control measures are being adhered to and to demonstrate that they are operating as intended.
(The remainder of the previously linked Post contains a detailed analysis of this, seemingly, infinitely recurring, SQF Auditorial Issue).
The relevance of Internal Audits should IMO be interpreted within the chronological context of above re-quotation.
"Nuff said" I guess. 
PS - JFI I noticed this short article comparing "Validation of PRPS" in BRC, SQF, FSMA which illustrates some differences. One odd aspect is zero mention of Codex, ie article is presumably US oriented.
https://fsns.com/req...isite-programs/
PPS -
It was not discussed in previous Posts of this thread but one further consequence of SQF essentially ignoring Codex's chronological distinction between Validation/Verification is to create confusion over responses to Section 2.5.2, eg this near-Horror Story -
https://www.ifsqn.co...es/#entry130802