diff --git a/src/controller/audit.controller/index.js b/src/controller/audit.controller/index.js
index 07930c35c..4a95b181c 100644
--- a/src/controller/audit.controller/index.js
+++ b/src/controller/audit.controller/index.js
@@ -36,8 +36,8 @@ router.get('/audit/org/:org_identifier',
 
 // Get last X changes (Secretariat or Org Admin)
 router.get('/audit/org/:org_identifier/:number_of_changes',
-  mw.onlySecretariat,
   mw.validateUser,
+  mw.onlySecretariat,
   auditMw.parseGetParams,
   controller.AUDIT_GET_LAST
 )
diff --git a/src/controller/registry-org.controller/index.js b/src/controller/registry-org.controller/index.js
index 997a8e771..c24148d6a 100644
--- a/src/controller/registry-org.controller/index.js
+++ b/src/controller/registry-org.controller/index.js
@@ -212,8 +212,8 @@ router.post('/registryOrg',
   }
   */
   mw.useRegistry(),
-  mw.onlySecretariat,
   mw.validateUser,
+  mw.onlySecretariat,
   body(['reports_to']).not().exists().withMessage('reports_to must not be present'),
   parseError,
   parsePostParams,