Current Good Manufacturing Practice and 
Preventive Controls, Foreign Supplier 
Verification Programs, Intentional Adulteration, 
and Produce Safety Regulations: 
Enforcement Policy Regarding Certain 
Provisions 
 
Guidance for Industry 
 
 
You may submit electronic or written comments regarding this guidance at any time. Submit 
electronic comments to https://www.regulations.gov. Submit written comments to the Dockets 
Management Staff (HFA-305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061, 
Rockville, MD 20852. All comments should be identified with the docket number FDA-2021-D-
0563, listed in the notice of availability published in the Federal Register.  
 
For questions regarding this document, you may contact the FSMA Technical Assistance 
Network online at https://www.fda.gov/food/guidanceregulation/fsma/ucm459719.htm, by mail 
at Food and Drug Administration; 5001 Campus Drive; Wiley Building, HFS-009; Attn: FSMA 
Outreach; College Park, MD, 20740, or by phone at 1-888-SAFEFOOD (1-888-723-3366).   
 
 
 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Food Safety and Applied Nutrition 
Center for Veterinary Medicine 
Office of Regulatory Affairs 
 
 
 
 
 
 
 
March 2022   
  Contains Nonbinding Recommendations 
Table of Contents 
 
I. Introduction ..........................................................................................................3   
II. Background .........................................................................................................4   
A. Enforcement Policy for Entities Growing, Harvesting, Packing, or 
Holding Hops, Wine Grapes, Pulse Crops, and Almonds ................................ 6 
B. Enforcement Policy for Certain Entities Subject to CGMP and 
Preventive Controls, Produce Safety, and/or FSVP Requirements ................ 6 
1. Specific facilities subject to part 117 and/or part 507 that conduct farm-
related activities ....................................................................................................7   
2. Written assurances in the customer provisions in part 117 and related 
rules .......................................................................................................................7   
3.  Certain human food by-products for use as animal food ................................ 7 
III. Discussion ...........................................................................................................8   
A. Extension of Enforcement Policy for Supply-Chain Program 
Requirements Applicable to Co-Manufacturers of Human Food and Animal 
Food ........................................................................................................................8   
B. Enforcement Policy for Certain Entities and Requirements Under the 
Mitigation Strategies to Protect Food Against Intentional Adulteration 
Regulation............................................................................................................10 
1.  Enforcement policy for IA requirements for facilities covered by the January 
2018 enforcement policy related to farm-related activities ...............................10 
2.  Enforcement policy with regard to the requirement for reanalysis in 21 CFR 
121.157(b)(3) ......................................................................................................11 
C. Enforcement Policy for Supplier Approval and Verification 
Requirements in Part 117, Part 507, and the FSVP Regulation ....................12 
IV. References .........................................................................................................14 
  
   
2 
 
  Contains Nonbinding Recommendations 
 
Current Good Manufacturing Practice and 
Preventive Controls, Foreign Supplier 
Verification Programs, Intentional Adulteration, 
and Produce Safety Regulations: 
Enforcement Policy Regarding Certain 
Provisions 
 
Guidance for Industry 
 
This guidance represents the current thinking of the Food and Drug Administration (FDA, the 
Agency, or we) on this topic. It does not establish any rights for any person and is not binding on 
FDA or the public. You can use an alternative approach if it satisfies the requirements of the 
applicable statutes and regulations. To discuss an alternative approach, contact the FDA staff 
responsible for this guidance as listed on the title page. 
 
I. Introduction 
The purpose of this document is to state that the Food and Drug Administration (FDA, we, or the 
Agency), at this time and based on our current understanding of the risks, does not intend to 
enforce certain regulatory requirements as they currently apply to certain entities and/or 
activities.  The applicable requirements are established in our regulations entitled Current Good 
Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Food for 
Animals (21 CFR Part 507); Current Good Manufacturing Practice, Hazard Analysis, and 
Risk-Based Preventive Controls for Human Food (21 CFR Part 117); Foreign Supplier 
Verification Programs for Importers of Food for Humans and Animals (21 CFR Part 1, Subpart 
L (FSVP)); Mitigation Strategies to Protect Food Against Intentional Adulteration (21 CFR 
Part 121); and Standards for Growing, Harvesting, Packing, or Holding of Produce for Human 
Consumption (21 CFR Part 112).   
 
Section II of this document describes certain enforcement discretion policies that were issued 
previously and are relevant to the enforcement policies discussed in sections III.B and III.C.  
Section III describes new or extended enforcement discretion policies.  Section III.A describes 
our extension of FDAs enforcement discretion in certain circumstances when a receiving facility 
that is a contract manufacturer/processor not in compliance with certain supply-chain program 
requirements for food manufactured for a brand owner.  Section III.B describes that we do not 
intend to enforce requirements of the Intentional Adulteration regulation for facilities under the 
preexisting farm-activity related enforcement policy.  Section III.B also announces that FDA 
3 
 
  Contains Nonbinding Recommendations 
does not intend to enforce the Intentional Adulteration regulations requirement for reanalysis in 
certain circumstancesfor example, when there is a single failure that is addressed through 
implementation of corrective action procedures.  Section III.C describes that FDA does not 
intend to enforce the supplier approval and verification requirements in part 117, part 507, and 
the FSVP regulation with regard to supplier compliance with requirements that are already 
associated with an enforcement discretion policy.   
 
We are issuing this guidance consistent with our good guidance practices regulation (21 CFR 
10.115).  This guidance is immediately effective because FDA has determined that prior public 
participation is not feasible or appropriate (21 CFR 10.115(g)(2)), on the basis that the guidance 
presents a less burdensome policy that remains consistent with FDAs public health mission.  As 
with all guidance documents, the public can comment on the guidance at any time (21 CFR 
10.115(g)(5)).  If FDA receives comments on the guidance document, FDA will review those 
comments and revise the guidance document when appropriate (21 CFR 10.115(g)(3)(ii)).  
 
The contents of this document do not have the force and effect of law and are not meant to bind 
the public in any way, unless specifically incorporated into a contract. This document is intended 
only to provide clarity to the public regarding existing requirements under the law. FDA 
guidance documents, including this guidance, should be viewed only as recommendations, unless 
specific regulatory or statutory requirements are cited.  The use of the word should in Agency 
guidance means that something is suggested or recommended, but not required. 
 
In this guidance, pronouns such as you refer to entities that are covered by this guidance.  
II. Background  
See Table 1 for information about the rulemakings to establish five regulations as part of our 
implementation of the FDA Food Safety Modernization Act (FSMA; Pub. L. 111-353) and for 
the abbreviations that we use in this document for these regulations. You can access the listed 
Federal Register publications and other information about these regulations from our FSMA 
website (https://www.fda.gov/fsma) and from the Docket No. (listed in Table 1) established for 
each rulemaking (available at https://www.regulations.gov). 
 
 
 
 
 
 
 
 
 
 
 
 
Table 1.The Regulations That Are Relevant to This Guidance Document 
4 
 
  Contains Nonbinding Recommendations 
Title and Regulatory Citation  Abbreviation  Docket No. and Key Publications in the 
Used in This  Federal Register1 
Document 
Current Good Manufacturing Practice,  part 507    Docket No. FDA2011N0922  
Hazard Analysis, and Risk-Based    Proposed rule: 78 FR 64736, October 29, 
Preventive Controls for Food for  2013 
Animals (21 CFR part 507)    Supplemental notice of proposed 
rulemaking: 79 FR 58476, September 29, 2014 
  Final rule: 80 FR 56170, September 17, 2015 
  Final rule; extension and clarification of 
compliance dates for certain provisions: 81 FR 
57784, August 24, 2016 
Current Good Manufacturing Practice,  part 117    Docket No. FDA2011N0920  
Hazard Analysis, and Risk-Based    Proposed rule: 78 FR 3646, January 16, 2013  
Preventive Controls for Human Food (21    Supplemental notice of proposed 
CFR part 117)  rulemaking: 79 FR 58524, September 29, 2014  
  Final rule: 80 FR 55908, September 17, 2015  
  Final rule; extension and clarification of 
compliance dates for certain provisions: 81 FR 
57784, August 24, 2016 
Foreign Supplier Verification Programs  FSVP    Docket No. FDA2011N0143 
for Importers of Food for Humans and  regulation    Proposed rule: 78 FR 45730, July 29, 2013 
Animals (21 CFR Part 1, Subpart L)     Supplemental notice of proposed 
rulemaking: 79 FR 58574, September 29, 2014 
  Final rule: 80 FR 74226, November 27, 2015 
  Final rule; extension and clarification of 
compliance dates for certain provisions: 81 FR 
57784, August 24, 2016 
Mitigation Strategies to Protect Food  IA regulation or    Docket No. FDA-2013-N-1425 
Against Intentional Adulteration (21  part 121    Proposed rule: 78 FR 78014, December 24, 
CFR Part 121)  2013 
  Final rule: 81 FR 34166, May 27, 2016 
Standards for the Growing, Harvesting,  Produce Safety    Docket No. FDA2011N0921 
Packing, and Holding of Produce for  regulation or    Proposed rule: 78 FR 64736, October 29, 
Human Consumption (21 CFR part 112)  part 112  2013 
  Supplemental notice of proposed 
rulemaking: 79 FR 58434, September 29, 2014 
  Final rule: 80 FR 74354, November 27, 2015 
  Final rule; extension and clarification of 
compliance dates for certain provisions: 81 FR 
57784, August 24, 2016 
 
 
Since issuing the regulations listed in Table 1, FDA has issued three enforcement policy 
guidances relevant to this guidance document that recognize that industry is still in the process of 
coming into compliance with a requirement or that FDA is considering options to address 
 
1 During each rulemaking listed in Table 1, we also issued several notices extending the comment period or 
announcing a public meeting to discuss the proposed rule. For the complete history of Federal Register publications 
associated with each rulemaking, see the applicable final rule. 
5 
 
  Contains Nonbinding Recommendations 
concerns raised by stakeholders.2  Below we identify and describe several enforcement 
discretion policies from those guidances that are relevant to the new enforcement discretion 
policies discussed later in this guidance in section III.  The enforcement policies identified and 
described in sections II.A and II.B are unchanged. 
A. Enforcement Policy for Entities Growing, Harvesting, Packing, or Holding 
Hops, Wine Grapes, Pulse Crops, and Almonds 
In a notice published in the Federal Register of March 28, 2019 (84 FR 11644), we announced 
the availability of a guidance for industry entitled Produce Safety Rule: Enforcement Policy for 
Entities Growing, Harvesting, Packing, or Holding Hops, Wine Grapes, Pulse Crops, and 
Almonds: Guidance for Industry (the produce commodity guidance) 
(https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-industry-
enforcement-policy-entities-growing-harvesting-packing-or-holding-hops-wine-grapes).  The 
produce commodity guidance announced our intent not to enforce part 112 for entities growing, 
harvesting, packing, or holding almonds, hops, pulse crops, or wine grapes while we consider 
rulemaking to address the unique circumstances of these commodities.   
B. Enforcement Policy for Certain Entities Subject to CGMP and Preventive 
Controls, Produce Safety, and/or FSVP Requirements 
In a notice published in the Federal Register of January 5, 2018 (83 FR 598), we announced the 
availability of a guidance for industry entitled Policy Regarding Certain Entities Subject to the 
Current Good Manufacturing Practice and Preventive Controls, Produce Safety, and/or Foreign 
Supplier Verification Programs: Guidance for Industry (the January 2018 enforcement policy 
guidance) (https://www.fda.gov/regulatory-information/search-fda-guidance-
documents/guidance-industry-policy-regarding-certain-entities-subject-current-good-
manufacturing-practice-and).  The January 2018 enforcement policy guidance announced our 
intent not to enforce certain requirements, as follows: 
 
  Part 117 and/or part 507 as applied to specific facilities that conduct farm-related activities: 
  Facilities that would qualify as secondary activities farms except for the ownership of 
the facility; 
  Facilities that would qualify as farms if they did not color raw agricultural 
commodities (RACs); 
  Facilities that would qualify as secondary activities farms except that they pack, 
package, label, and/or hold processed food that consists only of RACs that have been 
dried/dehydrated to create a distinct commodity; 
  Farm mixed-type facilities making silage food for animals; 
 
2 Those guidances are:  (1) Produce Safety Rule: Enforcement Policy for Entities Growing, Harvesting, Packing, or 
Holding Hops, Wine Grapes, Pulse Crops, and Almonds: Guidance for Industry, (2) Policy Regarding Certain 
Entities Subject to the Current Good Manufacturing Practice and Preventive Controls, Produce Safety, and/or 
Foreign Supplier Verification Programs, and (3) Supply-Chain Program Requirements and Co-Manufacturer 
Supplier Approval and Verification for Human Food and Animal Food: Guidance for Industry, all available at 
https://www.fda.gov/regulatory-information/search-fda-guidance-documents. 
6 
 
  Contains Nonbinding Recommendations 
  Written assurances requirements in the customer provisions in part 117, part 507, the 
Produce Safety regulation, and the FSVP regulation;  
  FSVP requirements as applied to the importation of food contact substances; and 
  Animal food preventive control requirements as applied to human food facilities, for certain 
human food by-products for use as animal food that are further manufactured/processed. 
1. Specific facilities subject to part 117 and/or part 507 that conduct farm-related activities 
In the January 2018 enforcement policy guidance, we stated that to provide sufficient time to 
pursue rulemaking related to farm-related activities and other solutions to the concerns regarding 
the applicability of part 117 and part 507, we intended for the enforcement policy to remain in 
effect until the completion of the future rulemaking related to farm-related activities.  Only 
certain facilities that conduct farm-related activities but are subject to part 117 and/or part 507 
are covered by the January 2018 enforcement policy guidance; those entities are listed in the sub-
bullets (arrows) above.  Until we complete the rulemaking related to farm-related activities, we 
intend to exercise enforcement discretion regarding:  (1) the part 117 and/or part 507 preventive 
controls requirements for the listed entities; (2) the part 507 current good manufacturing practice 
(CGMP) requirements for the listed entities that are subject to the part 507 CGMPs; or the part 
117 CGMP requirements with regard to non-produce RACs for the listed entities. Note that as 
indicated in the January 2018 enforcement policy guidance, for human food CGMPs applicable 
to produce RACs, we intend to enforce the requirements per our usual policies.  
2. Written assurances in the customer provisions3 in part 117 and related rules 
In the January 2018 enforcement policy guidance, we explained that industry provided us with 
feedback indicating that certain distribution chains would require vastly more written assurances 
than FDA had anticipated.  We stated that we intend to initiate a new rulemaking that takes into 
consideration complex supply chain relationships and resource requirements.  Until the 
completion of such a rulemaking, we intend to exercise enforcement discretion regarding the 
requirements related to written assurances in part 117, part 507, the FSVP regulation section 
1.507, and the Produce Safety regulation.  The written assurance provisions are 21 CFR 
117.136(a)(2)(ii), (3)(ii), and (4)(ii); 21 CFR 507.36(a)(2)(ii), (3)(ii), and (4)(ii); 21 CFR 
1.507(a)(2)(ii), (3)(ii), and (4)(ii) (FSVP regulation); and 21 CFR 112.2(b)(3) (Produce Safety 
regulation). 
3.  Certain human food by-products for use as animal food 
In the January 2018 enforcement policy guidance, we explained that we would be considering 
the application of part 507 preventive controls requirements to certain manufacturing/processing 
activities conducted on human food by-products, after separation from the human food, for use 
as animal food (e.g., drying/dehydrating to reduce weight, bulk, or volume of the food).  While 
we consider that issue, we intend to exercise enforcement discretion regarding the part 507 
preventive controls requirements related to human food by-products if after separation from the 
human food the entities are performing one of a limited number of manufacturing/processing 
 
3 The customer provisions of part 117, part 507, 21 CFR 1.507, and the Produce Safety regulation are listed in the 
January 2018 enforcement policy guidance at pp. 15-16. 
7 
 
  Contains Nonbinding Recommendations 
activities identified in the January 2018 enforcement policy guidance.4  This policy applies to 
human food facilities meeting the qualifications in 21 CFR 507.12(a)(1), including that their 
manufacturing/processing activities are conducted under CGMP requirements. A human food 
facility conducting the limited activities on human food by-products has the option to utilize 
either the part 117 or part 507 CGMP requirements. 
III. Discussion  
As discussed below, we intend to extend the duration of the enforcement policy for supply-chain 
program requirements for co-manufacturers (section III.A), and we anticipate continuing this 
policy until such time as FDAs deliberations are complete, which may occur when a related rule 
is finalized.  In addition, we intend to exercise enforcement discretion regarding the IA 
regulation for certain entities and activities (section III.B), and the supplier approval and 
verification requirements in part 117, part 507, and the FSVP regulation with regard to supplier 
compliance with requirements already associated with an enforcement discretion policy (section 
III.C).    
A. Extension of Enforcement Policy for Supply-Chain Program Requirements 
Applicable to Co-Manufacturers of Human Food and Animal Food 
As discussed in the co-manufacturer guidance (https://www.fda.gov/regulatory-
information/search-fda-guidance-documents/guidance-industry-supply-chain-program-
requirements-and-co-manufacturer-supplier-approval-and), industry has expressed concerns that 
the supply-chain program requirements would require revisions to contracts between brand 
owners and their suppliers to allow brand owners to share certain information (e.g., audits of 
suppliers) with the brand owners contract manufacturers/processors, and that establishing new 
contracts would take a significant period of time, impeding their ability to meet compliance 
dates.  Therefore, FDA announced that under certain circumstances and on a temporary basis, we 
do not intend to take enforcement action regarding a receiving facility that is a contract 
manufacturer/processor, and that is not in compliance with certain supply-chain program 
requirements for food manufactured for the brand owner, until November 6, 2019. 
 
In September 2019, industry submitted a request for an extension of the co-manufacturer 
enforcement discretion policy, contending that the supplier verification and approval challenges 
related to co-manufacturing cannot all be addressed by revising contracts, and suggesting that 
approaches utilized in other FSMA implementation contexts may be applied to find solutions to 
these challenges.  (Refs. 1, 2).  FDA has determined that it should continue to consider the 
additional practical challenges related to compliance with these provisions.5 
 
4 Those activities are drying/dehydrating, evaporating, pressing, chopping and similar activities to reduce 
weight, bulk, or volume, and/or mixing, centrifuging, and similar activities to combine ingredients or separate 
components (e.g., water and solids), as long as these activities are not performed to prevent or significantly 
minimize animal food hazards and do not introduce animal food hazards. 
5 FDA issued a constituent update on November 6, 2019, that announced our intent to issue an extension of the 
enforcement discretion policy for certain supply-chain program requirements applicable to receiving facilities that 
are co-manufacturers, available at: FDA Continues Enforcement Discretion Policy Relevant to Certain Co-
Manufacturers under FSMA | FDA.  
8 
 
  Contains Nonbinding Recommendations 
 
As FDAs deliberations proceed, we do not intend to take enforcement action regarding certain 
supply-chain program requirements for food manufactured for the brand owner by a receiving 
facility that is a contract manufacturer/processor, as described in the co-manufacturer guidance 
and restated in this section.  Specifically, we do not intend to take enforcement action regarding 
21 CFR 117.410(d) and 117.415(a)(3), and 21 CFR 507.110(d) and 507.115(a)(3) in the 
circumstances described below for Supplier Approval and for Supplier Verification.  
Furthermore, we do not intend to take enforcement action under the FSVP regulation regarding 
an importer who is relying on 21 CFR 1.502(c)(3) but whose supply-chain program is under an 
enforcement discretion policy regarding 21 CFR 117.410(d) and 117.415(a)(3) or 21 CFR 
507.110(d) and 507.115(a)(3) in the circumstances described below for Supplier Approval and 
for Supplier Verification.  We anticipate continuing the enforcement policy until deliberations 
are complete, which may occur when a related rule is finalized.    
 
For co-manufacturers under this policy that are also FSVP importers, we intend to enforce the 
importer identification requirements in 21 CFR 1.509 per our usual policies.  Under 21 CFR 
1.509(a), for each line entry of food product offered for importation into the United States, the 
importer must provide its name, electronic mail address, and unique facility identifier recognized 
as acceptable by FDA electronically when filing entry with U.S. Customs and Border Protection.  
For more information on the unique facility identifier, see FDAs guidance Compliance with 
Providing an Acceptable Unique Facility Identifier for the Foreign Supplier Verification 
Programs Regulation (https://www.fda.gov/regulatory-information/search-fda-guidance-
documents/guidance-industry-compliance-providing-acceptable-unique-facility-identifier-
foreign-supplier). 
 
Supplier Approval 
As noted above, until its deliberations are complete, FDA does not intend to take enforcement 
action under the following circumstances: (1) a brand owner conducts supplier approval 
activities, (2) the co-manufacturer describes these activities in its food safety plan, and (3) the 
co-manufacturer conducts any necessary supplier approval activities not conducted by the brand 
owner.  For example, FDA does not intend to take enforcement action when a brand owner 
(rather than the co-manufacturer) evaluates supplier performance as part of approving a supplier, 
the co-manufacturers food safety plan states that the brand owner will consider supplier 
performance before a supplier is approved, and the co-manufacturer conducts any other 
necessary supplier approval activities (e.g., hazard analysis of the food).  However, our usual 
enforcement policies apply with respect to the requirements that a co-manufacturer follow 
written procedures for receiving raw materials and other ingredients, and document use of the 
procedures (21 CFR 117.420 and 507.120).   
 
Supplier Verification 
Until its deliberations are complete, FDA also does not intend to take enforcement action under 
the following circumstances: (1) a brand owner determines and/or conducts supplier verification 
activities for its co-manufacturer, (2) the co-manufacturer describes these activities in its food 
safety plan, and (3) the co-manufacturer conducts any necessary supplier verification activities 
not conducted by the brand owner.  For example, FDA does not intend to take enforcement 
action when an audit is determined to be the appropriate supplier verification activity but a co-
9 
 
  Contains Nonbinding Recommendations 
manufacturer does not independently obtain a supplier audit or review the conclusions of a 
supplier audit obtained and reviewed by the brand owner, the co-manufacturers food safety plan 
states that the brand owner will obtain and review audits of the supplier, and the co-manufacturer 
conducts any other necessary supplier verification activities (e.g., sampling and testing of the raw 
material or other ingredient).   
B.  Enforcement Policy for Certain Entities and Requirements Under the 
Mitigation Strategies to Protect Food6 Against Intentional Adulteration 
Regulation 
FDA published the IA rule in the Federal Register of May 27, 2016.  The IA regulation includes 
requirements for food defense measures against intentional adulteration and can be found in 21 
CFR part 121.  Specifically, the IA regulation requires covered facilities to identify significant 
vulnerabilities and implement mitigation strategies, including mitigation strategy management 
components and related activities, such as reanalysis, to establish a proactive and systematic food 
defense program to protect food from intentional adulteration intended to cause wide scale public 
health harm.  
1. Enforcement policy for IA requirements for facilities covered by the January 2018 
enforcement policy related to farm-related activities  
The IA regulation does not apply to activities of a farm that are subject to section 419 of the 
FD&C Act (Standards for Produce Safety) (21 CFR 121.5(d)). Therefore, a threshold question to 
determine whether the IA regulation applies to an entity is whether the entity is a farm as that 
term is defined in 21 CFR 1.227 of the section 415 registration regulation.   
 
As mentioned in section II, we previously announced our intent to exercise enforcement 
discretion regarding part 117 for certain facilities that would qualify as farms except for some 
fact or circumstance discussed in the January 2018 enforcement policy guidance (e.g., facilities 
that would be farms except for ownership of the facility; facilities that would be farms if they did 
not color RACs). As explained above, we intend to pursue rulemaking and other solutions to the 
farm-related activity concerns that have been raised. This rulemaking could change the 
applicability of the intentional adulteration requirements to some entities that conduct farm-
related activities.  For example, a change to the farm definition could change the status of an 
entity from a facility required to register to a farm, and consequently change its status under the 
IA regulation from covered to exempt.  
 
While we pursue the rulemaking and other solutions to address concerns related to facilities that 
conduct farm-related activities, FDA does not intend to enforce the requirements of the IA 
regulation for those facilities that are under the farm-activity related enforcement policy 
described in the January 2018 enforcement policy guidance.  
 
6 The IA regulation does not apply to the manufacturing, processing, packing, or holding of food for animals other 
than man. 
10 
 
  Contains Nonbinding Recommendations 
2. Enforcement policy with regard to the requirement for reanalysis in 21 CFR 
121.157(b)(3) 
The IA regulation requires reanalysis of the food defense plan (FDP) in certain circumstances, 
including whenever a mitigation strategy, a combination of mitigation strategies, or the FDP as a 
whole is not properly implemented (21 CFR 121.157(b)(3)). Improper implementation of 
mitigation strategies is also addressed by taking food defense corrective actions. Specifically, 
covered entities are required to establish and implement written food defense corrective actions 
procedures that must be taken if mitigation strategies are not properly implemented (21 CFR 
121.145(a)(1)). The corrective actions procedures must describe the steps to be taken to ensure 
that:  (1) appropriate action is taken to identify and correct a problem that has occurred with 
implementation of a mitigation strategy; and, (2) appropriate action is taken, when necessary, to 
reduce the likelihood that the problem will recur (21 CFR 121.145(a)(2)).   
 
In light of the requirement to take corrective actions to address an implementation failure, in 
certain circumstances, FDA does not intend to enforce the requirement for a reanalysis of all or 
part of the FDP.  Specifically, FDA does not intend to enforce the requirement for reanalysis in 
21 CFR 121.157(b)(3) when improper implementation of a mitigation strategy or combination of 
mitigation strategies is addressed through implementation of corrective actions procedures that 
correct the problem and reduce the likelihood of recurrence.  
 
For example, an FDP provides that a mitigation strategy for a bulk liquid storage tank is to use a 
lock to secure the access hatch when unattended or not in use.  A monthly food defense 
verification review of monitoring records indicates that the mitigation strategy was not properly 
implemented once during the month (i.e., the hatch on the liquid storage tank was left unlocked).  
Corrective actions records indicate that the cause of the problem was employees working at the 
tank not locking the access hatch after filling the tank.  Corrective actions records also indicate 
that the problem was corrected by relocking the lock and retraining the employees and the 
supervisors working at this actionable process step.  FDA does not intend to enforce the 
requirement for reanalysis under this circumstance.   
 
The next month, a verification review of food defense monitoring and corrective actions records 
shows that the lock was still not consistently being placed on the access hatch to the storage tank 
(i.e., the hatch on the tank was left unlocked on multiple days). Now it is clear that the corrective 
actions procedures are not sufficiently reducing the likelihood of recurrence. In this situation, 
FDA intends to apply its usual enforcement policies with respect to the requirement that the 
facility perform a reanalysis of the mitigation strategy. As a result, the facility might determine 
that a new mitigation strategy is needed (e.g., restrict access to the bulk liquid storage tank to 
authorized personnel).  
 
FDA also intends to enforce, per its usual policies, the requirement in 21 CFR 121.157(b)(3) to 
conduct a reanalysis when the FDP as a whole is not properly implemented. For example, a 
facility identifies background checks as a mitigation strategy to be used in combination with 
other mitigation strategies for all actionable process steps within the facility. The monitoring 
procedure is to assess whether the checks were completed prior to assigning the employee to an 
actionable process step. The corrective actions procedure is to conduct the check prior to 
11 
 
  Contains Nonbinding Recommendations 
assigning the employee to an actionable process step if the check has not yet been conducted and 
to reassign an employee who has been assigned to an actionable process step without a 
background check. A manager discovers that there are no monitoring or corrective actions 
records for the background checks and determines the background check program was never 
implemented. Further, the manager determines it is no longer feasible to implement the program.  
In this example, FDA intends to enforce the requirement that the entire FDP be reanalyzed per its 
usual policies, because the mitigation strategies at each actionable process step were determined 
to be adequate based on the inclusion of background checks which were not conducted. Without 
the implementation of background checks, the mitigation strategies may not be adequately 
minimizing or preventing the significant vulnerabilities at each actionable process step. 
C.  Enforcement Policy for Supplier Approval and Verification Requirements 
in Part 117, Part 507, and the FSVP Regulation 
Among other things, the rulemaking to establish part 117 amended our current good 
manufacturing practice regulation for manufacturing, packing, or holding human food to 
modernize it and establish it in new part 117, primarily in subpart B, with associated 
requirements in subparts A and F (the human food CGMP requirements).  Part 117 also includes 
new requirements for domestic and foreign facilities that are required to register under section 
415 to establish and implement hazard analysis and risk-based preventive controls for human 
food (the human food preventive controls requirements). The human food preventive controls 
requirements are primarily in subparts C and G, with associated requirements in subparts A, D, 
E, and F.  Specifically, subpart G of part 117 establishes requirements for a supply-chain 
program for those raw materials and other ingredients for which a receiving facility has 
identified a hazard requiring a supply-chain applied control.  In certain circumstances FDAs 
supply-chain program provisions require a facility to conduct supplier approval and verification 
activities to provide assurance that raw materials and other ingredients were produced in 
compliance with a FSMA regulation, such as part 117 or the Produce Safety regulation. 
 
The rulemaking to establish part 507 included new requirements for CGMPs for food for 
animals, primarily in subpart B, with associated requirements in subparts A and F (the animal 
food CGMP requirements) and requirements for hazard analysis and risk-based preventive 
controls for food for animals, primarily in subparts C and E, with associated requirements in 
subparts A, D, E, and F (the animal food preventive controls requirements).  Specifically, subpart 
E of part 507 establishes requirements for a supply-chain program for those raw materials and 
other ingredients for which a receiving facility has identified a hazard requiring a supply-chain 
applied control.  In certain circumstances FDAs supply-chain program provisions require a 
receiving facility to conduct supplier verification activities. 
 
The FSVP regulation requires importers to develop, maintain, and follow an FSVP that, among 
other things, provides adequate assurance that foreign suppliers are producing food in 
compliance with processes and procedures that provide at least the same level of public health 
protection as those required under the Produce Safety regulation, part 117, or part 507, as 
12 
 
  Contains Nonbinding Recommendations 
applicable, and that the food is not adulterated or misbranded with respect to allergens.7  In 
certain circumstances FDAs FSVP provisions require an importer to conduct supplier approval 
and verification activities to provide this assurance.  
 
As described above in sections II and III, FDA has stated it does not intend to take enforcement 
action regarding certain regulatory requirements under the Produce Safety regulation, part 117, 
and part 507.  When FDA does not intend to take enforcement action regarding a provision in 
one of those regulations for a particular entity, we also do not intend to take enforcement action 
regarding the requirement for an importer or receiving facility to verify the entitys compliance 
with that provision.  Stated differently, FDA intends for its enforcement discretion policy to 
extend to any requirement (under FSVP or the preventive controls supply-chain program 
requirements) for an importer or receiving facility to verify a suppliers compliance with a 
FSMA requirement which itself is associated with an enforcement discretion policy.  For 
example, we do not intend to take enforcement action regarding the requirement for an FSVP 
importer of pulse crops to verify that the pulse crop grower produced the crop in compliance 
with the Produce Safety regulation, because FDA has stated its intent to exercise enforcement 
discretion regarding the requirements of the Produce Safety regulation for entities growing pulse 
crops.   
 
The enforcement discretion policy for importers and receiving facilities is intended to cover the 
period during which the underlying enforcement discretion policy for the supplier applies.  That 
is, when FDA intends to exercise enforcement discretion regarding a suppliers compliance with 
the Produce Safety regulation, part 117, or part 507, FDA also intends to exercise enforcement 
discretion regarding the importers or receiving facilitys obligation to verify the suppliers 
compliance with those provisions.   
    
Importantly, this enforcement discretion policy does not apply to all supplier verification 
requirements under FSVP or the supply-chain program requirements.  An FSVP importer must 
develop an FSVP that complies with applicable FSVP requirements, and FDAs usual 
enforcement policies apply for FSVP requirements that are not associated with an enforcement 
discretion policy.  As stated above, the importers FSVP must ensure that the foreign supplier is 
producing the food in compliance with processes and procedures that provide at least the same 
level of public health protection as those required under the Produce Safety regulation, part 117, 
or part 507, as applicable, and that the food meets the requirements of sections 402 (regarding 
adulteration) and 403(w) (if applicable, regarding misbranding of human food with respect to 
labeling for the presence of major food allergens) of the FD&C Act.  Consequently, even though 
FDA does not intend to enforce the FSVP importers obligation to verify a suppliers compliance 
with Produce Safety, part 117, or part 507 requirements when an enforcement discretion policy 
applies for the suppliers compliance with those provisions, FDA intends to enforce the 
requirements, per its usual policies, for an FSVP importer to develop and follow an FSVP that 
will ensure that the food imported from that foreign supplier is not adulterated or misbranded 
with respect to allergen labeling. 
 
 
7 Allergen-related requirements are not applicable to animal food.  See comment/response 259 in the part 507 rule 
preamble, 80 FR 56170 at 56244 (Sept. 17, 2015). 
13 
 
  Contains Nonbinding Recommendations 
IV.  References 
1.  Request for Extension from Grocery Manufacturers Association to FDA Docket FDA-
2017-D-5996. 
2.  Comment from Grocery Manufacturers Association to FDA Docket FDA-2017-D-5996. 
14