FSMA’s preventive controls rule mandates a supply-chain program to “provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented.” The rule defines a supply-chain-applied control as “a preventive control for a hazard in a raw material or other ingredient when the hazard in the raw material or other ingredient is controlled before its receipt.”

FDA made a few general updates in the final rule, including changing “supplier program” to “supply-chain program”, and it designated a subpart G with eight sections of regulatory text. Intended to improve clarity and readability, the language reflects its applicability to non-suppliers in a new requirement – that is, a supply-chain control can be applied and/or verified by a non-supplier (e.g., distributor, broker, aggregator). However, the receiving facility must verify the supply-chain-applied control itself or obtain documentation of the verification activity, review and assess the documentation, and document that review and assessment.

There are different compliance dates for the supply-chain program versus the entire rule, aligning  compliance with the dates of FSVP rule and providing greater consistency. This also addresses comment concerns that a receiving facility would be required to comply with the supply-chain program provisions before its supplier must comply with applicable new FSMA food safety regulations.

Does your current program comply with the new rules? If not, how can you bring it in line?

The Supply Chain Program

The rule requires a supply chain program when the receiving facility has identified, through its hazard analysis, that there is a hazard requiring a supply-chain-applied control. The program should address hazards requiring a preventive control that may be intentionally introduced for purposes of economic gain, as well as those unintentionally introduced.

FDA specifies the basic content of a supply-chain program, but allows for some flexibility. The rule mandates that the supply-chain program include:

• Written procedures for receiving raw materials and other ingredients
• Preventive control management components that include corrective actions and corrections, review of records and reanalysis
• Supplier approval and use of only approved suppliers, but FDA is considering the issuance of guidance for temporary use of unapproved suppliers
• Determining appropriate supplier verification activities
• Conducting supplier verification activities
• Documenting supplier verification activities:
  • Onsite audits
  • Sampling and testing of the raw material or ingredient (by the supplier or receiving facility)
  • Receiving facility review of the supplier’s relevant food safety records
  • Other appropriate supplier verification activities based on the risk associated with supplier performance and the raw material or other ingredient

In supplier approval and determination of supplier verification activities, the receiving facility must consider:

• The hazard analysis, including the nature of the hazard, applicable to the raw material and ingredients
• Where the preventive controls for hazards are applied
• The supplier’s procedures, processes and practices related to the safety of the raw material and ingredients
• Applicable FDA food safety regulations and the supplier’s compliance with them
• The supplier’s food safety performance history relevant to the applicable raw materials, including results from testing for hazards, food-safety audit results and corrective action.
• Any other relevant factors, such as storage and transportation practices

Other key points of the rule:

• There must not be any financial conflicts of interests that influence the results of the verification activities. Payment must not be related to results
• Domestic inspection by representatives of other federal agencies or by representatives of state, local, tribal, or territorial agencies may substitute for an audit
• The definition of “supplier” has been revised so that the grower remains the supplier when the harvester is under separate management. The “supplier” is the establishment that “grows” food rather than that which “harvests” food.
• Foreign suppliers may provide documentation, when applicable, of a written assurance that the supplier is producing the raw material or other ingredient in compliance with relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States
• The provisions for supplier verification in the FSVP rule have been aligned with the provisions for a supply-chain program, so importers and receiving facilities can consider compliance with both the supplier-chain-program rule and the forthcoming FSVP regulations, as to avoid  duplication of verification activities
• If the receiving facility is an importer in compliance with the FSVP requirements and has documentation of verification activities under FSVP, a supply-chain program is not required even if the receiving facility’s hazard analysis determines that a supply-chain-applied control is required