FSMA Supply Chain Program, 21 CFR 117 (G)

Food Safety Modernization Act of 2016 requires establishments that manufacture, process, hold or distributes food to register with FDA and comply with GMPs.
Subpart C of 21 CFR 117, requires establishments to conduct hazard analysis of their process and ingredients.
Hazard Analysis is the process of identifying potential hazards and assess these hazards for severity of consequences when control over hazards is lost and likelihood of occurrence of these hazards in company’s specific operation.
Based on hazard analysis in FSMA, companies identify 4 different types of Preventive Controls (Process, Allergens, Sanitation and Supply Chain Preventive Controls).
Requirements for Supply Chain Program is outlined in 21 CFR 117 subpart G. Regulation requires establishments to develop and implement Supply Chain Program where hazard analysis indicate the need. For significant hazards that cannot be controlled by process controls establishments need to relay on their suppliers. In this case, significant hazards are controlled through supply chain preventive controls.
Subpart G describes components of Supply Chain Programs – Identification of requirements for approved suppliers, approving suppliers, identifying verification procedures and finally conducting verification activities of approved suppliers.
There are several options as far as verification activities. Receiving facility may decide to request copies of 3rd party audits, conduct 2nd party audit by qualified auditor, request food safety records or sample and test and others.
Standard practice within food industry and following GFSI guideline was to obtain copies of 3rd party audits, therefore this is the most common verification activity to meet requirement of subpart G.
FSMA also requires that along Supply Chain Program receiving facility has documented receiving procedures and keeps receiving records for products where significant hazards are controlled through supply chain preventive control.
In general, the requirements for supply chain outlined in FSMA are similar to requirements for approved suppliers required by GFSI benchmarked certification schemes.