Supplier Approval and Verification – Preventive Controls Rule

NOTE: This issue is new to the re-proposed FSMA rules released in 2014.

Background

The Food Safety Modernization Act (FSMA) requires the Food and Drug Administration (FDA) to develop regulations for “Hazard Analysis and Risk-based Preventive Controls” (HARPC) requirements at food facilities.  These requirements include a hazard analysis and the implementation and monitoring of preventive controls to ensure that hazards are identified and addressed.  The HARPC requirements make up the bulk of the new requirements that facilities must comply with in the Preventive Controls Rule.

Congress authorized FDA to include what are known as “supplier verification activities” as part of the HARPC requirements, but explicitly prohibited FDA from requiring a third party to audit preventive controls. Congress also directed FDA to ensure that the HARPC requirements provide sufficient flexibility to be practicable for all sizes of types of facilities, including, but not limited to, small businesses, such as small food processing facilities co-located on a farm.

In the revised, or re-proposed, Preventive Controls Rule, FDA has included a new provision that specifically requires certain facilities to include supplier verification programs in their food safety plan. The original proposed Preventive Controls Rule did not include the supplier verification program, although it did request comments on whether or not a supplier program should be required.

To figure out whether you operate a facility that must comply with HARPC requirements and develop and implement a food safety plan, visit NSAC’s “Do I Operate a Farm or a Facility?” issue page.  Facilities, including facilities on farms, must register with FDA, and are subject to the Preventive Controls Rule.  Some facilities may be eligible for modified requirements to the HARPC requirements described below, and on-farm processors may be exempt from the HARPC requirements under certain circumstances.

Proposed Supplier Program

Under the revised proposed rule, if a manufacturing facility receives raw materials or ingredients from a supplier (either a facility or a farm), then the receiving facility must establish and implement a supplier program if the following conditions are met:

  • The receiving facility identifies a significant hazard with the raw material or ingredient; and
  • The supplier is the one controlling the hazard.

A supplier program is NOT required if:

  • There are no significant hazards associated with the raw material or ingredient;
  • The receiving facility is implementing preventive controls that are adequate to significantly minimize or prevent the hazard (e.g. processing with a “kill step”); or
  • The receiving facility relies on its customers to control the hazard and annually obtains written assurance from the customer that explains the preventive controls the customer is following to significantly minimize the risk.

A supplier program must be written, and must include certain verification activities (and documentation of these verification activities). Verification activites include:

  • Onsite audits;
  • Sampling or testing of the raw material;
  • Review of the supplier’s records by the receiving facility; or
  • Other appropriate supplier verification activities based on the risk associated with the ingredient or the supplier.

In general, facilities have some flexibility in determining which type of verification activity it would institute. However, FDA is proposing to require an onsite audit – that must be done before the facility can buy from the supplier, and then annually – if the hazard is one for which there is “reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans.” FDA does not provide details or guidance regarding how to know whether a raw material would fall in this category, but it is likely to apply to produce that is usually consumed raw.

If the receiving facility “determines that other verification activities and/or less frequent onsite auditing of the supplier provide adequate controlled assurance that the hazards are controlled,” then an onsite audit is not required.

FDA acknowledges that the costs from this program are likely to increase overall costs of compliance for farms that supply manufacturing facilities, but does not provide cost estimates. See our Costs to Farmers and Consumers page for more information.

What the Proposed Rules Do NOT Require

FDA is proposing to define “supplier” as the establishment that manufactures/processes the food, raises the animal, or harvest the food that is being supplied to the receiving facility. This means that food hubs (or other establishments) that only pack or hold food for distribution would not be considered suppliers, and therefore would not have to implement the supplier program.

If a food hub aggregates produce from a farm and then distributes it to a manufacturing or processing facility, the receiving facility would not consider the food hub the supplier. Rather, the farm that provides the food hub with produce would be the supplier, and the facility would require verification measures of the farm, not the food hub.

FDA has also stated that it does not intend for this requirement to subject a supplier to multiple audits, and that a single audit could suffice for multiple receiving facilities. However, this is not clear from the regulations.

So – what does this mean?

Let’s take a facility that makes fresh salsa and gets whole tomatoes, peppers, and garlic from separate farms. The facility would have to implement a supplier program, and would likely require onsite audits of each of the farms to ensure compliance with the Produce Rule. However, if the farm is subject to modified requirements or the de minimis exemption under the Produce Rule, then the full supplier program (including the onsite audit) would not be required (see below).

Now let’s consider a facility that processes jam and gets blueberries from a farm. Because the facility is controlling the hazard (by applying the kill step – cooking the berries as the jam is processed), a supplier program for the blueberry farm is not necessary.

In the case of a food hub that aggregates produce from several farms and then supplies a restaurant, grocery store, or other retail food establishment, there would be no supplier program. FDA is asking for comments on whether they should require either the food hub or the retail food establishment to implement some sort of verification measures in such a situation. See below for more information on what the rules do NOT require.

Modified Requirements for Qualified Facilities and Exempt Farms

If the supplier is a qualified facility, then the receiving facility does not have to implement a full supplier program. Rather, the receiving facility must:

  • Document annually that the supplier is a qualified facility;
  • Obtain written assurance, at least every 2 years, that the supplier is producing the raw material in compliance with applicable FDA food safety regulations and that the raw material is not adulterated; and
  • The written assurance must include a brief description of the processes and procedures that the supplier is following to ensure the safety of the food.

If the supplier is a produce farm subject to a full (de minimis) exemption or modified exemption under the Produce Rule, then the receiving facility does not have to implement a full supplier program. Rather, the receiving facility must:

  • Document annually that the supplier is subject to modified requirements or a de minimis exemption under the Produce Rule; and
  • Obtain written assurance, at least every 2 years, that the supplier is producing the raw material in compliance with applicable FDA food safety regulations and that the raw material is not adulterated.

FDA Needs to Hear from You on Supplier Verification

This new proposed provision is likely to impact both facilities covered under the Preventive Controls rule, and the farmers that supply them with fresh ingredients. Here are some questions to help guide your comments to FDA:

  • Do you currently supply raw produce to a facility for further manufacturing/processing? If so, does the facility already require verification measures, either through an audit or some other process? What are the associated costs?
  • Do you currently supply raw produce to a retail food establishment like a grocery store? If so, does the retail food establishment already require verification measures, either through an audit or some other process? What are the associated costs?
  • Have you voluntarily participated in a third party market certification scheme (like USDA GAPs)?
  • Do you think FDA should require facilities to audit suppliers?
  • Do you understand what FDA means by raw materials or ingredients that pose “significant hazards” or have a “reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans?” If not, what could FDA to clarify this issue?
  • If you are growing produce, do you think FDA should require additional verification activities (i.e. beyond the requirements of the Produce Rule) if you are selling your produce to a retail food establishment, like a grocery store?

How do I submit a comment to FDA?

Our step-by-step instructions show you how.

Additional Resources

 

This information may be shared if credited to NSAC and accompanied by a link to this page.

Take Action What's happening right now »