When a hazard is controlled upstream by the supplier, Subpart G of 21 CFR Part 117 requires a supply-chain program.
Not every hazard gets controlled on your own line. Subpart G of Part 117 covers the cases where a facility’s hazard analysis identifies a hazard that will instead be controlled upstream, by the supplier, before an ingredient ever arrives. A pathogen kill step performed by an ingredient supplier rather than the receiving facility is the most common example. Wherever that pattern applies, a supply-chain program is required, scoped to that specific ingredient and hazard rather than imposed facility-wide.
Relying on a supplier to control a hazard starts with approving that supplier. Approval has to be based on demonstrated food safety performance and compliance with applicable FDA regulations, tracked through an approved supplier list that records which suppliers may ship which covered ingredients. An unapproved supplier can only be used temporarily, and only under specific, documented conditions.
Once a supplier is approved, Part 117 defines four types of verification activity: an onsite audit, sampling and testing of the ingredient itself, a review of the supplier’s food safety records, or another activity justified by the specific hazard analysis. An onsite audit is generally required for hazards that could cause serious illness or death. Choosing between the options is a risk-based decision, weighing the severity of the hazard against the supplier’s performance history, and the choice is reassessed periodically and whenever conditions change.
None of this counts unless it is documented. This course closes with the recordkeeping a supply-chain program requires: a written program describing approved suppliers and the verification activities used for each, and retained records, audit reports, test results, or document reviews, that let both the facility and FDA confirm the hazard is actually being controlled.
A hazard that a supplier controls upstream is only controlled if the receiving facility can show it. Approving suppliers on demonstrated performance, choosing verification activities on risk and keeping the records is what lets both the facility and FDA confirm that the control is working.
Completion certificate, PDF slide download, and access to the complete GMP course library from day one.
Start this course →