Supply Chain Program Workflow

🚚

Supply Chain Program - Controlling Hazards That Your Suppliers Control

When a hazard in a raw material or ingredient is controlled by the supplier before it reaches you, the facility must rely on a supply-chain program rather than its own process control. The receiving facility must approve its suppliers, decide which verification activities are appropriate and how often, carry them out, and document the results. Onsite audits are required before use and at least annually for hazards with a reasonable probability of serious adverse health consequences or death, unless the facility documents why other verification or a lower frequency is adequate.

21 CFR Part 117 Subpart G · 117.135(c)(4) · FSMA Section 103

21 CFR 117 Subpart G

21 CFR 117.135(c)(4)

Supplier Verification

Supply-Chain-Applied Control

A control applied by a supplier, not the receiving facility, to a hazard in a raw material or ingredient before receipt.

Basis: Identified in the hazard analysis

Approved Supplier

A supplier the receiving facility has approved in writing, based on its hazard analysis and its verification of the supplier.

Basis: Written approval

Verification Activities

Onsite audits, sampling and testing, review of the supplier's food safety records, and other risk-based activities.

Basis: Risk-based and documented

Onsite Audit

An audit by a qualified auditor of the supplier's facility, focused on the hazards the supplier is controlling.

Basis: Before use and at least annually

Phase 1

Supplier Risk Assessment

1Identify hazards controlled by suppliers

Hazard analysis identifies hazards in raw materials and ingredients that are controlled before receipt, not by the facility.

21 CFR 117.130 · 117.135(c)(4)

↓

2Determine which materials are in scope

Raw materials and ingredients where the supplier controls a hazard requiring a preventive control brought under the program.

21 CFR 117.405

↓

3Assess each supplier's risk

Hazard severity, supplier procedures, compliance history, and the food safety record of the supplier considered together.

21 CFR 117.425

↓

4Define responsibilities

The facility confirms what it must do itself and what others may do, with their work reviewed and documented.

21 CFR 117.415

Phase 2

Approval and Verification Planning

Is there a reasonable probability of serious adverse health consequences or death?

YES → Onsite audit before use and annually NO → Choose other risk-based verification

↓

5Approve suppliers

Suppliers approved in writing before material is used, based on the hazards they control and on verification of their controls.

21 CFR 117.420

↓

6Set verification activities and frequency

Audit, testing, records review, or other activities chosen for each supplier, with the frequency and reasoning documented.

21 CFR 117.425

↓

7Establish receiving procedures

Written procedures ensure that material arrives only from approved suppliers, with limits on temporary use of an unapproved supplier.

21 CFR 117.420(b)

Phase 3

Verification Activities

8Conduct onsite audits

Qualified auditors audit the supplier's controls over the hazard, before use and at least annually where required.

21 CFR 117.430(b) · 117.435

↓

9Conduct testing and records review

Product sampling and testing, and review of the supplier's relevant food safety records, performed at the set frequency.

21 CFR 117.430(a) · 117.410(b)

↓

10Act on nonconformance

When a supplier is not controlling a hazard, prompt action is taken, including approval status and affected material.

21 CFR 117.410(e) · 117.150

Phase 4

Records and Reevaluation

11Document supplier verification

Approval, determinations, audit reports, test results, records reviewed, and actions taken kept for each supplier.

21 CFR 117.475

↓

12Review records on time

Supply-chain program records reviewed within 7 working days, or a documented reasonable period.

21 CFR 117.475(b) · 117.165(a)(4)

↓

13Reevaluate suppliers and the program

Supplier approval and verification reevaluated when performance, hazards, or circumstances change, and as part of reanalysis.

21 CFR 117.425 · 117.170

Supplier Verification Activities (Overview)

Onsite Audit

Required before using a supplier and at least annually for a hazard with a reasonable probability of serious adverse health consequences or death, unless a documented determination supports other or less frequent verification.

21 CFR 117.430(b)

Sampling and Testing

Product testing at a frequency tied to the hazard and the supplier's record, with results compared to specifications.

21 CFR 117.410(b)

Records Review and Other Activities

Review of the supplier's food safety records, and other appropriate risk-based activities, including qualifying inspection results used in place of an audit.

21 CFR 117.410(b) · 117.435

Supplier Nonconformance Response (Overview)

Detect A failed audit, an out-of-specification test result, or a record review finding shows the supplier is not controlling the hazard.

Contain Affected incoming material is held, and product already made with it is evaluated for safety.

Act on approval status The supplier is placed on hold, restricted, or removed from the approved list until the cause is corrected and verified.

Document and reevaluate The action is recorded, and verification activities and frequency for that supplier are reevaluated.

Key Supply-Chain Program Outputs (Overview)

Approved supplier list Which suppliers are approved for which materials, and the status of each.

Verification plan and risk assessment The activity and frequency chosen for each supplier, with the reasoning behind it.

Audit, testing, and records review results Evidence that verification was carried out as planned and what it found.

Supplier performance and reevaluation record A running view of how each supplier performs and when its approval was last reevaluated.

Supply-Chain Program Quality Elements

Hazard Linkage Every supplier control traced to a specific hazard identified in the written hazard analysis.

Approved Supplier Control Only approved suppliers supply in-scope material, and the list is kept current.

Risk-Based Verification Activity and frequency chosen from hazard severity and supplier performance, not convenience.

Qualified Auditors Auditors with documented qualifications and no financial conflict of interest.

Independent Judgment The facility makes its own determinations and does not accept the supplier's own verification as its own.

Receiving Controls Receiving procedures that actually confirm the supplier and lot before material is used.

Nonconformance Response Defined action on approval status and affected material whenever a supplier fails to control a hazard.

Records and Reevaluation Complete records reviewed on time, with supplier approval revisited as circumstances change.

Never do this

Accept a supplier's own audit or verification as your own. Receive in-scope material from a supplier you have not approved. Rely on a certificate of analysis without ever verifying it. Treat approval as a one-time event. Leave a supplier on the approved list after it has failed to control a hazard.

Supplier-controlled vs facility-controlled hazards

The supply-chain program applies only where the hazard is controlled by the supplier before receipt. If your own process, such as a validated kill step, controls the hazard, the ingredient does not need a supply-chain program for that hazard.

Alternatives to an onsite audit

For a supplier whose hazard calls for an audit, written results of an appropriate inspection by FDA, another federal agency, or a state, local, tribal, or territorial agency may be used, if the inspection took place within one year of when the audit would have been required.

Key regulations

21 CFR 117.405 to 117.435 - supply-chain program requirements. 21 CFR 117.475 - supply-chain program records. 21 CFR 117.135(c)(4) - supply-chain-applied controls. 21 CFR 117.160(c) - validation not required for supply-chain controls. 21 CFR 117.150 - corrective action when a supplier is not controlling a hazard.