One of the most notable new mandates of the Food Safety Modernization Act (FSMA) preventive controls rule is the requirement for a supply-chain program, the purpose of which is to “provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented.” (A “supply-chain-applied control” is further defined as “a preventive control for a hazard in a raw material or other ingredient when the hazard in the raw material or other ingredient is controlled before its receipt.”)
The FSMA statute specifically identifies supplier verification activities as a preventive control, but the U.S. Food and Drug Administration (FDA) didn’t see it as just as “have to do,” rather the Agency states right in the rule that it believes it to be important that this program be mandated by the rule to ensure the safety of food where hazards are controlled in raw materials and other ingredients before receipt by a receiving facility. Additionally, a supply-chain program would be a fairly standard measure implemented by any food-safety expert to minimize or prevent hazards in incoming supplies.
While the proposed rule did include the requirement for this program, FDA made a few general updates, including a wording change from “supplier program” to “supply-chain program” and its designation in a newly established subpart G with eight sections of regulatory text. The subpart was established to improve clarity and readability. The verbiage change to reflect its applicability to non-suppliers in a new requirement – that is, a supply-chain control can be applied and/or verified by a non-supplier (e.g., distributor, broker, aggregator). But, in that case, the receiving facility must verify the supply-chain-applied control itself; or obtain documentation of the verification activity, review and assess the documentation, and document that review and assessment. In addition to these general updates, the rule includes some revisions from the proposed program.
Does your current program comply with the new rules? If not, what will you need to do to bring it in line? Following is a description of the supply-chain program and its requirements, including changes from the proposed rule.
The Supply-Chain Program
The rule requires a supply-chain program when the receiving facility has identified, through its hazard analysis, that there is a hazard requiring a supply-chain-applied control. The program should address hazards requiring a preventive control that may be intentionally introduced for purposes of economic gain, as well as those unintentionally introduced.
Although FDA is continuing to specify the basic content of a supply-chain program, and it allows for some flexibility, the rule mandates that the supply-chain program must include:
- Written procedures for receiving raw materials and other ingredients.
- Preventive control management components that include corrective actions and corrections (taking into account the nature of any supplier non-conformance), review of records, and reanalysis.
- Supplier approval, and use of only approved suppliers. (However, FDA is considering the issuance of guidance for use of unapproved suppliers on a temporary basis.)
- Determining appropriate supplier verification activities (including frequency of each).
- Conducting supplier verification activities.
- Documenting supplier verification activities, which are to include:
- Onsite audits
- Sampling and testing of the raw material or ingredient (by the supplier or receiving facility)
- Receiving facility review of the supplier’s relevant food safety records
- Other appropriate supplier verification activities based on the risk associated with supplier performance and the raw material or other ingredient
In supplier approval and determination of supplier verification activities, the receiving facility must consider:
- The hazard analysis, including the nature of the hazard, applicable to the raw material and ingredients.
- Where the preventive controls for those hazards are applied (e.g., supplier, supplier’s supplier, etc.).
- The supplier’s procedures, processes, and practices related to the safety of the raw material and ingredients.
- Applicable FDA food safety regulations and information and the supplier’s compliance with those (including receipt of any FDA warning letter or import alert).
- The supplier’s food safety performance history relevant to the applicable raw materials or, including results from testing for hazards, food-safety audit results, and corrective action.
- Any other relevant factors, such as storage and transportation practices
In addition to these requirements, a few other key points of the rule are:
- There must not be any financial conflicts of interests that influence the results of the verification activities and payment must not be related to results
- Domestic inspection by representatives of other federal agencies (such as USDA), or by representatives of state, local, tribal, or territorial agencies may substitute for an audit.
- The definition of “supplier” has been revised so that the grower remains the supplier when the harvester is under separate management. Specifically, the “supplier” is the establishment that “grows” food rather than that which “harvests” food. Doing so focuses the requirements on the entity that produces the food, rather than that which removes the food from the growing area.
- Foreign suppliers may provide documentation, when applicable, of a written assurance that the supplier is producing the raw material or other ingredient in compliance with relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States
- The provisions for supplier verification in the FSVP rule have been aligned with the provisions for a supply-chain program, so importers and receiving facilities can consider compliance with both the supplier-chain-program rule and the forthcoming FSVP regulations, so verification activities do not have to be duplicated.
- If the receiving facility is an importer, is in compliance with the forthcoming FSVP requirements, and has documentation of verification activities under FSVP, a supply-chain program is not required even if the receiving facility’s hazard analysis determines that a supply-chain-applied control is required.
As discussed in our blog, , different compliance dates were established for the supply-chain program, then for the rule as a whole. This is to align compliance with the dates of FSVP rule to provide greater consistency across this aspect of the programs. It also serves to address comment concerns that a receiving facility would be required to comply with the supply-chain program provisions of before its supplier is required to comply with applicable new FSMA food safety regulations, causing potential revision of the program at that time.
About the Author . . .
Dr. David Acheson is the Founder and CEO of . Dr. Acheson brings more than 30 years of medical and food safety research and experience to the firm. Prior to forming The Acheson Group, he served as the Chief Medical Officer at the USDA Food Safety and Inspection Service and then in 2002 joined the U.S. Food and Drug Administration as the Chief Medical Officer at the FDA Center for Food Safety and Applied Nutrition (CFSAN).
