FDA 483 Citations for the Supply-Chain Program Under 21 CFR 117.405 and 117.410

22 hours ago

5 min read

FDA investigators cited the supply-chain program requirements of the preventive controls rule on system-generated Form FDA 483s in fiscal year 2025:

"You did not implement your written supply-chain program," 117.405(a)(1), 46 times
"Your supply-chain program does not provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented," 117.410(c), 42 times

That is 88 citations. A supply-chain program is needed when a hazard in a raw material or ingredient is controlled by the supplier rather than by the facility itself, for example Salmonella in a ready-to-eat ingredient that receives no kill step, or an allergen that must be absent from a supplier's ingredient. If the facility does not verify the supplier, nothing in its own process stops the hazard.

What the citations mean

Examples written after "Specifically" usually describe:

A written supply-chain program that is not followed
Ingredients received from suppliers that were never approved
No verification activities, or verification done once and never repeated
Supplier certificates of analysis accepted without review, or without a method or results
No annual onsite audit for a hazard that could cause serious illness or death, and no documented reason for another approach
Hazard analysis that identifies a supply-chain-applied control, with no corresponding supplier controls
Verification records not reviewed, or failures not acted on

What Subpart G requires

When a program is required (117.405(a)). A receiving facility must establish and implement a risk-based supply-chain program for those raw materials and other ingredients for which it has identified a hazard requiring a supply-chain-applied control. A program is not required when the receiving facility controls the hazard itself, or when it relies on a customer to control the hazard and has the required disclosures and written assurances under 117.136. The program must be written (117.405(b)).

General elements (117.410(a)). The program must include:

Using approved suppliers (117.420)
Determining appropriate supplier verification activities, including their frequency (117.425)
Conducting supplier verification activities (117.430)
Documenting supplier verification activities (117.475)
When applicable, verifying a supply-chain-applied control applied by an entity other than the supplier, and documenting it (117.415)

Verification activities (117.410(b)). Appropriate supplier verification activities include onsite audits, sampling and testing of the raw material or ingredient, review of the supplier's relevant food safety records, and other activities appropriate to the risk.

Assurance (117.410(c)). The supply-chain program must provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented.

Serious hazards (117.430(b)). When a hazard will be controlled by the supplier and is one for which there is a reasonable probability that exposure will result in serious adverse health consequences or death (SAHCODHA), the appropriate verification activity is an onsite audit of the supplier before using the raw material or ingredient and at least annually thereafter, unless the receiving facility documents its determination that other verification activities and frequencies provide adequate assurance.

Approval and review (117.420 and 117.425). The receiving facility must approve suppliers before receiving raw materials and ingredients from them, considering the hazard analysis, the entity that will apply controls, supplier performance and compliance history, and must document the approval. Written procedures for receiving raw materials and ingredients must be established and followed to ensure they come only from approved suppliers, or, temporarily, from unapproved suppliers whose materials are verified before use.

How to respond to the 483

FDA does not set a single deadline for responding to a food 483, but most firms respond in writing within 15 business days, so FDA has the response before it decides on further action.

Identify supply-chain-applied controls

Review the hazard analysis. For each raw material and ingredient, record whether a hazard requiring a preventive control is controlled by you, by the supplier or by your customer.

Approve and verify suppliers

For each supplier of a material with a supply-chain-applied control, document the evaluation and approval. Choose verification activities and frequencies based on the hazard and the supplier's performance. For SAHCODHA hazards, plan an annual onsite audit or document why another approach gives adequate assurance.

Implement and review

Conduct the verification activities, review results and act on failures. Block receipt from unapproved suppliers at receiving.

Assess past use

For materials used without verification, review supplier records and test retained samples where possible. Decide whether finished product needs further action.

What a compliant supply-chain program contains

List of materials and hazards requiring supply-chain-applied controls
Supplier evaluation and approval
Receiving procedures that enforce approved suppliers
Verification activities and frequencies with a rationale
Onsite audits by qualified auditors for SAHCODHA hazards, or a documented alternative
Review of verification results
Corrective actions for supplier failures
Records under 117.475

Common mistakes in supply-chain program responses

Writing a program but leaving purchasing and receiving unchanged
Relying on certificates of analysis or audit certificates without review
Using the same verification for every supplier regardless of risk
Approving distributors without verifying the manufacturer that controls the hazard
Forgetting allergen hazards controlled by suppliers

Example: how one response section might read

This illustrates structure only; your response must describe your own facts.

Observation 9: Your supply-chain program does not provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented. Specifically, chocolate chips used in no-bake bars are received without any verification of Salmonella control by the supplier.

Response:

Product assessment: Retained samples from the three lots of chocolate chips in inventory were tested for Salmonella and were negative. Finished product lots made with earlier chips were assessed against supplier lot records.
Approval and verification: The supplier was evaluated and approved on a stated date. Because Salmonella is a SAHCODHA hazard controlled by the supplier, its most recent onsite audit by a qualified auditor was reviewed, and annual audits will continue.
Ongoing verification: Lot certificates of analysis with method and results are reviewed for every delivery, and one lot per quarter is tested by an outside laboratory.
Receiving: The receiving procedure now rejects deliveries from suppliers not on the approved list.

Frequently asked questions

When do we need a supply-chain program?

When your hazard analysis identifies a hazard in a raw material or ingredient that will be controlled before you receive it, by your supplier or the supplier's supplier.

Can a supplier's third-party audit count?

Yes, an onsite audit conducted by a qualified auditor can be used if it meets Subpart G requirements, including consideration of FDA food safety regulations. You must review and document the results.

Does a distributor count as the supplier?

The supplier is the establishment that manufactures or processes the food, or grows or raises it. A distributor can help gather documents, but the verification must address the supplier that applies the control.

How A.P. Lyon documents help

A.P. Lyon's Supplier Approval and Control Procedure covers supplier evaluation, approval, verification and removal. The Receiving and Inspection of Incoming Materials Procedure enforces approved suppliers, and the FSMA Food Safety Plan and Preventive Controls Procedure links the program to the food safety plan. All are also available within the full food safety management system.

Documents are editable Word and Excel files and must be adapted to your materials and suppliers. Audits must be conducted by qualified auditors. A.P. Lyon does not provide food safety consulting or supplier audits.

Next steps

Identify materials with supply-chain-applied controls
Approve suppliers and choose verification by risk
Enforce approved suppliers at receiving and review results
Respond in writing within 15 business days with dates for each action

To build a complete set of procedures at a volume discount, use Build Your QMS.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.