The supply chain for food and beverage companies has grown to be truly global and interconnected. To offer customers exciting new flavors, products, and ingredients, many businesses have expanded their geographic reach of sourcing ingredients and materials.

Entering into this vast network of different suppliers means companies could be opening themselves up to more risks. The U.S. Food and Drug Administration (FDA) recognized these complexities and possible problems in the supply chain when developing the Food Safety Modernization Act (FSMA). As a result, regulators are now requiring companies to take increased measures to ensure the safety of their food.

However, food and beverage businesses still must control costs to stay competitive, making maintaining the efficiency and performance of their supply chain also crucial. The entire end-to-end process must be strategically planned and systematically managed with an acute emphasis on mitigating any risks from suppliers. The following are some best practices food and beverage companies can use to better protect themselves from any food safety and quality incidents.  

Identifying Supply Chain Risks
Companies must start with evaluating their current processes to manage supply chain risks. For instance, are audits relied upon to verify their suppliers have appropriate food safety practices in place? Or are second- or third-party audits conducted?

Is the testing program in-house? Are certificates of analysis (COAs) relied upon? Where and how is that information collected and tracked? What departments and staff are in charge of the supply chain—R&D, finance, operations, QA, etc.?

Taking a critical look at supply chain management will not only allow risks to be identified but will also unlock the ability to differentiate which risks have the greatest potential impact. Oftentimes, food and beverage companies wonder whether they should devote more resources to managing high-risks areas than low-risk areas, and the answer is yes. Nearly everything food companies do today must be risk based.

FSMA and Supply Chain Control
Because FDA recognized that supply chain control is critical in terms of managing food safety risks, it developed two key rules under FSMA to address this area—the Preventive Controls rule and the Foreign Supplier Verification Program (FSVP).

Food and beverage manufacturers subject to the Preventive Controls rule must assess supply chain risks and then verify that the risks are being controlled. If it is determined that the supplier is responsible for controlling the risk, the purchasing company must be able to verify that the supplier is doing so effectively.

FSMA’s FSVP is very similar to the Preventive Controls rule, with the exception that it shifts the burden of ensuring safe food to importers. It is therefore FDA’s expectation that importers will have assessed risks in the supply chain and subsequently have verified that risks are being controlled.

While these rules are conceptually simple, many companies still face confusion around their implementation. Here are some steps that will help ensure companies are compliant with the regulations:

1. Perform a Hazard Analysis: Look at hazards presented by the materials sourced in all three areas: ingredients, products, and packaging.

2. Evaluate the Risks: Identify the types of risks posed, including whether they are microbiological, chemical, or physical. The next step is to identify who is responsible for controlling the risk: the supplier, the processor, or the end customer. FSMA requires a letter of assurance from any customer assuming responsibility for controlling the risk.  

3. Supplier Verification: If it has been determined that the supplier is controlling the risk, this will need to be verified.

4. Use of Approved Suppliers: FDA can request to see companies’ lists of approved suppliers and the method used to select and approve suppliers.

5. Corrective Actions: If there is a problem with a supplier, corrective actions must be carried out appropriately and thoroughly documented.

6. Build a Program and Keep Records: Detailed recordkeeping is a common theme across many aspects of FSMA, so confirm that records are updated regularly and are well organized.

Developing a FSMA Approach to Risk Management
When beginning a practical implementation of a FSMA approach to supply chain risk management, create a list of all ingredients used as well as products and primary packaging. Next, perform a Hazard Analysis and document the results in records that can be presented to FDA. Finally, assign responsibility to who will control the risks identified.

To begin a supplier verification program, compile a list of all suppliers and their manufacturing sites. For all Class 1 risks being controlled by the supplier, an onsite audit will be needed from each site sourced. Many companies rely on third-party audits to satisfy this requirement, but proper documentation should be put in place.

Because Global Food Safety Institute (GFSI) standards are well-aligned with FSMA, GFSI certification appears to satisfy FDA requirements. If an onsite audit for Class 1 risks is not able to be conducted, documentation will be needed of the explanation for this as well as how the risk will be controlled through an alternative method, such as a testing program.

Some companies use COAs to control other risks from their suppliers, but accurate understanding of each COA is necessary. If an ingredient poses a high risk, make sure the COA is strong and reliable. For instance, is the testing method an approved one? Does it test adequate amounts of the product? Is the lab that is being used an accredited one? While it is not necessary to look at COAs quite this closely for every ingredient, be sure to do so for those deemed most important.

Assessing Existing Suppliers
Not all suppliers present equal risks. How, then, should these risks be evaluated? Companies must first determine which risks are most significant and then dedicate the most resources on the areas of greatest risk. There are multiple factors that can impact risks, which can be categorized into three main areas:

1. Ingredient Risk: This refers to the inherent risks posed by the ingredient itself, including a recurring history of problems, country of origin, and so forth.

2. Supplier Risk: Supplier behavior, including the degree to which they control risks, should be factored into the risk assessment.

3. Use of the Ingredient: Ingredients used in all products versus a select few pose a higher risk. Likewise, the ingredients used in high-profile products—or most associated with a company’s brand—should also be considered a greater risk.

Next, companies should begin to rank supplier risks by collecting information about their qualifications and certificates, onsite audit results, any prior history of problems with the supplier, and regulatory actions.

Then, understand how and where an ingredient is used in the product production process. How many products are affected by this ingredient? Are these flagship products or strongly linked to a brand identity? What is the financial impact of a recall? All this information will help define the risk-based strategy of a food and beverage company.   

This ranked risk approach allows companies to not only protect themselves, but optimize resources. The same amount of resources can’t be used to prevent risks for every supplier and ingredient. However, identifying which entities pose the greatest threats will help ensure risk management dollars are truly being spent based on an accurate and thorough risk assessment.

Working with Suppliers
To some extent, the effectiveness of your supply chain management lies in the ability to collaborate seamlessly both externally with the supplier as well as internally. When new products are in development, make sure that all teams involved are collaborating to ensure that potential risks are identified proactively—not reactively. This may mean that in addition to R&D, procurement, and supply chain personnel, a food safety manager might also need to be involved in the early phases of product development. The company must understand both the ingredient risk and the supplier risk. If it is deemed that the ingredient poses a high risk, it may require a change or a new process for controlling risks.

One area in which many companies fall short is tracking the performance of existing suppliers. The emphasis is typically on innovation—which is why new suppliers are so thoroughly vetted—but to ensure safety at every level of the supply chain, companies must also monitor current suppliers.

Develop a process to track and trend performance data, which could include timeliness of deliveries, how well specs are being met, COAs, corrective actions, and so forth. Keep thorough records and analyze them frequently to look for warning signs that a supplier’s performance needs to be addressed.

While transitioning supply chain management activities towards a more risk-based approach may require an initial investment of time and effort, it will help companies take a more proactive stance on food safety. As a result, it could be the very activity that helps a brand succeed even in the face of increasing supply chain complexity.

Special thanks to Brian Sharp, president of SafetyChain, for his thoughts on this topic.

David Acheson, M.D., F.R.C.P., is founder and CEO of The Acheson Group.