(a)(1) Except as provided by paragraphs (a)(2) and (3) of this section, the receiving facility must establish and implement a risk-based supply-chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain-applied control.

(2) A receiving facility that is an importer, is in compliance with the foreign supplier verification program requirements under part 1, subpart L of this chapter, and has documentation of verification activities conducted under § 1.506(e) of this chapter (which provides assurance that the hazards requiring a supply-chain-applied control for the raw material or other ingredient have been significantly minimized or prevented) need not conduct supplier verification activities for that raw material or other ingredient.

(3) The requirements in this subpart do not apply to food that is supplied for research or evaluation use, provided that such food:

(i) Is not intended for retail sale and is not sold or distributed to the public;

(ii) Is labeled with the statement “Food for research or evaluation use”;

(iii) Is supplied in a small quantity that is consistent with a research, analysis, or quality assurance purpose, the food is used only for this purpose, and any unused quantity is properly disposed of; and

(iv) Is accompanied with documents, in accordance with the practice of the trade, stating that the food will be used for research or evaluation purposes and cannot be sold or distributed to the public.

(b) The supply-chain program must be written.

(c) When a supply-chain-applied control is applied by an entity other than the receiving facility's supplier (e.g., when a non-supplier applies controls to certain produce (i.e., produce covered by part 112 of this chapter), because growing, harvesting, and packing activities are under different management), the receiving facility must:

(1) Verify the supply-chain-applied control; or

(2) Obtain documentation of an appropriate verification activity from another entity, review and assess the entity's applicable documentation, and document that review and assessment.

(a) The supply-chain program must include:

(1) Using approved suppliers as required by § 117.420;

(2) Determining appropriate supplier verification activities (including determining the frequency of conducting the activity) as required by § 117.425;

(3) Conducting supplier verification activities as required by §§ 117.430 and 117.435;

(4) Documenting supplier verification activities as required by § 117.475; and

(5) When applicable, verifying a supply-chain-applied control applied by an entity other than the receiving facility's supplier and documenting that verification as required by § 117.475, or obtaining documentation of an appropriate verification activity from another entity, reviewing and assessing that documentation, and documenting the review and assessment as required by § 117.475.

(b) The following are appropriate supplier verification activities for raw materials and other ingredients:

(1) Onsite audits;

(2) Sampling and testing of the raw material or other ingredient;

(3) Review of the supplier's relevant food safety records; and

(4) Other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material or other ingredient.

(c) The supply-chain program must provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented.

(d)(1) Except as provided by paragraph (d)(2) of this section, in approving suppliers and determining the appropriate supplier verification activities and the frequency with which they are conducted, the following must be considered:

(i) The hazard analysis of the food, including the nature of the hazard controlled before receipt of the raw material or other ingredient, applicable to the raw material and other ingredients;

(ii) The entity or entities that will be applying controls for the hazards requiring a supply-chain-applied control;

(iii) Supplier performance, including:

(A) The supplier's procedures, processes, and practices related to the safety of the raw material and other ingredients;

(B) Applicable FDA food safety regulations and information relevant to the supplier's compliance with those regulations, including an FDA warning letter or import alert relating to the safety of food and other FDA compliance actions related to food safety (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States, and information relevant to the supplier's compliance with those laws and regulations); and

(C) The supplier's food safety history relevant to the raw materials or other ingredients that the receiving facility receives from the supplier, including available information about results from testing raw materials or other ingredients for hazards, audit results relating to the safety of the food, and responsiveness of the supplier in correcting problems; and

(iv) Any other factors as appropriate and necessary, such as storage and transportation practices.

(2) Considering supplier performance can be limited to the supplier's compliance history as required by paragraph (d)(1)(iii)(B) of this section, if the supplier is:

(i) A qualified facility as defined by § 117.3;

(ii) A farm that grows produce and is not a covered farm under part 112 of this chapter in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5; or

(iii) A shell egg producer that is not subject to the requirements of part 118 of this chapter because it has less than 3,000 laying hens.

(e) If the owner, operator, or agent in charge of a receiving facility determines through auditing, verification testing, document review, relevant consumer, customer or other complaints, or otherwise that the supplier is not controlling hazards that the receiving facility has identified as requiring a supply-chain-applied control, the receiving facility must take and document prompt action in accordance with § 117.150 to ensure that raw materials or other ingredients from the supplier do not cause food that is manufactured or processed by the receiving facility to be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act or misbranded under section 403(w) of the Federal Food, Drug, and Cosmetic Act.

(a)(1) The receiving facility must approve suppliers.

(2) Except as provided by paragraphs (a)(3) and (4) of this section, the receiving facility must determine and conduct appropriate supplier verification activities, and satisfy all documentation requirements of this subpart.

(3) An entity other than the receiving facility may do any of the following, provided that the receiving facility reviews and assesses the entity's applicable documentation, and documents that review and assessment:

(i) Establish written procedures for receiving raw materials and other ingredients by the entity;

(ii) Document that written procedures for receiving raw materials and other ingredients are being followed by the entity; and

(iii) Determine, conduct, or both determine and conduct the appropriate supplier verification activities, with appropriate documentation.

(4) The supplier may conduct and document sampling and testing of raw materials and other ingredients, for the hazard controlled by the supplier, as a supplier verification activity for a particular lot of product and provide such documentation to the receiving facility, provided that the receiving facility reviews and assesses that documentation, and documents that review and assessment.

(b) For the purposes of this subpart, a receiving facility may not accept any of the following as a supplier verification activity:

(1) A determination by its supplier of the appropriate supplier verification activities for that supplier;

(2) An audit conducted by its supplier;

(3) A review by its supplier of that supplier's own relevant food safety records; or

(4) The conduct by its supplier of other appropriate supplier verification activities for that supplier within the meaning of § 117.410(b)(4).

(c) The requirements of this section do not prohibit a receiving facility from relying on an audit provided by its supplier when the audit of the supplier was conducted by a third-party qualified auditor in accordance with §§ 117.430(f) and 117.435.

(a) Approval of suppliers. The receiving facility must approve suppliers in accordance with the requirements of § 117.410(d), and document that approval, before receiving raw materials and other ingredients received from those suppliers;

(b) Written procedures for receiving raw materials and other ingredients. (1) Written procedures for receiving raw materials and other ingredients must be established and followed;

(2) The written procedures for receiving raw materials and other ingredients must ensure that raw materials and other ingredients are received only from approved suppliers (or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose raw materials or other ingredients are subjected to adequate verification activities before acceptance for use); and

(3) Use of the written procedures for receiving raw materials and other ingredients must be documented.

Appropriate supplier verification activities (including the frequency of conducting the activity) must be determined in accordance with the requirements of § 117.410(d).

(a) Except as provided by paragraph (c), (d), or (e) of this section, one or more of the supplier verification activities specified in § 117.410(b), as determined under § 117.410(d), must be conducted for each supplier before using the raw material or other ingredient from that supplier and periodically thereafter.

(b)(1) Except as provided by paragraph (b)(2) of this section, when a hazard in a raw material or other ingredient will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans:

(i) The appropriate supplier verification activity is an onsite audit of the supplier; and

(ii) The audit must be conducted before using the raw material or other ingredient from the supplier and at least annually thereafter.

(2) The requirements of paragraph (b)(1) of this section do not apply if there is a written determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled.

(c) If a supplier is a qualified facility as defined by § 117.3, the receiving facility does not need to comply with paragraphs (a) and (b) of this section if the receiving facility:

(1) Obtains written assurance that the supplier is a qualified facility as defined by § 117.3:

(i) Before first approving the supplier for an applicable calendar year; and

(ii) On an annual basis thereafter, by December 31 of each calendar year, for the following calendar year; and

(2) Obtains written assurance, at least every 2 years, that the supplier is producing the raw material or other ingredient in compliance with applicable FDA food safety regulations (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States). The written assurance must include either:

(i) A brief description of the preventive controls that the supplier is implementing to control the applicable hazard in the food; or

(ii) A statement that the facility is in compliance with State, local, county, tribal, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries.

(d) If a supplier is a farm that grows produce and is not a covered farm under part 112 of this chapter in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5, the receiving facility does not need to comply with paragraphs (a) and (b) of this section for produce that the receiving facility receives from the farm as a raw material or other ingredient if the receiving facility:

(1) Obtains written assurance that the raw material or other ingredient provided by the supplier is not subject to part 112 of this chapter in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5:

(i) Before first approving the supplier for an applicable calendar year; and

(ii) On an annual basis thereafter, by December 31 of each calendar year, for the following calendar year; and

(2) Obtains written assurance, at least every 2 years, that the farm acknowledges that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

(e) If a supplier is a shell egg producer that is not subject to the requirements of part 118 of this chapter because it has less than 3,000 laying hens, the receiving facility does not need to comply with paragraphs (a) and (b) of this section if the receiving facility:

(1) Obtains written assurance that the shell eggs produced by the supplier are not subject to part 118 because the shell egg producer has less than 3,000 laying hens:

(i) Before first approving the supplier for an applicable calendar year; and

(ii) On an annual basis thereafter, by December 31 of each calendar year, for the following calendar year; and

(2) Obtains written assurance, at least every 2 years, that the shell egg producer acknowledges that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

(f) There must not be any financial conflicts of interests that influence the results of the verification activities listed in § 117.410(b) and payment must not be related to the results of the activity.

(a) An onsite audit of a supplier must be performed by a qualified auditor.

(b) If the raw material or other ingredient at the supplier is subject to one or more FDA food safety regulations, an onsite audit must consider such regulations and include a review of the supplier's written plan (e.g., Hazard Analysis and Critical Control Point (HACCP) plan or other food safety plan), if any, and its implementation, for the hazard being controlled (or, when applicable, an onsite audit may consider relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

(c)(1) The following may be substituted for an onsite audit, provided that the inspection was conducted within 1 year of the date that the onsite audit would have been required to be conducted:

(i) The written results of an appropriate inspection of the supplier for compliance with applicable FDA food safety regulations by FDA, by representatives of other Federal Agencies (such as the United States Department of Agriculture), or by representatives of State, local, tribal, or territorial agencies; or

(ii) For a foreign supplier, the written results of an inspection by FDA or the food safety authority of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States.

(2) For inspections conducted by the food safety authority of a country whose food safety system FDA has officially recognized as comparable or determined to be equivalent, the food that is the subject of the onsite audit must be within the scope of the official recognition or equivalence determination, and the foreign supplier must be in, and under the regulatory oversight of, such country.

(d) If the onsite audit is solely conducted to meet the requirements of this subpart by an audit agent of a certification body that is accredited in accordance with regulations in part 1, subpart M of this chapter, the audit is not subject to the requirements in those regulations.

(a) The records documenting the supply-chain program are subject to the requirements of subpart F of this part.

(b) The receiving facility must review the records listed in paragraph (c) of this section in accordance with § 117.165(a)(4).

(c) The receiving facility must document the following in records as applicable to its supply-chain program:

(1) The written supply-chain program;

(2) Documentation that a receiving facility that is an importer is in compliance with the foreign supplier verification program requirements under part 1, subpart L of this chapter, including documentation of verification activities conducted under § 1.506(e) of this chapter;

(3) Documentation of the approval of a supplier;

(4) Written procedures for receiving raw materials and other ingredients;

(5) Documentation demonstrating use of the written procedures for receiving raw materials and other ingredients;

(6) Documentation of the determination of the appropriate supplier verification activities for raw materials and other ingredients;

(7) Documentation of the conduct of an onsite audit. This documentation must include:

(i) The name of the supplier subject to the onsite audit;

(ii) Documentation of audit procedures;

(iii) The dates the audit was conducted;

(iv) The conclusions of the audit;

(v) Corrective actions taken in response to significant deficiencies identified during the audit; and

(vi) Documentation that the audit was conducted by a qualified auditor;

(8) Documentation of sampling and testing conducted as a supplier verification activity. This documentation must include:

(i) Identification of the raw material or other ingredient tested (including lot number, as appropriate) and the number of samples tested;

(ii) Identification of the test(s) conducted, including the analytical method(s) used;

(iii) The date(s) on which the test(s) were conducted and the date of the report;

(iv) The results of the testing;

(v) Corrective actions taken in response to detection of hazards; and

(vi) Information identifying the laboratory conducting the testing;

(9) Documentation of the review of the supplier's relevant food safety records. This documentation must include:

(i) The name of the supplier whose records were reviewed;

(ii) The date(s) of review;

(iii) The general nature of the records reviewed;

(iv) The conclusions of the review; and

(v) Corrective actions taken in response to significant deficiencies identified during the review;

(10) Documentation of other appropriate supplier verification activities based on the supplier performance and the risk associated with the raw material or other ingredient;

(11) Documentation of any determination that verification activities other than an onsite audit, and/or less frequent onsite auditing of a supplier, provide adequate assurance that the hazards are controlled when a hazard in a raw material or other ingredient will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans;

(12) The following documentation of an alternative verification activity for a supplier that is a qualified facility:

(i) The written assurance that the supplier is a qualified facility as defined by § 117.3, before approving the supplier and on an annual basis thereafter; and

(ii) The written assurance that the supplier is producing the raw material or other ingredient in compliance with applicable FDA food safety regulations (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States);

(13) The following documentation of an alternative verification activity for a supplier that is a farm that supplies a raw material or other ingredient and is not a covered farm under part 112 of this chapter:

(i) The written assurance that supplier is not a covered farm under part 112 of this chapter in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5, before approving the supplier and on an annual basis thereafter; and

(ii) The written assurance that the farm acknowledges that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States);

(14) The following documentation of an alternative verification activity for a supplier that is a shell egg producer that is not subject to the requirements established in part 118 of this chapter because it has less than 3,000 laying hens:

(i) The written assurance that the shell eggs provided by the supplier are not subject to part 118 of this chapter because the supplier has less than 3,000 laying hens, before approving the supplier and on an annual basis thereafter; and

(ii) The written assurance that the shell egg producer acknowledges that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States);

(15) The written results of an appropriate inspection of the supplier for compliance with applicable FDA food safety regulations by FDA, by representatives of other Federal Agencies (such as the United States Department of Agriculture), or by representatives from State, local, tribal, or territorial agencies, or the food safety authority of another country when the results of such an inspection is substituted for an onsite audit;

(16) Documentation of actions taken with respect to supplier non-conformance;

(17) Documentation of verification of a supply-chain-applied control applied by an entity other than the receiving facility's supplier; and

(18) When applicable, documentation of the receiving facility's review and assessment of:

(i) Applicable documentation from an entity other than the receiving facility that written procedures for receiving raw materials and other ingredients are being followed;

(ii) Applicable documentation, from an entity other than the receiving facility, of the determination of the appropriate supplier verification activities for raw materials and other ingredients;

(iii) Applicable documentation, from an entity other than the receiving facility, of conducting the appropriate supplier verification activities for raw materials and other ingredients;

(iv) Applicable documentation, from its supplier, of:

(A) The results of sampling and testing conducted by the supplier; or

(B) The results of an audit conducted by a third-party qualified auditor in accordance with §§ 117.430(f) and 117.435; and

(v) Applicable documentation, from an entity other than the receiving facility, of verification activities when a supply-chain-applied control is applied by an entity other than the receiving facility's supplier.