Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 1

Hazard Analysis and Risk-Based 

Preventive Controls for Human Food: 

Draft Guidance for Industry 1

This draft guidance, when finalized, will represent the current thinking of the Food and Drug 

Administration (FDA or we) on this topic. It does not establish any rights for any person and is 

not binding on FDA or the public. You can use an alternative approach if it satisfies the 

requirements of the applicable statutes and regulations. To discuss an alternative approach, 

contact FDA’s Technical Assistance Network by submitting your question 

at https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm459719.htm.

Chapter 15: Supply-Chain Program for Human Food Products

Table of Contents

15.1 Purpose of this Chapter

15.2 Considerations to Keep in Mind if You Establish and Implement a 

Supply-Chain Program

15.3 Overview of the Requirements for a Supply-Chain Program

15.3.1 Applicable Requirements of Part 117

15.3.2 “Receiving Facilities” and “Suppliers”

15.3.3 Produce Safety Regulation

15.3.4 Foreign Supplier Verification Program Regulation

15.3.5 Accredited Third-Party Certification Regulation

15.3.6 How We Use the Term “You” in This Chapter

15.4 Understand the Potential Hazard

15.5 Terms Used in This Chapter

15.5.1 Definitions Established in 21 CFR 117.3

 1 This guidance has been prepared by the Office of Food Safety in the Center for Food Safety and 

Applied Nutrition at the U.S. Food and Drug Administration. 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 2

15.5.2 Other Terms That FDA Uses in This Chapter

15.6 Requirement to Establish and Implement a Supply-Chain Program 

(21 CFR 117.405)

15.6.1 Requirement to Establish and Implement a Supply-chain Program

15.6.2 How Your Corporate Parent Can Participate in Establishing and 

Implementing Your Supply-chain Program

15.6.3 Exceptions to the Requirement to Establish and Implement a Supply-chain 

Program

15.6.3.1 Exception for importers

15.6.3.2 Exception for food supplied for research or evaluation use

15.6.4 Requirement When a Supply-Chain-Applied Control Is Applied by an Entity 

Other than the Receiving Facility’s Supplier

15.6.5 Role of the Preventive Controls Qualified Individual in the Supply-Chain 

Program

15.7 General Requirements Applicable to a Supply-Chain Program (21 

CFR 117.410)

15.7.1 What the Supply-Chain Program Must Include

15.7.2 Appropriate Supplier Verification Activities

15.7.2.1 Onsite audits (21 CFR 117.410(b)(1))

15.7.2.2 Sampling and testing of the raw material or other ingredient (21 CFR 

117.410(b)(2))

15.7.2.3 Review of the supplier’s relevant food safety records (21 CFR 

117.410(b)(3))

15.7.2.4 Other appropriate supplier verification activities based on supplier 

performance and the risk associated with the raw material or other 

ingredient (21 CFR 117.410(b)(4))

15.7.3 Assurance that a Hazard Has Been Significantly Minimized or Prevented

15.7.4 Considerations in Approving Suppliers and Determining the Appropriate 

Supplier Verification Activities and the Frequency with Which They Are 

Conducted

15.7.4.1 Hazard analysis

15.7.4.2 Entity controlling the hazard

15.7.4.3 Supplier performance

15.7.4.4 Other factors

15.7.4.5 Exception to the full requirements for considerations for approving 

suppliers and determining appropriate supplier verification activities
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 3

15.7.5 Supplier Nonconformance

15.8 Responsibilities of the Receiving Facility (21 CFR 117.415)

15.8.1 Your Responsibility to Approve Suppliers

15.8.2 Your Responsibility to Determine and Conduct Appropriate Supplier 

Verification Activities

15.8.2.1 Flexibility for another entity to determine, conduct, and document 

appropriate supplier verification activities

15.8.2.2 Supplier verification activities that the supplier can conduct and document

15.8.3 What You May Not Accept from a Supplier as a Supplier Verification 

Activity

15.8.4 Audit Provided by the Supplier

15.9 Using Approved Suppliers (21 CFR 117.420)

15.9.1 Approving Suppliers

15.9.2 Written Procedures for Receiving Raw materials and Other Ingredients

15.10 Determining Appropriate Supplier Verification Activities (Including 

Determining the Frequency of Conducting the Activity) (21 CFR 

117.425)

15.11 Conducting Supplier Verification Activities for Raw Materials and 

Other Ingredients (21 CFR 117.430)

15.11.1 Requirement to Conduct Supplier Verification Activities

15.11.2 Specific Requirements When the Hazard Requiring a Preventive Control is 

a SAHCODH Hazard

15.11.2.1 Requirement for an onsite audit when the hazard requiring a preventive 

control is a SAHCODH hazard

15.11.2.2 Exception to the requirement for an onsite audit when the hazard 

requiring a preventive control is a SAHCODH hazard

15.11.3 Alternative Supplier Verification Activity If the Supplier Is a “Qualified 

Facility”

15.11.4 Alternative Supplier Verification Activity If the Supplier is a Certain Type of 

Produce Farm

15.11.5 Alternative Supplier Verification Activity If the Supplier Is a Shell Egg 

Producer That Is Not Subject to the Requirements of 21 CFR Part 118

15.11.6 Financial Conflict of Interest

15.12 Onsite Audit (21 CFR 117.435)

15.12.1 Who Conducts an Onsite Audit
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 4

15.12.2 Consideration of Food Safety Regulations

15.12.3 Substitution of an Inspection for an Audit

15.12.4 Audits Conducted to Meet the Requirements of Subpart G Do Not Have to 

Comply with the Requirements of the Accredited Third-Party Regulation

15.13 Records Documenting the Supply-Chain Program

15.14 Compliance Dates

15.15 Table of Abbreviations

15.16 References

15.1 Purpose of this Chapter

The purpose of this chapter is to help a receiving facility comply with the requirements of 

subpart G for establishing and implementing a supply-chain program for its suppliers. (See 

section 15.3.2 and the list of terms in section 15.5.1 for the definition of “receiving facility.”) This 

chapter also is intended to help an entity other than the receiving facility conduct certain 

activities on behalf of a receiving facility, provided that the receiving facility complies with 

applicable requirements in subpart G to review and assess the entity’s applicable 

documentation, and document that review and assessment.

15.2 Considerations to Keep in Mind if You Establish and Implement 

a Supply-Chain Program

If you are an importer, see section 15.6.2.1 for a discussion of how we have aligned the 

provisions for supplier verification in our regulation entitled “Foreign Supplier Verification 

Programs for Importers of Food for Humans and Animals” (21 CFR part 1, subpart L; the FSVP 

regulation) with the provisions for a supply-chain program in subpart G such that importers and 

receiving facilities do not have to duplicate verification activities. Importantly, this chapter of this

guidance does not address the responsibilities of receiving facilities that import raw materials or 

other ingredients to comply with applicable requirements of the FSVP regulation. If you are a 

receiving facility that is also a food importer, and you choose to comply with the FSVP 

regulation rather than conduct supplier verification activities in accordance with subpart G (see 

21 CFR 117.405(a)(2)), you should refer to our guidance on the FSVP regulation.

15.3 Overview of the Requirements for a Supply-Chain Program

15.3.1 Applicable Requirements of Part 117

Subpart C requires a facility to conduct a hazard analysis to determine whether there are any 

hazards that require a preventive control (21 CFR 117.130) and identifies several types of 

possible preventive controls, including process controls (21 CFR 117.135(c)(1)), food allergen 

controls (21 CFR 117.135(c)(2)), sanitation controls (21 CFR 117.135(c)(3)), and supply-chain 

controls (21 CFR 117.135(c)(4)). The requirements for supply-chain controls are established in 

subpart G (Supply-Chain Program). We list the requirements of subpart G in Table 15-1. In the 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 5

remainder of this chapter, we provide recommendations for how you can comply with each of 

these requirements.

Table 15-1 Requirements for a Supply-Chain Program in Subpart G

Section Description

117.405 Requirement to establish and implement a supply-chain program

117.410 General requirements applicable to a supply-chain program

117.415 Responsibilities of the receiving facility

117.420 Using approved suppliers

117.425 Determining appropriate supplier verification activities (including 

determining the frequency of conducting the activity)

117.430 Conducting supplier verification activities for raw materials and other 

ingredients

117.435 Onsite audit

117.475 Records documenting the supply-chain program

15.3.2 “Receiving Facilities” and “Suppliers”

Subpart G applies to a “receiving facility.” Part 117 defines a “receiving facility” as a facility that 

is subject to subparts C and G of part 117 and that manufactures/processes a raw material or 

other ingredient that it receives from a supplier. (See 21 CFR 117.3.) Part 117 defines a 

“supplier” as the establishment that manufactures/processes the food, raises the animal, or 

grows the food that is provided to a receiving facility without further manufacturing/processing 

by another establishment, except for further manufacturing/processing that consists solely of the 

addition of labeling or similar activity of a de minimis nature. (See 21 CFR 117.3.)

Under subpart G, entities such as brokers, produce aggregators, food distributors, and cold 

storage facilities are neither receiving facilities that are required to establish a supply-chain 

program nor suppliers, because such entities are not manufacturers/processors. However, part 

117 provides that such entities can conduct certain activities specified in subpart G on behalf of 

a receiving facility. (See 21 CFR 117.415.)

Examples of receiving facilities are:

• A facility that manufactures/processes produce raw agricultural commodities (RACs) into 

bagged salads;

• A facility that mills grains such as wheat to make flour; and

• A facility that manufactures cookies using flour, sugar and other ingredients.

Examples of suppliers are:

• A farm that grows RACs such as lettuce that are supplied to a bagged salad manufacturer;

• A farm that grows wheat that is supplied to a miller; and

• A facility that mills grains and manufactures flour that is supplied to a cookie manufacturer.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 6

See also section 15.6.4 for a discussion of the special circumstance of when a preventive 

control is applied by an entity other than the receiving facility’s supplier (e.g., when a harvesting 

or packing operation applies controls to certain produce (i.e., produce covered by part 112), 

because growing, harvesting, and packing activities are under different management).

15.3.3 Produce Safety Regulation

In part 112 (21 CFR part 112), we have established our regulation entitled “Standards for the 

Growing, Harvesting, Packing, and Holding of Produce for Human Consumption” (the produce 

safety regulation; 80 FR 74354, November 27, 2015). The produce safety regulation sets forth 

in a new part 112 procedures, processes, and practices that minimize the risk of serious 

adverse health consequences or death, including those reasonably necessary to prevent the 

introduction of known or reasonably foreseeable biological hazards into or onto produce and to 

provide reasonable assurances that the produce is not adulterated on account of such hazards. 

The produce safety regulation applies to certain produce farms, and does not apply to activities 

of facilities that are subject to part 117. 

Some provisions of subpart G (i.e., 21 CFR 117.405(c), 117.410(d)(2)(ii), 117.430(d), and 

117.475(c)(13)) refer to the provisions of the produce safety regulation.

15.3.4 Foreign Supplier Verification Program Regulation

In part 1, subpart L (21 CFR part 1, subpart L), we have established our regulation entitled 

“Foreign Supplier Verification Programs for Importers of Food for Humans and Animals” (the 

FSVP regulation; 80 FR 74226, November 27, 2015). The FSVP regulation requires importers 

to establish foreign supplier verification programs to verify that their foreign suppliers are using 

processes and procedures that provide the same level of public health protection as those 

required under the provisions on hazard analysis and risk-based preventive controls and 

standards for produce safety in the FD&C Act, that the imported food is not adulterated, and that 

food is not misbranded with respect to food allergen labeling. 

Some provisions of subpart G (i.e., 21 CFR 117.405(a)(2) and 117.475(c)(2)) refer to the 

provisions of the FSVP regulation. 

15.3.5 Accredited Third-Party Certification Regulation

In part 1, subpart M (21 CFR part 1, subpart M), we have established our regulation entitled 

“Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and to Issue 

Certifications” (the accredited third-party certification regulation; 80 FR 74570, November 27, 

2015). The accredited third-party certification regulation provides for accreditation of third-party 

certification bodies to conduct food safety audits and to certify that eligible foreign entities 

(including registered foreign food facilities) and food produced by such entities meet applicable 

FDA requirements for purposes of sections 801(q)2 and 8063 of the FD&C Act.

 2 Section 801(q) of the FD&C Act gives FDA the authority to make a risk-based determination to require, 

as a condition of admissibility, that a food imported or offered for import into the United States be 

accompanied by a certification or other assurance that the food meets the applicable requirements of the 

FD&C Act.

3 Section 302 of FSMA (Voluntary qualified importer program) amended the FD&C Act to create a new 

section 806 with the same name. Section 806 of the FD&C Act describes a voluntary, fee-based program 

for the expedited review and importation of foods from importers who achieve and maintain a high level of 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 7

Some provisions of part 117 (i.e., the definition of “qualified auditor” in 21 CFR 117.3 and the 

requirements for onsite audits in 21 CFR 117.435(d)) refer to the provisions of the accredited 

third-party certification regulation.

15.3.6 How We Use the Term “You” in This Chapter

In this guidance, we use the term “you” to refer to a “receiving facility,” rather than to all facilities 

subject to the PCHF requirements, because the requirements of subpart G apply only to 

receiving facilities.

15.4 Understand the Potential Hazard

Part 117 defines “supply-chain-applied control” as a preventive control for a hazard in a raw 

material or other ingredient when the hazard in the raw material or other ingredient is controlled 

before its receipt. (See 21 CFR 117.3 and the list of terms in section 15.5.1.) For background 

and details about hazards, including hazards that could require a supply-chain-applied control, 

see Chapter 3 – Potential Hazards Associated with the Manufacturing, Processing, Packing, 

and Holding of Human Food.

15.5 Terms Used in This Chapter

15.5.1 Definitions Established in 21 CFR 117.3

Section III.A in the Introduction of this guidance includes a glossary of terms that are used in 

this guidance and that are defined in 21 CFR 117.3. At this time, that glossary does not include 

all terms that are used in this chapter. See Table 15-2 for additional terms that are defined in 21 

CFR 117.3. We intend to include these terms in the glossary in section III.A in the Introduction 

of this guidance when we update the Introduction. When we do so, we intend to delete Table 

15-2 from this chapter, because it would be duplicative.

Table 15-2 Applicable Terms Defined in Part 117 (See 21 CFR 117.3.)

Term What the Term Means

Audit The systematic, independent, and documented examination (through observation, 

investigation, records review, discussions with employees of the audited entity, and, 

as appropriate, sampling and laboratory analysis) to assess a supplier’s food safety 

processes and procedures.

Manufacturing/ 

processing

Making food from one or more ingredients, or synthesizing, preparing, treating, 

modifying or manipulating food, including food crops or ingredients. Examples of 

manufacturing/processing activities include: Baking, boiling, bottling, canning, 

cooking, cooling, cutting, distilling, drying/dehydrating raw agricultural commodities to 

create a distinct commodity (such as drying/dehydrating grapes to produce raisins), 

evaporating, eviscerating, extracting juice, formulating, freezing, grinding, 

homogenizing, irradiating, labeling, milling, mixing, packaging (including modified 

atmosphere packaging), pasteurizing, peeling, rendering, treating to manipulate 

ripening, trimming, washing, or waxing. For farms and farm mixed-type facilities, 

manufacturing/processing does not include activities that are part of harvesting, 

packing, or holding.

 

control over the safety and security of their supply chains. This control includes importation of food from 

facilities that have been certified under FDA’s third-party certification rule.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 8

Term What the Term Means

Qualified auditor A person who is a qualified individual as defined in this part and has technical 

expertise obtained through education, training, or experience (or a combination 

thereof) necessary to perform the auditing function as required by § 117.180(c)(2). 

Examples of potential qualified auditors include: (1) A government employee, 

including a foreign government employee; and (2) An audit agent of a certification 

body that is accredited in accordance with regulations in 21 CFR part 1, subpart M 

(Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and 

To Issue Certifications).

Qualified facility A facility (when including the sales by any subsidiary; affiliate; or subsidiaries or 

affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) that 

is a very small business, or a facility to which both of the following apply: (1) During 

the 3-year period preceding the applicable calendar year, the average annual 

monetary value of the food manufactured, processed, packed or held at such facility 

that is sold directly to qualified end-users (as defined in this part) during such period 

exceeded the average annual monetary value of the food sold by such facility to all 

other purchasers; and (2) The average annual monetary value of all food sold during 

the 3-year period preceding the applicable calendar year was less than $500,000, 

adjusted for inflation.

Raw agricultural 

commodity (RAC)

Any food in its raw or natural state, including all fruits that are washed, colored, or 

otherwise treated in their unpeeled natural form prior to marketing. 

Receiving facility A facility that is subject to subparts C and G of part 117 and that 

manufactures/processes a raw material or other ingredient that it receives from a 

supplier.

Supplier The establishment that manufactures/processes the food, raises the animal, or grows 

the food that is provided to a receiving facility without further 

manufacturing/processing by another establishment, except for further 

manufacturing/processing that consists solely of the addition of labeling or similar 

activity of a de minimis nature.

Supply-chain-applied 

control

A preventive control for a hazard in a raw material or other ingredient when the 

hazard in the raw material or other ingredient is controlled before its receipt.

Very small business A business (including any subsidiaries and affiliates) averaging less than $1,000,000, 

adjusted for inflation, per year, during the 3-year period preceding the applicable 

calendar year in sales of human food plus the market value of human food 

manufactured, processed, packed, or held without sale (e.g., held for a fee).

Written procedures for 

receiving raw materials 

and other ingredients

Written procedures to ensure that raw materials and other ingredients are received 

only from suppliers approved by the receiving facility (or, when necessary and 

appropriate, on a temporary basis from unapproved suppliers whose raw materials or 

other ingredients are subjected to adequate verification activities before acceptance 

for use).

15.5.2 Other Terms That FDA Uses in This Chapter

Section III.B in the Introduction of this guidance includes a glossary of terms that are used in 

this guidance but are not defined in 21 CFR 117.3. At this time, that glossary does not include 

all terms that are used in this chapter. See Table 15-3 for additional terms that we use in this 

chapter. We intend to include these terms in the glossary in section III.B in the Introduction of 

this guidance when we update the Introduction. When we do so, we intend to delete Table 15-3

from this chapter, because it would be duplicative.

Table 15-3 Terms Used in this Chapter

Term What the Term Means
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 9

Term What the Term Means

Approved supplier A supplier that has met the criteria of the receiving facility’s supply chain 

program, is controlling the identified hazard, and has been approved by the 

receiving facility.

Certificate of analysis (CoA) A document, provided by the supplier of a food prior to or upon receipt of the 

food, that documents certain characteristics and attributes of the food.

Customer An entity that receives a product, raw material, or ingredient from a receiving 

facility.

Identified hazard A hazard identified by the receiving facility as requiring a supply-chainapplied control.

Second-party audit An audit conducted by an employee of a receiving facility.

SAHCODH hazard A hazard for which there is a reasonable probability that exposure to the 

hazard will result in serious adverse health consequences or death to 

humans.

Third-party audit An audit conducted by a qualified auditor that is not an employee of either 

the receiving facility or the supplier.

15.6 Requirement to Establish and Implement a Supply-Chain 

Program (21 CFR 117.405)

15.6.1 Requirement to Establish and Implement a Supply-chain Program 

With some exceptions (see 21 CFR 117.405(a)(2) and (a)(3)), subpart G requires a receiving 

facility to establish and implement a risk-based supply-chain program for those raw materials 

and other ingredients for which the receiving facility has identified a hazard requiring a supplychain-applied control. (See 21 CFR 117.405(a)(1).)

The supply-chain program must be written. (See 21 CFR 117.405(b).) There is no standardized 

or required format for the written supply-chain program or its records. You can use whatever 

format works best for your facility, provided that the records include all the required information.

You are not required to establish and implement a supply-chain program for a particular raw 

material or other ingredient if you will control the hazard at your own facility, regardless of 

whether your supplier has also applied one or more preventive controls for that hazard to raw 

materials and other ingredients that your supplier provides to you. (See 21 CFR 117.405(a)(1).)

In addition, you are not required to implement a preventive control if you comply with certain 

requirements for ensuring a hazard will be controlled by your customer or subsequent entity in 

the distribution chain. (See 21 CFR 117.136.) 

Subpart G does not require you to establish and implement a supply-chain program to control 

potential hazards associated with food contact substances. A long-standing CGMP provision 

requires that appropriate quality control operations be employed to ensure that food is suitable 

for human consumption and that food-packaging materials are safe and suitable. (See 21 CFR 

117.80(a)(2).) Similar provisions address other circumstances where food contact substances 

may migrate to the raw materials and other ingredients obtained by a receiving facility from 

suppliers (e.g., 21 CFR 117.40 regarding food-contact surfaces). FDA has extensive premarket 

review processes for food contact substances under the food contact notification process (21 

CFR part 170, subpart D) and the food additive petition process (21 CFR part 171). In light of 

FDA’s premarket oversight of food contact substances and our experience with regulatory 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 10

oversight of food-packaging material as a matter of CGMP, we consider following CGMPs by a 

receiving facility to be sufficient to address the safety of food contact substances in raw 

materials and other ingredients it obtains. Therefore, there are no hazards associated with food 

contact substances that are hazards requiring a supply-chain applied control under 21 CFR 

117.405(a)(1).

15.6.2 How Your Corporate Parent Can Participate in Establishing and 

Implementing Your Supply-chain Program 

As discussed in the final rule establishing part 117, your corporate parent (as the owner, 

operator, or agent in charge) can be active in developing and implementing your food safety 

plan (see Response 371, Response 668, and Response 690 at 80 FR 56022, 56100, and 

56111, respectively). For example, an individual at the corporate level may be the preventive 

controls qualified individual (PCQI). Further, the responsibilities of the receiving facility (such as 

approving suppliers) could be handled at the corporate level. For example, your corporate 

parent could have a team that establishes written procedures for supplier approval, determines

supplier verification activities, conducts supplier verification activities, and maintains required 

documentation. In addition, your corporate parent could establish and implement a supply-chain 

program that takes into consideration its knowledge of the food safety programs in place at all of 

the facilities under its ownership. See also the example in section 15.11.2.2 in which a facility 

that is part of a larger corporation determines an alternative to an onsite audit when the supplier 

is a subsidiary of the same corporation. The records documenting the supply-chain program are 

subject to the requirements, in subpart F, applying to records that must be established and 

maintained. Under 21 CFR 117.315, offsite storage of records (such as storage at the place of 

business of your corporate parent of records documenting the supply-chain program) is 

permitted if such records can be retrieved and provided onsite within 24 hours of request for 

official review. If your corporate parent establishes and maintains the records for the supplychain program electronically and you can access applicable records maintained at the corporate 

level electronically, we consider the records to be onsite.

15.6.3 Exceptions to the Requirement to Establish and Implement a Supplychain Program

Subpart G provides for two exceptions to the requirement to establish and implement a supplychain program. 

15.6.3.1 Exception for importers

We have aligned the provisions for supplier verification in the FSVP regulation with the 

provisions for a supply-chain program in part 117. A receiving facility that is an importer, is in 

compliance with the FSVP regulation, and has documentation of verification activities conducted 

under 21 CFR 1.506(e) (which provides assurance that the hazards to be controlled before 

importation for the raw material or other ingredient have been significantly minimized or 

prevented) need not conduct supplier verification activities for that raw material or other 

ingredient. (See 21 CFR 117.405(a)(2).) We are providing separate guidance to help importers 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 11

who are subject to the FSVP regulation to comply with the requirements of the FSVP 

regulation.

4

15.6.3.2 Exception for food supplied for research or evaluation use

The requirements for a supply-chain program do not apply to food that is supplied for research 

or evaluation use, provided that such food:

• Is not intended for retail sale and is not sold or distributed to the public (21 CFR 

117.405(a)(3)(i));

• Is labeled with the statement “Food for research or evaluation use” (21 CFR 

117.405(a)(3)(ii));

• Is supplied in a small quantity that is consistent with a research, analysis, or quality 

assurance purpose, the food is used only for this purpose, and any unused quantity is 

properly disposed of (21 CFR 117.405(a)(3)(iii)); and 

• Is accompanied with documents, in accordance with the practice of the trade, stating that 

the food will be used for research or evaluation purposes and cannot be sold or distributed 

to the public (21 CFR 117.405(a)(3)(iv)).

You should take steps to ensure that the label statement “Food for research or evaluation use” 

remains securely attached to the food until the food is used for research or evaluation.

The quantity of the food should be limited to the amount anticipated to be needed to perform the 

research, analysis, or quality assurance procedures, and any unused portion should be properly 

disposed of. The amount of food used in research or for evaluation can vary based on the type 

of food, the nature of the research or evaluation, and other factors such as the number of 

repetitions required for the research or evaluation process. For example, 10 pounds of a food 

could be a small quantity consistent with the amount needed to perform a laboratory analysis for 

pesticides, and 50 pounds of the food could be a small quantity consistent with the amount 

needed for a mycotoxin analysis. On the other hand, only a few ounces of a color additive might 

be needed for research.

The exemption for food for research or evaluation does not apply to food for consumption at 

trade shows, because such food would be “distributed to the public” (i.e., attendees of the trade 

show). (See 21 CFR 117.405(a)(3)(i).) This is the case regardless of whether it is a “Research 

and Development” (R&D) facility that directly provides the food for consumption to a trade show, 

or it is the R&D facility’s customer that provides the food for consumption to a trade show. 

However, the exemption for research or evaluation would apply to food used in a defined study, 

conducted during a trade show, of a food involving a discrete set of test subjects who have 

agreed to participate in the study, because it does not appear that such food would be sold or 

distributed to the general public. When the exemption does not apply, you must comply with the 

requirements of subpart G when your supplier applies a supply-chain-applied control even if you 

consider yourself an “R&D facility.”

 4 Even if you implement a supply-chain program in accordance with subpart G for a raw material or other 

ingredient you import, you will need to ensure that you are identified as the FSVP importer of the raw 

material or other ingredient in accordance with 21 CFR 1.509.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 12

15.6.4 Requirement When a Supply-Chain-Applied Control Is Applied by an 

Entity Other than the Receiving Facility’s Supplier

When a supply-chain-applied control is applied by an entity other than the receiving facility’s 

supplier (e.g., when such an entity applies controls to certain produce (i.e., produce covered by 

part 112)), because growing, harvesting, and packing activities are under different 

management), the receiving facility must: (1) Verify the supply-chain-applied control; or (2) 

obtain documentation of an appropriate verification activity from another entity, review and 

assess the entity’s applicable documentation, and document that review and assessment. (See 

21 CFR 117.405(c).)

The most likely circumstance where this requirement applies is included as an example in the 

requirement – i.e., when the supplier is a farm and growing, harvesting, and packing activities 

are under different management. The definition of supplier specifies that the supplier is the 

establishment that grows the food. However, harvesting and packing operations that are 

conducted by a business entity separate from the grower do not fall within the definition of 

“supplier,” even though harvesting and packing operations include some supply-chain-applied 

controls, such as maintaining wash water temperature adequate to minimize infiltration of 

microorganisms and establishing and following water-change schedules for recirculated water.

A receiving facility has an obligation to identify and implement preventive controls to provide 

assurances that any hazards requiring a preventive control will be significantly minimized or 

prevented and the food manufactured, processed, packed, or held by the facility will not be 

adulterated under section 402 of the FD&C Act (21 U.S.C. 342) or misbranded under section 

403(w) of the FD&C Act (21 U.S.C. 343(w)). That obligation includes responsibilities for raw 

materials and other ingredients when a supply-chain-applied control is applied by an entity 

(such as a harvesting or packing operation) other than the receiving facility’s supplier (the 

grower).

We do not expect the receiving facility to follow all of the requirements of subpart G applicable 

to “suppliers” when verifying control by another entity in the supply chain (e.g., a harvesting or 

packing operation). Instead, we expect the receiving facility will take steps such as a review of 

that entity’s applicable food safety records. For example, if a receiving facility receives produce 

from a supply chain that includes a separate grower, harvester, and packer, the grower is the 

supplier and the requirements of subpart G applicable to “suppliers” apply to the grower. To 

verify controls applied by the harvester, the receiving facility could review the harvester’s 

records, such as records of training for workers who hand harvest RTE produce. To verify 

controls applied by the packer, the receiving facility could review the packer’s records, such as 

water-change schedules for recirculated water used in packing operations.

See also the discussion in sections 15.8.1 and 15.8.2 of provisions of part 117 that allow entities 

such as distributors, brokers, and aggregators to determine, conduct, and document verification 

activities that apply to suppliers as a service to you, provided that you review and assess 

applicable documentation provided by the other entity and document your review and 

assessment. (See 21 CFR 117.415(a)(3).) If a harvester determines, conducts, and documents

verification activities that apply to the grower (your supplier), you could review and assess the 

harvester’s documentation. Likewise, you could obtain documentation of review of applicable 

records maintained by the harvester or packer from another entity, review and assess the 

entity’s applicable documentation, and document that review and assessment.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 13

15.6.5 Role of the Preventive Controls Qualified Individual in the SupplyChain Program

The preventive controls are part of your food safety plan, and your food safety plan must be 

prepared, or its preparation overseen by, your PCQI. (See 21 CFR 117.126(a)(2), 21 CFR 

117.126(b)(2), and 117.180(a)(1).) (See 21 CFR 117.3 and the Glossary in section III of the 

Introduction of this guidance for the definition of “PCQI.”)

15.7 General Requirements Applicable to a Supply-Chain Program 

(21 CFR 117.410)

15.7.1 What the Supply-Chain Program Must Include

Subpart G includes a list of the general requirements for what the supply-chain program must 

include, and provides a cross-reference to where you can find the specific requirements. As 

specified in 21 CFR 117.410(a), the general requirements are:

• Using approved suppliers as required by § 117.420 (21 CFR 117.410(a)(1)); 

• Determining appropriate supplier verification activities (including determining the frequency 

of conducting the activity) as required by § 117.425 (21 CFR 117.410(a)(2)); 

• Conducting supplier verification activities as required by §§ 117.430 and 117.435 (21 CFR 

117.410(a)(3));

• Documenting supplier verification activities as required by § 117.475 (21 CFR 

117.410(a)(4)); and

• When applicable, verifying a supply-chain-applied control applied by an entity other than the 

receiving facility’s supplier and documenting that verification as required by § 117.475, or 

obtaining documentation of an appropriate verification activity from another entity, reviewing 

and assessing that documentation, and documenting the review and assessment as 

required by § 117.475 (21 CFR 117.410(a)(5)).

See the discussion of the specific requirements of 21 CFR 117.405(c), 117.420, 117.425, 

117.430, 117.435, and 117.475 in sections 15.6.4, 15.9, 15.10, 15.11, 15.12, and 15.13, 

respectively.

15.7.2 Appropriate Supplier Verification Activities

Section 21 CFR 117.410(b) of subpart G specifies four appropriate supplier verification activities 

for raw materials and other ingredients. We discuss these in sections 15.7.2.1 through 15.7.2.4.

15.7.2.1 Onsite audits (21 CFR 117.410(b)(1))

See 21 CFR 117.430(b), 21 CFR 117.435, 21 CFR 117.475(c)(7), and sections 15.11.2, 15.12, 

and 15.13 for details about the requirements for onsite audits and our recommendations for how 

to comply with those requirements.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 14

15.7.2.2 Sampling and testing of the raw material or other ingredient 

(21 CFR 117.410(b)(2))

Subpart G provides that sampling and testing of a raw material or other ingredient is an 

appropriate supplier verification activity. (See 21 CFR 117.410(b)(2).) Such sampling and 

testing can be on a periodic basis or on a lot-by-lot basis. We recommend that you establish the 

frequency of such testing by first conducting the sampling and testing on a relatively frequent 

basis (e.g., monthly) until the supplier establishes a good history of supplying an acceptable raw 

material or other ingredient, after which time you could sample and test less frequently, such as 

quarterly.

If you choose to use sampling and testing as a supplier verification activity, you should use 

scientifically-based sampling plans that provide reasonable assurance that the hazard has been 

significantly minimized or prevented and that address known limitations of sampling and testing 

foods as a verification activity. For example, your sampling plan should take into consideration 

whether a hazard is homogeneously distributed throughout the lot, and your selection of an 

analytical method should consider whether food components could interfere with the method of 

analysis, as well as whether the method is sensitive enough to detect a hazard that is present at 

low concentrations. To address such limitations, we recommend that you obtain samples that 

are representative of the lot, use a testing method that has been shown to provide reliable 

results when the analyte of interest is within the food matrix you will be testing, and use a 

method that has a sensitivity appropriate to detect that hazard.

See 21 CFR 117.475(c)(8) and section 15.13 for a list of required documentation when you 

conduct sampling and testing as a supplier verification activity. See section 15.8.2.2 for a 

discussion of the flexibility the rule provides for your supplier to conduct and document sampling 

and testing of raw materials and other ingredients, for the hazard it controls, and provide such 

documentation (such as in a Certificate of Analysis (COA)) to you in lieu of you conducting such 

sampling and testing yourself.

15.7.2.3 Review of the supplier’s relevant food safety records (21 CFR 

117.410(b)(3))

In general, by “relevant food safety records” we mean any records that will provide sufficient 

documentation that your supplier is following the procedures your supplier established to control 

a hazard and that the hazard has been controlled. Many such records relate to a particular lot of 

a raw material or other ingredient provided to you, such as the record created when a 

preventive control measure was applied. For example, if you produce frozen mixed vegetables

and rely on your supplier (the farm that grows the vegetables) to control pesticide residues in 

the raw vegetables that you will use to produce the frozen mixed vegetables, and you determine 

through supplier verification activities (e.g., periodic testing for pesticides) that your supplier 

provided a vegetable with a pesticide level in excess of the approved tolerance for that 

pesticide, you could obtain a copy of the pesticide application records from the farm that grows 

the vegetables for a period of time adequate to demonstrate that problems that could lead to 

excess pesticide levels have been resolved. 

Relevant food safety records also include, when applicable, records demonstrating that your 

supplier has verified control of a hazard by its own supplier. Such records could relate more 

broadly to a supplier’s food safety procedures, such as records of your supplier’s audit of its 

supplier’s food safety activities. For example, if you produce deli salads and obtain chopped 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 15

fresh vegetables from your supplier, you could obtain a copy of your supplier’s records 

documenting his audits of the farms growing the vegetables.

Figure 1 shows an example of using relevant food safety records when the hazard requiring a 

supply-chain-applied control is Salmonella that could contaminate black pepper and your 

supplier (Supplier A) provides you with a spice mix containing black pepper that has been 

steam-treated by Establishment B (earlier in the supply chain) to control Salmonella. One 

relevant food safety record could be the applicable audit records resulting from an onsite audit 

of Establishment B, which you could obtain from Supplier A.5 The applicable audit records could 

include copies of audit procedures, dates, conclusions of the audits, and any corrective actions 

taken in response to significant deficiencies identified during the audit of Establishment B. If 

Supplier A conducts additional verification activities such as periodic testing of the steamtreated black pepper, you could also ask Supplier A to provide records of those activities to you 

for your review. If you want to see documentation of the applicable parameters for the steam 

treatment that Establishment B delivered to a lot of black pepper, you could obtain these 

records either directly from Establishment B or from Supplier A.

 5 Alternatively, Supplier A may request that Establishment B obtain a third-party audit. Thus, 

Establishment B may also be able to provide applicable audit records for you to review.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 16

Figure 1. Applicable Records When Supplier A Provides You With a Spice Mix Containing Black 

Pepper That Has Been Steam-treated by Establishment B

See 21 CFR 117.475(c)(9) and section 15.13 for a list of required documentation when you 

conduct a review of the supplier’s relevant food safety records as a supplier verification activity.

15.7.2.4 Other appropriate supplier verification activities based on 

supplier performance and the risk associated with the raw material or other 

ingredient (21 CFR 117.410(b)(4))

Subpart G provides that you could conduct (and document) or obtain documentation of other 

supplier verification activities that are appropriate based on your supplier’s performance and the 

risk posed by the raw material or other ingredient. This means that you could specify and design 

risk-based activities (other than an onsite audit, sampling and testing, and review of relevant 

food safety records) that can provide effective supplier verification.

As one example, you could develop and use a fact-specific questionnaire or consider 

information applicable to a supplier’s certification to a specific audit scheme, and you could use 

such activities alone or in combination with other supplier verification activities. As another 

example, if you determine and document that you would audit a supplier on a biennial rather 

spice mix with 

black pepper black pepper

Establishment B

Steam treats black 

pepper to control for 

Salmonella

Supplier A

Creates spice mix with 

treated black pepper

Your Facility

Identifies Salmonella 

hazard in black pepper

Establishment B

Identification 

and control of 

hazard

Supplier A

Conducts and documents the 

following supplier verification 

activities of Establishment B:

Supplier A's onsite audit of 

Establishment B 

Other supplier verification activities 

conducted by Supplier A of 

Establishment B (such as periodic 

testing of steam-treated black 

pepper)

Your Facility

Supplier Verification of 

hazard control through 

review of supplier's 

relevant food safety 

records:

or

Review Supplier A's 

records of other activities 

- Review audit records of 

Establishment B

OR

- Review documentation 

of applicable parameters 

for the steam treatment 

done by Establishment B

(obtain from Supplier A 

or Establishment B 

directly)

Supplier 

verification

activities by 

Supplier A and 

Your Facility
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 17

than annual basis as provided by 21 CFR 117.430(b)(2), you could review the records 

demonstrating the results of the supplier’s environmental monitoring program during the year 

that you do not conduct an audit.

See 21 CFR 117.475(c)(10) and section 15.13 for recommended documentation when you 

conduct a supplier verification activity other than an onsite audit, sampling and testing, or review 

of the supplier’s relevant food safety records.

15.7.3 Assurance that a Hazard Has Been Significantly Minimized or 

Prevented

The supply-chain program in subpart G is a type of preventive control and, thus, must comply 

with the requirements applicable to preventive controls in 21 CFR 117.135. Under 21 CFR 

117.135(a), a preventive control provides assurance that any hazards requiring a preventive 

control will be significantly minimized or prevented. To make this clear, 21 CFR 117.410(c) 

specifies that the supply-chain program must provide assurance that a hazard requiring a 

supply-chain-applied control has been significantly minimized or prevented. Suppliers that are 

subject to the PCHF requirements in part 117 are required to develop and implement a food 

safety plan that will significantly minimize or prevent hazards associated with the food

manufactured, processed, packed or held by the facility (21 CFR 117.126) and to document

they are following their plan (21 CFR 117.190). Suppliers subject to the produce safety 

requirements in part 112 must take appropriate measures to minimize the risk of serious 

adverse health consequences or death from the use of, or exposure to, covered produce, 

including those measures reasonably necessary to prevent the introduction of known or 

reasonably foreseeable hazards into covered produce, and to provide reasonable assurances 

that the produce is not adulterated under section 402 of the FD&C Act on account of such 

hazards. (See 21 CFR 112.11.)

15.7.4 Considerations in Approving Suppliers and Determining the 

Appropriate Supplier Verification Activities and the Frequency with Which 

They Are Conducted 

As noted in section 15.7.1, subpart G specifies that you must approve suppliers and determine 

appropriate supplier verification activities (including determining the frequency of conducting the 

activity). (See 21 CFR 117.410(a)(1) and (a)(2).) Section 21 CFR 117.410(d)(1) specifies factors 

that you must consider in approving suppliers and determining appropriate supplier verification 

activities (including determining the frequency of conducting the activity). We discuss these 

factors in sections 15.7.4.1 through 15.7.4.4. With one exception, the requirement to consider 

each of these factors applies every time you approve a supplier for a raw material or other 

ingredient, and every time that you determine the appropriate supplier verification activity for a 

food received from that supplier. See a discussion of the exception, in 21 CFR 117.410(d)(2), in 

section 15.7.4.5.

As noted in sections 15.8.1 and 15.8.2, only you can approve suppliers, but subpart G provides

some flexibility for another entity in the distribution chain to conduct certain other activities 

related to supplier verification, and to provide you with applicable documentation of those 

activities, to help you do so.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 18

15.7.4.1 Hazard analysis

The first factor that you must consider in (1) approving suppliers, (2) determining appropriate 

supplier verification activities, and (3) determining the frequency of conducting those activities is 

the hazard analysis of the food, conducted in accordance with 21 CFR 117.130. (See 21 CFR 

117.410(d)(1)(i).) To do so, you must consider the nature of the hazard controlled before receipt 

of the raw material or other ingredient. (See 21 CFR 117.410(d)(1)(i).) Immediately below, we 

explain the requirements of part 117 for a hazard analysis and provide recommendations for 

how to consider the hazard analysis in approving suppliers, determining appropriate supplier 

verification activities, and determining the frequency of those activities.

Part 117 requires that you conduct a hazard analysis to identify and evaluate, based on 

experience, illness data, scientific reports, and other information, known or reasonably 

foreseeable hazards for each type of food manufactured, processed, packed, or held at your 

facility to determine whether there are any hazards requiring a preventive control. (See 21 CFR 

117.130(a).) If you determine that there are any hazards that require a preventive control, with 

few exceptions Part 117 further requires that you must identify and implement a preventive 

control. (See 21 CFR 117.135(a).) When the preventive control will be applied to a raw material 

or other ingredient before receipt, part 117 requires that you establish and implement a riskbased supply-chain program for that raw material or other ingredient. (See 21 CFR 117.405.)

As part of your hazard analysis, you would evaluate the hazard to assess the severity of the 

illness or injury if the hazard were to occur and the probability that the hazard will occur in the 

absence of preventive controls. (See 21 CFR 117.130(c)(1)(i).) The outcome of this aspect of 

the hazard evaluation impacts the type of verification activity you use (as well as the frequency 

of conducting the activity). For example, when the hazard is one for which there is a reasonable 

probability that exposure to the hazard will cause serious adverse health consequences or 

death, in general you must conduct an annual onsite audit before using the raw material or other 

ingredient from the supplier and at least annually thereafter. (See 21 CFR 117.430(b) and the 

discussion in section 15.11.2.) For other hazards, the determination of supplier verification 

activities, and the frequency of conducting those activities, also should be risk-based – i.e., the 

greater the risk presented by the hazard, the more robust the verification activity, and the 

greater the frequency of the verification.

As part of your hazard analysis, you also would evaluate environmental pathogens whenever a 

ready-to-eat food is exposed to the environment prior to packaging and the packaged food does 

not receive a treatment or otherwise include a control measure (such as a formulation lethal to 

the pathogen) that would significantly minimize the pathogen. (See 21 CFR 117.130(c)(1)(ii).) If, 

for example, you are purchasing a cheese to be used in an RTE product you make, and you 

expect that a sanitation control will be applied to address the environmental pathogen Listeria 

monocytogenes, you could ask to review the cheese producer’s written procedures for the 

environmental monitoring it does to verify the sanitation controls. (See 21 CFR 117.165(b)(3).)

You also could periodically verify your supplier’s controls by sampling and testing the cheese for 

L. monocytogenes. Because L. monocytogenes is a hazard for which there is a reasonable 

probability that exposure to the hazard will cause serious adverse health consequences or 

death, you also would conduct an annual onsite audit to verify that your supplier controls L.

monocytogenes when it manufactures the cheese by using a “kill step” such as pasteurization of 

the milk used to make the cheese and sanitation controls to significantly minimize contamination 

from L. monocytogenes in the environment, with environmental monitoring to verify controls for 

L. monocytogenes. 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 19

For all hazards that require a supply-chain-applied control, we recommend that you use the 

outcome of your hazard analysis to help you determine the extent of what you do to consider 

supplier performance as required by 21 CFR 117.117.410(d)(1)(iii) (see the discussion in 

section 15.7.4.3). The greater the risk presented by the hazard, the more stringently you should 

assess supplier performance as a mechanism to reduce the risk presented by the hazard.

15.7.4.2 Entity controlling the hazard

The second factor that you must consider in (1) approving suppliers, (2) determining appropriate 

supplier verification activities, and (3) determining the frequency of conducting those activities is 

the entity or entities that will be applying controls for the hazards requiring a supply-chainapplied control. (See 21 CFR 117.410(d)(1)(ii).) For example, the entity that applies the 

appropriate preventive control could be your direct supplier or your supplier’s supplier. If the 

control is not applied by your direct supplier, you would direct your supplier verification activities 

to your supplier’s supplier, but there is some flexibility in how you could do this.

Figure 2 shows an example in which you obtain a seasoning mix from Supplier X. Supplier X 

made the seasoning mix by blending milk powder (produced by Establishment Y) and a spice

blend (produced by Establishment Z). You identify Salmonella as a hazard in the seasoning mix, 

and you learn from Supplier X (your direct supplier) that it does not apply a control for 

Salmonella in its blending operation. Instead, Establishment Y applies a process control for 

Salmonella in the milk powder and Establishment Z applies a process control for Salmonella in 

the spice blend. Although Supplier X is your “supplier,” Supplier X also is a receiving facility 

(because Supplier X is a manufacturer) and, thus, would have conducted appropriate supplier 

verification activities, such as auditing its suppliers (or obtaining audits) and sampling and 

testing the milk and the spices, to ensure that they have used proper controls. (See section 

15.11.1 for a discussion of when an audit is required for certain hazards and the exception to 

that requirement.) With respect to supplier verification activities for Establishments Y and Z, 

Subpart G provides that you could rely on documentation provided by Supplier X to you 

regarding Supplier X’s supplier verification activities. (See 21 CFR 117.415(a)(3).) Alternatively,

you could conduct the appropriate supplier verification activities with respect to Establishments 

Y and Z yourself, or you could rely on documentation from Supplier X for some supplier 

verification activities with respect to Establishments Y and Z and conduct other supplier 

verification activities with respect to Establishments Y and Z yourself. You also would determine 

an appropriate supplier verification activity and associated frequency for Supplier X.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 20

Figure 2. Supplier X makes a seasoning mix by blending milk powder (produced by Establishment 

Y) and a spice blend (produced by Establishment Z)

In determining whether to approve a supplier that relies on its own supplier to control the hazard

requiring a supply-chain-applied control, we recommend you consider the robustness of the 

entity’s supplier approval process and supplier verification activities.

15.7.4.3 Supplier performance

The third factor that you must consider in approving suppliers, determining appropriate supplier 

verification activities, and determining the frequency of conducting those activities is supplier 

performance. (See 21 CFR 117.410(d)(1)(iii).) Considering supplier performance includes:

• The supplier’s procedures, processes, and practices related to the safety of the raw material 

and other ingredients (21 CFR 117.410(d)(1)(iii)(A)); 

• Applicable FDA food safety regulations and information relevant to the supplier’s compliance 

with those regulations, including an FDA warning letter or import alert relating to the safety 

of food and other FDA compliance actions related to food safety (or, when applicable, 

relevant laws and regulations of a country whose food safety system FDA has officially 

seasoning mix

Establishment Y

Process control for 

Salmonella during 

manufacture of milk 

powder

Establishment Z

Process control for 

Salmonella applied to 

spice blend 

Supplier X

Creates seasoning mix with 

processed milk powder and 

spice blend; identifies 

hazard, but does not apply 

its own controls

Your Facility

Identifies Salmonella 

hazard in seasoning mix

milk powder

spice blend

Identification 

and control of 

hazard

Establishment Z

Establishment Y

Supplier X

Does not apply its own 

controls, but does conduct 

and document supplier 

verification of

Establishments Y and Z:

Appropriate supplier 

verification activities could 

include auditing or 

obtaining an audit of 

Establishments Y and Z and 

sampling and testing the 

milk and spices to ensure 

that suppliers used proper 

Your Facility

Supplier verification of hazard 

control through:

Alternatively

Review Supplier X 

documention of its supplier 

verification activities of 

Establishments Y and Z

- Conduct appropriate 

supplier verification 

actitivites of Establishments 

Y and Z directly (e.g., audit). 

OR

- Conduct some supplier 

verification activities of 

Establishments Y and Z 

yourself and rely on 

documentation from Supplier 

X for others.

Establishments Yand Z

Supplier 

verification

activities by 

Supplier X and 

Your Facility
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 21

recognized as comparable or has determined to be equivalent to that of the United States, 

and information relevant to the supplier’s compliance with those laws and regulations) (21 

CFR 117.410(d)(1)(iii)(B)); and 

• The supplier’s food safety history relevant to the raw materials or other ingredients that the 

receiving facility receives from the supplier, including available information about results 

from testing raw materials or other ingredients for hazards, audit results relating to the safety 

of the food, and responsiveness of the supplier in correcting problems (21 CFR 

117.410(d)(1)(iii)(C)). 

As noted in section 15.7.4.1 regarding your hazard analysis as the first factor to consider, the 

greater the risk presented by the hazard, the more stringently you should assess supplier 

performance as a mechanism to reduce the risk presented by the hazard.

15.7.4.3.1 Supplier’s procedures, processes, and practices

Understanding the supplier’s procedures, processes, and practices related to the safety of the 

raw material and other ingredients can help you understand the supplier’s strengths and 

weaknesses. Mechanisms to do so include:

• Conducting a supplier “pre-assessment” questionnaire or survey to gather information about 

the supplier’s operation, covering topics such as product information (e.g., regulatory 

compliance information and allergen information) and the supplier’s food safety programs 

(e.g., a Hazard Analysis and Critical Control Point (HACCP) program, a sanitation control 

program, and an allergen control program);

• Asking the supplier to provide documents such as a food safety plan or HACCP plan (if 

applicable) and third-party food safety and good manufacturing practice audit results; 

• Conducting a pre-approval site visit to assess programs and process capabilities; and

• Using a system with defined metrics to evaluate supplier performance, including compliance 

to specifications, third-party audit scores, number of recalls, mock recall performance, 

material rejections/complaints, and issue response time (e.g., the supplier’s timeframe for 

resolving a food safety issue).

15.7.4.3.2 Applicable food safety regulations

You should determine what FDA food safety regulations a potential supplier is subject to, such 

as the CGMP and PCHF requirements (21 CFR part 117), the produce safety regulation (21 

CFR part 112), the requirements applicable to low-acid canned foods (21 CFR parts 108 and 

113), the requirements applicable to acidified foods (21 CFR parts 108 and 114), or other 

relevant food safety provisions. In evaluating the supplier’s compliance with the relevant 

regulations, you should consider whether the supplier is the subject of an FDA warning letter, 

import alert, or other FDA compliance action related to food safety (e.g., mandatory recall). See 

our Web site “Supplier Evaluation Resources” (FDA, 2016d) for resources that are available to 

help you evaluate the supplier’s compliance with relevant FDA regulations.

Having an understanding of applicable FDA food safety regulations and information relevant to 

the supplier’s compliance with those regulations can help you determine whether the supplier 

has a demonstrable history of supplying acceptable products and meeting all industry and 

regulatory requirements. Mechanisms to do so include:

• Asking the supplier to provide documentation of any recent regulatory inspections on file; 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 22

• Searching our online databases for warning letters, import alerts, import refusals, recalls, 

and inspections. All of these databases are available to the public from our Web site 

“Supplier Evaluation Resources” (FDA, 2016d).

• Searching for actions that we publicize, such as food outbreak investigations and 

suspension of a facility’s registration. We generally make these available from the

homepage for our human food program at http://www.fda.gov/Food/default.htm.

You should use this information to inform your decisions about whether you will approve a 

supplier, the type of verification activity you would use if you do approve the supplier, and the 

frequency of conducting the verification activity. Being subject to an FDA enforcement action 

such as a warning letter or an import alert should not necessarily disqualify a supplier. However, 

you should consider carefully the actions a supplier has taken as a result of regulatory 

compliance issues along with how it impacts your approval of that supplier and your verification 

activities.

Part 117 includes several provisions that reflect that some suppliers operate in a foreign 

country. (See, e.g., the definition of “qualified auditor in 21 CFR 117.3 and the provisions of 21 

CFR 117.405(a)(2), 117.430(c), 117.435(c)(1)(ii), 117.435(c)(2), and 117.475(c)(15).) When the 

supplier is in a foreign country whose food safety system FDA has officially recognized as 

comparable or determined to be equivalent to that of the United States, you may consider 

relevant laws and regulations of that country, and information relevant to the supplier’s 

compliance with those laws and regulations. (See 21 CFR 117.410(d)(1)(iii)(B).) Thus, having 

an understanding of applicable laws and regulations in a foreign country can help you consider 

supplier performance when FDA has officially recognized that country’s food safety system as 

comparable or determined it is equivalent to that of the United States. For example, just as you 

could ask a domestic supplier to provide documentation of any recent regulatory inspections on 

file, you could ask a foreign supplier that is in a foreign country whose food safety system FDA 

has officially recognized as comparable or determined to be equivalent to that of the United 

States to provide documentation of an inspection conducted by the applicable food safety 

authority. As of the date of this guidance, FDA has a Food Safety Systems Recognition 

Arrangement with Australia (FDA, 2017), Canada (FDA, 2016b), and New Zealand (FDA, 

2015a). To determine whether we have a Food Safety Systems Recognition Arrangement or 

other cooperative arrangement with a foreign country, you can search the “Cooperative 

Arrangements” Web page (FDA, 2016a) of our “International Arrangements” Web page (FDA, 

2015b) of our internet site directed to International Programs (FDA, 2016c). 

15.7.4.3.3 Supplier’s food safety history

Before you became subject to the requirements of subpart G, you could already have 

established a relationship with your suppliers and have information related to audits or have the 

results of sampling and testing that provide a history of how the supplier has met your 

specifications. If so, you already could be aware of past problems with raw materials or other 

ingredients provided by the supplier, and the steps the supplier took to address such problems.

You may consider such prior relationships as part of your consideration of the supplier’s food 

safety history. Likewise, as time goes on and you conduct appropriate supplier verification 

activities to comply with the requirements of subpart G, you would consider this same type of 

information for suppliers that you approve in compliance with subpart G.

You should focus your consideration of the supplier’s food safety history on the hazard that the 

supplier is controlling because that is the most relevant information. However, you should also 

consider other information about the supplier, e.g., information regarding recalls or regulatory 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 23

actions. For example, if you are obtaining a product from a supplier that is controlling a microbial 

hazard (e.g., Salmonella in a spice blend) and food from this supplier has been associated with 

a chemical hazard (e.g., excess sulfites in another spice blend it produces), you should consider 

whether you should implement verification activities related to control of sulfites to prevent 

excess sulfites in the spice blend you receive for a period of time adequate to demonstrate that 

problems that could lead to excess sulfites levels have been resolved.

15.7.4.4 Other factors

Section 117.410(d)(1)(iv) specifies that you must consider any other factors as appropriate and 

necessary, such as storage and transportation practices, in approving suppliers, determining 

appropriate supplier verification activities, and determining the frequency of conducting those 

activities. For example, if you are receiving raw materials or other ingredients that support the 

growth of mold that could produce mycotoxins during storage if temperature and moisture are 

not controlled, you should consider the procedures that the supplier uses to control factors 

impacting growth of mold during the time the supplier stores the raw materials or other 

ingredients being supplied. As another example, if you are receiving raw materials or other 

ingredients that need temperature control during transportation to ensure their safety, you 

should consider the ability of the supplier to ensure control of temperature during transportation 

if the supplier will be responsible for that activity. As another example, if you are obtaining a raw 

material or other ingredient from a facility that is owned by your corporate parent you may 

consider your knowledge of corporate-wide food safety procedures, processes, and practices in 

determining the type of supplier verification activity and the frequency with which it is conducted.

See also the discussion in section 15.6.2 of a circumstance where an individual at the corporate 

level is the PCQI for the purposes of the supply-chain program.

15.7.4.5 Exception to the full requirements for considerations for 

approving suppliers and determining appropriate supplier verification 

activities

Section 117.410(d)(2) provides that considering supplier performance can be limited to the 

supplier’s compliance history (as required by 21 CFR 117.410(d)(1)(iii)(B)), if the supplier is: (i) 

A qualified facility as defined by 21 CFR 117.3; (ii) a farm that grows produce and is not a 

covered farm under 21 CFR part 112 in accordance with 21 CFR 112.4(a), or in accordance 

with 21 CFR 112.4(b) and 112.5; or (iii) a shell egg producer that is not subject to the 

requirements of 21 CFR part 118 because it has less than 3,000 laying hens.

15.7.5 Supplier Nonconformance

Section 117.410(e) specifies that if you determine through auditing; verification testing;

document review; relevant consumer, customer or other complaints; or otherwise that the 

supplier is not controlling hazards that you have identified as requiring a supply-chain-applied 

control, you must take and document prompt action in accordance with 21 CFR 117.150 

(Corrective actions and corrections) to ensure that raw materials or other ingredients from the 

supplier do not cause food that you manufacture or process to be adulterated under section 402 

of the FD&C Act or misbranded under section 403(w) of the FD&C Act. 

We recommend that you establish processes and procedures to handle supplier 

nonconformance situations. The appropriate actions you take in response to nonconformance

will depend on the circumstances and the specific root cause of the nonconformance and could

include:
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 24

• Discontinuing use of the supplier until the cause or causes of nonconformance, adulteration, 

or misbranding are adequately addressed;

• Notifying the supplier of the problem and requesting documentation of corrective actions 

taken by the supplier;

• Assisting the supplier’s efforts to correct and prevent recurrence of the problem;

• Revising your supply-chain program; and

• Conducting, or working with your supplier to conduct, a recall of an adulterated or 

misbranded food.

15.8 Responsibilities of the Receiving Facility (21 CFR 117.415)

Section 117.415 describes your responsibilities as a receiving facility. As noted in section 

15.3.2, subpart G includes provisions that provide for an entity other than you to conduct certain 

activities, provided that you review and assess the entity’s applicable documentation, and 

document that review and assessment. Section 117.415 both specifies this flexibility provided 

by subpart G and places some bounds on that flexibility. We discuss this flexibility and its 

bounds in sections 15.8.1 through 15.8.4.

15.8.1 Your Responsibility to Approve Suppliers 

Section 117.415(a)(1) specifies that the receiving facility must approve suppliers. Although 21 

CFR 117.415(a)(2) through (a)(4) provide some flexibility for other entities to determine and 

conduct appropriate supplier verification activities (see section 15.8.2), ultimately the receiving 

facility is responsible for its supply-chain program (see the discussion in the final rule 

establishing part 117, 80 FR 55908 at 56097). See section 15.7.4 for considerations in 

approving suppliers and section 15.9 for the requirements to approve suppliers before receiving 

raw materials and other ingredients from those suppliers and have written procedures for 

receiving raw materials and other ingredients.

As noted in section 15.6.1, the definition of “supplier” in part 117 means that a broker or 

distributor is not a supplier; the supplier is the establishment that manufactures/processes the 

food, raises the animal, or grows the food. Thus, if you buy raw materials or other ingredients 

from a broker or distributor, you should ask the broker or distributor to provide you with 

information that allows you to approve the establishment that manufactures/processes the food, 

raises the animal, or grows the food as a supplier of the food that you purchase from that broker 

or distributor. Likewise, if you purchase raw materials or other ingredients from a retail 

establishment (e.g., a warehouse-style establishment that sells to consumers), some applicable 

information (e.g., name and place of business of the manufacturer, packer, or distributor) would 

be on the product label as required by food labeling regulations. (See 21 CFR 101.5.) Also, you 

could ask the retail establishment to provide you with information that allows you to evaluate the 

establishment that manufactures/processes the food, raises the animal, or grows the food. 

15.8.2 Your Responsibility to Determine and Conduct Appropriate Supplier 

Verification Activities

Section 117.415(a)(2) specifies that the receiving facility must determine and conduct 

appropriate supplier verification activities, and satisfy all documentation requirements of subpart 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 25

G. However, sections 117.415(a)(3) and (4) provide some flexibility for other entities to 

determine and conduct supplier verification activities on behalf of the receiving facility. See 

section 15.7.4 for considerations in determining appropriate supplier verification activities and 

the frequency of conducting them.

15.8.2.1 Flexibility for another entity to determine, conduct, and 

document appropriate supplier verification activities

Under 21 CFR 117.415(a)(3), an entity other than the receiving facility may do any of the 

following, provided that the receiving facility reviews and assesses the entity’s applicable 

documentation, and documents that review and assessment:

• Establish written procedures for receiving raw materials and other ingredients by the entity

(21 CFR 117.415(a)(3)(i));

• Document that written procedures for receiving raw materials and other ingredients are 

being followed by the entity (21 CFR 117.415(a)(3)(ii)); and 

• Determine, conduct, or both determine and conduct the appropriate supplier verification 

activities (21 CFR 117.415(a)(3)(iii)), with appropriate documentation.

Although we specify that these activities are your responsibility, subpart G accounts for one or 

more entities in the supply chain between you and “the supplier” by providing some flexibility for 

these entities to perform certain activities.

15.8.2.2 Supplier verification activities that the supplier can conduct 

and document 

Under 21 CFR 117.415(a)(4), the supplier may conduct and document sampling and testing of 

raw materials and other ingredients, for the hazard controlled by the supplier, as a supplier 

verification activity for a particular lot of product and provide such documentation to the 

receiving facility. However, 21 CFR 117.415(a)(4) also requires that you review and assess that 

documentation, and document that review and assessment. An example of documentation of 

the results of sampling and testing is a COA, whether of periodic testing or lot-by-lot testing of 

the raw material or ingredient. 

We recommend that a COA document that major analytical parameters for the specific foods, or 

lots, contained in a specific shipment have been met (see, e.g., GMA, 2008). Testing can be 

performed by the supplier’s in-house laboratory or contracted to an outside testing laboratory.

The laboratory conducting the testing should use scientifically valid laboratory methods and 

procedures that can provide reliable, accurate test results.

15.8.3 What You May Not Accept from a Supplier as a Supplier Verification 

Activity

Section 117.415(b) specifies that a receiving facility may not accept any of the following as a 

supplier verification activity from its supplier:

• A determination by its supplier of the appropriate supplier verification activities for that 

supplier (21 CFR 117.415(b)(1)); 

• An audit conducted by its supplier of that supplier (21 CFR 117.415(b)(2)); 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 26

• A review by its supplier of that supplier’s own relevant food safety records (21 CFR 

117.415(b)(3)); or 

• The conduct by its supplier of other appropriate supplier verification activities for that 

supplier (21 CFR 117.415(b)(4)).

The only supplier verification activities in which the supplier can play a role are sampling and 

testing (see section 15.8.2.2) and providing an audit of the supplier conducted by a third party 

(see section 15.8.4).

15.8.4 Audit Provided by the Supplier

Under 21 CFR 117.415(c), your responsibilities as a receiving facility do not prohibit you from 

relying on an audit provided by your supplier when the audit of the supplier was conducted by a 

third-party qualified auditor in accordance with the requirements of subpart G applicable to 

audits (i.e., 21 CFR 117.430(f) and 117.435). We discuss these requirements applicable to 

audits in sections 15.11.6 and 15.12, respectively.

15.9 Using Approved Suppliers (21 CFR 117.420)

As noted in sections 15.7.1 and 15.8.1, subpart G requires that a receiving facility approve 

suppliers. (See 21 CFR 117.410(a)(1) and 117.415(a)(1).) 

15.9.1 Approving Suppliers

Section 117.420(a) specifies that the receiving facility must approve suppliers in accordance 

with the requirements of 21 CFR 117.410(d), and document that approval, before receiving raw 

materials and other ingredients from those suppliers. As discussed in section 15.7.4, 21 CFR 

117.410(d) both specifies factors that you must consider in approving suppliers and determining 

appropriate supplier verification activities and provides for an exception to the full requirements 

for considering these factors.

15.9.2 Written Procedures for Receiving Raw materials and Other 

Ingredients

Section 117.420(b) specifies that:

• Written procedures for receiving raw materials and other ingredients6 must be established 

and followed (21 CFR 117.420(b)(1)); 

• The written procedures for receiving raw materials and other ingredients must ensure that 

raw materials and other ingredients are received only from approved suppliers (or, when 

necessary and appropriate, on a temporary basis from unapproved suppliers whose raw 

materials or other ingredients are subjected to adequate verification activities before 

acceptance for use) (21 CFR 117.420(b)(2)); and 

 6 As noted in the list of terms in section 15.5, part 117 defines the term “written procedures for receiving 

raw materials and other ingredients” to mean written procedures to ensure that raw materials and other 

ingredients are received only from suppliers approved by the receiving facility (or, when necessary and 

appropriate, on a temporary basis from unapproved suppliers whose raw materials or other ingredients 

are subjected to adequate verification activities before acceptance for use). We defined this term to 

simplify the provisions discussing these procedures.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 27

• Use of the written procedures for receiving raw materials and other ingredients must be 

documented (21 CFR 117.420(b)(3)).

You have flexibility to design appropriate written procedures that are tailored to your facility and 

operations for receiving raw materials and other ingredients. The goal of these written

procedures is to ensure that you can accurately identify approved suppliers and incorporate 

changes to your suppliers in a timely and accurate way (e.g., addition of new approved 

suppliers, deletion of suppliers no longer deemed approved, criteria for approving temporary 

suppliers). Procedures to ensure that raw materials or other ingredients are only received from 

approved suppliers allow consistent implementation of the supplier program by personnel who 

order raw materials and other ingredients, personnel who receive raw materials and other 

ingredients, and personnel who conduct supplier verification activities. Such procedures also 

can be part of training of personnel who will have responsibility for receiving raw materials and 

other ingredients. 

The use of written procedures for receiving raw materials and other ingredients is particularly 

important in light of the flexibility subpart G provides for an entity other than you (such as an 

entity in the supply chain between you and the supplier) to conduct this activity. (See 21 CFR 

117.415(a)(2).) Although such an entity can do this as a service to you, a written procedure is 

appropriate to ensure a robust and meaningful verification. If you purchase from a broker or 

distributor, you must approve the suppliers of the raw materials or other ingredients you buy 

from the broker/distributor (see sections 15.8.1 and 15.9.1), but the broker/distributor could 

document that written procedures are being followed to ensure that the raw materials and other 

ingredients provided to you only come from suppliers that you have approved. The 

broker/distributor would provide this documentation to you (e.g., in documents accompanying 

the shipment) for you to review and assess. Thus, if you rely on a broker/distributor to ensure 

that the raw materials and other ingredients provided to you only come from suppliers that you 

have approved, you and the broker/distributor you buy from should agree on the written 

procedures for how the broker/distributor will document that raw materials or other ingredients 

are received only from suppliers approved by you. For example, the broker/distributor could 

have a checklist that an employee dates and initials after reviewing the invoice from the 

supplier, and send a copy of that dated checklist to you together with the invoice for the raw 

materials or other ingredients. You could use an electronic system or specific supply chain 

management software to document receipt of the raw material or other ingredient and review of 

checklist from the broker/distributor at the time of receipt. Below, we discuss the use of 

checklists and computer systems in more detail.

One approach to a written procedure for ensuring that raw materials and other ingredients are 

only received from approved suppliers is to maintain and use an actual “approved supplier list” 

to ensure that only suppliers from the lists are used for the purchase of raw materials or other 

ingredients (Zaura, 2005). One example of this approach is a simple paper system where the 

receiving personnel or quality control/assurance personnel check the origin of the purchased 

materials (IFS, 2012) and refer to a list of approved suppliers to verify that the raw material or 

ingredient is received from an approved supplier (SQFI, 2014) (e.g., put a check mark on the 

receiving document if the supplier is an approved supplier).

Another approach to a written procedure for ensuring that raw materials and other ingredients 

are only received from approved suppliers is a computer system or specific supply chain 

management software that manages the procurement, receipt, and usage of raw materials and 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 28

other ingredients. An example of this approach is for authorized personnel from the receiving 

facility or its corporate headquarters to enter approved suppliers and approved raw materials 

and other ingredients into the computerized system. When raw materials and other ingredients 

are delivered to a facility, the receiving personnel cross reference the purchase order number, 

supplier name, and material received with the information previously entered into the computer 

system to verify the materials are from an approved supplier and the order is correct. Typically 

the computer system would also have a safeguard mechanism to prevent the acceptance of a 

raw material or other ingredient from an unapproved supplier. On an as needed basis, a facility 

or its corporate headquarters can use the computer system to generate a list of the approved 

suppliers and approved raw materials or ingredients in real time.

Another approach to a written procedure for ensuring that raw materials and other ingredients 

are only received from approved suppliers is use of computer programs that link inputs on items 

received with the list of approved suppliers for that item and flag discrepancies. You could either 

use your existing receiving record system or modify your existing receiving record system to 

record information regarding receipt from approved suppliers. 

Subpart G accounts for emergency situations in which you would need to receive raw materials 

or other ingredients on a temporary basis from an unapproved supplier (See 21 CFR 

117.420(b)(2) and SQFI, 2014.) Examples of such situations are disruptions in delivery of raw 

materials and other ingredients from approved suppliers due to:

• An environmental incident (e.g., an earthquake) or weather-related incident (e.g., a tornado

or severe drought or flooding in the area where the supplier is located);

• A major equipment breakdown at the facility of a sole supplier of a food;

• The emergence of a contamination problem at your supplier’s facility; or

• Your supplier ceases operations without giving you advance notification.

For an unapproved supplier that you plan to use on a temporary basis, we recommend that you 

conduct at least a minimal review of the supplier. For example, we suggest that you review 

FDA’s Web site to determine whether the potential supplier has received a warning letter or is 

listed on an import alert. In addition, if you need to use an unapproved supplier under such 

unexpected circumstances, you must subject the applicable raw materials or other ingredients 

to adequate verification activities before acceptance for use. (See 21 CFR 117.420(b)(2).) For 

example, if you are receiving a raw material or ingredient such as black pepper and your 

supplier controls Salmonella, you could sample and test each shipment of food from the supplier

for Salmonella using a statistically-based sampling plan. Alternatively, you could obtain and 

review records of the process that the temporary supplier uses to kill Salmonella in the black 

pepper. 

You should use unapproved suppliers only on a temporary basis until you are able to fully 

evaluate and approve a new supplier, or until the problem with your previously approved 

supplier has been corrected and, as appropriate, you reevaluate your approval of that supplier.

An appropriate time period for use of an unapproved supplier on a temporary basis might vary, 

depending on the circumstances, from a few weeks to a few months. For example, if your 

approved supplier ceases operations and you intend to continue to use a temporary supplier, 

you should promptly evaluate the new supplier and revise your supply-chain program 

accordingly. If you are considering multiple new suppliers to replace your approved supplier, 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 29

you may need some additional time to evaluate and approve the additional suppliers. As 

another example, it could be the case that you expect to be able to obtain the food from the 

approved supplier in a few weeks, but you subsequently determine that it may take several 

months or an indefinite period of time before you can obtain the food from the approved supplier

because of an equipment breakdown or a weather-related incident. In that circumstance, you 

may determine that you want to use your temporary supplier or another supplier on a more 

permanent basis. If that occurs, you should promptly evaluate and approve the new supplier 

and revise your supply-chain program to reflect this. Having multiple suppliers approved for 

each raw material or ingredient you receive can reduce the use of temporary suppliers when 

one supplier becomes unavailable.

How you document use of the written procedures for receiving raw materials and other 

ingredients depends on what your procedures are and how you implement them. For example, if 

you use a checklist, or put a check mark on the receiving document if the supplier is an 

approved supplier, then the checklist or receiving document would be your documentation. If 

you use a computerized system, you can generate records, such as a list of approved suppliers 

and a list of approved raw materials and other ingredients received from those suppliers on an 

as needed basis. If you receive documentation from another entity that has documented the 

receipt of raw materials or other ingredients from suppliers you have approved, you would 

review that documentation to verify that it is correct and document your assessment (e.g., with a 

notation on the documentation you received or in a computerized receiving log). 

If you receive raw materials or other ingredients on a temporary basis from an unapproved 

supplier, remember that subpart G requires you to subject raw materials or other ingredients 

from that unapproved supplier to adequate verification activities before you accept the raw 

materials or other ingredients for use. (See 21 CFR 117.420(b)(3).) To satisfy this requirement, 

you should document the verification activities that you conducted before accepting raw 

materials or other ingredients from a temporary supplier. 

15.10 Determining Appropriate Supplier Verification Activities 

(Including Determining the Frequency of Conducting the Activity) (21 

CFR 117.425)

Section 21 CFR 117.425 requires that appropriate supplier verification activities (including the 

frequency of conducting the activity) be determined in accordance with the requirements of 21 

CFR 117.410(d). Section 21 CFR 117.410(d) specifies the considerations in approving suppliers 

and determining the appropriate supplier verification activities and the frequency with which they 

are conducted. For details about the requirements of 21 CFR 117.410(d) and our 

recommendations for complying with those requirements, see section 15.7.4.

15.11 Conducting Supplier Verification Activities for Raw Materials 

and Other Ingredients (21 CFR 117.430)

Section 21 CFR 117.430 specifies requirements to conduct one or more of the supplier 

verification activities specified in 21 CFR 117.410(b), provides for alternative supplier verification 

activities in certain circumstances, and prohibits certain financial conflicts of interest. We 

discuss these provisions in sections 15.11.1 through 15.11.6.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 30

15.11.1 Requirement to Conduct Supplier Verification Activities

With some exceptions, 21 CFR 117.430(a) requires that one or more supplier verification 

activities (i.e., onsite audit, sampling and testing, review of food safety records, and other 

supplier verification activities)7 must be conducted for each supplier before using the raw 

material or other ingredient from that supplier and periodically thereafter. The exceptions to this 

requirement are specified in 21 CFR 117.430(c), (d), and (e). See the discussion of the 

exceptions to this requirement in sections 15.11.3 through 15.11.5.

A successful supplier program includes supplier verification activities both before the use of the 

raw material or other ingredient and periodically thereafter to evaluate ongoing compliance 

(ASTA, 2011; Edleman, 2012; Eldridge, 2012; ERG, 2004; Neumann, 2009; Zaura, 2005). 

Periodic verification provides routine feedback on the supplier’s performance, rather than only 

when a problem arises (Zaura, 2005). 

Subpart G includes specific requirements for conducting onsite audits (21 CFR 117.435) and for 

documenting the conduct of supplier verification activities (21 CFR 117.475). See sections 

15.11.2 and 15.12 for discussions of conducting an onsite audit as a supplier verification 

activity. See section 15.13 for a discussion of documenting of supplier verification activities.

15.11.2 Specific Requirements When the Hazard Requiring a Preventive 

Control is a SAHCODH Hazard

15.11.2.1 Requirement for an onsite audit when the hazard requiring a 

preventive control is a SAHCODH hazard

With one exception (see section 15.11.2), 21 CFR 117.430(b)(1) requires that when a hazard in 

a raw material or other ingredient will be controlled by the supplier and is one for which there is 

a reasonable probability that exposure to the hazard will result in serious adverse health 

consequences or death to humans (SAHCODH hazard): 

• The appropriate supplier verification activity is an onsite audit of the supplier (21 CFR 

117.430(b)(1)(i)); and 

• The audit must be conducted before using the raw material or other ingredient from the 

supplier and at least annually thereafter (21 CFR 117.430(b)(1)(ii)).

SAHCODH hazards are those for which a recall of a violative product posing such a hazard is 

designated as “Class 1” under 21 CFR 7.3(m)(1) (i.e., a situation in which there is a reasonable 

probability that the use of, or exposure to, a violative product will cause serious adverse health 

consequences or death). Examples of such hazards that, in some circumstances, have resulted 

in serious adverse health consequences or death to humans include pathogens or their toxins in 

RTE foods and undeclared food allergens. Foods (other than dietary supplements or infant 

formula) containing a SAHCODH hazard are considered “reportable foods,” subject to the 

Reportable Food Registry requirements prescribed by the Food and Drug Administration 

Amendments Act of 2007. See our “Guidance for Industry: Questions and Answers Regarding 

the Reportable Food Registry as Established by the Food and Drug Administration 

 7 The list of appropriate supplier verification activities is specified in 21 CFR 117.410(b). The receiving 

facility determines which activity to conduct in accordance with 21 CFR 117.410(d). See the discussion of 

the appropriate supplier verification activities in section 15.4.2. See the discussion of determining 

appropriate supplier verification activities in section 15.4.4.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 31

Amendments Act of 2007” (FDA, 2009 and FDA, 2010), and the annual reports of the 

Reportable Food Registry (e.g., FDA, 2016e.) for examples of foods that we have considered to 

be SAHCODH hazards. 

Onsite audits provide the opportunity to review the food safety plan and written procedures and 

to observe the implementation of food safety procedures, as well as to review the records 

related to the past application of control measures, including laboratory test results. Audits also 

provide the opportunity to interview employees to assess their understanding of the food safety 

measures for which they are responsible.

The goal of conducting an audit “at least annually thereafter” is to receive the results of an audit 

with sufficient frequency to provide assurance that a hazard requiring a supply-chain-applied 

control has been significantly minimized or prevented. We realize there could be practical 

reasons which preclude meeting this timeframe, e.g., if a third-party auditor needs to delay a 

previously scheduled audit. We do not expect to take action if the timeframe between annual 

audits is reasonably close to one year (e.g., within 13-14 months).

For specific requirements that apply to an audit, see 21 CFR 117.435 and section 15.12. For a 

discussion of documentation associated with an audit, see section 15.13.

15.11.2.2 Exception to the requirement for an onsite audit when the 

hazard requiring a preventive control is a SAHCODH hazard

The exception to the requirement to conduct an annual onsite audit when the hazard requiring a 

preventive control is a SAHCODH hazard is when there is a written determination that other 

verification activities and/or less frequent onsite auditing of the supplier provide adequate 

assurance that the hazards are controlled. (See 21 CFR 117.430(b)(2).) The written 

determination is part of your food safety plan and, thus, must be prepared by (or under the 

oversight of) your PCQI (see the discussion in section 15.6.5).

As an example of using an alternative approach to an annual onsite audit, consider the situation 

in which you are part of a larger corporation, are making trail mix, and obtain roasted peanuts 

from a supplier that is a subsidiary of the corporation and is operating under the same food 

safety system as you. You could determine that the food safety requirements established by the 

parent company and applied at the subsidiary provide the needed assurance that Salmonella in 

raw peanuts is adequately controlled. You could support your decision by documenting this 

determination, including the supplier’s procedures and the corporation’s activities to verify that 

the subsidiary operates in accordance with corporate food safety policies to ensure that hazards 

are adequately controlled. See also the discussion in section 15.6.2 of a circumstance where an 

individual at the corporate level is the PCQI for the purposes of the supply-chain program.

However, if a SAHCODH hazard is identified for the food and you conclude that annual onsite 

auditing is not required, we recommend that your supplier verification activities generally include 

some frequency of onsite auditing, such as every 2 or 3 years for most suppliers not in your 

same corporate structure. For example, consider the situation in which you have many years of 

experience with the same supplier. You could document the history of the supplier’s compliance

with control of the hazard (including summarizing test results, audit findings and other 

information) to support your decision that an annual onsite audit is not needed. You would

identify appropriate supplier verification activities and document these in your supply-chain 

program, e.g., you could determine and describe in your written program that you will require an 

audit every two years and sample and test for the hazard each quarter in the intervening year.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 32

15.11.3 Alternative Supplier Verification Activity If the Supplier Is a 

“Qualified Facility” 

Section 21 CFR 117.430(c) provides for an alternative supplier verification activity if a supplier is 

a qualified facility as defined by 21 CFR 117.3. If this is the case, you do not need to comply 

with the requirements to conduct one of the supplier verification activities specified in 21 CFR 

117.410(b) (i.e., audit, sampling and testing, review of the supplier’s relevant food safety 

records, or other appropriate supplier verification activity), or conduct an annual onsite audit if 

the hazard requiring a preventive control is a SAHCODH hazard, if you:

• Obtain written assurance that the supplier is a qualified facility as defined by § 117.3: 

o Before first approving the supplier for an applicable calendar year; and 

o On an annual basis thereafter, by December 31 of each calendar year, for the 

following calendar year; and 

• Obtain written assurance, at least every 2 years, that the supplier is producing the raw 

material or other ingredient in compliance with applicable FDA food safety regulations (or, 

when applicable, relevant laws and regulations of a country whose food safety system FDA 

has officially recognized as comparable or has determined to be equivalent to that of the 

United States). The written assurance must include either: 

o A brief description of the preventive controls that the supplier is implementing to 

control the applicable hazard in the food; or

o A statement that the facility is in compliance with State, local, county, tribal, or other 

applicable non-Federal food safety law, including relevant laws and regulations of 

foreign countries.

A facility is a qualified facility if it is a very small business as that term is defined in part 117. See 

the definitions for “qualified facility” and “very small business” in 21 CFR 117.3 and in the list of 

terms in section 15.5. A qualified facility is not subject to the PCHF requirements for hazard 

analysis and risk-based preventive controls, including the requirement to have a supply-chain 

program. It is the responsibility of the supplier to determine whether it is a qualified facility; it is 

your responsibility to obtain written assurance from the supplier that it is a qualified facility.

By specifying “by December 31” for the annual written assurance that the supplier is a qualified 

facility, the provision provides some flexibility for you to work with each applicable supplier to 

determine the specific date within a calendar year for that supplier to annually notify you about 

its status. You and your suppliers have some flexibility to approach the potential for the status of 

a facility to shift between “qualified facility” and “not a qualified facility” (or vice versa) in a way 

that works best for your specific business relationship.

The biennial written assurance aligns with the responsibilities of a qualified facility to submit an 

attestation to FDA every two years.

8 (See 21 CFR 117.201(a).) In its attestation, the qualified 

facility attests that: (1) It meets the definition of a qualified facility; and (2) either it has 

established and is following certain food safety practices, or it is in compliance with State, local, 

county, tribal, or other applicable non-Federal food safety law, including relevant laws and 

 8 For a facility that begins manufacturing, processing, packing or holding food before September 17, 2018, 

the facility must make its first submission by December 17, 2018. For a facility that begins manufacturing, 

processing, packing or holding food after September 17, 2018, the facility must make its first submission 

before beginning operations. 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 33

regulations of foreign countries. See section 15.7.4.3 for a discussion of the applicability of 

relevant laws and regulations of a country whose food safety system FDA has officially 

recognized as comparable or has determined to be equivalent to that of the United States. A

qualified facility submits its attestation to FDA on Form FDA 3942a. A supplier that is a qualified 

facility could provide a copy of that form to its customers to help them comply with 21 CFR 

117.430(c)(1). (A qualified facility that submits the attestation electronically could print a copy for 

this purpose.) Subpart G also requires that a receiving facility obtain a written assurance that 

includes a brief written description of the preventive controls that the qualified facility is 

implementing to control the applicable hazard in the food, or a statement that the qualified 

facility is in compliance with an applicable non-Federal food safety law. For example, a qualified 

facility that supplies honey-roasted pecans could include a brief written description of its 

preventive controls to control Salmonella on the pecans (e.g., roasting the pecans at a specified 

temperature for a specified time period); alternatively, a qualified facility that supplies honeyroasted pecans could provide a statement that it complies with the food safety laws of the state 

in which it is located. 

15.11.4 Alternative Supplier Verification Activity If the Supplier is a Certain 

Type of Produce Farm

Section 21 CFR 117.430(d) provides for an alternative supplier verification activity if a supplier is 

a farm that grows produce and is not a covered farm under the produce safety regulation in 21 

CFR part 112 in accordance with 21 CFR 112.4(a), or in accordance with 21 CFR 112.4(b) and 

112.5. If this is the case, you do not need to comply with the requirements to conduct one of the 

supplier verification activities specified in 21 CFR 117.410(b), or conduct an annual onsite audit 

if the hazard requiring a preventive control is a SAHCODH hazard, for produce that the 

receiving facility receives from the farm as a raw material or other ingredient if you: 

• Obtain written assurance that the raw material or other ingredient provided by the supplier is 

not subject to the produce safety regulation in 21 CFR part 112 in accordance with 21 CFR

112.4(a), or in accordance with 21 CFR 112.4(b) and 112.5: 

o Before first approving the supplier for an applicable calendar year; and 

o On an annual basis thereafter, by December 31 of each calendar year, for the 

following calendar year; and 

• Obtain written assurance, at least every 2 years, that the farm acknowledges that its food is 

subject to section 402 of the FD&C Act (or, when applicable, that its food is subject to 

relevant laws and regulations of a country whose food safety system FDA has officially 

recognized as comparable or has determined to be equivalent to that of the United States).

Under 21 CFR 112.4(a), a farm or farm mixed-type facility that has less than $25,000 in annual 

sales of produce averaged over the previous 3-year period is not a covered farm under the 

produce safety regulation. Under 21 CFR 112.4(b) and 112.5, a farm is not a covered farm if the 

farm is eligible for a qualified exemption and associated modified requirements based on the 

average monetary value of all food sold and the relative value of food sold directly to qualified 

end users as compared to all other buyers9

, and FDA has not withdrawn the farm’s exemption.

It is the responsibility of the supplier to determine whether it is not subject to the produce safety 

regulation; it is your responsibility to obtain written assurance from the supplier that it is not 

subject to the produce safety regulation.

 9 See 21 CFR 112.5(a) for the requirements of the qualified exemption and 21 CFR 112.3 for the 

definition of “qualified end users.”
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 34

By specifying “by December 31” for the annual written assurance that the supplier is a farm that 

grows produce and is not a covered farm under the produce safety regulation, the provision 

provides some flexibility for you to work with each applicable supplier to determine the specific 

date within a calendar year for that supplier to annually notify you about its status. You and your

suppliers have some flexibility to approach the potential for the status of a facility to shift 

between “not a covered farm” and “covered farm” (or vice versa) in a way that works best for 

your specific business relationship.

See section 15.7.4.3 for a discussion of the applicability of relevant laws and regulations of a 

country whose food safety system FDA has officially recognized as comparable or has 

determined to be equivalent to that of the United States.

15.11.5 Alternative Supplier Verification Activity If the Supplier Is a Shell Egg 

Producer That Is Not Subject to the Requirements of 21 CFR Part 118

Section 21 CFR 117.430(e) provides for an alternative supplier verification activity if a supplier is 

a shell egg producer that is not subject to the requirements of 21 CFR part 118 for the 

production, storage, and transportation of shell eggs because it has less than 3,000 laying hens.

If this is the case, you do not need to comply with the requirements to conduct one of the 

supplier verification activities specified in 21 CFR 117.410(b), or conduct an annual onsite audit 

if the hazard requiring a preventive control is a SAHCODH hazard, if you: 

• Obtain written assurance that the shell eggs produced by the supplier are not subject to 21 

CFR part 118 because the shell egg producer has less than 3,000 laying hens: 

o Before first approving the supplier for an applicable calendar year; and 

o On an annual basis thereafter, by December 31 of each calendar year, for the 

following calendar year; and

• Obtain written assurance, at least every 2 years, that the shell egg producer acknowledges 

that its food is subject to section 402 of the FD&C Act (or, when applicable, that its food is 

subject to relevant laws and regulations of a country whose food safety system FDA has 

officially recognized as comparable or has determined to be equivalent to that of the United 

States).

A shell egg producer is not subject to the requirements for the production, storage, and 

transportation of shell eggs if it has less than 3,000 laying hens. It is the responsibility of the 

supplier to determine whether it is not subject to the requirements for the production, storage, 

and transportation of shell eggs; it is your responsibility to obtain written assurance from the 

supplier that it is not subject to those requirements. 

By specifying “by December 31” for the annual written assurance that the supplier is a shell egg 

producer that is not subject to 21 CFR part 118, the provision provides some flexibility for you to 

work with each applicable supplier to determine the specific date within a calendar year for that 

supplier to annually notify the receiving facility about its status. You and your suppliers have 

some flexibility to approach the potential for the status of a facility to shift between “not subject 

to 21 CFR part 118” and “subject to 21 CFR part 118” (or vice versa) in a way that works best 

for your specific business relationship.

See section 15.7.4.3 for a discussion of the applicability of relevant laws and regulations of a 

country whose food safety system FDA has officially recognized as comparable or has 

determined to be equivalent to that of the United States.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 35

15.11.6 Financial Conflict of Interest

Section 21 CFR 117.430(f) specifies that there must not be any financial conflicts of interests 

that influence the results of the verification activities listed in 21 CFR 117.410(b). For example, if 

a qualified individual has a financial conflict of interest that influences the results of supplier 

verification activities, the qualified individual would be precluded from being able to 

independently conduct supplier verification activities. You can avoid this possibility when 

conducting supplier verification activities by only using individuals or firms that do not have 

conflicts of interest.

In addition, 21 CFR 117.430(f) specifies that payment must not be related to the results of the 

activity. For example, you may not give a qualified auditor who conducts an onsite audit, or a 

qualified individual who reviews supplier food safety records, greater compensation for 

determining that a supplier is in compliance with applicable FDA requirements. Also, you may 

not reduce the compensation of a qualified auditor or qualified individual or assess financial 

penalties because the qualified auditor or qualified individual identified areas of supplier noncompliance. Similarly, a supplier may not make such payments.

The requirements of 21 CFR 117.430(f) do not prohibit employees of a supplier from performing 

the functions specified in 21 CFR 117.415 in accordance with 21 CFR 117.415. (See the 

discussion of functions that a supplier can perform in accordance with 21 CFR 117.415(a)(4) in 

section 15.8.2.2). For example, this provision would not prohibit an employee of a supplier from 

conducting sampling and testing so that the supplier could provide the results in documentation 

provided to the receiving facility; it is common for suppliers to include COAs for tests conducted 

on specific lots of product along with the shipment to the receiving facility. The requirements of 

21 CFR 117.430(f) also do not prohibit you from relying on an audit provided by your supplier 

when the audit of the supplier was conducted by a third-party qualified auditor. (See the 

discussion of 21 CFR 117.415(c) in section 15.8.4.)

15.12 Onsite Audit (21 CFR 117.435)

Section 21 CFR 117.435 specifies requirements applicable to onsite audits, including who must 

conduct an onsite audit; consideration of applicable food safety regulations; and when the 

written results of an inspection can be substituted for an audit. We discuss these provisions in 

sections 15.12.1 through 15.12.3.

15.12.1 Who Conducts an Onsite Audit

Section 21 CFR 117.435(a) requires that an onsite audit of a supplier be performed by a 

qualified auditor. Part 117 defines “qualified auditor” as a person who is a qualified individual as 

defined in part 117 and has technical expertise obtained through education, training, or 

experience (or a combination thereof) necessary to perform the auditing function as required by 

21 CFR 117.180(c)(2). Examples of potential qualified auditors include: 

• A government employee, including a foreign government employee; and 

• An audit agent of a certification body that is accredited in accordance with the accredited 

third-party certification regulation.

Part 117 defines “qualified individual” as a person who has the education, training, or 

experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 36

and safe food as appropriate to the individual’s assigned duties. A qualified individual may be, 

but is not required to be, an employee of the establishment.

See the definitions of “qualified auditor” and “qualified individual” in 21 CFR 117.3 and in the list 

of terms in section 15.5.) The requirements applicable to a qualified auditor are set forth in 21 

CFR 117.180(c)(2), which specifies that to be a qualified auditor, a qualified individual must 

have technical expertise obtained through education, training, or experience (or a combination 

thereof) necessary to perform the auditing function. A qualified auditor may be, but is not 

required to be, an employee of the receiving facility.

We have not established specific courses, programs, or certifications, or defined the type of 

experiences that would be required to satisfy the requirements applicable to a qualified auditor

as defined in part 117. However, consistent with the requirements for competent audit agents in 

21 CFR 1.650 and the guidance entitled “Third-Party Certification Body Accreditation for Food 

Safety Audits: Model Accreditation Standards: Guidance for Industry and FDA Staff” (Guidance 

on Accredited Third-Party Certification) (FDA, 2016f), we expect a qualified auditor to have 

education, training, or experience that provides the person with knowledge and skills necessary 

to evaluate whether the equipment, processes, and procedures in a food facility or on a farm 

ensure that the hazards associated with the food have been controlled. For example, an 

individual who has previously conducted food safety inspections for a food safety authority may 

be a qualified auditor, provided that the individual has the knowledge and experience to assess 

compliance with the applicable provisions of the FD&C Act. A person should have at least some 

actual experience in auditing (including assisting in audits or observing audits) to meet the 

definition of a qualified auditor, because the necessary technical expertise likely cannot be 

obtained solely through education and/or training that does not involve assisting or observing 

others in the performance of an audit.

The example of an audit agent of a certification body that has been accredited in accordance 

with regulations in our accredited third-party certification regulation (21 CFR part 1, subpart M) 

adds context about the standard for such individuals. The requirements in 21 CFR 1.650

address how an accredited third-party certification body must ensure its audit agents are 

competent and objective. Although an onsite audit that is solely conducted to meet the 

requirements of part 117 by an audit agent of a certification body that is accredited in 

accordance with regulations in part 1, subpart M, is not subject to the requirements in those 

regulations (see section 15.12.4), the requirements for audit agents and the Guidance on 

Accredited Third-Party Certification with respect to competency are useful in determining 

appropriate education, training, or experience for a qualified auditor. For example, competency 

requirements for audit agents in the accredited third-party certification regulation include that 

they:

• Have relevant knowledge and experience that provides an adequate basis for the audit 

agent to evaluate compliance with applicable food safety requirements of the FD&C Act and 

FDA regulations;

• Be competent to conduct food safety audits; and

• Have completed annual food safety training (FDA 2016f). 

The Guidance on Accredited Third-Party Certification (FDA 2016f) further recommends 

education and/or experience for entry level auditors and lead auditors, as well as auditor skills 

such as observational, reasoning, analytical and communication skills (FDA 2016f). Auditors 

should be trained to understand and properly apply FDA’s food safety requirements under the 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 37

FD&C Act and FDA regulations for purposes of auditing (FDA 2016f). Technical training may 

vary depending on the processes and products being audited (FDA 2016f). Training methods 

may include classroom training, annual food safety training, and joint audits with a qualified 

trainer to help the audit agent apply classroom learning (FDA 2016f).

The GFSI provisions for auditor competency in ‘‘GFSI Food Safety Auditor Competencies’’ 

(GFSI, 2013) are also useful in determining the knowledge, experience, and skills for a qualified 

auditor. The GFSI’s auditor competency model lists three main components for auditor 

competencies: (1) Auditing skills and knowledge; (2) technical skills and knowledge; and (3) 

behavior and systems thinking (GFSI, 2013). Within each main component, GFSI provides 

details of specific tasks and the required auditor knowledge and skills to perform the specific 

tasks (GFSI, 2013).

You or one of your employees may conduct the audit as long as you are or your employee is a 

qualified auditor, based on education, training, or experience, or a combination thereof.

15.12.2 Consideration of Food Safety Regulations

Section 21 CFR 117.435(b) requires that if the raw material or other ingredient at the supplier is 

subject to one or more FDA food safety regulations, an onsite audit must consider such 

regulations and include a review of the supplier's written plan (e.g., HACCP plan or other food 

safety plan), if any, and its implementation, for the hazard being controlled (or, when applicable, 

an onsite audit may consider relevant laws and regulations of a country whose food safety 

system FDA has officially recognized as comparable or has determined to be equivalent to that 

of the United States).

The qualified auditor who audits your supplier may be your own employee (“second-party audit”) 

or an independent third party (i.e., a qualified auditor who is neither your employee nor an 

employee or the supplier) (third-party audit). Both second-party audits and third-party audits 

allow first-hand review of the critical food safety programs in place at a supplier’s establishment

and can help you to obtain a sense of how effective programs are by diligently reviewing 

program records, observing activities, and interviewing workers.

Because FDA food safety regulations vary in scope and detail, the parameters and key 

components of an onsite audit conducted under section 21 CFR 117.435(a) would vary 

depending on what regulations apply to the supplier.

A supplier that is subject to the PCHF requirements must have a food safety plan. (See 21 CFR 

117.126.) If your supplier is subject to the PCHF requirements, the onsite audit would focus on 

the supplier’s food safety plan and assess the implementation of the preventive controls applied 

by the supplier to address the known or reasonably foreseeable hazards that you have 

determined to require a supply-chain-applied control. For example, before you obtain roasted 

peanuts for which you had identified Salmonella as a hazard from a supplier subject to the 

PCHF requirements, you would audit the supplier (or obtain documentation of an audit 

performed by a third party) to determine whether the supplier’s roasting process adequately 

controlled the Salmonella. Because the supplier was subject to the PCHF requirements, the 

audit should include a review of the supplier’s food safety plan. The auditor should review 

whether the roasting process had been validated to significantly minimize Salmonella in peanuts 

and should examine whether the supplier had implemented the roasting procedures in 

accordance with its food safety plan (e.g., through observing the establishment’s procedures 

and reviewing records).
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 38

A supplier that is not subject to the PCHF requirements, but is subject to HACCP requirements, 

would have a “HACCP plan” rather than a “food safety plan.” If, for example, you use juice as an 

ingredient in a refrigerated fruit salad, and your supplier is subject to the process control 

requirements in 21 CFR 120.24, the onsite audit of the juice supplier would assess the 

validation and implementation of the process controls in your supplier’s HACCP plan. 

The produce safety regulation in 21 CFR part 112 does not require farms that are subject to that 

regulation to have food safety plans. However, in some cases, a supplier (such as a large 

farming operation) might voluntarily elect to establish a food safety plan. In that case, the onsite 

audit of the supplier should include a review of the supplier’s written plan, and its 

implementation of the plan, to ensure that identified hazards are being adequately controlled.

An audit of your supplier should include both records review and observation of practices to 

obtain a complete picture of the safety of your supplier’s operations. Comprehensive systems 

audits that include records reviews are more likely to reflect conditions throughout the year than 

an audit focused only on the state of the facility at the time of the audit. An audit of a 

manufacturing/processing facility subject to the PCHF requirements should address process, 

allergen, sanitation, and supply-chain-applied controls (if any), as well as CGMPs (if applicable) 

and the specific hazards identified in your hazard analysis of the food.

There are several national and international auditing schemes widely used to assess food safety 

practices in manufacturing facilities and on farms. You could rely on the results of audits 

conducted in accordance with such schemes provided that the audits evaluate the farm or 

facility’s compliance with applicable FDA regulations, review the supplier’s food safety plan (if 

any) and its implementation, and otherwise meet the requirements for onsite audits in 21 CFR 

117.435. Before relying on the results of a third-party onsite audit, you should determine 

whether the auditing scheme used can help you to conclude whether the supplier uses 

processes and procedures that comply with applicable regulations. Audit schemes that consider 

FDA food safety regulations and include a review of the supplier’s written food safety plan

(including a HACCP plan), if any, and its implementation, with respect to the hazard being 

controlled are likely to satisfy the requirements for an onsite audit.

15.12.3 Substitution of an Inspection for an Audit

Section 21 CFR 117.435(c) allows for the following inspections to substitute for an onsite audit, 

provided that the inspection was conducted within 1 year of the date that the onsite audit would 

have been required to be conducted:

• The written results of an appropriate inspection of the supplier for compliance with 

applicable FDA food safety regulations by FDA, by representatives of other Federal 

Agencies (such as the United States Department of Agriculture (USDA)), or by 

representatives of State, local, tribal, or territorial agencies (21 CFR 117.435(c)(1)(i)); or

• For a foreign supplier, the written results of an inspection by FDA or the food safety authority 

of a country whose food safety system FDA has officially recognized as comparable or has 

determined to be equivalent to that of the United States. (See 21 CFR 117.435(c)(1)(ii).) For 

inspections conducted by the food safety authority of a country whose food safety system 

FDA has officially recognized as comparable or determined to be equivalent, the food that is 

the subject of the onsite audit must be within the scope of the official recognition or 

equivalence determination, and the foreign supplier must be in, and under the regulatory 

oversight of, such country. (See 21 CFR 117.435(c)(2).)
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 39

For an inspection conducted by FDA, other Federal Agencies, or State, local, tribal, or territorial 

agencies, an ‘‘appropriate’’ inspection conducted for compliance ‘‘with applicable FDA 

regulations’’ means that the inspection must be sufficiently relevant to compliance with 

applicable FDA food safety regulations to credibly substitute for an onsite audit. For example, 

inspection by USDA to determine whether a farm satisfies the requirements of the produce 

safety regulation could constitute an appropriate inspection that could substitute for an audit, but 

an inspection by USDA to determine whether a farm satisfies the requirements of the National 

Organic Program could not.

In the case of a foreign supplier, a country whose food safety system FDA has officially 

recognized as ‘‘comparable’’ to that of the United States would be one for which there is a 

signed systems recognition arrangement or other agreement between FDA and the country 

establishing official recognition of the foreign food safety system. See section 15.7.4.3.2 for 

information on countries for which we have a Food Safety Systems Recognition Arrangement or 

other cooperative arrangement with a foreign country.

Some countries issue certifications or recognitions to facilities for compliance with certain 

requirements such as for HACCP systems. We would not accept a HACCP certificate issued by 

a foreign government as a substitute for an onsite audit because HACCP requirements are not 

identical to the PCHF requirements, and it would not be clear as to what basis was used to 

issue a HACCP certificate. However, a receiving facility could consider whether such a 

certificate could be part of its justification for conducting another supplier verification activity in 

lieu of an annual onsite audit, or for conducting an audit on a less frequent basis than annually

(see section 15.11.2.2).

15.12.4 Audits Conducted to Meet the Requirements of Subpart G Do Not 

Have to Comply with the Requirements of the Accredited Third-Party 

Regulation

Section 21 CFR 117.435(d) specifies that if an onsite audit is solely conducted to meet the 

requirements of part 117 by an audit agent of a certification body that is accredited in 

accordance with regulations in part 1, subpart M, the audit is not subject to the requirements in 

those regulations.

Audits conducted under the accredited third-party certification regulation are done for specific 

purposes, e.g., for compliance with the requirements of the Voluntary Qualified Importer 

Program. Audits conducted to meet the requirements of 21 CFR 117.435 may be conducted by 

a person who had been accredited under these provisions; however, the requirements for audits 

conducted under the accredited third-party certification regulation (e.g., specific information that 

must be included in an audit and submission of regulatory audit reports to FDA under 21 CFR 

1.652) would not apply to an audit even when the auditor is accredited to do such audits unless 

they are also conducted for purposes under the accredited third-party certification regulation. 

15.13 Records Documenting the Supply-Chain Program

Section 21 CFR 117.475 specifies that the records documenting the supply-chain program are 

subject to the requirements of subpart F of part 117. (See 21 CFR 117.475(a).) Subpart F sets 

forth general requirements applicable to all records, such as the use of either paper or electronic 

records and the need for records to be accurate, indelible, and legible. Subpart F also sets forth 

requirements for record retention and official review. Section 117.330 in subpart F explains how 

you can use existing records to satisfy the recordkeeping requirements of part 117. 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 40

Section 21 CFR 117.475 requires that you must review the records of the supply-chain program 

in accordance with § 117.165(a)(4). (See 21 CFR 117.475(b).) Under 21 CFR 117.165(a)(4(ii)),

records of the supply-chain program must be reviewed within a reasonable time after the 

records are made by (or under the oversight of) a PCQl to ensure that the records are complete, 

the activities reflected in the records occurred in accordance with the food safety plan, the 

preventive controls are effective, and appropriate decisions were made about corrective actions.

Table 15-4 lists the records required (as applicable) for the supply-chain program. (See 21 CFR 

117.475(c).)

Table 15-4 List of Records Required for the Supply-Chain Program

Section Description Discussion

117.475(c)(1) The written supply-chain program There is no standardized or 

required format for the written 

supply chain program or its 

records. You can use whatever 

format works best for your facility, 

provided that the records include 

all the required information. Also,

the written supply-chain program is 

part of the food safety plan, which

must be signed and dated by the 

owner, operator, or agent in charge 

of the facility upon initial 

completion and upon any 

modification. (See 21 CFR

117.310.) 

117.475(c)(2) If you are an importer, documentation 

that you are in compliance with the FSVP 

requirements under part 1, subpart L, 

including documentation of verification 

activities conducted under §1.506(e) 

If you are an importer, and you 

have records documenting the 

supplier verification activities you 

conducted to comply with the 

FSVP regulation, you can rely on 

those records as documentation of 

verification activities to comply with 

the supply-chain program 

requirements of subpart G.

117.475(c)(3) Documentation of the approval of a 

supplier

• Your written determination of the basis 

for approving the supplier; and

• The approved suppliers – e.g., a paper 

list of approved suppliers or an electronic 

system that can generate a list of 

approved suppliers as needed
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 41

Section Description Discussion

17.475(c)(4) Written procedures for receiving raw 

materials and other ingredients

Examples are a paper checklist 

and a computer system that 

manages the procurement, receipt, 

and usage of raw materials and

other ingredients.

117.475(c)(5) Documentation demonstrating use of the 

written procedures for receiving raw 

materials and other ingredients

Examples are a paper checklist 

that was marked to demonstrate

receipt and electronic records 

produced by a computer system 

that manages the procurement, 

receipt, and usage of raw materials 

and other ingredients.

117.475(c)(6) Documentation of the determination of 

the appropriate supplier verification 

activities for raw materials and other 

ingredients

Your written determination should 

explain why you chose your 

particular supplier verification 

activities. See the discussion in 

section 15.7.4.

117.475(c)(7) Documentation of the conduct of an 

onsite audit, including (i) The name of the 

supplier subject to the onsite audit; (ii) 

Documentation of audit procedures; (iii) 

The dates the audit was conducted; (iv) 

The conclusions of the audit; (v) 

Corrective actions taken in response to 

significant deficiencies identified during 

the audit; and (vi) Documentation that the

audit was conducted by a qualified 

auditor

Examples of documentation of 

audit procedures include the 

process(es) and food(s) observed, 

types of records reviewed, and 

whether the audit included 

interviews or laboratory testing. 

Examples of the conclusions of an 

audit include whether the audit did, 

or did not, result in any significant 

deficiencies. 

You have some flexibility to work 

with the qualified auditor, or with a 

supplier who arranges for a thirdparty audit, on appropriate 

documentation that the auditor has 

technical expertise obtained 

through education, training, or 

experience (or a combination 

thereof) necessary to perform the 

auditing function. Examples of 

such documentation are a list of 

applicable training and examples 

of relevant audits conducted by the 

auditor.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 42

Section Description Discussion

117.475(c)(8) Documentation of sampling and testing 

conducted as a supplier verification 

activity. This documentation must 

include: (i) Identification of the raw 

material or other ingredient tested 

(including lot number, as appropriate) 

and the number of samples tested; (ii) 

Identification of the test(s) conducted, 

including the analytical method(s) used; 

(iii) The date(s) on which the test(s) were 

conducted and the date of the report; (iv) 

The results of the testing; (v) Corrective 

actions taken in response to detection of 

hazards; and (vi) Information identifying 

the laboratory conducting the testing

You have some flexibility in the 

format of appropriate 

documentation of sampling and 

testing, such as on a CoA. 

Documentation of corrective 

actions would apply to the steps 

you take when you (or a third party

acting on your behalf) detect the 

hazard in raw materials or other 

ingredients that you received, 

including what you do with the raw 

material or other ingredient and the 

steps you take to address the 

problem with the supplier.

117.475(c)(9) Documentation of the review of the 

supplier's relevant food safety records. 

This documentation must include: (i) The 

name of the supplier whose records were 

reviewed; (ii) The date(s) of review; (iii) 

The general nature of the records 

reviewed; (iv) The conclusions of the 

review; and (v) Corrective actions taken 

in response to significant deficiencies 

identified during the review

Records of the supply-chain 

program must be reviewed within a 

reasonable time after the records 

are made by (or under the 

oversight of) a PCQl to ensure that 

the records are complete, the 

activities reflected in the records 

occurred in accordance with the 

food safety plan, the supplier’s

preventive controls are effective, 

and appropriate decisions were 

made about corrective actions.

(See 21 CFR 117.165(a)(4).)

117.475(c)(10) Documentation of other appropriate 

supplier verification activities based on 

the supplier performance and the risk 

associated with the raw material or other 

ingredient

Your documentation of other 

appropriate supplier verification 

activities would depend on the 

nature of the activity. For example, 

if you use a fact-specific 

questionnaire you would have a 

record of the questionnaire applied 

to a particular supplier. If you 

considered information applicable 

to a supplier’s certification to a 

specific audit scheme, you would 

have a record of the information 

you considered.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 43

Section Description Discussion

117.475(c)(11) Documentation of any determination that 

verification activities other than an onsite 

audit, and/or less frequent onsite auditing 

of a supplier, provide adequate 

assurance that the hazards are 

controlled when a hazard in a raw 

material or other ingredient will be 

controlled by the supplier and is one for 

which there is a reasonable probability 

that exposure to the hazard will result in 

serious adverse health consequences or 

death to humans

Because your written supply-chain 

program is part of your food safety 

plan, the written determination 

must be prepared by (or under the 

oversight of) your PCQI. See the 

discussion in section 15.11.2.2 for 

examples of what such a written 

determination could address.

117.475(c)(12) The following documentation of an 

alternative verification activity for a 

supplier that is a qualified facility: (i) The 

written assurance that the supplier is a 

qualified facility as defined by §117.3, 

before approving the supplier and on an 

annual basis thereafter; and (ii) The 

written assurance that the supplier is 

producing the raw material or other 

ingredient in compliance with applicable 

FDA food safety regulations (or, when 

applicable, relevant laws and regulations 

of a country whose food safety system 

FDA has officially recognized as 

comparable or has determined to be 

equivalent to that of the United States)

You and your suppliers have some 

flexibility to determine the 

appropriate documentation in a 

way that works best for your 

specific business relationship. For 

example, for documentation of its 

status, a qualified facility could 

provide you with documentation of 

its submission of the qualified 

facilities form (Form FDA 3942a). 

For the other assurance, you and 

your supplier can choose which of 

two options to use, based on the 

specific circumstances of the 

supplier. See the discussion in 

section 15.11.3 of the two different 

types of attestation.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 44

Section Description Discussion

117.475(c)(13) The following documentation of an 

alternative verification activity for a 

supplier that is a farm that supplies a raw 

material or other ingredient and is not a 

covered farm under part 112 of this 

chapter: (i) The written assurance that

the supplier is not a covered farm under 

part 112 of this chapter in accordance 

with §112.4(a), or in accordance with 

§§112.4(b) and 112.5, before approving 

the supplier and on an annual basis 

thereafter; and (ii) The written assurance 

that the farm acknowledges that its food 

is subject to section 402 of the FD&C Act 

(or, when applicable, that its food is 

subject to relevant laws and regulations 

of a country whose food safety system 

FDA has officially recognized as 

comparable or has determined to be 

equivalent to that of the United States)

You and your suppliers have some 

flexibility to determine the 

appropriate documentation in a 

way that works best for your 

specific business relationship.

117.475(c)(14) The following documentation of an 

alternative verification activity for a 

supplier that is a shell egg producer that 

is not subject to the requirements 

established in part 118 of this chapter 

because it has less than 3,000 laying 

hens: (i) The written assurance that the 

shell eggs provided by the supplier are 

not subject to part 118 of this chapter 

because the supplier has less than 3,000 

laying hens, before approving the 

supplier and on an annual basis 

thereafter; and (ii) The written assurance 

that the shell egg producer 

acknowledges that its food is subject to 

section 402 of the FD&C Act (or, when 

applicable, that its food is subject to 

relevant laws and regulations of a 

country whose safety system FDA has 

officially recognized as comparable or 

has determined to be equivalent to that 

of the United States)

You and your suppliers have some 

flexibility to determine the 

appropriate documentation in a 

way that works best for your 

specific business relationship.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 45

Section Description Discussion

117.475(c)(15) The written results of an appropriate 

inspection of the supplier for compliance 

with applicable FDA food safety 

regulations by FDA, by representatives of 

other Federal Agencies (such as the U.S.

Department of Agriculture), or by 

representatives from State, local, tribal, 

or territorial agencies, or the food safety 

authority of another country when the 

results of such an inspection are

substituted for an onsite audit

The written results of an 

appropriate inspection would 

depend on the inspection and how 

the entity conducting the inspection 

reports its results.

117.475(c)(16) Documentation of actions taken with 

respect to supplier nonconformance

Your documentation of supplier 

nonconformance would depend on 

the nature of the nonconformance.

See the examples of potential 

supplier nonconformance in 

section 15.7.5.

117.475(c)(17) Documentation of verification of a supplychain-applied control applied by an entity 

other than the receiving facility's supplier

The documentation you receive 

from another entity should be 

similar to the documentation you 

would have if you had conducted 

the activity yourself.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 46

Section Description Discussion

117.475(c)(18) When applicable, documentation of the 

receiving facility's review and 

assessment of: (i) Applicable 

documentation from an entity other than 

the receiving facility that written 

procedures for receiving raw materials 

and other ingredients are being followed;

(ii) Applicable documentation, from an 

entity other than the receiving facility, of 

the determination of the appropriate 

supplier verification activities for raw 

materials and other ingredients; (iii) 

Applicable documentation, from an entity 

other than the receiving facility, of 

conducting the appropriate supplier 

verification activities for raw materials 

and other ingredients; (iv) Applicable 

documentation, from its supplier, of: (A) 

The results of sampling and testing 

conducted by the supplier; or (B) The 

results of an audit conducted by a thirdparty qualified auditor in accordance with 

21 CFR 117.430(f) and 117.435; and (v) 

Applicable documentation, from an entity 

other than the receiving facility, of 

verification activities when a supplychain-applied control is applied by an 

entity other than the receiving facility's 

supplier

You have some flexibility for how 

to appropriately document that you 

reviewed and assessed the 

documentation from another entity.

For example, appropriate staff in 

your facility could date and sign the 

documentation received from the 

other entity, or you could attach a 

signed, dated statement, from 

appropriate staff in your facility, 

specifying that the documentation 

had been reviewed and assessed.

15.14 Compliance Dates

In the preamble of the final rule establishing part 117, we provided compliance dates for the 

requirements of the supply-chain program in subpart G. (See Table 54 in the final rule, 80 FR 

55908 at 56128). The compliance dates for implementing your supply-chain program apply with 

respect to each of your suppliers, not to your supply-chain program as a whole, because the 

compliance dates depend on whether your suppliers will be subject to part 117, the produce 

safety regulation, or neither regulation. For those suppliers subject to part 117 or the produce 

safety regulation, you are not required to conduct supplier verification activities until after your

supplier’s compliance date is reached. 

For your convenience, Table 15-5 provides the information from Table 54 in the preamble of the 

final rule establishing part 117. 
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 47

Table 15-5 Compliance Dates for the Requirements of the Supply-Chain Program 

Situation Compliance date:

You are a small business and your supplier will not 

be subject to the PCHF requirements of part 117 or 

the produce safety regulation

September 18, 2017

You are a small business and your supplier is 

subject to the PCHF requirements of part 117 or 

the produce safety regulation

The later of September 18, 2017, or 6 months after 

your supplier of that raw material or other 

ingredient is required to comply with the applicable 

requirements

You are neither a small business nor a very small 

business and your supplier will not be subject to the 

PCHF requirements of part 117 or the produce 

safety regulation

March 17, 2017

You are neither a small business nor a very small 

business and your supplier will be subject to the 

PCHF requirements of part 117 or the produce 

safety regulation

6 months after your supplier of that raw material or 

other ingredient is required to comply with the 

applicable requirements

15.15 Table of Abbreviations

Section IV in the Introduction of this guidance includes a table of abbreviations that are used in 

this guidance. At this time, that Table of Abbreviations does not include all abbreviations that 

are used in this chapter. See Table 15-6 for an additional abbreviation that we use in this 

chapter. For the convenience of the reader, Table 15-6 also describes what we mean by 

“PCHF,” even though this abbreviation is already in section IV in the Introduction of this 

guidance. We intend to compile all abbreviations in section IV in the Introduction of this 

guidance when we update the Introduction. When we do so, we intend to delete Table 15-6 from 

this chapter, because it would be duplicative.

Table 15-6 Table of Abbreviations

Abbreviation What It Means

PCHF “Preventive Controls for Human Food” (requirements in 21 CFR 

part 117 for hazard analysis and risk-based preventive controls 

for human food in accordance with section 418 of the FD&C Act) 

SAHCODH 

Hazard

Hazard for which there is a reasonable probability that exposure 

to the hazard will result in serious adverse health consequences 

or death to humans

15.16 References 

American Spice Trade Association (ASTA). 2011. Clean, Safe Spices.
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 48

Eastern Research Group, Inc. (ERG). 2004. Good Manufacturing Practices (GMPs) for the 21st 

Century - Food Processing. Section Four. Common Food Safety Problems in the U.S. Food 

Processing Industry: A Delphi Study. 

Edleman, V. 2012. The Supplier Approval Process. The Manufacturing Confectioner, 92(11):60-

67.

Eldridge, B., 2012. Supplier Management: Six Steps to Selecting the Right Supplier. Food 

Safety Magazine, 18 (4): 30-31. 

FDA. 2009. “Guidance for Industry: Questions and Answers Regarding the Reportable Food 

Registry As Established by the Food and Drug Administration Amendments Act of 2007.” 

(http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/RFR/

ucm180761.htm)

FDA. 2010. “Draft Guidance for Industry: Questions and Answers Regarding the Reportable 

Food Registry As Established by the Food and Drug Administration Amendments Act of 2007 

(Edition 2).” (http://www.fda.gov/downloads/Food/GuidanceRegulation/UCM213214.pdf) 

FDA Memorandum. 2014. “Supplier Programs.” See Reference 24 to the 2014 supplemental 

human preventive controls notice. 

FDA. 2015a. FDA - New Zealand MPI, Food Safety Systems Recognition Arrangement. 

(http://www.fda.gov/internationalprograms/agreements/memorandaofunderstanding/ucm331907

.htm).

FDA. 2015b. International Arrangements.

(http://www.fda.gov/internationalprograms/agreements/) 

FDA. 2016a. Cooperative Arrangements. 

(http://www.fda.gov/InternationalPrograms/Agreements/MemorandaofUnderstanding/default.htm

) 

FDA. 2016b. FDA - CFIA and Health Canada, Food Safety Systems Recognition Arrangement.

(http://www.fda.gov/InternationalPrograms/Agreements/MemorandaofUnderstanding/ucm49819

7.htm) 

FDA. 2016c. International Programs. (http://www.fda.gov/InternationalPrograms/default.htm). 

FDA. 2016d. Supplier Evaluation Resources. 

(https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm516330.htm) 

FDA. 2016e. The Reportable Food Registry: A Five Year Overview of Targeting Inspection 

Resources and Identifying Patterns of Adulteration, September 8, 2009 – September 7, 2014. 

(http://www.fda.gov/downloads/food/complianceenforcement/rfr/ucm502117.pdf)

FDA. 2016f. Third-Party Certification Body Accreditation for Food Safety Audits: Model 

Accreditation Standards: Guidance for Industry and FDA Staff. 

(https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/uc

m455328.htm)
Contains Nonbinding Recommendations

Draft-Not for Implementation

Chapter 15 (Supply-Chain Program) - Page 49

FDA. 2017. Report of the Systems Recognition Review of Australia by the U.S. FDA. 

(https://www.fda.gov/downloads/Food/InternationalInteragencyCoordination/InternationalCooper

ation/UCM553393.pdf)

Global Food Safety Initiative & The Consumer Goods Forum 2013. “GFSI Food Safety Auditor 

Competencies, Edition 1.” (http://www.mygfsi.com/images/mygfsi/gfsifiles/informationkit/GFSI_Food_Safety_Auditor_Competencies_-_Edition_1_October_2013.pdf)

International Featured Standards (IFS). 2012. IFS Food: Standard for auditing quality and food 

safety of food products, Version 6. (http://www.ifs-certification.com/index.php/en/certificationbodies-en/ifs-standards/ifs-food)

Neumann, M. 2009. Benefits of a supplier approval program. Crisis Control Newsletter, 

U0109(1):1-2.

Safe Quality Food Institute (SQFI). 2014. SQF Code 7.2. A HACCP-Based Supplier Assurance 

Code for the Food Industry. (http://www.sqfi.com/wp-content/uploads/SQF-Code_Ed-7.2-

July.pdf)

Zaura, 2005. Effective Supplier Program. Food Quality Magazine, December/January, 86-88.