As part of the Food Safety Modernization Act (FSMA), the U.S. Food and Drug Administration (FDA) requires most food facilities and U.S. importers to conduct certain supplier verification activities through implementation of a Supply Chain Program or Foreign Supplier Verification Program (FSVP), respectively, to ensure that hazards that can only be controlled by their supplier (or other previous entity) have been properly addressed and the food meets FDA food safety requirements.

The receiving facility or U.S. importer must, among other things, conduct hazard analyses of the food; identify the suppliers or entities controlling significant food safety hazards; evaluate them for approval; and determine, conduct, and document verification activities at an established frequency. They are also required to approve and verify suppliers prior to receiving or importing the raw material, ingredient, or food.

Read on to learn how to choose a supplier verification activity that is appropriate for your supplier.

What Entities Conduct Supplier Verification Activities?

As mentioned, a receiving facility or U.S. importer will be required to comply with Supply Chain Program or FSVP, respectively, when significant food safety hazards can only be controlled by entities prior to receiving or importing the food.   A “supplier” is considered the entity that manufactures or processes food, raises animals, or grows the food that will be received by a facility or imported into the U.S. Entities that only engage in re-packaging (i.e., placing an already packaged food inside another packaging), storing packaged food, or labeling are not considered suppliers as they are not the entities applying controls.  However, these entities (e.g., brokers, produce aggregators, food distributors, and cold storage facilities) may assist in gathering required information or conducting certain supplier verification activities on behalf of a receiving facility or U.S. importer in certain instances.

Considerations for Determining Supplier Verification Activities

When determining the appropriate supplier verification activities and the frequency at which they are conducted, you must consider:

• The results of the hazard analysis, including the nature of the hazard and the control applied
• The entity or entities within the supply chain applying the controls
• Supplier performance as it relates to their food safety procedures, processes, and practices, their overall food safety and/or FDA compliance history and any other relevant factors, including storage and transportation practices.

Types of Verification Activities

FDA specifies four appropriate supplier verification activities. Each activity can be conducted alone or in combination with another activity and they are:

• Annual onsite audits
• Sampling and testing of the raw material, ingredient, or food
• Review of the supplier’s relevant food safety records
• Other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material, ingredient, or food.

Annual onsite audits

If a supplier is controlling a significant hazard that may result in Serious Adverse Health Consequences Or Death to Human or Animals, what FDA refers to as a “SAHCODHA” hazard, the default verification would be an annual onsite audit of the supplier. The audit must be performed by a qualified auditor and must consider  FDA food safety regulations applicable to the raw material, ingredient, or food.

The auditor must review the adequacy of supplier’s Food Safety Plan (if the supplier is required to have one) and that it is being properly implemented to control the associated hazards.  A qualified auditor is a person who has the technical expertise obtained through education, training, or experience (or a combination thereof) necessary to  the auditing function.

A food facility inspection conducted by FDA or a foreign government employee or by an audit agent of an accredited certification body may be accepted in lieu of an onsite audit if it took place within the past year. In this case, the receiving facility would need to obtain and review the inspection or audit results to ensure the scope of the audit covered the applicable food and process and that it demonstrates FDA compliance. If the results are not favorable and non-compliance is discovered, corrective action must be taken to address the food safety concerns prior to using the supplier.

The receiving entity or U.S. importer must document the following information pertaining to the onsite audit:

• The name of the supplier audited
• Audit procedures
• The dates the audit was conducted
• The conclusions of the audit
• Corrective actions taken in response to significant deficiencies identified during the audit
• Documentation that the audit was conducted by a qualified auditor

Sampling and testing

When choosing this verification method, you must ensure that the type of testing conducted is scientifically-based and appropriate for the type of hazard and food. Testing must also be conducted at sufficient frequency   to “provide reasonable assurance that the hazard has been significantly minimized or prevented” The frequency should be based on the supplier’s food safety history and the likelihood of the hazard. The receiving entity or U.S. importer do not have to conduct the testing. They may rely on the supplier to provide them testing results or Certificates of Analysis (COA). They must still ensure that the supplier or other entity used adequate sampling and testing methods as part of the review of the results.

You must choose a testing method that provides reliable results when there may be interference from other food components or when the concentration of the hazard might be present at low levels, which would require a method sensitive enough to detect the hazard. FDA has indicated that sampling and testing of a food on its own may not be a reliable verification method as it does not reveal information about whether the control procedures are being followed. Therefore, this type of verification should be combined with an onsite audit or review of relevant food safety records to verify that control measures have been properly applied.

The receiving entity or U.S. importer must document the following information pertaining to sampling and testing:

• Identification of the raw material, ingredient, or food tested (including lot number, as appropriate) and the number of samples tested
• Identification of the test(s) conducted, including the analytical method(s) used
• The date(s) on which the test(s) were conducted and the date of the report
• The results of the testing
• Corrective actions taken in response to detection of hazards
• Information identifying the laboratory or entity conducting the testing

Review of the supplier’s relevant food safety records

FDA defines relevant food safety records as, “any records that will provide sufficient documentation that your supplier is following the procedures your supplier established to control a hazard and that the hazard has been controlled”. You may need to review a supplier’s records if you establish through other verification activities that a hazard was not addressed sufficiently to decrease risks associated with it. You would need to request corrective actions and review updated procedures and controls or other records until you are confident that the supplier has resolved the issue.

If your supplier is supplying you with products for which they used a supplier, you may need to obtain records from the supplier’s supplier, including documentation of audits and verification your supplier performed on their suppliers. The receiving entity or U.S. importer must document the following information pertaining to review of food safety records:

• The name of the supplier whose records were reviewed;
• The date(s) of review
• The general nature of the records reviewed;
• The conclusions of the review
• Corrective actions taken in response to significant deficiencies identified during the review

Other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material, ingredient, or food

If other supplier verification activities are more appropriate to the risk posed, you could conduct and document or obtain documentation of these activities.

If you are conducting a supplier verification activity other than an onsite audit, sampling and testing, or review of the supplier’s relevant food safety records, these must follow FDA’s general requirements of record-keeping, such as the needs for records to be accurate, indelible, and legible. Records must also be “reviewed within a reasonable time after the records are made by (or under the oversight of) the receiving entity’s Preventive Controls Qualified Individual (PCQI) or the U.S. importers qualified individual to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions”, as applicable.

Other requirements when importing raw materials, ingredients, or food to the U.S.

Like U.S. importers, a receiving facility that is importing raw materials, ingredients or food from a foreign supplier, is also subject to FSVP requirements. However, as a food facility, they can address supplier verification requirements through their Supply Chain Program. Both programs are equivalent with one exception. To fully comply with FSVP, the receiving facility needs to list themselves as FSVP Importer at customs entry for the raw materials, ingredients or food they are importing.