Supplier Controls for Prevention of Food Safety Recalls

The Preventive Controls for Human Foods Regulation requires food companies to develop and implement a risk-based Food Safety Plan.
Supplier Controls for Prevention of Food Safety Recalls - Articles


The Preventive Controls for Human Foods Regulation requires food companies to develop and implement a risk-based Food Safety Plan.

In this Food Safety Plan, companies must conduct a hazard analysis, determine potential hazards and implement preventive controls that will prevent, reduce or eliminate those hazards. In addition to process controls (previously called critical control points, or CCPs), additional controls must also be considered, including sanitation preventive controls, allergen preventive controls and supply chain preventive controls. A recall plan is also required.

Penn State's Extension Food Safety and Quality Team has been conducting training for food industry professionals to become Preventive Controls Qualified Individuals (PCQI). This designation gives these people the necessary training to be able to prepare and alter their company's food safety plan. Through the training we have conducted thus far, we have had the opportunity to discuss how people plan to develop and implement these preventive controls. Our interactions with hundreds of food professionals have exposed some challenges that people are experiencing as they begin the process of plan development. From our discussions, supply chain preventive control appears to be the one that poses some interesting challenges, if not properly addressed.

The three primary challenges with the supply chain preventive controls are:

  1. Incorporating the risk level for a given hazard and establishing appropriate controls for the given risk level of that hazard.
  2. Understanding all facets of a very com­plex supply chain, primarily upstream suppliers or the suppliers of the supplier.
  3. The need to establish emergency supplier procedures to follow when an alternative supply is required.

Increasing risk requires increasing control

One of the first goals when completing the hazard analysis is to determine potential hazards in the ingredients. Potential hazards are defined as any biological, chemical (including radiological) or physical hazards that are known to be, or have the potential to be, associated with the facility or the food. As this is being done, the risk of each hazard is determined, evaluating the severity of the hazard and the likelihood of occurrence. That is, the greater the severity of that hazard and the greater the chance of it occurring, the greater the risk. For example, raw chicken would be a greater risk for Salmonella than cooked chicken.

When ingredients have potential hazards with sufficient risk, a preventive control is required. So, the final goal of the hazard analysis exercise is to determine how that risk is going to be prevented. Will that risk be controlled by the supplier; will it be controlled by the purchasing facility's own process, or will it be controlled by the customer? For those ingredients with potential risks that must be controlled by the supplier, there must be a supply chain preventive control.

Supply chain preventive controls can be accomplished by a combination of different procedures. These include:

  • Third­ party audits where another company is contracted to do the audit.
  • Customer audits where the purchasing company completes the audit itself.
  • Testing by the supplier with issuance of a certificate of analysis (COA), e.g., testing the ingredient by the purchasing company to verify that COA.
  • Evaluation of past government inspection records including any issued FDA 483 reports.
  • Providing production records, etc.

Regardless of the risk, a specification and a letter of guarantee from all suppliers are needed.

The higher the risk of the hazard to be controlled by the supplier, especially for those suppliers that are less known to us, the higher the number of procedures that are needed. For example, if you have been buying mushroom compost from a well-known supplier for the past 20 years, a COA for each lot with occasional internal verification testing, along with a third-party audit, may be sufficient. However, if a "new-to­ the-industry" compost supplier is under consideration as an approved supplier, the purchasing company should consider conducting its own audit, coupled with a heightened level of sampling and testing of each lot as it arrives.

It is important to recognize that a COA and a third-party audit may not, by themselves, constitute a solid supply chain preventive control. A COA, depending on how the sample was taken and tested, may not provide sufficient evidence that the lot is free of the hazard. Third-party audits also have limitations. Depending on the auditor, these audits may not provide an adequate look at the sufficiency of the process making that product. Third-party audits are fine for getting a snapshot of a company's Good Manufacturing Program (GMP) and whether a company is following the Hazard Analysis Critical Control Point (HACCP) plan; but, if the fundamental process is flawed, an audit may not pick this up. There are many examples where audits were not able to find system flaws, including the case involving the cantaloupe outbreak in 2011. In this case, the company received a good audit score, only to discover later that a flawed process resulted in Listeria contamination of the cantaloupes.

So, when developing the supply chain preventive controls, it is important to look beyond just receiving COAs and third­ party audit results. Depending upon the supplier and the risk of the hazard, additional procedures including COA verification testing, on-site audits and review of the supplier's pro­duction records may need to be included.

Only be as good as your supplier's supplier

Today, commodities can move through one or more middlemen who may process, repackage or mix lots before they are sold by the supplier to you. If your supplier is bringing in product from a multitude of different channels, then a food safety lapse by any one of these middlemen may impact your product.

The best way to demonstrate this issue is through reviewing a recent case involving frozen vegetables and Listeria contamination. A Washington state producer of frozen vegetables, we’ll call Firm A, was selling bulk product to other companies that would repack those vegetables with branded labels. Firm A was also packing product for sale for its own retail customers under several different store brands. To meet sales demand, this firm relied on other frozen produce companies to provide them bulk frozen product which they then resold as their own. Unfortunately, one of these bulk suppliers, Firm B, had a Listeria contamination issue. So, while there were companies who had audited Firm A, and had even received COAs for the lots they purchased, these customer companies were pulled into a recall situation when this Firm A packed product was tested and found positive for Listeria. This contaminated product was bulk product provided by their supplier, Firm B.

As control is moved further upstream, assurance that a product is without issue can become more difficult. It is therefore, important to understand how suppliers, specifically those tasked with controlling riskier hazards, manage their own supply chain. Do they have the capacity to produce all products internally or are they supplementing their own product with bulk product produced by someone else? For the ingredients purchased, are they requiring their supplier to control specific hazards?

Understanding how your suppliers work can help determine which restrictions you may want that company to follow, or whether you want to use that supplier at all. For example, if you have a company co-packing mushrooms, you can require that this supplier only use mushrooms that they have grown themselves.

Emergency Supplier

There are times when a currently approved supplier just can't get you an ingredient, or when your sales demand goes beyond your ability to produce and then you must rely on another company to help fill sales demand. If an alternate supplier has not already been identified and approved, this situation can put your company in a position where you either forgo the sales opportunity or need to quickly approve a supplier with whom you may have little history.

The best way to plan for this type of scenario is to have pre-approved secondary suppliers and co-packers. For each of these vendors, you would have all the updated documentation as required in your Supplier Control Plan. Depending on the supplier and the item being purchased, you may also require additional supply chain controls, including instituting a tighter sampling and testing protocol during the initial transactions

But it is not always easy to have pre-approved secondary suppliers in place for every product. Regardless, consideration should be given to writing an emergency supplier approval protocol. The protocol should incorporate tighter supply chain actions, as the risk for the hazards increases, or when the supplier is not as well known. Depending on the ingredient and the risk of the hazard, an on-site audit, additional sampling and testing, and evaluation of a lot upon receipt may be required in addition to the normal documentation. In some cases, local oversight of the production of the lot of material being purchased may be warranted.


Enacting appropriate supply chain controls is not only important from a regulatory compliance perspective, but well­ developed and executed protocols can help prevent supplier issues from causing recalls of your own product. As these supply chain preventive controls are developed, they should incorporate monitoring and verification procedures that consider the increased risk of the hazard for that ingredient. It is important to understand your suppliers, including their own supply network.

As part of your company's supply chain program, develop procedures to handle emergency supplier situations. Don't let a supplier's lack-of-control issue become your recall.

Originally printed in Mushroom News Magazine, September 2016. Article updated August 2018.