21 CFR 117 Subpart G - Supply-Chain Program

What it says

When the hazard analysis identifies a hazard that a supplier will control, the receiving facility must have a risk-based supply-chain program that includes approving suppliers, determining and conducting appropriate supplier verification activities, such as onsite audits, sampling and testing, or review of records, and documenting them. For hazards that could cause serious adverse health consequences or death, an onsite audit is the default verification unless an alternative is justified in writing.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• This subpart applies only where the receiving facility relies on its supplier, rather than a control of its own, for a significant hazard.
• The facility has to approve suppliers before using them and keep records of that approval and the verification that follows.
• Supplier verification isn't a one-time event, as activities need to be repeated at appropriate intervals.

What FDA inspectors look for

• Whether suppliers that control a significant hazard were approved before use.
• Whether verification activities match the hazard and are documented.
• Whether supplier issues were followed by action, such as more verification or a change of supplier.

Related regulations