In the food industry, a strong innovation pipeline is critical for ensuring an organization’s profitability and long-term survival. While some products remain tried and true over time, there is a growing customer and consumer appetite for new and exciting products with modern attributes that keep our brands relevant and even create a need for new ones. Responding to consumer interests has driven the industry to develop products that are gluten-free, non-genetically modified, organic, vegan, paleo and keto diet-friendly, free from allergens, antibiotic-free, contain sourcing claims, and subjected to cold-pressed processing, among a variety of other attributes. While designing for these attributes themselves does not drive a food safety risk, the introduction of any new and novel ingredients to a system presents the need for sound practices and supplier approval requirements.

Consumers’ increasing awareness and interest in global cuisines additionally introduce opportunities for ingredients once deemed exotic to become mainstream. As a product developer sets out to design new products with these attributes or ingredients, they may introduce a variety of new ingredients to a company’s supply chain and possibly create challenges for sourcing. There also may be a new management risk from a food safety and regulatory standpoint with ingredients coming from new suppliers or facilities all over the world. 

Considerations for how ingredients will be sourced, inspected or segregated, and processed may have implications for the quality and safety of the finished product. It is important for the developers deciding which ingredients to use to be in communication with not only their procurement partners but also their food safety and quality partners to use ingredients from reliable and trustworthy suppliers from the beginning. As R&D projects move from benchtop samples to commercialization, product developers must select appropriate raw materials to not only meet product design parameters but also adhere to relevant regulatory and company requirements, such as any applicable regulations under the Food Safety Modernization Act (FSMA). 

As a basic requirement of the Preventive Controls for Human Food regulations, the performance and documentation of a thorough hazard analysis is the cornerstone of a food safety plan. A facility’s food safety team, including the Preventive Controls-Qualified Individual and product development team must be aware of potential ingredients or future processing procedures that may introduce new or increased biological, chemical (including radiological hazards), or physical hazards. 

A manufacturing facility receiving the ingredients would also need to evaluate the hazard to assess the severity of any illness or injury if the hazard were to occur and the probability that the hazard will occur without preventive controls. For example, a facility receiving ready-to-eat almonds that does not employ a lethality step as part of its process flow would need to perform a hazard analysis to determine if additional supply chain controls are needed. This is because raw almonds can be a source of Salmonella, and almonds have been previously implicated in Salmonella-related recalls/outbreaks. If the receiving facility does not employ a process step that would control Salmonella in raw almonds (e.g., a validated roasting process), it will need to rely on the process preventive control at the supplier’s facility for treating the almonds to significantly minimize or prevent the potential presence of Salmonella. This means the receiving facility’s hazard analysis should reflect that Salmonella on raw almonds is a hazard requiring a supply chain-applied control (or preventive control). 

Per FSMA, a manufacturing facility’s supply chain control program [§ 117.420 (21 C.F.R. 17.410(a)(1)(2)(3)(4))] needs to have one or more of the following elements:

  1. Use of approved suppliers
  2. Determination of appropriate verification activities prior to approving the supplier
  3. Continuation of verification activities at set frequencies
  4. Documentation of the supplier approval and all related verification activities

A FSMA-compliant supply chain program must be written. However, it is a best practice to have a written supply chain program regardless of whether you are required to implement supply chain controls based on your food safety system. In some cases, your supply chain program may have existed prior to FSMA regulations, and in those cases, you will need to ensure your program meets the requirements and update it as needed. This could get complicated, considering the complexity of the supply chain system. In the subsequent sections of this article, we list some important considerations for manufacturers when designing a robust supply chain program for their organization.

Supplier Approval under FSMA

The U.S. Food and Drug Administration has allowed two different pathways to complete supplier verification: under the Preventive Controls regulation (referred to as “Subpart G”) and under the Foreign Supplier Verification Program (FSVP). Subpart G outlines requirements stating that ingredient suppliers must be verified to ensure they are appropriately controlling hazards before they ship ingredients to a company that will not be controlling the identified hazard. An FSVP requires verification of suppliers and their food safety practices before they ship ingredients or products from a foreign location. The FSVP regulations are very similar to Subpart G requirements and may be used in situations where imported foods are not already verified under a U.S. food safety plan. However, compliance with an FSVP is typically deemed equivalent to compliance with Subpart G. For the purpose of this article, we will focus on Subpart G requirements.

The need for a FSMA-compliant supplier approval program is dictated by decisions made in the food safety plan, specifically in the hazard analysis. If the hazard analysis indicates that a hazard requiring a preventive control is present, the company receiving the ingredient has some decisions to make. They could choose to control the hazard themselves, perhaps through a process preventive control like cooking for a microbial hazard. Or perhaps the company chooses not to control the hazard; if this is the case, they must provide written disclosure of the hazard to their customer if their customer is a manufacturer, processor, or preparer. There is one additional option (the one most relevant to our discussion): The company can rely on their supplier to control the hazard. This piece is where adherence to Subpart G and a supplier verification program come into play. 

Use of Approved Suppliers

If you are implementing a supply chain control in your food safety system, you must procure your materials or ingredients in question from an approved supplier. A receiving company must approve suppliers in accordance with requirements of 21 C.F.R. §117.410(d) and document that approval before receiving raw materials or ingredients from those suppliers. Once a supplier has been approved, it is important that the receiving facility develop written procedures for receiving ingredients from their approved suppliers. The procedures should demonstrate that the materials are received only from approved suppliers. The details of the approvals should include not just an approved company but also the location/address of the approved site. The receiving facility should also keep records on the materials they receive and suppliers from whom they received. Determining which suppliers to approve will be based on verification activities up front prior to ingredient receipt and then on a continuous basis based on ingredient risk.

Determination of Appropriate Verification Activities Prior to Approving the Supplier

Whether a supplier is approved will be based on verification of their ability to adequately control the hazards you have identified. There are many verification activities you can choose to approve a supplier. For example, you may choose to use the results of an on-site audit of the supplier. You could also perform periodic sampling and testing of the raw material or ingredient based on the hazard identified. Another good choice may be to review relevant food safety records related to your suppliers’ controls for the hazard you identified. In this scenario, you would review records related to particular lots of ingredients you are procuring and review the records generated for the preventive control that is controlling the hazard you identified as associated with the ingredient. You also have the flexibility to design your own verification activities. One common approach is to develop a supplier questionnaire, which asks specific food safety systems-related questions of your supplier. You can decide based on their answers whether steps they take to control identified hazards are adequate. You are not limited to just one verification activity, either. You should find the best approach or combination of approaches to ensure that your supplier is effectively controlling the hazard before you begin receiving the material.

Many food manufacturers have required a third-party food safety audit [typically a Good Manufacturing Practices (GMP) audit] from their suppliers as part of their supplier approval program. In 2000, the Global Food Safety Initiative (GFSI) was developed in response to several recalls in the industry and lack of consumer confidence in food manufacturers. This private organization benchmarked audit schemes to ensure they met the minimum requirements of the GFSI guidance documents. Several major retailers mandated that their suppliers be audited against a GFSI-recognized scheme. These schemes were more comprehensive and improved food safety standards of manufacturers, thus becoming the audit of choice for customers, manufacturers, and suppliers alike.

Because they lack the resources to annually audit every ingredient supplier that requires a preventive control, most manufacturers are requiring these suppliers be audited against a GFSI-recognized scheme. GFSI schemes review a supplier’s food safety/Hazard Analysis and Critical Control Points (HACCP) plan and associated food safety records. Many of these schemes are updating their audit to meet FSMA Preventive Controls requirements. When building a supplier approval program, a risk assessment should be developed to identify those suppliers who pose a risk to your business and brand. The following criteria are some examples you may want to include in your risk assessment: 

  • Food safety audit: Has the supplier been audited by your own company? If so, what was the outcome of that audit? Does the supplier have a GFSI audit scheme? If so, what were the nonconformances? Do they have just a GMP audit? 
  • Country of origin: Are there supply chain geographic concerns, such as is the manufacturing facility in country of use? Is it outside the country of use but doesn’t pose a supply chain concern? Is it outside country of use and does pose a supply chain concern? 
  • History of food fraud: Has the supplier or parent company had a history of fraudulent intentional adulteration or substitution of an ingredient? What about the ingredient itself: Has there been known adulteration or substitution in the industry? 
  • Recalls, alerts, and warning letters in the last 2 years: The number of recalls, alerts, warning letters, or compliance and enforcement actions over a period may indicate a risk associated with a supplier. 
  • End use of the ingredient: Does the use of the ingredient provide a validated lethality step or does the ingredient itself have no pathogenic microbiological risk? Does the use of the ingredient provide a heat treatment step but not validated lethality, or does the use of the ingredient have no validated lethality step or validated lethality? 
  • Chemical or physical risk associated with the ingredient: Are there any chemical or inherent physical risks associated with the ingredient? If chemical or inherent physical risks are associated with the ingredient, does the supplier have good control measures in place to mitigate them? For example, if aflatoxin is an identified risk in peanuts, does the supplier have a blancher in their process and do they report aflatoxin results on a certificate of analysis (COA)? If there is an inherent physical hazard like cherry pits in cherries, does the supplier have an X-ray machine in place to ensure removal of pits? In situations where there are inherent chemical or physical risks associated with the ingredient but the supplier has minimal or no control measures in place, will the company receiving the ingredient apply an appropriate control? 
  • Single/sole source: Determine if an ingredient is single sourced or procured through multiple suppliers or multiple supplying locations. If an ingredient is single sourced, there should be only one supplier with one supplying location. The volume of the ingredient supplied may also be a factor that may affect the risk assessment. Each criterion should have a different risk weight associated with it depending on what you deem a higher risk to your company and brand. Remember that as the supply chain becomes more complex, risk can potentially be added. For example, if you are receiving an ingredient from a broker who in turn received it from an importer who received it from the supplier, this may increase risk. You need to know who the actual manufacturer is for that ingredient. This risk assessment should help you identify risks so that you can manage and mitigate them. Just like any program, this should be updated as risk levels change or new risks are identified. 

Continuation of Verification Activities at Set Frequencies 

Your verification activities don’t end after you have approved a supplier to provide an ingredient or raw material. You must then periodically verify your supplier and their identified controls. In general, the nature of the hazard and your hazard analysis will inform what continued verification activities you will employ and how frequently you will be performing them. The greater the risk you identify, the more stringent you should be assessing your supplier’s performance through your verification activities. For a FSMA-compliant program, any ingredient or raw material with a SAHCODHA (serious adverse health consequences or death to humans or animals) hazard identified (or an ingredient/raw material that has potential of SAHCODHA) will have to include an annual on-site audit as verification. There is an exception to this requirement, but it will require documentation that your approach, whether it be other verification activities or less frequent auditing, provides adequate assurances in place of the annual audit, and a person who is qualified to make this decision has documented the justification. 

Documentation of the Supplier Approval and All Related Verification Activities

It is likely that you will have some suppliers who fall under the FSMA requirement of a supply chain program while many other suppliers will not—perhaps they are not controlling a hazard on your behalf, or maybe they fall under a different regulatory pillar (U.S. Department of Agriculture, Seafood HACCP, etc.). It is up to the company to decide how to handle these other suppliers, whether they should fall under the same program as the FSMA-required supplier or be covered under a separate program. Regardless of which approach you choose, careful consideration of your expectations for a supplier and documentation of your reviews and decision-making are vital.

It is also very common for a company with multiple individual establishments to maintain a supply chain program at a central site. Perhaps the corporate team conducts the hazard analysis, supplier approvals, and verification activities while providing details on approved suppliers and ingredients to the individual sites. The sites then ensure they follow a documented receiving procedure for ingredients, review appropriate documents such as COAs where applicable at receiving, and document their review of information. This approach may be more harmonized than having each site maintain a unique supply chain program individually.

Conclusions

In a rapidly evolving marketplace, food companies need to meet the growing consumer demand for novel food products containing modern attributes to keep their brands relevant. Hazard analysis of ingredients in the development of such foods needs to be performed to identify any potential risk associated with the finished product. Manufacturers need to employ adequate supply chain preventive controls to significantly minimize and prevent the identified reasonably foreseeable hazards on their incoming ingredients where appropriate based on hazard analysis. It is the manufacturer’s responsibility to develop a supply chain program and identify appropriate suppliers who meet the manufacturing facility’s expectations. The need for a FSMA-compliant supplier approval program is dictated by decisions made in the food safety plan, specifically in the hazard analysis. A cross-functional team should be involved to ensure compliance with regulations as the different elements of the supply chain program are being developed. In this article, we discussed several best practices for manufacturers when designing a robust supply chain program for their organization. Manufacturers should find the best approach or combination of these approaches to adequately ensure potential hazards, if any, of incoming ingredients are effectively controlled before they arrive at their facility. Robust food safety practices will ensure success for individual product launches as well as long-term success for food companies.

Resources

Bala Kottapalli was the director, enterprise microbiology, at Conagra Brands when this article was submitted. He is a member of the editorial advisory board for Food Safety Magazine.

Sarah Ehlers is director of food design for Conagra Brands. 

Karleigh Bacon is a regulatory compliance manager at Kraft Heinz. 

Penny Mack is a manager of supplier quality at Conagra Brands.