The supply chain for food and beverage companies has grown to be truly global and interconnected. To offer customers exciting new flavors, products, and ingredients, many businesses have expanded their geographic reach of sourcing ingredients and materials.

Entering into this vast network of different suppliers means companies could be opening themselves up to more risks. The U.S. Food and Drug Administration (FDA) recognized these complexities and possible problems in the supply chain when developing the Food Safety Modernization Act (FSMA). As a result, regulators are now requiring companies to take increased measures to ensure the safety of their food.

However, food and beverage businesses still must control costs to stay competitive, making maintaining the efficiency and performance of their supply chain also crucial. The entire end-to-end process must be strategically planned and systematically managed with an acute emphasis on mitigating any risks from suppliers. The following are some best practices food and beverage companies can use to better protect themselves from any food safety and quality incidents.  

Identifying Supply Chain Risks
Companies must start with evaluating their current processes to manage supply chain risks. For instance, are audits relied upon to verify their suppliers have appropriate food safety practices in place? Or are second- or third-party audits conducted?

Is the testing program in-house? Are certificates of analysis (COAs) relied upon? Where and how is that information collected and tracked? What departments and staff are in charge of the supply chain—R&D, finance, operations, QA, etc.?

Taking a critical look at supply chain management will not only allow risks to be identified but will also unlock the ability to differentiate which risks have the greatest potential impact. Oftentimes, food and beverage companies wonder whether they should devote more resources to managing high-risks areas than low-risk areas, and the answer is yes. Nearly everything food companies do today must be risk based.

FSMA and Supply Chain Control
Because FDA recognized that supply chain control is critical in terms of managing food safety risks, it developed two key rules under FSMA to address this area—the Preventive Controls rule and the Foreign Supplier Verification Program (FSVP).

Food and beverage manufacturers subject to the Preventive Controls rule must assess supply chain risks and then verify that the risks are being controlled. If it is determined that the supplier is responsible for controlling the risk, the purchasing company must be able to verify that the supplier is doing so effectively.

FSMA’s FSVP is very similar to the Preventive Controls rule, with the exception that it shifts the burden of ensuring safe food to importers. It is therefore FDA’s expectation that importers will have assessed risks in the supply chain and subsequently have verified that risks are being controlled.

While these rules are conceptually simple, many companies still face confusion around their implementation. Here are some steps that will help ensure companies are compliant with the regulations:

1. Perform a Hazard Analysis: Look at hazards presented by the materials sourced in all three areas: ingredients, products, and packaging.

2. Evaluate the Risks: Identify the types of risks posed, including whether they are microbiological, chemical, or physical. The next step is to identify who is responsible for controlling the risk: the supplier, the processor, or the end customer. FSMA requires a letter of assurance from any customer assuming responsibility for controlling the risk.  

3. Supplier Verification: If it has been determined that the supplier is controlling the risk, this will need to be verified.

4. Use of Approved Suppliers: FDA can request to see companies’ lists of approved suppliers and the method used to select and approve suppliers.

5. Corrective Actions: If there is a problem with a supplier, corrective actions must be carried out appropriately and thoroughly documented.

6. Build a Program and Keep Records: Detailed recordkeeping is a common theme across many aspects of FSMA, so confirm that records are updated regularly and are well organized.

Developing a FSMA Approach to Risk Management
When beginning a practical implementation of a FSMA approach to supply chain risk management, create a list of all ingredients used as well as products and primary packaging. Next, perform a Hazard Analysis and document the results in records that can be presented to FDA. Finally, assign responsibility to who will control the risks identified.

To begin a supplier verification program, compile a list of all suppliers and their manufacturing sites. For all Class 1 risks being controlled by the supplier, an onsite audit will be needed from each site sourced. Many companies rely on third-party audits to satisfy this requirement, but proper documentation should be put in place.

Because Global Food Safety Institute (GFSI) standards are well-aligned with FSMA, GFSI certification appears to satisfy FDA requirements. If an onsite audit for Class 1 risks is not able to be conducted, documentation will be needed of the explanation for this as well as how the risk will be controlled through an alternative method, such as a testing program.