How do control strategies get defined before validation?

Identify CQAs, link to CPPs, set monitoring and alarm logic, and document responses and acceptance criteria.