A supplier approval program is how a food maker decides which suppliers it can buy from, and checks that they keep controlling the hazards it's counting on them for. Under FDA's preventive controls rule, a supply-chain program is needed when a hazard in an ingredient is controlled by the supplier, not by the maker, aflatoxin in peanuts, Salmonella in pasteurized almonds, and it has three parts: approve each supplier before receiving from it, receive only from approved suppliers by a written procedure, and verify them before first use and periodically after, with an annual onsite audit where the hazard could cause serious harm, unless a written determination says something else gives enough assurance. In the example below, a nut butter maker keeps four suppliers on its list and finds one check overdue. Below are the rules, the list, and a free template.
The short version
- A supply-chain program is needed for hazards a supplier controls, not ones you control yourself.
- Approve each supplier, in writing, before receiving from them.
- Receive only from approved suppliers, by a written receiving procedure, documented.
- Verify each supplier before first use and periodically: audits, sampling and testing, or reviewing their records.
- For hazards that could cause serious harm or death, an onsite audit before first use and yearly, unless a written determination says otherwise.
- Suppliers that are qualified facilities can be handled with written assurances instead.
- TaroStack keeps suppliers with their documents, and each lot received with its certificate. More below.
The rules
| Rule | What it says | Source |
|---|---|---|
| When a program is needed | For raw materials and ingredients with a hazard requiring a supply-chain-applied control | 21 CFR 117.405(a) |
| Approval | Approve suppliers, and document it, before receiving from them | 21 CFR 117.420(a) |
| Receiving | Written procedures so ingredients come only from approved suppliers, or temporarily from unapproved ones with verification before use | 21 CFR 117.420(b) |
| Verification | Before first use and periodically; for serious hazards, an onsite audit before use and at least yearly, unless a written determination | 21 CFR 117.430 |
| Qualified facility suppliers | Written assurance each year that the supplier is a qualified facility, and every two years that it follows the food safety rules | 21 CFR 117.430(c) |
Ingredients whose hazards you control yourself, by roasting, cooking or another step in your own plant, don't need a supply-chain control for that hazard. This is general information, not legal advice.
An example: a nut butter maker's suppliers
Red Oak Nut Butters, a made-up nut butter maker in Little Rock, Arkansas, I use in these examples, roasts its own peanuts, so Salmonella in peanuts is its own control. Its list on October 16:
| Supplier | Ingredient | Hazard the supplier controls | Verification | Every | Last done | Next due | Status |
|---|---|---|---|---|---|---|---|
| Delta Peanut Shellers | Raw peanuts | Aflatoxin | Certificate each lot; own test twice a year | 6 months | Apr 10 | Oct 10 | Overdue |
| Central Valley Almond Co. | Pasteurized almonds | Salmonella | Third-party audit report under a written determination | 12 months | Feb 3 | Feb 2027 | OK |
| Ozark Honey Co-op | Honey | None needing a supplier control | Spec and letter of guarantee | 24 months | Mar 1 | Mar 2028 | OK |
| Gulf Salt Supply | Sea salt | None needing a supplier control | Spec | 24 months | Mar 1 | Mar 2028 | OK |
The almonds are the serious hazard: Red Oak doesn't roast them, so it relies on the supplier's pasteurization, and instead of flying to the orchard every year, it wrote a determination that the supplier's annual third-party audit report gives enough assurance. The peanut aflatoxin test was due October 10 and slipped; a sample from the current lot went to the lab the same day. The honey and salt have no hazard that the supplier controls, so they're on the list with a spec, but no supply-chain control. How Red Oak handles Salmonella in its own roaster is in its HACCP plan; how a supplier's recall reaches a maker is in supplier recall: what to do.
Get the template
Download the supplier approval program template. One sheet: each supplier and ingredient with the hazard the supplier controls, the approval date, the verification activity and how often, when it was last done and the documents on file, where the next due date and the status fill in from today's date, red when overdue. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
The list says who's approved. It doesn't stop someone receiving a delivery from a new peanut supplier on a busy Friday, and it doesn't keep each lot's certificate with the lot, so when a buyer asks for the aflatoxin certificate behind a particular jar, someone digs through a folder.
How TaroStack does it
TaroStack keeps suppliers with their documents, and each lot received with its certificate.
Suppliers on record. Suppliers are kept with their lead times and minimums, and each delivery is received against its supplier, with or without a purchase order.
Certificates on the lot. Fields of your own on each receipt and lot hold the certificate of analysis number and its result. A receiving log on paper is in food receiving log template.
Lot to jar. Each batch records the lots it consumed, so the certificate behind any jar is one step away, and a supplier's recall shows in one report which batches used that lot. How lots carry through is in what is lot tracking.
| The job | Folder | In TaroStack |
|---|---|---|
| Who you buy from | A list | Suppliers, with purchase orders |
| A lot's certificate | A folder | A field on the lot |
| The certificate behind a jar | Dig for it | Batch to lot to certificate |
| A supplier's recall | Search the batch sheets | One recall report |
Suppliers, purchase orders, lots with fields of your own, and recalls are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.