Under FDA's preventive controls rule, when your hazard analysis finds a hazard that a supplier controls before the ingredient reaches you, because nothing you do later would, you need a written supply-chain program for that ingredient. It means approving the supplier before you receive from it, written receiving procedures so only approved suppliers' goods come in, and verifying the supplier: an onsite audit, sampling and testing, a review of its food safety records, or another suitable activity, before first use and periodically. Where the hazard could cause serious illness or death, the default is an onsite audit before first use and every year, unless you write a determination that something else gives enough assurance. A supplier that's a qualified facility needs only written assurances: of its status every year and of its compliance every two years. Qualified facilities themselves don't need a supply-chain program. In the example below, a Colorado granola maker sets up its program.
The short version
- Needed when a supplier controls a hazard that nothing later in your process does.
- Approve suppliers before receiving; write receiving procedures.
- Verify: onsite audit, sampling and testing, or a records review.
- Serious hazards: an onsite audit before first use and yearly, unless a written determination says otherwise.
- Qualified facility suppliers: written assurances, yearly and every two years.
- Qualified facilities don't need a supply-chain program.
- TaroStack receives each ingredient by supplier and lot. More below.
What applies
| Situation | What the program asks |
|---|---|
| You control the hazard yourself, such as by baking | Not a supply-chain control: your own process control |
| The supplier controls a hazard that could cause serious illness or death | Approve; onsite audit before first use and yearly, unless a written determination supports another activity |
| The supplier controls a less serious hazard | Approve; testing, a records review or an audit, at a frequency you set |
| The supplier is a qualified facility | Written assurance of its status by December 31 each year; of its compliance every 2 years |
| The ingredient has no hazard needing a control | No supply-chain control |
| You import it and meet FSVP | No repeat verification under this program |
Keeping the list of approved suppliers is in approved supplier list, and the importer's version of this program in fsvp requirements.
The rules
| Rule | Where |
|---|---|
| When it's needed | For raw materials and ingredients with a hazard requiring a supply-chain-applied control; written; not repeated by an importer meeting FSVP (21 CFR 117.405) |
| Approval and receiving | Suppliers approved and documented before receiving; written receiving procedures, followed and documented (117.420) |
| Verification activities | Onsite audits, sampling and testing, review of the supplier's food safety records, or other appropriate activities (117.410(b)) |
| Serious hazards | An onsite audit before first use and at least annually, unless a written determination supports other activities or less frequent audits (117.430(b)) |
| Qualified facility suppliers | Written assurance of status before approval and by December 31 each year; written assurance of compliance at least every 2 years (117.430(c)) |
| Records | The program, approvals, receiving procedures, and audit, testing and records review documentation (117.475); qualified facilities are outside subpart G (117.5(a)) |
This is general information, not legal advice.
An example: almonds and chocolate
Summit Ridge Snacks, a made-up granola and snack bar maker in Boulder, Colorado, with about $2.4 million a year in sales to grocers in six states, adds almonds and chocolate chips after its granola is baked, so the suppliers' controls are the only ones on those hazards:
| Ingredient | Hazard | Who controls it | What Summit Ridge does |
|---|---|---|---|
| Almonds | Salmonella | The almond processor, by pasteurizing | Approved; an onsite audit before first use and each year |
| Chocolate chips | Salmonella | The chocolate maker, in its process | Approved; a written determination that a yearly review of its food safety records, with a lot test twice a year, is enough |
| Dark chocolate drizzle from a small maker | Salmonella | A qualified facility | Written assurance of its status each December; of its compliance every 2 years |
| Oats | Salmonella | Summit Ridge, by baking | Not a supply-chain control: the bake |
| Dried cranberries | None needing a control | No supply-chain control |
When the almond processor was bought and moved production to a new plant, the approval was redone and a new onsite audit came before the first delivery from that plant. Until then, almonds came from a second approved supplier. When a supplier recalls a lot, what to do is in supplier recall what to do.
Get the checker
Download the supply chain program checker. One sheet: each ingredient, whether it has a hazard needing a control, who controls it, whether the hazard is serious, and whether the supplier is a qualified facility; what the program asks fills in. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
The checker sorts each ingredient once. When a new supplier ships a pallet before approval, or a familiar one changes plants, the program depends on someone catching it at the dock.
How TaroStack does it
TaroStack receives each ingredient by supplier and lot, so which supplier's almonds went into which batch is on record.
Receiving by supplier and lot. Each delivery is received from its supplier with its lot, so a delivery from a new supplier shows up as one.
Batches by lot. Each batch records the almond and chocolate lots it used.
Recalls. If a supplier recalls a lot, one report shows which batches used it and every customer who got them.
| The job | Notebook | In TaroStack |
|---|---|---|
| Which supplier's almonds went into a batch | A notebook | Batches by lot |
| Deliveries by supplier | Invoices | Receiving by supplier and lot |
| A supplier's recall | Search the invoices | One recall report |
Receiving, batches, lots and recalls are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.