It’s More Than Winning Over the Buyers

What is Quality Assurance?

At a food retailer, the QA team is responsible for maintaining the quality and safety of products sold by that retailer. In the case of a supermarket, this would include products sourced from suppliers, products made through contracted manufacturers, and even ready-to-eat food prepared at the onsite deli. The QA Team conducts quality inspections, handles food recalls, and conducts supplier verification.

The Quality Assurance team may be the reason your food product doesn't make it into major retailers and distribution chains. This would happen if you are unable to prove that you are following industry-standard practices. For this reason, it's important to understand what your purchaser's QA Team is looking for and how to work with them so that you can get your product onto retailer shelves and grow your sales.

Even after a major buyer has pledged to place an order, there’s another hurdle before you can start selling your products to a new retailer: The Quality Assurance (QA) Team.

The QA team’s job is to uphold quality standards and protect the company’s reputation. They evaluate hundreds of prospective (and current) suppliers to determine whether their products meet the company’s quality and safety standards.

They are the gatekeeper for all new products and if the product doesn’t pass quality assurance, then the retailer won’t risk carrying that product.

Don’t let this frighten you. The QA team has no incentive to arbitrarily reject new suppliers and they are often willing to work with new suppliers to help them pass QA and get their products onboard.

Before we go into strategies for working with QA teams, let’s review how the process typically works.

How QA Teams Approve Suppliers

After the buying team expresses interest carrying a new product, the QA team steps in to conduct some due diligence about the supplier.

The QA team will typically email the prospective supplier requesting information, such as a third party audit result or records showing your company’s food safety practices.

After, there may be some back-and-forth with your contact on the QA team. This depends on your company’s ability to provide the requested documents and demonstrate the safety and quality of your product.

Finally, the QA team will either give your products a “pass” or they will delay the company’s purchase of your products until you can achieve specific requirements.

With this in mind, having a positive relationship with your a prospective buyer’s QA team can mean the difference between winning a huge account or not. To stay in their good graces, consider the following tips:

1. Before asking a question or requesting a piece of material from the QA team, check and see if it’s available on the company’s supplier facing website.
   

2. Avoid asking them to explain food safety concepts or regulation to you. Instead, look it up on FDAreader.com or, if we’ve failed you, then google it.
   

3. Fill out all forms and documents as completely as possible and provide all requested documents.
   

4. Collate your submissions a minimum number of attachments and present it in the most straightforward possible manner. Your QA contact reviews thousands of these documents per month and will appreciate your efforts towards clarity.
   

5. Be honest. The QA team doesn’t demand perfect manufacturing programs as a prerequisite for approval and they appreciate when suppliers are honest about their process.

What the Quality Assurance Team is Looking For

QA teams want a supplier who presents them with a straightforward case about “why our product’s safety and quality is not worth worrying about.”

The most compelling evidence is a third party audit result— which reads like a physical exam for your company’s food safety practices. In the absence of that, a thoughtfully compiled and organized set of food safety policies and records can signal that your business is serious about food safety. Ultimately, the QA team will describe their needs — and it’s important to listen. Dozens of times, I’ve been able to get my clients’ products into new retailers despite their inability to meet the “official” supplier qualifications. All I did was follow the instructions we were given, provide the documents that we were able to come up with, and present it in an easy-to-read format.

Honesty is the Answer (Even When the Truth is Imperfect)

When confronted with a shortcoming in my clients’ food safety practices I have found that honesty is the answer. Specifically, I candidly explain the current state of that food safety issue and how the supplier is working to fix it. The following anecdote from my consulting career illustrates how this has worked in my favor:

One time, a distributor hired me to fix some trouble they were having with a nationwide supermarket chain. The supermarket had already been selling the distributor’s product for almost a year but the distributor was ignoring all of QA team’s emails. Eventually, the supermarket’s buying team threatened to halt all business with the distributor unless they responded to the QA team’s requests, and so the distributor hired me as a consultant to sort it all out. I quickly put together a basic food safety plan— a set documents showing how the distributor managed food safety across their operation— and sent it off to the supermarket’s QA team.  

The QA manager who was reviewing the documents noticed a problem and called me. He explained that, while the warehouse operation looked safe enough, the distributor didn’t have any evidence that the actual foods they were buying were safely manufactured. In other words, he pointed out that the distributor hadn’t done any supplier verification. He was 100% right and this could have been a deal breaker for working with the distributor.

I took a deep breath and told him the truth— that the distributor hadn’t verified the safety of any of the foods in their catalog prior to hiring me that week. I had just begun sending out requests to the distributor’s suppliers a few days before. So far only one supplier of ninety had responded. I sent the QA manager an overview of how I was beginning to implement a supplier verification program on behalf of the distributor. I also shared the records showing we had collected information from and approved one supplier. Then I waited.

To my surprise, the QA manager was grateful for the honesty and he approved the distributor to continue supplying the supermarket. We were able to organize a timeline by which the distributor would verify all of their suppliers over the course of several months and communicate this to the supermarket.

In my experience, displaying honesty— even about imperfections in my client’s food safety program— actually instilled a greater confidence in the program overall. QA teams are constantly being lied to (I’m sure they don’t like it) and they are quick to acknowledge that even the best suppliers have imperfect programs.

So how should you approach working with a new purchaser and their QA team?

• Figure out exactly what they want and don’t waste their time

• Be honest about where you can and and can’t meet their expectations

• Present your documents in an organized fashion.

Keep Reading

---

---

To learn more about Foreign Supplier Verification Programs overall, see our introduction article

How Do I Develop a Foreign Supplier Verification Program?

Contents

How Do I Develop a FSVP?

1. Determine Your Qualified Individual
2. Decide How Your Program Works
3. Conduct Your Verification Activities
4. Approve Your Suppliers and Maintain Your Program

Keeping Records of Your FSVP
Taking Corrective Actions
Re-evaluating Suppliers

If you import products for consumption into the US, you likely are required to develop a foreign supplier verification program (FSVP).

Below is a step by step guide to developing and implementing an FSVP.

---

1. Determine your Qualified Individual

First, The FSVP must be prepared by a "qualified individual" who has the education, training or experience necessary to perform the activity. If this person is a 3rd party or consultant, that's fine. However, note that supplier verification is an ongoing process and it must always be completed by a qualified individual. For most companies, the easiest solution is to have someone on staff undergo a 2 day training course on developing a Foreign Supplier Verification Program.

Source 21 CFR 1.503

---

2. Decide How Your Program Works

Before you begin approving suppliers, you must establish the procedures you will use to approve suppliers. The goal is to provide assurance that hazards in the food you import are being prevented.

You can rely on a 3rd party to conduct your supplier verification if you review and assess the documentation yourself and document your review and assessment of the materials.

Examples of appropriate verification activities:

• Onsite audit by a qualified individual

• Sampling & testing

• Review of foreign suppliers food safety records

• Other appropriate supplier verification activities

---

3. Conduct Your Verification Activities

This step is the bulk of the process: collecting information from your suppliers, reviewing it, and documenting your review process.

You may rely on a 3rd party to conduct supplier verification activities (i.e. a 3rd party audit) if you assess their documentation with appropriate frequency. You must document your review and assessment of the activities and document that the activities were performed by a qualified individual.

The following are common verification methods for approving suppliers:

Hazard Analysis

You are required to review a hazard analysis for each type of food you import. Hopefully, each of your foreign suppliers has completed one and can provide this to you. If not, then you must conduct a hazard analysis to determine whether there are any hazards requiring a control. This hazard analysis must be written and contain an evaluation of environmental hazards.

Some key points about the hazard analysis:

• You must either conduct a hazard analysis for each type of food you import OR use a supplier hazard analysis.

• If you are importing Raw Agricultural Commodities (RACs) then no biological hazards need be considered in the Hazard analysis.

• If you are reviewing a hazard analysis supplied by the supplier or a 3rd party, then you must document your review of the hazard analysis and confirm that it was conducted by a qualified individual.

• If no hazards are identified which require a preventive control, then no verification is required for those products. Still you must have a hazard analysis on file to show that this has been determined. This provision does not apply to produce.

Subpart L  - FSVP for Food Importers

Onsite Audit

Certain importers may wish to independently conduct onsite audits of the foreign supplier. Or, they may simply review the audit results conducted by a reputable 3rd party auditor.

An audit is required as part of the supplier verification process when there is "reasonable probability that exposure to the hazard will result in serious adverse health consequences or death" you must conduct or obtain documentation of an onsite audit at least annually. (1.506 (d) (ii) (2)

In this case, an audit may be replaced by written inspection results by the FDA, USDA, or a food safety authority of a country whose food safety system is equivalent to that of the US.

Sampling & Testing of Food

If you choose to use product testing and sampling as part of your verification, you must retain documentation of the following:

• The number and type of samples tested

• identification of the food tested (lot numbers)

• tests conducted and the methods of the testing

• Any corrective action taken into detection of hazards

• Information identifying the lab

• Documentation that the tests were performed by a qualified individual.
  

Review of Foreign Supplier's Food Safety Records

The most common method of supplier verification is the review of a foreign supplier's food safety records.

If you choose to use your foreign supplier's food safety records as part of your verification, you must retain the following information:

• The records reviewed

• Dates of review

• General nature of the records reviewed

• Conclusions of review

• Any corrective actions taken in response to significant deficiencies identified.

• Documentation that the review was conducted by a qualified individual.

You may not allow on the foreign supplier to conduct supplier verification activities for their own business.

Final Considerations:

Hazards Not Controlled by the Foreign Supplier

Does a 3rd party control one of the hazards on behalf of your supplier (i.e. your overseas milk supplier has their pasteurization completed offsite by another company.) If so, you must collect this verification data from the 3rd party or have your supplier send it to you.

Supplier Performance & History

It is perfectly acceptable to take into consideration your supplier's history, procedures, practices, storage, transportation, etc as part of your verification activities.

Document Your Verification Activities

Remember, it's not enough to simply collect these documents from your foreign suppliers -- you have to assess them and document that assessment.

For example, let's say I'm an importer of Ned's Italian Tomato Sauce and they send me their most recent audit result. Beyond having that audit result on file, I need to record that I reviewed that audit, that it showed me they controlling the hazards in their process, and that my review occurred on such-and-such date.

The Whole Picture

For fear of stating the obvious, you must approve your foreign suppliers on the basis of your evaluation. In other words, you must consider all the information you gather in your approval process and cannot discount any piece of information simply because it is contrary to the result that you're looking for.

This doesn't mean that one failed audit in your supplier's history means you cannot approve them. However, you must acknowledge this information if it is revealed in your verification activities or outside of them.

Source 21 CFR -- 1.504

---

4. Approve your Suppliers and Maintain the Program

Once you have completed your verification activities, you may add the relevant supplier's to your approved supplier list and begin sourcing product from them. At that point, the program should require only occasional ongoing maintenance

Keeping Records of Your Foreign Supplier Verification Program (FSVP)

Your records should comply with the following provisions:

• They must be originals, photocopies or digital records

• You must keep them for 2 years unless otherwise specified

• They must be available for review by the FDA

• You do not need to have a specific copy of each record for the FDA (e.g. you can have one copy of a record to satisfy both a state requirement and a federal requirement)

Source 21 CFR §1.510

There are several exemptions to Foreign Supplier Verification Requirements. This section applies to:

Taking Corrective Actions

You must take corrective actions if you determine that the food you are receiving is not meeting the requirements of the FDA regulations. Simply put, if the food you receive could cause harm to a consumer or is unsafe, then you must take some type of corrective action. This determination could be based on customer complaints or verification activities that you conduct (i.e. records review or viewing an inspection result.)

The appropriate corrective action to take could include discontinuing your use of that supplier until the hazards have been addressed.

If this determination occurs outside of the scope of your supplier verification activities, then it may reveal that your verification activities are not comprehensive. Simply put -- you didn't catch the mistake in your normal supplier verification practices therefore something is inherently wrong with your process. In this case you are obligated to update your plan so that you are able to adequately verify your suppliers.

Source 21 CFR §1.508

Re-evaluating Suppliers

You must re-evaluate your foreign suppliers (and document it),

• Every 3 years, at minimum

• When you learn anything new or when anything has changed that would warrant a re-evaluation.

You may use a 3rd party foreign supplier review as your re-evaluation, insofar as you document your assessment of that evaluation. The evaluation must be performed by a qualified individual.

Source 21 CFR -- 1.504

This article applies to you if…

∆ You are a food importer

∆ The products you import are regulated by the FDA

∆ You do not qualify for a small-food-importer exemption (<$10mm/yr imported)

∆ You need to build a foreign supplier verification plan

More About Supply Chain

---

More Posts

---

ConsultinG Services

For step-by-step instructions, see Guide to Developing an FSVP

What You Need to Know about FSVP

Contents

What You Need to Know
Applicability and Exemptions
Very Small Importer Exemption
Foreign Suppliers Requiring No Verification
Foods Subject To Special Foreign Supplier Verification Regulations
FAQ

• Nearly all food imported into the US must be produced in alignment FDA Regulations

• Foreign Supplier Verification Program (FSVP) is a major component of FSMA which requires US businesses to only import food products from suppliers they have vetted and approved.

• Most businesses which import food products for consumption inside the US must verify that the food is produced in alignment with FDA regulations. This is done through the implementation of a Foreign Supplier Verification Program (FSVP). When a certain type of food (i.e. seafood) is subject to specific regulation, a foreign supplier must also comply with those specific standards.

• The verification process may include, among other methods: an assessment of the supplier's food safety records, a review of an audit report, or a site visit.

---

Applicability and Exemptions

Generally, foreign supplier verification is required for most importers, for most imported foods, and for most foreign suppliers. To better understand what types of businesses and products may not be regulated under Subpart L (Foreign Supplier Verification Program), see the exemptions below:

Very Small Importer Exemption

A "Very Small Importer" is a company that imports $<1mm year in product value for imported human food (or <$2.5mm year in value for imported animal food)

Modified requirements for "Very Small Importers"

• A very small importer must document that they meet the qualification for this exemption (i.e. be able to prove they are doing less than $1 million in imports)

• Receive a written assurance from each foreign suppliers, prior to importing any food. The written assurance must be obtained every 2 years and include the following

1. A brief description of the preventive controls being applied to control hazards in the food. This must be provided for each food that is imported.

2. A statement that the foreign supplier is compliant with FDA regulations or (when equivalent) the relevant laws of their own country

• You must take corrective action (such as suspending your import of this food) if you determine that the supplier is not producing food consistent with their assurance.

• You must keep signed and dated records of these activities for > 2 years.

Foreign Suppliers Requiring No Verification

An importer is not required to conduct verification activities for certain foreign suppliers, including

• Qualified Facilities, or

• farms that grow produce and are not covered under part 112, or

• A shell egg producer that has fewer than 3,000 laying hens.

• Suppliers operating in countries with an officially recognized or equivalent food safety system

If you are importing products from a foreign supplier that is exempt, the modified requirements are as follows:

• You must obtain a written assurance of their exemption type (i.e. farm or qualified facility or small shell egg producer)

• You must initially evaluate your foreign supplier's performance history as it relates to compliance with FDA regulations. You must re-evaluate this if you become aware of any relevant changes or information or ever 3 years at minimum.

• You must take corrective action (such as suspending your import of this food) if you determine that the supplier is not producing food consistent with their assurance.

• You must keep signed and dated records of all verification activities for > 2 years.

• You must approve your foreign suppliers based on the activities described above.

• You must establish written procedures to ensure that you are using only approved foreign suppliers. You may import from unapproved suppliers on a temporary basis, if you have other, adequate verification prior to import.

Source 21 CFR §1.512

Countries with Officially Recognized or Equivalent Food Safety Systems

If you are importing from a country with a recognized equivalent food system, you may be free from the following the majority of FSVP requirements (§1.504-§1.508). As of 2018, the only countries who have achieved this are: Australia, Canada, and New Zealand.

However, your program still must be developed by a qualified individual, your company must be identified upon food import, and you must maintain your FSVP records in compliance with §1.510.

Source 21 CFR §1.513   

Foods Subject to Special Foreign Supplier Verification Regulations:

Certain foods are exempt from Subpart L (the requirements for Foreign Supplier Verification Programs outlined in this article) and are subject to different requirements.

Imported Seafood Products (aka Fish / Fishery Products)

Since seafood products are subject to specific FDA regulations found in Part 123, importers of seafood products are required to verify that the overseas manufacturer is aligned with Part 123. You can read about the specific requirements for verifying a foreign seafood supplier here

Imported Juice Products

Juice products are subject to specific FDA regulations found in Part 120, importers of seafood products are required to verify that the overseas manufacturer is aligned with Part 120 (specifically, that they have and follow a HACCP plan).

Meat Products

The Foreign Supplier Verification Program does not apply to meat products that, at the time of import, are under USDA jurisdiction.

Food that cannot be consumed without the hazards being controlled

You aren’t required to conduct an evaluation or foreign supplier verification when:

• The food can’t be consumed without controlling for the hazard

• You rely on the customer (who must be subject to 117C) to control the hazards. In this case you must disclose this to the customer and obtain annual assurance that they are controlling for the hazard

• You rely on a subsequent entity in the supply chain (further downstream from you and the customer) to control for the hazard.

Source 21 CFR §1.507

---

FSVP FAQ

How must the importer be identified at entry?

You must identify your firm as the importer and include your FDA identification (DUNS) number and email address when filing for entry. The foreign owner or consignee of the food oversees must designate a US representative as the importer as the food.

Source 21 CFR §1.509

What are some consequences of failing to comply with the requirements of this subpart?

• The food may be inadmissible for import.

• The importer may be found in violation of federal law.

Source 21 CFR §1.514

What FSVP must I have if I am importing a food subject to certain requirements in the dietary supplement current good manufacturing practice regulation?

Source 21 CFR Section 1.511

More About Supply Chain

---

Consulting Services

---

What You Need To Know

Contents

What You Need to Know
What You Need to Do
What You Need to Have on File
Summary of Subpart G

• Subpart G describes the requirements for a Supply Chain Program.

• A Supply Chain Program demonstrates that your suppliers are producing their products (typically ingredients and packaging) in a safe manner.

• You must have a Supply Chain Program if your hazard analysis revealed a hazard requiring a supply-chain control.

• You have considerable leeway in how you verify your suppliers but there are some specific requirements (see below).

• You are obligated to document and take prompt action if you learn a supplier is not controlling a hazard as required.

---

Applicability & Exemptions

This section applies to any business whose hazard analysis reveals a hazard requiring a supply-chain-applied control. This means you can't complete your Supply Chain Program until you have completed your hazard analysis.

For Example - Let's say that Ned's Raw Cookies uses pasteurized eggs as an ingredient in their product. Since Ned's Raw Cookies are sold and consumed raw, the company is not controlling for the salmonella hazard that is present in eggs.

In this case, Ned's Raw Cookies would likely rely on a supply-chain-applied control to minimize the salmonella hazard in their product. Ned's Raw Cookies would request documentation from their egg supplier to prove that the supplier is controlling the risk of salmonella. This documentation may be an audit result, a copy of supplier's food safety plan, or sufficient food safety records to show that that hazard has been controlled.

Exemptions:

You are not required to apply a supply-chain-applied-control in the following scenarios:

1. No hazards requiring a supply chain applied control exist

2. Your business (the receiving facility) is able to use a process control to eliminate/minimize the hazard.

3. Your customer provides a written assurance that they must control the hazard.

4. The food produced is not consumed by the public (i.e. it's only for research purposes within the company)

5. The supplier is a "very small business"

---

What You Need to Do:

1. Review your hazard analysis to determine whether there is a hazard which requires a supply-chain-applied control.

2. Determine how you will approve the suppliers of those ingredients/packaging.

3. Request documents from your suppliers (i.e. a recent inspection report or their food safety plan) to demonstrate that they are controlling for that hazard. You may also verify your supplier's product yourself by conducting tests.

4. Review your suppliers' documents and document that you have reviewed them.

5. Only use approved suppliers

---

What You Need to Have on File:

Your supply chain program must be written and contain the following:

• An explanation of how you approve suppliers

• A list of approved suppliers

• A procedure for receiving products (i.e. a receiving SOP)

• Each of the following documents for each supplier (if their ingredient has a hazard which requires a supply-chain control)

  • Documentation of having reviewed the supplier's food safety records.

  • A written inspection report of the supplier by the state, FDA, city, or other agency

• Any records of supplier non-conformance and your response to that (could be a corrective action).

Summary of §117 Subpart G

Below is a summary of Subpart G so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.405 (a) (2) then just look up this same code in the CFR.

117.405 Requirement to Establish and Implement a Supply-Chain Program

a. 

1. A facility must establish a risk-based supply-chain program for the ingredients and raw materials that have a hazard requiring a supply-chain-applied control.

2. Importers who conduct foreign-supplier-verification programs don't need to conduct supply-chain-applied controls for those materials whose hazards have been mitigated.

3. Requirements in this part don't apply to food whose use is research or testing. However this food,

i. May not be sold or given to the public

ii. Must be labeled "food for research or evaluation use"

iii. Is supplied in small quantity and disposed of.

iv. Is accompanied with documents stating the food is for research and not for public consumption.

b. The supply-chain program must be written.

c. If the supply-chain-applied control is applied by a 3rd party (i.e. not the receiving facility and not the produce supplier -- let's say it's a 3rd party that washes produce on behalf of a farm who sells it to a food processor), then the receiving facility must:

1. verify the control themselves

2. obtain documentation to verify that the control was applied.

§117.410 General Requirements Applicable to a Supply-Chain Program:

a. The supply-chain program must include:

1. Using approved suppliers (i.e. an approved supplier list)

2. The determination of appropriate supplier verification activities

3. Conducting supplier verification activities

4. Documenting supplier verification activities

5. When applicable, verifying that a supply-chain-applied control was applied by a 3rd party.

b. The following are appropriate supplier verification activities for raw materials and other ingredients:

1. Onsite audits

2. Product sampling

3. Review of suppliers food safety records

c. The supply chain program must provide assurance that a hazard requiring a supply-chain-applied control is minimized or prevented.

d. 

1. In approving suppliers and determining verification activities, you must consider:

i. The nature of the hazard

ii. Who will be applying the controls on behalf of your supplier

iii. Supplier performance, including their history, audit results, test results, etc.

iv. Storage and transportation practices

2. If you are considering the suppliers history, this may be limited if they are a small business, a farm, or a facility that is exempt from some FDA provisions.

e. If you learn that a supplier is not controlling a hazard that you identified must be controlled by the supplier, then you are obligated to document this and take prompt action.

117.415 Responsibilities of the Receiving Facility

a. 

1. the receiving facility must approve suppliers

2. The receiving facility must conduct all supplier verification activities.

3. A 3rd party may do the following on behalf of the receiving party:

i. establish procedures for receiving raw ingredients

ii. Document that written procedures for receiving raw materials are being followed

iii. Determine and conduct supplier verification activities

4. The supplier may conduct product testing themselves and provide this to the facility conducting the supplier verification.

b. A receiving facility may not accept any of the following as a supplier verification activity:

1. Determination by the supplier of appropriate supplier verification activities.

2. An audit conducted by the supplier

3. A review of records by the supplier of the supplier.

c. The receiving facility may accept a 3rd party audit result provided by the supplier.

§117.420 Using Approved Suppliers

a. Approval of Suppliers The receiving facility must approve suppliers and document it before receiving ingredients from them.

b. Written procedures for receiving raw materials and other ingredients 

1. You must write and implement procedures for receiving products (i.e. a receiving SOP)

2. Your written procedures must ensure that ingredients are only received from approved suppliers

3. The use of these written procedures must be documented (i.e. you must have a receiving log to show that you are following your written receiving procedure)

§117.430 Conducting Supplier Verification Activities for Raw Materials and Other Ingredients

a. You must conduct supplier verification activities before using the supplier.

b.

1. When a hazard in a raw material will be controlled by the supplier and the outcome of exposure to the hazard results in a serious injury or death, then:

i. the appropriate supplier verification activity is an onsite audit

ii. the audit must be conducted before that raw material is supplied and at least annually thereafter.

2. The requirements above (b) (1) don't apply if other verification activities can provide assurance that this hazard is controlled.

c. If the supplier is a qualified facility, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the quality facility exemption for their supplier.

2. The receiving facility must get written assurance every 2 years that the supplier is compliant with FDA regulations or the equivalent. This must include

i. description of the preventive controls in place used to control hazards.

ii. Statement that the facility is in compliance with all applicable laws.

d. If the supplier is a farm that grows produce not covered under 112 (FDA produce standards), the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the supplier's exemption from part 112 for their supplier.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

e. If the supplier is a shell egg producer not subject to requirements of part 118 (FDA Shell Egg Standards) because they have fewer than 3,000 laying hens, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the exemption from part 118 for their supplier, because the supplier has fewer than 3000 laying hens.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

f. There must not be any financial conflicts of interests related to verification (i.e. payments to a company performing supplier verification cannot be related to the results of the activity).

§117.435 Onsite Audit

a. An onsite audit must be performed by a qualified auditor

b. The auditor must consider all regulations to which a supplier is subject. The audit must include a review of food safety plan/HACCP plan.

c.

1. The following may be substituted for an onsite audit:

i. Inspection results from the FDA, State, or local agency.

ii. Inspection results from an overseas FDA equivalent.

2. If the inspection is from a foreign authority recognized as equivalent to the FDA, then the food produced by the supplier must fall within the scope of that recognized authority.

§117.475 Records Documenting the Supply Chain Program

a. Records related to supply-chain program are subject to requirements of Subpart F

b. The receiving facility must review the supplier records below in part (c) in the same manner that they would complete their own record verification (as defined in §117.465)

c. The facility must document the following records in their supply-chain program

1. Written supply chain program

2. Documentation that an importer is in compliance with the supply chain verification program requirements.

3. Documentation of the approval of that supplier

4. Written procedures for receiving raw materials and ingredients.

5. Documentation demonstrating the use of written procedures for receiving raw ingredients (This could be a receiving log)

6. Documentation of the approval of the supplier

7. Documentation of an onsite audit, including:

i. the name of the supplier being audited

ii. documentation of audit procedures

iii. dates of the audit

iv. conclusion of the audit

v. corrective actions to be taken in response to deficiencies found in the audit.

vi. documentation that the audit was conductected by a qualified auditor

8. Documentation of sampling and testing (if conducted as part of supplier verification) 

i. Identification of ingredient tested, number of samples tested.

ii. Identification of test conducted including the analytical methods.

iii. Dates of the tests

iv. Test results

v. Corrective actions taken in response to the testing

vi. Information identifying the lab conducting testing

9. Documentation of the review of the supplier's relevant food safety records.

i. The name of the supplier

ii. Dates of the record review

iii. General nature of the records review

iv. Conclusions of the review

v. Corrective actions taken in response to deficiencies found.

10. Documentation of other supplier verification activities conducted.

11. Documentation of the determination that verification activities conducted in lieu of an onsite audit are sufficient in the case that the hazard controlled by the supplier is one that could cause serious health consequences or death. You must provide adequate assurance that the supplier is controlling those hazards.

12. Documentation of an alternative verification activity if the supplier is a qualified facility.

13. Documentation of an alternative verification activity if the supplier is a farm.

14. Documentation of an alternative verification activity if the supplier is a shell egg producer.

15. The written results of an inspection of the supplier

16. Documentation of actions taken with respect to non conformance.

17. Documentation of mitigation of a hazard, if that control is applied by a 3rd party.

18. When applicable, documentation about the 3rd party and their verification activities.

This article is for you if…

∆ You are an FDA-regulated food business

∆ You purchase packaging/ingredients from one or more suppliers

∆ You are not defined as a very small business

---

---

Resources

FDA Regulation: Part 117 Subpart G - Supply Chain

---

More Regulation Guides

---

More Posts

---

What You Need to Know:

Verification means conducting a review to confirm a process was performed correctly. Verification answers the question "How do you know it actually happened?"

Example: A manager in a cookie factory reviews production records to confirm that the cookies were baked to the temperature described in the recipe.

Validation refers to the requirement that a food processor use scientifically proven methods to control a hazard. Validation answers the question "How do you know it works?"

Example: A food safety manager collects scientific research to demonstrate that the cooking temperature used in the recipe is effective in eliminating harmful bacteria in the raw product.

Why Verification and Validation are Important:

Both verification and validation are required or else food-safe outcomes may not be achieved.

Validation Without Verification...

Hand washing with soap is a valid method for removing dirt/grime from hands. However, if verification does not occur and employees do not actually wash their hands, then it doesn't matter how scientifically-proven the strategy is.

Verification Without Validation...

Hand washing without soap is not a valid method for cleaning hands. Even if a manager verifies that hand washing is occurring as required, it doesn't matter because hand washing without soap is not a valid method for cleaning hands.

---

Verification

Verification means the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure or combination of control measures is or has been operating as intended and to establish the validity of the food safety plan.

21 CFR 117(c)(1)(i)

Examples of Verification

• Reviewing cooking records to confirm the required temperature and cook time was reached

• Reviewing refrigeration records to confirm food was held sufficiently cold

• Observation that employees are following good food-handling practices

• Calibrating thermometers - this verifies that they are reading properly

• Sampling your own product for pathogens to verify that your process was faithfully performed

• Environmental monitoring - testing your production space for pathogens living on surfaces, in drains, etc.

• Supplier Verification - reviewing a supplier's records to confirm they are faithful to their food safety practices and claims.

When is Verification Required?

All records which monitor a preventive control must be verified within 7 days of their creation.

All corrective action records must be reviewed within 7 days of their creation.

Other verification records, such as instrument calibration, product testing, and environmental monitoring, must be verified "within a reasonable amount of time" as determined by the producer.

Who Conducts Verification?

All verification activities must be performed by a preventive controls qualified individual.

Examples of Verification

Verification

Example of Preventive Control	Verification Required?	Why?	Verification Example
Cooking Chicken to a temp of 165ºF as a preventive control to reduce the hazard of Salmonella Bacteria	Yes	The cook step is a preventive control. Therefore, the production record containing the cook temp/time must be verified	A manager reads the cook log and confirms that all chicken cooked that day was cooked to 165º
Fermentation and low pH are used as a method to prevent bacterial growth in pickled cucumbers stored at room temperature	Yes	Low pH is a preventive control applied to stop bacteria growth. Therefore, the pH records must be verified.	A manager reviews the daily production records to confirm the pH was below the required threshold in all batches. If there is a deviation, the manger verifies that the appropriate corrective action was taken.
Preservatives are used to kill harmful bacteria in chicken meat so that it can be consumed raw	Yes	This is a preventive control and must be verified	A manager confirms that the appropriate level of preservative was used to render the product safe. Additionally, in such a high-risk scenario, it may be advisable to test the chicken for pathogens.
Chlorine sanitizer used to sanitize dishes	Possibly	Depending on the nature of the product, it may not be a requirement to verify that the appropriate concentration of sanitizer was used.	Manager verifies a record showing that the sanitizer was tested and the chemical concentration fell into the designated range.
Items containing peanuts are stored in different-colored containers from non-peanut products	No	There is no requirement to verify the implementation of storage practices to mitigate an allergen concern, although it may be a good idea.	A manager may inspect storage spaces occasionally to confirm that practices are being followed to avoid allergen contact.

SOURCE: Sources

---

Validation:

Validation means obtaining and evaluating scientific and technical evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards.

21 CFR 117(c)(1)(i)

When is Validation Required?

You are required to validate every preventive control you are implementing. This means that if you use cooking as a means to kill bacteria, then you need to show that the time and temperature are a valid method for killing that bacteria type. This can often be achieved by referencing FDA guidance materials.

You are not required to validate the following types of preventive controls:

• Sanitation Preventive Controls

• Food Allergen Controls

• Recall Plan

Who Conducts Validation?

All validation activities must be performed by a preventive controls qualified individual.

Examples of Validation

Example of Preventive Control	Validation Required?	Why?	Validation Example
Cooking chicken to a temp of 165ºF as a preventive control to reduce the hazard of salmonella bacteria.	Yes	The cook step is a preventive control. While it's largely accepted that a 15 second exposure to 165ºF temps will kill salmonella, it's good to cite a source showing that this control is valid. You can simply link or reference any reputable text which states this fact.	5D reduction for Salmonella: 15 seconds at 165ºF Table A4.1, “Limiting Conditions for Pathogen Growth” FSPCA Preventive Controls for Human Food 1st Ediiton, 2016
Fermentation and low pH are used as a method to prevent bacterial growth in pickled cucumbers stored at room temperature	Yes	You'll need to describe exactly how you know that this combination of controls are effective in controlling specific bacterial pathogens. The validation must be specific to the hazards you are controlling. You can cite a study showing that a certain concentration of bacteria produced by the ferment is effective in limiting the growth of relevant, harmful pathogens. You might also link a source which describes the pH threshold for specific bacteria growth.	For example: pH is an effective limiter for pathogenic bacteria growth in lactic acid producing fermented products if a <4.6 pH is maintained. Hazard Analysis and Risk-Based Preventive Controls for Human Food: Draft Guidance for Industry, Chapter 4 “Preventive Controls” p.27
Preservatives are used to kill harmful bacteria in chicken meat so that it can be consumed raw	Yes	This is a less common type of control (using preservatives to make raw chicken edible) so you would need to make a compelling case that this preservative is effective in eliminating harmful bacteria. You can state the simple facts of the study in one of two sentences and then cite the source.	[cite your source]
Chlorine sanitizer used to sanitize dishes	No	Validation is not required for sanitation controls. In this case, it is widely accepted that chlorine is an effective sanitizer.	N/A
Items containing peanuts are stored in different-colored containers from non-peanut products	No	Validation is not required for allergen controls	N/A

SOURCE: Sources

This Article is For You if…

∆ You are developing a food safety plan or a HACCP plan.

∆ You are an FDA regulated food facility.

---

Resources

Food Safety Plan Guide to Validation

Food Safety Plan Guide to Verification

---

More about Food Safety Plans

---

More Posts

---

Supplier visits are a wonderful thing to procrastinate on if you’re a food manufacturer or restaurant owner. There’s barely enough time to get through your own production, so why lose a day to go visit one of your suppliers? Here are 3 reasons your business will benefit from a field trip upstream:

1. Your customers care about product quality

2. You are legally compelled to conduct supplier visits

3. You will learn how to improve your business

1.  Your Customers Care About Product Quality

Your customers demand the highest quality products from you. This means consistency of product, zero risk of food borne illness, and a product that tastes perfect every time. As a food producer, your sole focus is to get an "A+" on this every single day in your own facility. But can you guarantee the same of each of your suppliers?

Here is a simple and yet difficult truth to swallow: when you take custody of purchased ingredients/packaging/goods, you are responsible for them. For example, if you produce chocolate bars and your customers gets sick because of salmonella-infected sugar that was mishandled by your supplier (not you!) then your product will be recalled. Perhaps theirs will too, but that hardly matters when your production is halted and your brand reputation is at stake.

Here is a less extreme example: a supplier visit might show you that one of your suppliers is taking risks that you don't feel comfortable with. Whether it's a less-than-clean facility or lax attitudes about food safety basics, this may open a conversation with them about raising their food safety standards or losing your business.

2.  You Are Legally Compelled to Conduct Supplier Visits

Ahh, the Food Safety and Modernization Act (FSMA). All food manufacturers except exempt facilities (i.e. small timers and very low risk operations) must have a Supplier Verification Plan. In short, you have to prove that you are doing your due diligence when it comes to vetting your suppliers, beyond picking the vendor with the lowest prices.

Fortunately, the standard for "Supplier Verification" plans is fairly low from a regulatory standpoint because FSMA is new and everyone is still catching up. It doesn't necessarily require supplier visits, but this is actually one of the easiest ways to comply with FSMA without having to write out long, complicated food safety documents. Just visit the supplier and record that you conducted a visit, who you visited, and when.

3.  You Will Learn How to Improve Your Business

Supplier visits are a great way to learn about how to improve your operations. Chances are that your supplier is a more advanced operation than yours and that they've solved a lot of the problems that you haven't solved yet.

When I was managing a commissary, I visited one of our suppliers with the expectation of learning very little. I was completely wrong. Even though their product was completely different from ours: (them: raw chopped vegetables, us: gourmet hot meals) I saw what my facility was going to look like when we scaled 10x.

The quality assurance manager toured me around the facility and answered every question I had. It was an hour of free consulting that my company would have paid thousands of dollars for. He also sent me home with a flash-drive of  documentation and their recent audit results that I used to cut costs in my own operation and prepare for our next inspection.

Every business wants to increase their output by 10x but very few of us truly understand what that looks like. How many hires does that require? How will the layout of your facility change? Visiting your suppliers will show you what's happening in the big leagues and illuminate the path to getting there.

How to Conduct a Supplier Visit

1. Get in touch with your contact and ask if there's a time that works for you to come by and visit. Your suppliers will be very familiar with this request and probably have a process in place.
   

2. Show up on time and be respectful of their time. Remember, someone is taking time from their production role to tour you around, so be considerate and thankful.
   

3. Be a sponge
   

   • Ask if you can take photos. If so, photograph anything and everything. You may not think much of their eyewash stations now, but you'll be happy to revisit photos of theirs when it comes time to install your own.

   • Take notes. First, confirm it's OK to bring your note-taking apparatus into the facility. If so, scribble like your memory is fading. Otherwise, you'll forget all of it.

   • Ask questions. The goal here is twofold: First, it's a great way to learn about how to improve your own operations. Second, it's a great insight into their food safety awareness and culture.

   • Ask for documents. Request their food safety plan, audit results, log entries, everything. This isn't an unreasonable request: it's part of your due diligence. They'll probably only give you some of it, but this is priceless. Wouldn't it be helpful to have the scoresheet used by the auditor that's going to decide whether your product should be allowed on Whole Foods shelves? Bring a flash drive so you can accept digital copies.
     

4. Act on your findings. If you are aware that your supplier is creating a food safety hazard and you pass that risk along to your customer without doing anything about it (i.e. changing suppliers) you could go to jail. Yeah.
   

5. Send a thank you note. Anyone in the business long enough knows that supplier relationships are critical. A simple 3 sentence email will suffice and you'll be happy to have the contact.
   

As busy as you undoubtedly are with your own business, supplier visits are a critical part of your commitment to food safety. If nothing else, the field trip will show you how to host visitors in your own facility because it's only a matter of time before someone wants to walk through your space and see your records. Are you ready?

Have you conducted a supplier visit? Whats' the most surprising thing you saw? Let us know in the comments section below.

---

This Article is For You if…

∆ You purchase ingredients or packaging from another company

---

More about Supplier Verification

---

More Posts

---