FSMA Supply Chain Program: Approval, Verification, and Records

If your facility manufactures, processes, packs, or holds food and your hazard analysis identifies a hazard in an incoming ingredient that will be controlled by the supplier rather than at your own plant, the FSMA supply chain program requirements in Subpart G of 21 CFR Part 117 apply to you. You have to build a written, risk-based program that approves each supplier, verifies the supplier is actually controlling the hazard, and documents every piece of it in records you can hand to an FDA investigator.¹

Which Facilities the Rule Covers

The obligation attaches to “receiving facilities” — businesses that bring in raw materials or ingredients from outside sources. The trigger is narrow but firm: if your hazard analysis flags a hazard in an incoming ingredient, and the control point for that hazard sits at your supplier rather than on your own line, you owe a supply chain program for that ingredient. The program is written, and it applies separately to each ingredient with a supply-chain-applied control.¹

If you control the hazard yourself with a preventive control at your facility, Subpart G does not reach that ingredient. The program exists specifically to close the gap where your product’s safety depends on someone else doing their job before the truck backs up to your dock.

Importers should note the boundary with the Foreign Supplier Verification Program. If you already comply with FSVP under 21 CFR Part 1, Subpart L for a given imported ingredient, you don’t have to duplicate that work under Subpart G, provided your FSVP documentation adequately addresses the same hazards.¹ Food supplied solely for research or evaluation is also excluded when it is properly labeled and not distributed to the public.

What the Written Program Has to Contain

A preventive controls qualified individual (PCQI) must prepare or oversee the food safety plan, and the supply chain program is a required part of that plan.² A PCQI is someone with the education, training, or experience to develop and apply risk-based preventive controls; many facilities put staff through an FDA-recognized PCQI course, though the regulation does not require that specific credential.

Supplier Approval

Before you accept a covered ingredient, you must approve the supplier and document that approval.³ Approval is an affirmative decision that draws on the hazard analysis for the ingredient, the supplier’s procedures and track record, and any FDA food safety regulations the supplier must follow. It is not a formality, and inspectors treat it as substantive.

Receiving Procedures

You need written procedures for receiving raw materials, you have to follow them, and you have to document that you followed them.³ Those procedures must ensure that incoming materials come only from approved suppliers. Using an unapproved supplier on a temporary basis is permitted, but only when the materials are subjected to adequate verification before use. The temporary-supplier justification is a common weak spot during inspections.

Delegating the Work

You can hand off pieces of the program. Another entity may establish receiving procedures, document their use, or determine and conduct verification activities on your behalf. A supplier can even do its own sampling and testing for a hazard it controls and send you the results. In every case you must review and assess the other party’s documentation and keep records of that review.⁴ Responsibility does not transfer with the task.

Verification Methods and When Each Fits

The regulation lists four categories of appropriate verification activities:⁵

Onsite audits, in which a qualified auditor visits the supplier’s facility, reviews the food safety plan, observes operations, and produces a written report.
Sampling and testing, in which representative samples go to a laboratory for analysis of pathogens, chemicals, or other contaminants tied to the identified hazard.
Review of the supplier’s food safety records, such as monitoring logs and corrective action records showing how the supplier controls the hazard over time.
Other activities appropriate to the risk profile of the ingredient and the supplier’s performance history.

The method and frequency you choose must be scaled to the severity of the hazard and what you know about the supplier. Periodic record reviews may be enough for a low-risk ingredient from a long-standing supplier with a clean history. A new supplier of a higher-risk ingredient calls for something more rigorous. Whatever mix you pick, the overall program has to provide assurance that each hazard requiring a supply-chain-applied control has been significantly minimized or prevented.⁵

When an Onsite Audit Is the Default

For hazards where exposure carries a reasonable probability of serious adverse health consequences or death (SAHCODHA), the default verification activity is an onsite audit before first use of the ingredient from that supplier and at least annually after that.⁶ Allergen cross-contact in a shared facility, Salmonella in raw poultry ingredients, and Listeria in ready-to-eat foods are the kinds of hazards that fall into this category.

You can deviate from the audit default, but only through a written determination, supported by evidence, that other verification activities or less frequent audits provide adequate assurance. That determination will be read closely during an inspection, so the reasoning and the evidence need to hold up.

Who Can Perform the Audit

A qualified auditor is a qualified individual who also has the technical expertise, through education, training, or experience, to perform auditing functions.⁷ The regulation names government employees (including foreign government employees) and audit agents of accredited certification bodies as examples, but the definition is broader than those categories. Auditors do not have to be accredited under FDA’s third-party certification program to qualify.⁸

Lighter-Touch Paths for Certain Suppliers

Standard verification activities can be replaced with written assurances when a supplier fits one of a few defined categories. A “qualified facility” — generally a business averaging less than roughly $1.33 million in annual sales of human food under the most recent inflation-adjusted cutoff — is one such category.⁹ For a qualified-facility supplier, you must obtain written assurance before first approval and annually by December 31 for the following year confirming the supplier meets the definition, plus written assurance at least every two years that the supplier produces the ingredient in compliance with FDA food safety regulations, including a brief description of the preventive controls used.⁶

Similar written-assurance alternatives apply to farms that are not covered by the produce safety rule and to shell egg producers with fewer than 3,000 laying hens. In those cases, annual written assurance of the supplier’s exempt status replaces standard verification activities.⁶

What Happens When Verification Turns Up a Problem

If an audit finding, a failed test, a troubling record review, or even a customer complaint indicates a supplier is not adequately controlling an identified hazard, the receiving facility must act promptly under the corrective action framework in 21 CFR 117.150.⁵ That framework requires you to identify and correct the problem, reduce the likelihood of recurrence, evaluate all affected food for safety, and prevent any adulterated or misbranded food from reaching commerce.¹⁰ In practice that can mean halting use of the ingredient, quarantining inventory, moving to a backup supplier, or intensifying verification until the original supplier proves the root cause is fixed. Every action and its rationale goes into the records.

Records You Have to Keep

Documentation is how compliance is proven during an inspection. The regulation specifies what has to be on file, including:¹¹

The written supply chain program and documentation of each supplier’s approval.
Receiving procedures and evidence they are being followed.
Onsite audit documentation: supplier name, audit procedures, dates, conclusions, corrective actions for significant deficiencies, and confirmation the auditor was qualified.
Sampling and testing records: ingredient identification with lot numbers where appropriate, tests conducted, analytical methods, dates, results, corrective actions, and the identity of the testing laboratory.
Record review documentation: supplier name, review dates, general nature of records reviewed, conclusions, and corrective actions for significant deficiencies.
Written determinations justifying any decision to use alternative verification instead of an onsite audit for SAHCODHA hazards.
Written assurances from qualified facilities, non-covered farms, or small shell egg producers where those alternatives apply.

Supply chain program records must be retained at the facility for at least two years from the date they were prepared and must be available for FDA review and official copying on request.¹²

What Noncompliance Looks Like in Enforcement

FDA does not directly impose monetary fines for most FSMA violations. Enforcement generally escalates through progressively serious actions, and the agency’s usual practice is to give a facility a chance to correct problems voluntarily before formal action.¹³ That typically begins with an untitled letter or a warning letter identifying the violations.

If voluntary compliance does not follow, FDA can seek a court injunction ordering the facility to stop specific practices or operations, or pursue criminal prosecution for prohibited acts under the Federal Food, Drug, and Cosmetic Act. During an inspection, an FDA officer with reason to believe food is adulterated or misbranded can order administrative detention of that food, pulling it from distribution pending further investigation.¹⁴

The most severe tool is registration suspension. When FDA determines that food from a facility has a reasonable probability of causing serious adverse health consequences or death, and the facility either caused that situation or knew of it, the agency can suspend the facility’s registration.¹⁵ A suspended facility cannot introduce food, domestic or imported, into U.S. commerce until the suspension is lifted. FDA has indicated it may prioritize suspension in cases involving Class 1 recalls, confirmed foodborne illness links, or facilities with significant violations that have not permanently corrected the root cause.

1
eCFR. 21 CFR 117.405 – Requirement to Establish and Implement a Supply-Chain Program
2
eCFR. 21 CFR 117.126 – Food Safety Plan
3
eCFR. 21 CFR 117.420 – Using Approved Suppliers
4
eCFR. 21 CFR 117.415 – Responsibilities of the Receiving Facility
5
eCFR. 21 CFR 117.410 – General Requirements Applicable to a Supply-Chain Program
6
eCFR. 21 CFR 117.430 – Conducting Supplier Verification Activities for Raw Materials and Other Ingredients
7
eCFR. 21 CFR 117.3 – Definitions
8
U.S. Food and Drug Administration. Third-Party Audits and FSMA
9
U.S. Food and Drug Administration. FSMA Inflation Adjusted Cut Offs
10
eCFR. 21 CFR 117.150 – Corrective Actions and Corrections
11
eCFR. 21 CFR 117.475 – Records Documenting the Supply-Chain Program
12
eCFR. 21 CFR 117.315 – Requirements for Record Retention
13
U.S. Food and Drug Administration. Frequently Asked Questions: FSMA Food Traceability Rule
14
eCFR. Administrative Detention of Food for Human or Animal Consumption
15
U.S. Food and Drug Administration. Compliance Policy Guide Sec. 100.250 Food Facility Registration – Human and Animal Food