following: (1) The hazard analysis, including the nature of the hazard,
applicable to the raw material and ingredients; (2) where the
preventive controls for those hazards are applied for the raw material
and ingredients--such as at the supplier or the supplier's supplier;
(3) the supplier's procedures, processes, and practices related to the
safety of the raw material and ingredients; (4) applicable FDA food
safety regulations and information relevant to the supplier's
compliance with those regulations, including an FDA warning letter or
import alert relating to the safety of the food; (5) the supplier's
food safety performance history relevant to the raw materials or
ingredients that the receiving facility receives from the supplier,
including available information about results from testing raw
materials or ingredients for hazards, audit results relating to the
safety of the food, and responsiveness of the supplier in correcting
problems; and (6) any other factors as appropriate and necessary, such
as storage and transportation practices (proposed Sec.  117.136(b)).
    As discussed in Response 657, Response 658, and section XLVI.A, we
have revised the regulatory text regarding use of approved suppliers to
more explicitly state that the receiving facility must approve
suppliers. The factors that must be considered in determining the
appropriate supplier verification activities are equally relevant to
approving suppliers, and the final rule requires that these factors
must be considered in approving suppliers, as well as in determining
appropriate supplier verification activities. For clarity and
consistency with terms used throughout the final

provisions for a supply-chain program, the final rule specifies ``the
entity or entities that will be applying controls for the hazards
requiring a supply-chain-applied control'' rather than ``Where the
preventive controls for those hazards are applied for the raw material
and ingredients--such as at the supplier or the supplier's supplier.''
    As discussed in Response 673, we are using the term ``supplier
performance,'' rather than ``risk of supplier,'' when discussing
factors associated with suppliers. The final rule groups three of the
proposed factors as ``supplier performance.'' As a companion change to
emphasize that ``supplier performance'' applies to all three of these
factors, we refer to the supplier's ``food safety history'' rather than
``food safety performance history.''
    We also have revised the regulatory text to clarify that
consideration of supplier performance includes, when applicable,
relevant laws and regulations of a country whose food safety system FDA
has officially recognized as comparable or has determined to be
equivalent to that of the United States and information relevant to the
supplier's compliance with those laws and regulations. We made this
change because the final rule includes several provisions that
acknowledge that some food establishments, including food
establishments that are ``suppliers'' as that term is defined in this
rule, operate in a foreign country. (See, e.g., the definition of
``qualified auditor'' in Sec.  117.3 and Sec. Sec.  117.201(a)(2)(ii),
117.201(e), 117.405(a)(2), 117.430(c), 117.435(c)(1)(ii),
117.435(c)(2), and 117.475(c)(15)). Some of these provisions (e.g.,
Sec. Sec.  117.405(a)(2), 117.430(c), 117.435(c)(1)(ii), 117.435(c)(2),
and 117.475(c)(15)) are in the requirements for a supply-chain program.
When the supplier is in a foreign country whose food safety system FDA
has officially recognized as comparable or determined to be equivalent
to that of the United States, a receiving facility may substitute the
written results of an inspection by the applicable food safety
authority for an audit, provided that certain conditions are met (see
Sec.  117.435(c)(1)(ii) and (2)).
    The final rule provides flexibility for alternative verification
requirements for certain entities (see Sec.  117.430(c), (d), and (e)).
We have revised the factors that must be considered regarding supplier
performance to reflect the flexibility the rule provides for conducting
supplier verification activities for these entities (see Sec.
117.410(d)(2)).
    (Comment 675) Some comments support the flexibility for receiving
facilities to determine the appropriate supplier verification
activities and frequency with which to conduct these activities. Some
comments state that not all of the factors that we proposed a receiving
facility consider are relevant for the process of selecting the
verification activity. These comments suggest changing the regulatory
text to require a receiving facility to consider ``both food and
supplier related risks, including the following, as appropriate'' and
then listing the factors as proposed. Other comments suggested similar
changes to the regulatory text.
    (Response 675) We disagree that some of the factors that we
proposed a receiving facility must consider are not relevant to
determining the appropriate verification activity. Every factor might
not be determinative in all cases, and our requirement merely to
consider each factor does not assume so. However, any one of these
factors could be crucial depending on the food, the hazard, and the
nature of the preventive control. We continue to consider it
appropriate to require receiving facilities to consider each of these
factors in making their determinations about the appropriate
verification activities.
    (Comment 676) Some comments ask us to clarify that the phrase ``the
nature of the hazard'' means the nature of the hazard requiring
control.
    (Response 676) We have revised the regulatory text to specify ``the
nature of the hazard controlled before receipt of the raw material or
other ingredient.'' The revised regulatory text is consistent with
regulatory text in the provisions for the preventive control management
components (see Sec.  117.140(b), which specifies ``taking into account
the nature of the hazard controlled before receipt of the raw material
or other ingredient'').
    (Comment 677) Some comments agree that a receiving facility must
consider where the preventive controls for hazards are applied for the
raw materials and ingredients, such as at the supplier or the
supplier's supplier. Other comments assert that this consideration
should not be used to determine if supplier oversight is needed. Other
comments state that it may be hard to review the procedures used by a
supplier's supplier and beyond and ask us to provide clear flexibility
regarding requirements for the content and performance of a receiving
facility's supplier program.
    (Response 677) The purpose of the requirement to consider where the
hazard is controlled is to assist a receiving facility in determining
what supplier verification activities are appropriate, not to determine
whether supplier oversight is needed. Once a receiving facility has
already determined that a hazard requiring a preventive control is
controlled before receipt of a raw material or other ingredient,
supplier oversight is needed.
    We recognize that there is need for additional flexibility
regarding conducting supplier verification activities. As discussed in
Response 657, we are providing significant additional flexibility to
address this situation in the final rule.
    (Comment 678) Some comments object to the proposed requirement to
consider applicable FDA food safety regulations and information
relevant to the supplier's compliance with those regulations, including
an FDA warning letter or import alert relating to the safety of the
food. These comments assert that it is difficult for a receiving
facility to know a supplier's compliance status, because it is not easy
to obtain this kind of information in a timely fashion. Some comments
ask us to develop an online database to house this information to help
make it easier to find. Some comments ask us to replace the broad
requirement to consider applicable FDA food safety regulations and
information relevant to the supplier's compliance with those
regulations with a narrower requirement to only consider any FDA
warning letter or import alert relating to the safety of the food.
    (Response 678) We are retaining the broad requirement to consider
applicable FDA food safety regulations and information relevant to the
supplier's compliance with those regulations. Such information is
relevant to supplier performance regardless of whether there is an
applicable warning letter or import alert. For example, if a receiving
facility purchases canned green beans to use in making vegetable soup,
it is appropriate for the receiving facility to verify that its
supplier is producing the canned green beans in accordance with part
113.
    We currently have a searchable online database for warning letters
(Ref. 91) and another searchable online database for import alerts
(Ref. 92). Both of these databases are available to the public from our
homepage at http://www.fda.gov. We also publicize actions to suspend a
facility's registration, such as in our 2012 suspension of registration
due to Salmonella contamination of nut butter and nut products
manufactured, processed, packed, and held by the facility (Ref. 93).
Under the requirement to consider supplier performance with respect to
applicable food safety

regulations, a receiving facility cannot ignore published information
relating to a supplier's compliance with applicable FDA food safety
regulations in determining the appropriate verification activities,
such as publicized information regarding suspension of registration. To
emphasize this point, we have revised the regulatory text to specify
that the applicable information includes ``other FDA compliance actions
related to food safety.'' We also have revised the regulatory text to
specify that the compliance relates to an FDA warning letter or import
alert relating to the ``safety of food,'' rather than the ``safety of
the food,'' to provide flexibility for a receiving facility to identify
information that may raise a question about a supplier's compliance
history in a more general way, rather than only with respect to a
particular food.
    (Comment 679) Some comments state we should only require
consideration of the supplier's food safety performance history
relevant to the hazards requiring control in the raw materials or
ingredients that the receiving facility receives from the supplier.
    (Response 679) Consideration of the supplier's food safety history
relevant to the raw materials or other ingredients that the receiving
facility receives from the supplier will be focused on the hazard that
the supplier is controlling because that is the food safety information
the receiving facility will consider to be most relevant and for which
the receiving facility would develop a history. The information could
indicate that certain verification activities may be more appropriate
than others for verifying the control of the hazard at that particular
supplier or provide information useful in determining a frequency for
the verification activity. However, we decline to revise the provision
to specify that consideration should be limited to the hazards
requiring control. Even though this is the most relevant information, a
facility may become aware of information with respect to a raw material
or other ingredient provided to another customer of the supplier that
may suggest the need to conduct a different verification activity. For
example, if the receiving facility is obtaining a cheese product from a
supplier that is controlling pathogens such as L. monocytogenes and
Salmonella, and becomes aware that cheeses from this supplier have been
associated with an undeclared allergen due to improper labeling, the
receiving facility would determine that it should implement
verification activities related to label control to prevent undeclared
allergens.
    (Comment 680) Some comments ask us to replace the phrase ``examples
of factors that a receiving facility may determine are appropriate and
necessary are storage and transportation'' with ``such as storage and
transportation.''
    (Response 680) We have made this editorial change.

E. Supplier Non-Conformance (Final Sec.  117.410(e))

    We proposed that if the owner, operator, or agent in charge of a
receiving facility determines through auditing, verification testing,
relevant consumer, customer or other complaints, or otherwise that the
supplier is not controlling hazards that the receiving facility has
identified as significant, the receiving facility must take and
document prompt action in accordance with Sec.  117.150 to ensure that
raw materials or ingredients from the supplier do not cause food that
is manufactured or processed by the receiving facility to be
adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act (proposed Sec.  117.136(f)).
    (Comment 681) Some comments object to the use of the word
``significant'' in this proposed provision, recommending that we
replace it with ``requiring control by the supplier.'' These comments
reason that these activities are only necessary if the receiving
facility is relying on the supplier to control the specific hazards.
    (Response 681) We have revised the regulatory text to state ``a
hazard requiring a supply-chain-applied control'' rather than
``significant.''

XLV. Subpart G: New Requirement Specifying the Responsibilities of the
Receiving Facility (Final Sec.  117.415)

    As discussed in Response 657, after considering comments we are
providing flexibility for an entity other than the receiving facility
to determine, conduct, and document the appropriate supplier
verification activities, provided that the receiving facility reviews
and assesses the entity's applicable documentation, and documents the
receiving facility's review and assessment. We are specifying that
flexibility in Sec.  117.415. We have titled this section
``Responsibilities of the receiving facility'' to emphasize the
responsibility of the receiving facility for its supply-chain program.
(See Response 657 and Response 658.) Although comments focus on
flexibility for an entity in the supply chain between the supplier and
the receiving facility to perform supplier verification activities, and
such entities are the most likely entities to be the entities
determining, conducting, and documenting supplier verification
activities, the flexibility provided by the rule is not limited to such
entities.
    The rule does, however, set some bounds on the flexibility for
determining, conducting, and documenting appropriate supplier
verification activities. For example, as discussed in Response 657 and
Response 658, only the receiving facility can approve its suppliers. As
another example, although it would not be appropriate for a supplier to
determine the appropriate supplier verification activities for itself,
we had proposed that it would be appropriate for a supplier to conduct
sampling and testing of raw materials and ingredients as a supplier
verification activity (proposed Sec.  117.136(c)(1)(ii)), and we are
retaining that provision in the final rule (see Sec.  117.415(a)(4)).
Likewise, it is common industry practice for a supplier to arrange for
an audit by a third party (Ref. 83), and the new flexibility provision
does not prohibit a receiving facility from relying on an audit
provided by its supplier when the audit of the supplier was conducted
by a third-party qualified auditor in accordance with the requirements
of the rule applicable to audits (Sec.  117.435). See Sec.  117.415 for
the full text of this new flexibility provision.

XLVI. Subpart G: Comments on Using Approved Suppliers and Determining
Appropriate Supplier Verification Activities

    We proposed requirements for the use of approved suppliers
(proposed Sec.  117.136(a)(3)(i)) and for determining and documenting
appropriate supplier verification activities (proposed Sec.
117.136(b)). See table 48 for a description of the final provisions and
the changes we have made to clarify the requirements.

  Table 48--Revisions to the Proposed Requirements for Approving Suppliers and for Determining and Documenting
                                  Appropriate Supplier Verification Activities
----------------------------------------------------------------------------------------------------------------
                                       Proposed section
     Final section designation           designation               Description                  Revision
----------------------------------------------------------------------------------------------------------------
117.420(a)........................  117.136(a)(3)(i).....  The receiving facility      Explicit statement of
                                                            must approve suppliers      this requirement.
                                                            and document that
                                                            approval.
117.420(b)(1).....................  117.136(a)(3)(i).....  Written procedures for      Explicit requirement for
                                                            receiving raw materials     written procedures.
                                                            and other ingredients
                                                            must be established and
                                                            followed.
117.420(b)(2).....................  .....................  The purpose of the written  N/A.
                                                            procedures is to ensure
                                                            that raw materials and
                                                            other ingredients are
                                                            received only from
                                                            approved suppliers (or,
                                                            when necessary and
                                                            appropriate, on a
                                                            temporary basis from
                                                            unapproved suppliers
                                                            whose raw materials or
                                                            other ingredients the
                                                            receiving facility
                                                            subjects to adequate
                                                            verification activities
                                                            before acceptance for
                                                            use).
117.420(b)(3).....................  117.136(a)(3)(i).....  Use of the written          Conforming change
                                                            procedures for receiving    associated with the
                                                            raw materials and other     explicit requirement to
                                                            ingredients must be         establish and follow
                                                            documented.                 written procedures.
117.425...........................  117.136(b)...........  Requirement to determine    N/A.
                                                            and document appropriate
                                                            supplier verification
                                                            activities.
----------------------------------------------------------------------------------------------------------------

A. Using Approved Suppliers (Final Sec.  117.420)

    We proposed to require that a supplier program include verification
activities, as appropriate to the hazard, and documentation of these
activities, to ensure raw materials and ingredients are received only
from suppliers approved for control of the hazard(s) in that raw
material or ingredient (or, when necessary and appropriate, on a
temporary basis from unapproved suppliers whose raw materials or
ingredients the receiving facility subjects to adequate verification
activities before acceptance for use) (proposed Sec.  117.136(a)(i)).
    This proposed requirement included an implicit requirement that a
facility must approve suppliers. For clarity, we make that requirement,
and documentation of that approval, explicit in the final rule. (See
Sec.  117.420(a)).
    The rule continues to require that a receiving facility ensure raw
materials and other ingredients are received only from suppliers
approved for control of the hazard(s) in that raw material or other
ingredient (or, when necessary and appropriate, on a temporary basis
from unapproved suppliers whose raw materials or other ingredients are
subject to adequate verification activities before acceptance for use),
but we revised the provision to specify that the receiving facility
must do so by establishing and following written procedures, and
require documentation that these procedures were followed. To simplify
the provisions, we also established a definition for the term ``written
procedures for receiving raw materials and other ingredients'' to mean
written procedures to ensure that raw materials and other ingredients
are received only from suppliers approved by the receiving facility
(or, when necessary and appropriate, on a temporary basis from
unapproved suppliers whose raw materials or other ingredients are
subjected to adequate verification activities before acceptance for
use), and use that term throughout subpart G. For example, a facility
could design a checklist for employees to use when raw materials and
other ingredients are delivered to the facility. We decided to specify
use of written procedures for receiving raw materials and other
ingredients in light of the flexibility the final rule provides for an
entity other than the receiving facility (such as an entity in the
supply chain between the supplier) to conduct this activity (see Sec.
117.415(a)(2)). Although we agree that such an entity can do this as a
service to the receiving facility, a written procedure is appropriate
to ensure a robust and meaningful verification. As a companion change,
we revised the associated documentation requirement to specify
documentation of use of the written procedures.
    (Comment 682) Some comments support the requirement to approve
suppliers. Other comments ask us to provide guidance for use of
unapproved suppliers on a temporary basis, because the use of
unapproved suppliers could be a high risk situation. Other comments
emphasize that if the final supplier approval process is significantly
changed compared to the proposed supplier approval process, industry
must have enough time to plan and develop supplier verification plans
and a process for unapproved sources.
    (Response 682) We will consider including guidance for use of
unapproved suppliers on a temporary basis in guidance that we intend to
issue regarding the supply-chain program. We do not believe that the
final requirements regarding the use of approved suppliers will require
increased implementation time. The principal change is to allow
flexibility for entities in the supply chain other than the receiving
facility to establish written procedures for receiving raw materials
and other ingredients and document that written procedures for
receiving raw materials and other ingredients are being followed.

B. Determining Appropriate Verification Activities (Final Sec.
117.425)

    The rule requires that a supply-chain program include determining
appropriate supplier verification activities (including determining the
frequency of conducting the activity) (see Sec.  117.410(a)(2)).
Comments that addressed the proposed provision for determining
appropriate verification activities (which provides flexibility to the
facility to determine the appropriate verification activities) did not
disagree with it. (See Comment 675.) The rule also requires that
certain factors must be considered in determining appropriate
verification activities (Sec.  117.410(d)). We discuss those factors,
and comments that addressed those factors, in section XLIV.D. Both of
these provisions (i.e., Sec.  117.410(a)(2) and Sec.  117.410(d))
derive from the proposed requirement regarding factors that must be

considered in determining appropriate supplier verification activities
(proposed Sec.  117.136(b)). To give prominence to both the
responsibility and the flexibility to determine appropriate supplier
verification activities, and emphasize the factors that must be
considered in addressing this responsibility, new Sec.  117.425
specifies that appropriate supplier verification activities (including
the frequency of conducting the activity) must be determined in
accordance with the requirements of Sec.  117.410(d).

XLVII. Subpart G: Comments on Conducting Supplier Verification
Activities for Raw Materials and Other Ingredients

    We proposed requirements applicable to conducting supplier
verification activities (proposed Sec.  117.136(c)). Most comments that
support the proposed provisions suggest alternative or additional
regulatory text (see, e.g., Comment 688, Comment 690, and Comment 695)
or ask us to clarify how we will interpret the provision (see, e.g.,
Comment 684 and Comment 685). In the following sections, we discuss
comments that ask us to clarify the proposed requirements or that
disagree with, or suggest one or more changes to, the proposed
requirements. After considering these comments, we have revised the
proposed requirements as shown in table 49.

    Table 49--Revisions to the Proposed Requirements for Conducting Supplier Verification Activities for Raw
                                         Materials and Other Ingredients
----------------------------------------------------------------------------------------------------------------
                                       Proposed section
     Final section designation           designation               Description                  Revision
----------------------------------------------------------------------------------------------------------------
117.430(a)........................  117.136(c)(1)........  Requirement to conduct one  Add reference to an
                                                            or more appropriate         additional provision
                                                            supplier verification       that provides for
                                                            activities.                 alternative supplier
                                                                                verification activities
                                                                                for shell egg producers
                                                                                that have less than
                                                                                3,000 laying hens.
117.430(b)(1).....................  117.136(c)(2)(i).....  Requirement to conduct an   N/A.
                                                            onsite audit as the
                                                            supplier verification
                                                            activity when the hazard
                                                            being controlled by the
                                                            supplier is one for which
                                                            there is a reasonable
                                                            probability that exposure
                                                            to the hazard will result
                                                            in serious adverse health
                                                            consequences or death to
                                                            humans.
117.430(b)(2).....................  117.136(c)(2)(ii)....  Exception to the            N/A.
                                                            requirement to conduct an
                                                            annual onsite audit with
                                                            a written determination.
117.430(c)........................  117.136(c)(3)........  Alternative supplier         Modify the
                                                            verification activity       regulatory text to
                                                            when the supplier is a      better align with the
                                                            qualified facility.         responsibilities of a
                                                                                qualified facility to
                                                                                submit an attestation to
                                                                                FDA about its food
                                                                                safety practices or its
                                                                                compliance with State,
                                                                                local, county, tribal,
                                                                                or other applicable non-
                                                                                Federal food safety law,
                                                                                including relevant laws
                                                                                and regulations of
                                                                                foreign countries.
                                                                                Clarify that the
                                                                                date for a receiving
                                                                                facility to obtain
                                                                                written assurance that a
                                                                                supplier is a qualified
                                                                                facility is before first
                                                                                approving the supplier
                                                                                for an applicable
                                                                                calendar year, and on an
                                                                                annual basis thereafter,
                                                                                by December 31 of each
                                                                                calendar year for the
                                                                                following calendar year.
                                                                                Provide for
                                                                                written assurance that,
                                                                                when applicable, the
                                                                                supplier is producing
                                                                                the raw material or
                                                                                other ingredient in
                                                                                compliance with relevant
                                                                                laws and regulations of
                                                                                a country whose food
                                                                                safety system FDA has
                                                                                officially recognized as
                                                                                comparable or has
                                                                                determined to be
                                                                                equivalent to that of
                                                                                the United States.
117.430(d)........................  117.136(c)(3)........  Alternative supplier         Clarify that the
                                                            verification activity       applicable farms are
                                                            when the supplier is a      ``not covered farms''
                                                            farm that is not a          rather than ``not
                                                            ``covered farm'' under      subject to part 112''
                                                            part 112 in accordance      because some of these
                                                            with Sec.   112.4(a) or     farms are subject to
                                                            in accordance with Sec.     modified requirements in
                                                            Sec.   112.4(b) and 112.5.  Sec.   112.6.
                                                                                Clarify that the
                                                                                date for a receiving
                                                                                facility to obtain
                                                                                written assurance from
                                                                                the farm about its
                                                                                status is before first
                                                                                approving the supplier
                                                                                for an applicable
                                                                                calendar year, and on an
                                                                                annual basis thereafter,
                                                                                by December 31 of each
                                                                                calendar year for the
                                                                                following calendar year.

                                                                                Clarify that the
                                                                                written assurance from
                                                                                the farm is an
                                                                                acknowledgement that its
                                                                                food is subject to
                                                                                section 402 of the
                                                                                Federal Food, Drug, and
                                                                                Cosmetic Act (or, when
                                                                                applicable, that its
                                                                                food is subject to
                                                                                relevant laws and
                                                                                regulations of a country
                                                                                whose food safety system
                                                                                FDA has officially
                                                                                recognized as comparable
                                                                                or has determined to be
                                                                                equivalent to that of
                                                                                the United States).
117.430(e)........................  N/A..................  Alternative supplier        Specify an additional
                                                            verification activity       situation where the
                                                            when the supplier is a      receiving facility can
                                                            shell egg producer that     consider an alternative
                                                            has fewer than 3,000        supplier verification
                                                            laying hens.                activity.
----------------------------------------------------------------------------------------------------------------

A. Requirement To Conduct One or More Supplier Verification Activities
(Final Sec.  117.430(a))

    With two exceptions, we proposed that the receiving facility must
conduct and document one or more specified supplier verification
activities for each supplier before using the raw material or
ingredient and periodically thereafter (proposed Sec.  117.136(c)(1)).
See section XLIV.B for a discussion of comments regarding the
appropriate verification activities (i.e., onsite audits, sampling and
testing, records review, and other appropriate supplier verification
activities based on supplier performance and the risk associated with
the raw material or other ingredient). See sections XLVII.C and XLVII.D
for a discussion of the proposed exceptions to this requirement to
conduct and document verification activities. As discussed in section
XLVII.E, the final rule provides for an additional circumstance in
which an alternative supplier verification activity may be conducted--
i.e., when the supplier is a shell egg producer that has fewer than
3,000 laying hens.

B. Requirement for an Onsite Audit as a Verification Activity When a
Hazard Has a Reasonable Probability of Resulting in Serious Adverse
Health Consequences or Death to Humans (Final Sec.  117.430(b))

    We proposed that when a hazard in a raw material or ingredient will
be controlled by the supplier and is one for which there is a
reasonable probability that exposure to the hazard will result in
serious adverse health consequences or death to humans, the receiving
facility must have documentation of an onsite audit of the supplier
before using the raw material or ingredient from the supplier and at
least annually thereafter. We also proposed that this requirement does
not apply if the receiving facility documents its determination that
other verification activities and/or less frequent onsite auditing of
the supplier provide adequate assurance that the hazards are
controlled. (Proposed Sec.  117.136(c)(2)).
    (Comment 683) Some comments support the provision for audits when
there is a reasonable probability that exposure to the hazard will
result in serious adverse health consequences or death to humans. Some
of these comments state that audits should be the default verification
activity in order to eliminate facilities choosing the lowest cost
option regardless of whether it was best for food safety. Other
comments state that audits would be the best option for facilities that
cannot visit each supplier annually and that onsite inspection can
identify problems in ways that paperwork reviews cannot.
    However, other comments oppose this requirement. Some of these
comments express concern that this requirement does not allow the
necessary flexibility for a facility to tailor an effective supplier
program based upon risk. Other comments state that annual audits are
neither the preferred nor the most effective verification measure and
express concern that the provision sets a precedent that annual audits
are the preferred or most effective verification measure and that other
verification activities often can help paint a more accurate picture of
a supplier over time. Other comments express concern that audits only
give a ``snapshot'' of a supplier's performance at a given time and ask
that we not overemphasize audits.
    (Response 683) We are retaining this provision as proposed. As we
indicated in the Appendix of our 2013 proposed preventive controls
rule, an increasing number of establishments are requiring, as a
condition of doing business, that their suppliers become certified to
food safety management schemes that involve third-party audits (78 FR
3646 at 3818-3820); republished in its entirety with corrected
reference numbers on March 20, 2013, 78 FR 17142 at 17149-17151). An
online survey of retail suppliers noted that such certification
enhanced their ability to produce safe food (Ref. 94). We agree that
onsite audits can identify problems in ways that paperwork reviews
cannot. Because an audit involves more than simply observing the
facility producing a food product, we believe it is more than just a
``snapshot'' of the supplier's programs. As discussed in Response 669,
onsite audits can include observations, records review and employee
interviews.
    The requirement to conduct an annual audit in specified
circumstances is risk-based because the specified circumstances are
limited to situations where there is a reasonable probability that
exposure to the hazard in the raw material or other ingredient will
result in serious adverse health consequences or death to humans. The
food safety controls applied by suppliers of such raw materials or
other ingredients are more important than for other types of hazards
because of the serious adverse health consequences that can occur if
the hazards are not controlled. Annual audits are required of
certification schemes that are benchmarked to the Global Food Safety
Initiative Guidance Document for GFSI recognition (Ref. 95). We
disagree that this requirement does not provide flexibility in choosing
verification activities; in recognition that other verification
activities can help paint a more accurate picture of a supplier over
time, we have provided for alternative verification activities or audit
frequencies if the receiving facility documents its determination that
other verification activities and/or less frequent onsite auditing of
the supplier provide adequate assurance that the

hazards are controlled (see Sec.  117.430(b)(2)).
    (Comment 684) Some comments ask us to define those products that
may trigger the requirement for an audit, especially with respect to
farms. These comments question how to assess whether a hazard could
result in serious adverse health consequences or death to humans.
    (Response 684) We decline this request. Any list of such products
would be extensive and it is unlikely we could capture all the
circumstances in which this could apply. Hazards for which there is a
reasonable probability that exposure to the hazard will result in
serious adverse health consequences or death to humans are those for
which a recall of a violative product posing such a hazard is
designated as ``Class 1'' under 21 CFR 7.3(m)(1). Examples of such
hazards that, in some circumstances, have resulted in serious adverse
health consequences or death to humans include pathogens or their
toxins in RTE foods and undeclared food allergens. Foods (other than
dietary supplements or infant formula) containing a hazard for which
there is a reasonable probability that exposure to the hazard will
result in serious adverse health consequences or death to humans or
animals are considered reportable foods; examples of foods FDA has
considered to present a reasonable probability of serious adverse
health consequences or death can be found in our Guidance for Industry:
Questions and Answers Regarding the Reportable Food Registry as
Established by the Food and Drug Administration Amendments Act of 2007
(Ref. 32) and (Ref. 33).
    (Comment 685) Some comments ask us to clarify the role of third-
party audits and the GAP program and ask us to allow GAPs to be a
voluntary mechanism to satisfy buyer demands for food safety
certification.
    (Response 685) Although the rule would not require a receiving
facility to hire a third party to conduct an audit, onsite audits can
include third-party audits. There are likely to be benefits for
suppliers to have a third-party audit, because the same audit may be
acceptable by multiple receiving facilities as an appropriate supplier
verification activity. For farms, GAPs audits may be viewed as an
appropriate supplier verification activity. GAPs audits and other
third-party audits would need to comply with the requirements of this
rule applicable to onsite audits (see Sec.  117.435).
    (Comment 686) Some comments assert that we should delete this
provision entirely, stating that this requirement for an audit is
``outside the scope of FSMA.'' Other comments state that manufacturing
or processing facilities should not require suppliers that are produce
farms to conduct annual onsite audits in three specified circumstances:
(1) If the farm is not subject to the produce safety standards (e.g.,
the produce is not eaten raw, or the farm is not covered because total
annual sales exclude it, because these farms are so small as to pose
minimal risk to the food supply and audits would be cost-prohibitive
for them); (2) if the farm is subject to the produce safety standards
(because these farms are already regulated); and (3) if the farm has
been GAP certified (because this would mean they were undergoing
duplicative requirements).
    (Response 686) When a supplier farm is not subject to the produce
safety standards because of low sales revenue, we have provided for
modified verification requirements (see Sec.  117.430(d)). For produce
not subject to the produce safety standards because they are rarely
consumed raw, we would not expect receiving facilities to identify
hazards requiring a preventive control that would be controlled before
receipt of the raw material or ingredient; thus such produce would not
be subject to the supply-chain program.
    We disagree that a farm should not be subject to the requirements
of the supply-chain program in this rule simply because it is subject
to the produce safety rule. The produce subject to the produce safety
rule may contain hazards that could result in serious adverse health
consequences or death to humans; unless such produce will receive a
treatment that significantly minimizes these hazards, the controls for
the hazards are those applied by the farm. GAP certification involves
an audit of the farm; as noted in Response 685, GAPs audits that comply
with the requirements of this rule may be viewed as an appropriate
verification activity, and the certification audit could serve two
purposes.
    We disagree that a requirement for an audit is ``outside the scope
of FSMA.'' See the discussion in Response 669 regarding the provision
in section 419(c)(1)(E) of the FD&C Act that the regulation issuing
standards for the safety of produce ``not require a business to hire a
consultant or other third party to identify, implement, certify
compliance with the procedures, processes and practices'' and the
provision in section 418(n)(3)(D) of the FD&C Act that the preventive
controls regulation ``not require a facility to hire a consultant or
other third party to identify, implement, certify or audit preventive
controls.'' As noted in that response, a facility is not required to
hire a third party to conduct an audit.
    (Comment 687) Some comments support the flexibility to not conduct
an annual onsite audit if the receiving facility documents its
determination that other verification activities and/or less frequent
onsite auditing of the supplier provide adequate assurance that the
hazards are controlled. Other comments question how a facility would
prove that alternative measures are equally effective as an annual
audit, when it is not known how effective an annual audit is. Other
comments assert that the provision is meaningless because a farm or
facility would not take the legal risk of verifying it has received
``adequate assurance,'' because this would be subject to an FDA
inspector's interpretation.
    (Response 687) This provision requires a facility to use a
verification activity that provides adequate assurance that a hazard is
controlled, not to determine how effective an audit is and assess
whether alternative measures are equally effective.
    As an example of using an alternative approach to an annual onsite
audit, consider the situation in which a receiving facility is part of
a larger corporation, is making trail mix, and obtains roasted peanuts
from a supplier that is a subsidiary of the corporation and is
operating under the same food safety system as the receiving facility.
The receiving facility could determine that the food safety
requirements established by the parent company and applied at the
subsidiary provide the needed assurance that Salmonella in raw peanuts
is adequately controlled. The facility could support its decision by
documenting this determination, including the procedures in effect at
the supplier and the activities used by the corporation to verify that
the subsidiary operates in accordance with corporate food safety
policies and practices to ensure that hazards are adequately
controlled.
    We disagree that the provision is meaningless because a farm or
facility would see a legal risk in using an alternative to annual
onsite audits as a supplier verification activity. First, a farm would
be a supplier and would not be the entity that would determine whether
an onsite audit or some other supplier verification activity is
appropriate. As established in Sec.  117.415, determining the
appropriate supplier verification activity would be the responsibility
of a receiving facility, and although appropriate supplier verification
activities could be

determined by another entity in the receiving facility's supply chain
as a service, the supplier verification activities could not be
determined by the supplier itself. Second, although there is always a
potential for differences in interpretation between an FDA inspector
and an inspected firm, we are establishing a new inspection paradigm
focused on whether firms are implementing systems that effectively
prevent food contamination, requiring fundamentally different
approaches to food safety inspection and compliance. For example, FDA
intends to deploy specialized investigators, backed up by technical
experts, to assess the soundness and performance of a facility's food
safety system (Ref. 12). In addition, a central element of FDA's
strategy to gain industry compliance is to help make available to
farmers, food processors, and importers--especially small businesses--
the education and technical assistance they need to understand and
implement FSMA's new prevention-oriented standards (Ref. 6). The new
inspection paradigm and the assistance and training for industry should
help minimize different interpretations between industry and
regulators.
    (Comment 688) Some comments ask us to require facilities to notify
us when they determine that an alternative to an audit is an
appropriate supplier verification activity and be able to justify and
document how an alternative verification activity provides the same
level of assurance as an onsite audit.
    (Response 688) We decline this request. We will assess a facility's
supplier verification activities during a facility inspection,
including the documentation that an alternative verification activity
provides the same level of assurance as an onsite audit.
    (Comment 689) Some comments ask us to specify the type of
documentation required for our investigators to determine when the
activities are ``in compliance with the law and sufficient to protect
public health.''
    (Response 689) We decline this request. The facility's approach to
the determination, and the applicable documentation required to support
that determination, would depend on the circumstances. For example, in
Response 687 we discuss a possible approach in a situation in which a
receiving facility is part of a corporation and obtains an ingredient
from a supplier that is a subsidiary of the corporation and is
operating under the same food safety system as the receiving facility.
Another situation could be when a receiving facility has many years of
experience with the same supplier, but the approach and documentation
in that situation likely would be different from an approach and
documentation used when the supplier and the receiving facility are
part of the same corporation.
    (Comment 690) Some comments ask that we not limit the determination
for a supplier verification activity other than an onsite audit to a
determination by the receiving facility. These comments explain that
the corporate parent of a facility can be the entity that makes this
determination. These comments suggest that we can account for the role
of the corporation by specifying that a facility documents ``the
determination'' (rather than ``its'' determination).
    (Response 690) We have agreed that the corporate parent of a
facility can be active in developing and implementing the facility's
food safety plan (see section XXIV.A). However, the specific suggestion
of these comments is not necessary to achieve the outcome requested by
the comments because of editorial changes we made to provide for
entities other than the receiving facility to determine and conduct the
appropriate supplier verification activities.

C. Alternative Verification Activity When the Supplier Is a Qualified
Facility (Final Sec.  117.430(c))

    We proposed that if a supplier is a qualified facility the
receiving facility need not comply with the specified verification
requirements if the receiving facility: (1) Documents, at the end of
each calendar year, that the supplier is a qualified facility; and (2)
obtains written assurance, at least every 2 years, that the supplier is
producing the raw material or ingredient in compliance with applicable
FDA food safety regulations and that the raw material or ingredient is
not adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act. The written assurance must include a
brief description of the processes and procedures that the supplier is
following to ensure the safety of the food.
    This rule has several provisions that require written assurances.
We have established specific elements that each of these written
assurances must include--i.e., the effective date; printed names and
signatures of authorized officials; and the applicable assurance (see
Sec.  117.335).
    We have revised the provision to clarify that the receiving
facility must have written assurance that a facility is a qualified
facility: (1) Before first approving the supplier for an applicable
calendar year; and (2) by December 31 of each calendar year (rather
than ``at the end of the calendar year'') and that the written
assurance is regarding the status of the qualified facility for the
following calendar year. By specifying ``by December 31,'' a receiving
facility can work with each applicable supplier to determine the
specific date within a calendar year for that supplier to annually
notify the receiving facility about its status. See also Response 155,
Response 592, and Response 593, the requirements in Sec.  117.201(a)
for an annual determination of the status of a facility as a qualified
facility, and the requirements in Sec.  117.201(d) that apply when the
status of a facility changes from ``qualified facility'' to ``not a
qualified facility.'' A receiving facility and its suppliers have
flexibility to approach the potential for the status of a facility to
shift between ``qualified facility'' and ``not a qualified facility''
(or vice versa) in a way that works best for their specific business
relationship.
    As discussed in section XLIV.D, we have revised the requirements
for considering supplier performance to provide that the receiving
facility may, when applicable, consider relevant laws and regulations
of a country whose food safety system FDA has officially recognized as
comparable or has determined to be equivalent to that of the United
States, and information relevant to the supplier's compliance with
those laws and regulations, rather than consider applicable FDA food
safety regulations and information relevant to the supplier's
compliance with applicable FDA food safety regulations. We have made a
conforming change to the alternative verification activities for a
qualified facility (see the regulatory text of Sec.  117.430(c)(2)).
    (Comment 691) Some comments support this alternative supplier
verification activity because it provides flexibility. Other comments
ask us to revise the provision so that it only requires that the
supplier document its status as a qualified facility. Still other
comments ask us to remove all provisions on qualified facilities
because they view these provisions as effectively adding a second layer
of regulations on produce farms, and claim this is not authorized by
FSMA. Other comments ask us to delete the requirement that the written
assurance include a brief description of the processes and procedures
that the supplier is following to ensure the safety of the food.
    (Response 691) We have revised the provisions for an alternative
verification activity for a qualified facility to better

align with the responsibilities of a qualified facility to submit an
attestation to FDA about its food safety practices (Sec.
117.201(b)(2)(i)) or its compliance with State, local, county, tribal,
or other applicable non-Federal food safety law, including relevant
laws and regulations of foreign countries (Sec.  117.201(b)(2)(ii))
(see the regulatory text of Sec.  117.430(c)). Importantly, a qualified
facility is still subject to CGMPs and the FD&C Act, and if the
qualified facility is a supplier controlling a hazard it is reasonable
for a receiving facility to expect the qualified facility to provide to
the receiving facility an assurance that reflects an attestation the
facility has made to FDA. As modified, one possibility is for a
qualified facility to provide a receiving facility with a brief
description of the preventive controls it is implementing to control
the applicable hazard, consistent with an attestation of its food
safety practices in accordance with Sec.  117.201(a)(2)(i). For
example, the qualified facility could state that its manufacturing
processes include a lethality step for microbial pathogens of concern.
As required by Sec.  117.201(f), a qualified facility that submits an
attestation to FDA about its food safety practices would have
documentation of those practices to support its attestation to FDA and,
thus, would have documentation to support its written assurance to the
receiving facility. Although a qualified facility that submits an
attestation to FDA about its food safety practices also would have
documentation of monitoring the performance of the preventive controls
to ensure that such controls are effective as required by Sec.
117.201(a)(2)(i), we are not requiring the qualified facility to
describe its monitoring of the performance of preventive controls to
ensure that they are effective. Alternatively, a qualified facility
could provide a receiving facility with a statement that the facility
is in compliance with State, local, county, tribal, or other applicable
non-Federal food safety law, including relevant laws and regulations of
foreign countries.
    We disagree that the alternative verification activity for produce
farms would add a second layer of regulations on produce farms and are
retaining this provision. See Response 693.
    (Comment 692) Some comments ask us to remove the requirement that
the written assurance be obtained at least every 2 years. Other
comments ask us to revise the purpose of the written assurance from
``the raw material or ingredient is not adulterated'' to ``the
receiving facility's use of the raw material or ingredient will not
cause the finished food to be adulterated.''
    (Response 692) We decline these requests. A supplier verification
activity needs to consider supplier performance on an ongoing basis.
Procedures and practices evolve over time, and it is appropriate for a
receiving facility that is obtaining written assurance from a supplier
as an alternative verification activity to be aware of both procedures
and practices that have changed, as well as procedures and practices
that have stayed the same. The specified timeframe for updating the
written assurance--i.e., at least every two years--is reasonable.
    A supplier can only provide assurance about raw materials and other
ingredients that it supplies to the receiving facility, not about the
food product that the receiving facility will produce using the
supplier's raw material or other ingredients.

D. Alternative Verification Activity When the Supplier Is a Produce
Farm That Is Not a ``Covered Farm'' for the Purposes of the Future
Produce Safety Rule (Final Sec.  117.430(d))

    We proposed that if a supplier is a farm that is not subject to the
requirements that we have proposed to be established in the produce
safety rule in accordance with proposed Sec.  112.4 regarding the raw
material or ingredient that the receiving facility receives from the
farm, the receiving facility does not need to comply with the
verification requirements if the receiving facility: (1) Documents, at
the end of each calendar year, that the raw material or ingredient
provided by the supplier is not subject to the produce safety rule; and
(2) obtains written assurance, at least every 2 years, that the
supplier is producing the raw material or ingredient in compliance with
applicable FDA food safety regulations and that the raw material or
ingredient is not adulterated under section 402 of the FD&C Act. See
also Sec.  117.335, which establishes specific elements that this
written assurance must include--i.e., the effective date; printed names
and signatures of authorized officials; and the applicable assurance.
    Produce farms that are not ``covered farms'' under Sec.  112.4 of
the forthcoming produce safety rule have less than $25,000 in annual
sales averaged over the previous 3-year period, or satisfy the
requirements for a qualified exemption in Sec.  112.5 and associated
modified requirements in Sec.  112.6 based on average monetary value of
all food sold (less than $500,000) and direct farm marketing (during
the previous 3-year period, the average annual monetary value of food
sold directly to qualified end users exceeded the average annual
monetary value of the food sold to all other buyers). In the 2014
supplemental human preventive controls notice, we erroneously referred
to these farms as farms ``not subject to the requirements in part
112.'' While produce farms that make less than $25,000 are not subject
to the requirements in part 112, produce farms that satisfy the
requirements for a qualified exemption are not subject to the full
requirements of part 112, but they do have certain modified
requirements that they must meet, as described in Sec.  112.6. We have
corrected the description of these farms in Sec.  117.430(d).
    We have revised the provision to clarify that the receiving
facility must have documentation that the raw material or other
ingredient provided by the supplier is not subject to part 112 in
accordance with Sec.  112.4(a), or in accordance with Sec. Sec.
112.4(b) and 112.5: (1) Before first approving the supplier for an
applicable calendar year; and (2) by December 31 of each calendar year
(rather than ``at the end of the calendar year'') and that the
documentation is regarding the status of supplier for the following
calendar year. By specifying ``by December 31,'' a receiving facility
can work with each applicable supplier to determine the specific date
within a calendar year for that supplier to annually notify the
receiving facility about its status. See also the discussion in section
XLVII.C regarding a similar revision we made when the supplier is a
qualified facility.
    (Comment 693) Some comments support the proposed alternative
supplier verification activity. Other comments support applying the
proposed alternative supplier verification activity more broadly--i.e.,
to any farm that will not be subject to part 112 (e.g., a farm that
grows wheat), stating that both small and large non-produce farms
should have the same option as farms that are exempted under Sec.
112.4. Some comments ask us to revise the alternative verification
requirements to apply to raw materials from farms that do not grow and
harvest ``produce'' as we proposed to define it in Sec.  112.3(c) so
that the alternative verification requirements would apply to grain.
Some comments assert that it is not possible to receive ``written
assurances'' of compliance from growers of grain because there is no
safety standard for grain growers, and that any such documents would be
essentially meaningless.
    Some comments ask us to revise the requirement to obtain written
assurance so that it does not apply to ``food not subject to the
requirements of part 112 of this chapter pursuant to part 112.2.''

Other comments assert that a documentation requirement for commodities
that will be exempt from the produce safety rule would increase
recordkeeping burdens without added benefit because produce that will
be exempt from the produce safety rule is low-risk.
    Some comments assert that farms should not have to provide written
assurances because the requirement is ambiguous. These comments assert
that exempt farmers are small-scale producers who are subject primarily
to state and local laws and this provision would require them to
provide written assurances that they are complying with unspecified
Federal regulations. The comments claim that, without seeking legal
counsel, many exempt farmers would be unable to provide such
assurances, limiting the ability of these farmers to market their
products to non-exempt facilities (the overwhelming majority of the
food market).
    (Response 693) We have revised the provision to specify that the
written assurance from the farm must state that the farm acknowledges
that its food is subject to section 402 of the FD&C Act (or, when
applicable, that its food is subject to relevant laws and regulations
of a country whose food safety system FDA has officially recognized as
comparable or has determined to be equivalent to that of the United
States). Any business that introduces food into interstate commerce is
subject the prohibited acts provisions in section 301 of the FD&C Act,
and is accountable if it produces food that is adulterated.
    As discussed in Response 444, new Sec.  117.136(a) allows a
manufacturer/processor to not implement a preventive control if it
determines and documents that the type of food (e.g., RACs such as
cocoa beans, coffee beans, and grains) could not be consumed without
application of the appropriate control. We believe most receiving
facilities will take advantage of this provision, and not establish
supply-chain controls under the supply-chain program in subpart G for a
number of RACs.
    This alternative supplier verification activity is intended to
minimize the burden on suppliers that are small farms. The amount of
food produced by such farms is small, and the exposure to food from
such farms therefore is low. We disagree that a written assurance from
such a farm would be meaningless. Any business that distributes food in
interstate commerce is subject to the FD&C Act, and must produce food
that is in compliance with the FD&C Act, regardless of whether FDA has
established a specific regulation governing the production of the food.
    (Comment 694) Some comments ask us to delete this alternative
supplier verification activity because they see it as a contradiction
to the traceability provisions of the Bioterrorism Act and FSMA,
because ``traceback'' is only required for ``one step back'' or for a
single supplier for a particular shipment of food.
    (Response 694) The supply-chain program that is being established
in this rule is a preventive control for the ongoing production of safe
food, not a ``traceback'' provision, established under the Bioterrorism
Act, to help address credible threats relating to food that is
reasonably believed to be adulterated and to present a threat of
serious adverse health consequences or death to humans or animals.
    (Comment 695) Some comments ask us to specify 3 options for
verification if a supplier is a farm subject to the requirements of
part 112: (1) Documentation at the end of each calendar year that the
raw material or ingredient provided by the supplier is subject to part
112; (2) written assurance, at least every 2 years, that the supplier
is producing the raw material or ingredient in compliance with
applicable FDA food safety regulations and that the raw material or
ingredient is not adulterated under the FD&C Act; or (3) evidence that
the supplier is certified to a recognized third-party GAP/GHP/GMP/HACCP
audit scheme. (We note that we are assuming that ``GHP'' is an
abbreviation for ``Good Hygienic Practice.'')
    (Response 695) We decline this request. Documenting that a raw
material or other ingredient is subject to the produce safety rule has
no bearing on whether the farm is complying with that rule to control
the hazards. With respect to all farms subject to the requirements of
part 112 providing a written assurance, as discussed in Response 693,
the amount of food produced by the small farms that could provide
written assurance to a receiving facility is small, and the exposure to
food from such farms therefore is low. We disagree that it is
appropriate to extend this alternative supplier verification activity
to larger farms because such farms provide a larger volume of produce.
    A farm that has been subject to an audit that complies with the
requirements of this rule can provide the results of the audit.

E. Alternative Verification Activity When the Supplier Is a Shell Egg
Producer That Has Less Than 3,000 Laying Hens (Final Sec.  117.430(e))

    We are establishing an additional alternative supplier verification
activity when a supplier is a shell egg producer that is not subject to
the requirements of part 118 because it has less than 3,000 laying
hens. See the regulatory text of Sec.  117.430(e). The provision is
analogous to the alternative supplier verification activity when a
supplier is a farm that meets the criteria in Sec.  117.430(d) and
would account for a very small amount of eggs in the food supply. See
also Sec.  117.335, which establishes specific elements that the
required written assurance must include--i.e., the effective date;
printed names and signatures of authorized officials; and the
applicable assurance.

F. Independence of Persons Who Conduct Supplier Verification Activities
(Final Sec.  117.430(f))

    In the 2014 supplemental preventive controls notice, we requested
comment on whether we should include in the final preventive controls
rule requirements to address conflicts of interest for individuals
conducting verification activities and, if so, the scope of such
requirements.
    (Comment 696) Some comments ask that conflict of interest
provisions not be written too broadly, and be limited to circumstances
where the individual employee carrying out the verification activities
has a direct personal financial interest in or financial ties to the
supplier (e.g., owns a substantial amount of stock in the supplier or
is personally paid directly by the supplier). Comments state that it
would not be uncommon for a receiving facility to have a shared
financial interest in the supplier (e.g., partial ownership of one by
the other or both being owned by the same parent company). Thus,
employees that have an indirect financial interest (e.g., owning stock
in a supplier because they own stock in their own company, which in
turn owns an interest in the supplier) should not be disqualified from
performing verification activities. Comments also indicate that a
laboratory analyst performing ingredient testing should not be
precluded from testing ingredients from a supplier in which the analyst
has a potential conflict of interest, as long as the analyst is not
aware of the identity of the supplier at the time the test is
performed.
    (Response 696) We are establishing a requirement that there must
not be any financial conflicts of interests that

influence the results of the verification activities listed in Sec.
117.410(b) and payment must not be related to the results of the
activity. This does not prohibit employees of a supplier from
performing the functions specified in Sec.  117.415 in accordance with
Sec.  117.415. For example, this provision would not prohibit an
employee of a supplier from conducting sampling and testing so that the
supplier could provide the results in documentation provided to the
receiving facility. The provisions would not prevent a person who is
employed by a receiving facility from having an indirect financial
interest in a supplier (e.g., if a company in which the employee owns
stock owns an interest in the supplier).
    (Comment 697) Comments ask that we not preclude a supplier from
hiring an outside party to perform onsite audits, food certifications,
or sampling and testing.
    (Response 697) We have specified that the requirements do not
prohibit a receiving facility from relying on an audit provided by its
supplier when the audit of the supplier was conducted by a third-party
qualified auditor (see Sec.  117.415(c)). We also have specified that a
supplier may conduct and document sampling and testing of raw materials
and other ingredients, for the hazard controlled by the supplier, as a
supplier verification activity for a particular lot of product and
provide the documentation to the receiving facility (see Sec.
117.415(a)(4)). This acknowledges that it is common for suppliers to
include Certificates of Analysis for tests conducted on specific lots
of product along with the shipment to the receiving facility.

XLVIII. Subpart G: Comments on Onsite Audit

    We proposed requirements that would apply to an onsite audit. Most
comments that support the proposed provisions suggest alternative or
additional regulatory text (see, e.g., Comment 698, Comment 701, and
Comment 702) or ask us to clarify how we will interpret the provision
(see, e.g., Comment 703 and Comment 704). In the following sections, we
discuss comments that ask us to clarify the proposed requirements or
that disagree with, or suggest one or more changes to, the proposed
requirements. After considering these comments, we have revised the
proposed requirements as shown in table 50.

                       Table 50--Revisions to the Proposed Requirements for Onsite Audits
----------------------------------------------------------------------------------------------------------------
   Final section designation     Proposed section designation        Description                Revision
----------------------------------------------------------------------------------------------------------------
117.435(a)....................  117.136(d)(1).................  An onsite audit of a   N/A.
                                                                 supplier must be
                                                                 performed by a
                                                                 qualified auditor.
117.435(b)....................  117.136(d)(2).................  An onsite audit must   Clarify that, when
                                                                 consider applicable    applicable, an onsite
                                                                 FDA regulations.       audit may consider
                                                                                relevant laws and
                                                                                regulations of a country
                                                                                whose food safety system
                                                                                FDA has officially
                                                                                recognized as comparable
                                                                                or has determined to be
                                                                                equivalent to that of
                                                                                the United States.
117.435(c)(1)(i)..............  117.136(e)(1).................  Substitution of        Broaden the list of
                                                                 inspection for         applicable inspections
                                                                 domestic suppliers.    to include inspections
                                                                                by representatives of
                                                                                other Federal agencies
                                                                                (such as the United
                                                                                States Department of
                                                                                Agriculture), or by
                                                                                representatives of
                                                                                State, local, tribal, or
                                                                                territorial agencies.
117.435(c)(1)(ii) and           117.136(e)(2).................  Substitution of        N/A.
 117.435(c)(2).                                                  inspection for
                                                                 foreign suppliers.
117.435(d)....................  N/A...........................  Use of a third-party   If the onsite audit is
                                                                 auditor that has       solely conducted to meet
                                                                 been accredited in     the requirements of the
                                                                 accordance with        human preventive
                                                                 regulations that       controls rule by an
                                                                 will be established    audit agent of a
                                                                 in the forthcoming     certification body that
                                                                 third-party            is accredited in
                                                                 certification rule.    accordance with
                                                                                regulations that will be
                                                                                established in part 1,
                                                                                subpart M, the audit is
                                                                                not subject to the
                                                                                requirements in those
                                                                                regulations.
----------------------------------------------------------------------------------------------------------------

A. Requirements Applicable to an Onsite Audit (Final Sec.  117.435(a)
and (b))

    We proposed that an onsite audit of a supplier must be performed by
a qualified auditor. If the raw material or ingredient at the supplier
is subject to one or more FDA food safety regulations, an onsite audit
must consider such regulations and include a review of the supplier's
written plan (e.g., HACCP plan or other food safety plan), if any,
including its implementation, for the hazard being audited (proposed
Sec.  117.136(d)). We have revised ``including its implementation'' to
``and its implementation'' to emphasize that implementation of the plan
is distinct from the plan itself (e.g., Sec.  117.126(c) establishes
the recordkeeping requirement for the food safety ``plan,'' and Sec.
117.190 lists implementation records).
    As discussed in section XLIV.D, we have revised the requirements
for considering supplier performance to provide that the receiving
facility may, when applicable, consider relevant laws and regulations
of a country whose food safety system FDA has officially recognized as
comparable or has determined to be equivalent to that of the United
States, and information relevant to the supplier's compliance with
those laws and regulations, rather than consider applicable FDA food
safety regulations and information relevant to the supplier's
compliance with applicable FDA food safety regulations. We have made a
conforming change to the requirements for an onsite audit to clarify
that an onsite audit may consider relevant laws and regulations of a
country whose food safety system FDA has officially recognized as
comparable or has determined to be equivalent to that of the United
States.
    (Comment 698) Comments support a requirement that an onsite audit
be performed by a qualified auditor, provided that we finalize
provisions (in proposed Sec.  117.136(e)) whereby an inspection by
certain authorities could substitute for an audit. Some comments ask us
to specify that the rule permits the use of audits conducted by private
third-party food safety auditing firms. Other comments ask us to
provide a list of recognized private third-party food safety schemes
and consider making third-party food safety certification to a
recognized audit scheme mandatory for all food operations that grow,
pack, hold, and manufacture/process food for

wholesale markets. Other comments ask us to further specify that FDA
will audit all food facilities no less than once every 5 years to
verify that private third-party audits are consistent with FDA audits
and findings.
    (Response 698) See our discussion in section XLVIII.B of the final
provisions governing substitution of inspection for an audit. We agree
that onsite audits may be conducted by third parties but disagree that
it is necessary to specify this in the rule. Nothing in this rule
prevents a facility from hiring a third party to conduct audits.
    We decline the requests to provide a list of recognized private
third-party food safety schemes or to make third-party food safety
certification to a recognized audit scheme mandatory for all food
operations that grow, pack, hold, and manufacture/process food for
wholesale markets. The rule provides flexibility regarding use of
third-party auditors and the information is easily obtained from other
sources. Likewise, we decline the request to specify that FDA will
``audit'' all food facilities no less than once every 5 years to verify
that private third-party audits are consistent with FDA audits and
findings. We will inspect food facilities for compliance with this
rule, not to verify the findings of a third-party audit, with a
frequency consistent with our responsibilities under the FD&C Act.
    (Comment 699) Some comments express concern about the multiple
audits that facilities are subject to each year and ask us to encourage
those subject to the rule to accept an audit performed by any of the
``bona fide authorities'' where it is warranted. Other comments note
that food manufacturers conduct their own audits and have developed
extensive expertise in doing so, and oppose any supplier verification
requirement that would affect those audits. Other comments ask us to
allow audits such as GFSI benchmark schemes to satisfy supplier
verification requirements to avoid adding a new audit to audits
currently being conducted. Some comments express concern that requiring
a new audit in addition to audits already being conducted could lead to
auditor shortages and unnecessary additional costs.
    (Response 699) We expect that a facility will adopt an approach to
audits that works best for the facility and minimizes the number of
audits conducted for the same facility. An employee of a receiving
facility may perform an audit, provided that the employee satisfies the
criteria established in the rule for qualified auditors. Under Sec.
117.3 and Sec.  117.180, a qualified auditor is a qualified individual
(as defined in Sec.  117.3) and has technical expertise obtained
through education, training or experience (or a combination thereof)
necessary to perform the auditing function. See Response 700, in which
we discuss auditor qualifications with respect to the GFSI's auditor
competency model, noting that the provisions for auditor competency for
GFSI are consistent with our definition of a qualified auditor. GFSI
schemes that consider FDA food safety regulations and include a review
of the supplier's written HACCP plan (or other food safety plan), if
any, and its implementation, with respect to the hazard being
controlled are likely to satisfy the requirements for an onsite audit.
We expect that audits being conducted for other purposes will also be
used to satisfy supplier verification audit requirements and such
audits will be adjusted as needed to conform to the requirements of
this rule.
    (Comment 700) Some comments assert that GFSI-benchmarked audits and
other similarly accredited audits should be considered equivalent to
onsite audits.
    (Response 700) See our description of GFSI in Response 496. The
GFSI guidance document requires audit scheme owners to have a clearly
defined and documented audit frequency program, which must ensure a
minimum audit frequency of one audit per year of an organization's
facility (Ref. 83), and a GFSI-compliant food safety scheme must
include procedures for conducting internal audits (Ref. 95). To be used
to satisfy the requirements of this rule, a GFSI-benchmarked audit, as
with any audit, must address all requirements of this rule, including
the requirement to consider applicable FDA food safety regulations and
include a review of the supplier's written plan (e.g., HACCP plan or
other food safety plan), if any.
    As discussed in our memorandum on supplier programs (Ref. 83), the
GFSI guidance document also specifies that the person who performs the
audit needs to be qualified to do so. As described in ``GFSI Food
Safety Auditor Competencies,'' the GFSI's auditor competency model
lists three main components for auditor competencies: (1) Auditing
skills and knowledge; (2) technical skills and knowledge; and (3)
behavior and systems thinking (Ref. 96). Within each main component,
GFSI provides details of specific tasks and the required auditor
knowledge and skills to perform the specific tasks (Ref. 96). The
provisions for auditor competency are consistent with our definition of
a qualified auditor.
    (Comment 701) Some comments ask us to delete the proposed
requirement for a review of the supplier's written plan as part of an
audit because review of the supplier's food safety plan should be part
of an overall supplier verification program when the supplier is
controlling a hazard that could cause serious adverse health
consequences or death, but should not be tied to an audit. These
comments state that receiving facilities may choose to use an
unannounced audit program where the auditor spends time focusing on the
actual conditions on the production floor, with a review of the
supplier's food safety plan being done as a separate verification
activity.
    (Response 701) We decline this request. We agree that review of an
applicable food safety plan should be part of an overall supplier
verification program and that the review of the food safety plan may be
conducted separately from the observation of actual conditions on the
production floor, provided that both are conducted within the annual
timeframe. However, we believe it important that the audit address
whether the food safety plan is being implemented as designed, and
other comments to this rule support that view. For example, as
discussed in Comment 648 regarding our inspection of a food facility,
some comments assert that our access to company records must be
conducted onsite in the course of an authorized inspection so that we
may understand the full context of what the records show. Thus, the
onsite observations and the food safety plan review cannot be entirely
separated, as the comment seems to suggest.
    We note that the requirement to include a review of the supplier's
food safety plan only applies when the supplier has a food safety plan.
For example, we did not propose a requirement for a farm that would be
subject to the forthcoming produce safety rule to have a food safety
plan.

B. Substitution of Inspection by FDA or an Officially Recognized or
Equivalent Food Safety Authority

    We proposed that instead of an onsite audit, a receiving facility
may rely on the results of an inspection of the supplier by FDA or, for
a foreign supplier, by FDA or the food safety authority of a country
whose food safety system FDA has officially recognized as comparable or
has determined to be equivalent to that of the United States, provided
that the inspection was conducted within 1 year of the date that the
onsite audit would have been required to be conducted. For inspections
conducted by the food

safety authority of a country whose food safety system FDA has
officially recognized as comparable or determined to be equivalent to
that of the United States, the food that is the subject of the onsite
audit must be within the scope of the official recognition or
equivalence determination, and the foreign supplier must be in, and
under the regulatory oversight of, such country (proposed Sec.
117.136(e)).
    (Comment 702) Some comments ask us to allow State or local
inspection reports, as well as FDA inspection reports, to substitute
for an onsite audit for small and very small facilities. Other comments
ask us to create a ``safe harbor'' provision in which a supplier
providing a copy of permits obtained from the most recent inspection
done by Federal, State, or local health authorities satisfies the
supplier verification requirement; if there are no permits, review of
relevant records and/or sampling of raw material based on scale of
production should be adequate.
    (Response 702) We have revised the regulatory text to provide for
an appropriate inspection of the supplier for compliance with
applicable FDA food safety regulations by FDA, by representatives of
other Federal agencies (such as USDA), or by representatives of State,
local, tribal, or territorial agencies. We are specifying that the
inspection must be ``appropriate'' and be conducted for compliance
``with applicable FDA regulations'' to make clear that the inspection
must be sufficiently relevant to an onsite audit to credibly substitute
for an onsite audit. For example, inspection by USDA to determine
whether a farm satisfies the requirements of the produce safety rule
could constitute an appropriate inspection that could substitute for an
audit, but an inspection by USDA to determine whether a farm satisfies
the requirements of the National Organic Program could not.
    We have not provided for substitution of a ``permit obtained from
the most recent inspection'' for an onsite audit. We do not see how a
``permit'' could shed light on whether a business is complying with
specific applicable FDA regulations. We have provided for an
alternative verification activity to the annual onsite audit (such as a
review of relevant records and/or sampling of raw material) with a
written justification (see Sec.  117.430(b)). The rule would not
preclude an appropriate review of records, or sampling and testing of
raw materials, by other Federal agencies, or by representatives of
State, local, tribal, or territorial agencies, provided that the
receiving facility satisfies the requirements for an adequate written
justification.
    (Comment 703) Some comments ask us to clarify what we mean by
``food safety authority of a country whose food safety system FDA has
officially recognized as comparable or has determined to be equivalent
to that of the United States.'' These comments also ask whether a
specific country qualifies and whether HACCP certificates issued by a
specific foreign government agency would replace an onsite audit.
    (Response 703) A country whose food safety system FDA has
officially recognized as ``comparable'' to that of the United States
would be one for which there is a signed systems recognition
arrangement or other agreement between FDA and the country establishing
official recognition of the foreign food safety system. Information on
FDA systems recognition can be found on the FDA Web site (Ref. 97). As
of March 2015, FDA only has a signed systems recognition agreement with
New Zealand, but agreements with other countries are under development.
We would not accept a HACCP certificate issued by a foreign government
as a substitute for an onsite audit, but a receiving facility could
consider whether such a certificate could be part of its justification
for conducting another supplier verification activity in lieu of an
annual onsite audit, or for conducting an audit on a less frequent
basis than annually.
    (Comment 704) Some comments ask us to clarify that the applicable
standards will be those applied by the food safety authority of a
country with a food safety system recognized as comparable or
equivalent rather than having to achieve compliance with the applicable
U.S. FDA food safety regulations.
    (Response 704) The applicable standards will be those applied by
the food safety authority of a country with a food safety system
recognized as comparable or equivalent to that of the United States.

C. Onsite Audit by a Third-Party Auditor Accredited for the Purposes of
Section 808 of the FD&C Act

    We have proposed to establish regulations (in part 1, subpart M) to
provide for accreditation of third-party auditors/certification bodies
to conduct food safety audits of foreign food entities, including
registered foreign food facilities, and to issue food and facility
certifications (78 FR 45782, July 29, 2013). The purpose of the
proposed third-party certification rule is to help us ensure the
competence and independence of third-party auditors/certification
bodies who conduct foreign food safety audits and to help ensure the
reliability of food and facility certifications, issued by third-party
auditors/certification bodies, that we will use in making certain
decisions relating to imported food, such as food certifications
required by FDA as a condition of granting admission to a food
determined to pose a safety risk.
    (Comment 705) Comments support use of third-party auditors, but
emphasize that such auditors need not be accredited under the
requirements to be established under our forthcoming third-party
certification rule.
    (Response 705) We agree that a third-party auditor who conducts an
audit as a supplier verification activity to satisfy the requirements
of this rule need not be accredited under our forthcoming third-party
certification rule. In addition, we see no reason that any requirements
of our forthcoming third-party certification rule should apply to an
audit merely because it was conducted by a person who had been
accredited under that rule. To make this clear, we have added a
provision to specify that if an onsite audit is solely conducted to
meet the requirements of this rule by an audit agent of a certification
body that is accredited in accordance with regulations in part 1,
subpart M, the audit is not subject to the requirements in those
regulations. See Sec.  117.435(d). Because Sec.  117.435(d) refers to
provisions in a future third-party certification rule, we will publish
a document in the Federal Register announcing the effective date of
Sec.  117.435(d) once we finalize the third-party certification rule.

XLIX. Subpart G: Comments on Records Documenting the Supply-Chain
Program

    We proposed to require documentation of verification activities in
records, including minimum requirements for records documenting an
audit, records of sampling and testing, and records documenting a
review by the receiving facility of the supplier's relevant food safety
records. We also proposed that the receiving facility must review such
records in accordance with the requirements applicable to review of
records as a verification activity (i.e., in accordance with Sec.
117.165(a)(4)).
    We did not receive comments on the documentation requirements
associated with a written supplier program, determination of
appropriate supplier verification activities, review of records,
supplier verification activities other than an annual onsite audit when
the

hazard being controlled by the supplier is one for which there is a
reasonable probability that exposure to the hazard will result in
serious adverse health consequences or death to humans, alternative
supplier verification activity when the supplier is a qualified
facility, substitution of inspection for an audit, or supplier
nonconformance (proposed Sec.  117.136(g)(1), (2), (7), (9), (10),
(12), and (13), respectively). We are finalizing these documentation
requirements with editorial and conforming changes associated with the
final requirements of the supply-chain program.
    The supply-chain program includes two provisions that are explicit
requirements of the final human preventive controls rule, but had been
implicit requirements of the proposed human preventive controls rule.
The first of these provisions is the explicit requirement that the
receiving facility must approve suppliers in accordance with the
requirements of Sec.  117.410(d), and document that approval, before
receiving raw materials and other ingredients from those suppliers (see
Sec.  117.420(a)). The second of these requirements is that written
procedures for receiving raw materials and other ingredients must be
established and followed (see Sec.  117.420(b)(1)). We are including in
Sec.  117.475 the documentation associated with these requirements (see
Sec.  117.475(c)(3) and (4)).
    The supply-chain program includes four provisions that were not in
the proposed human preventive controls rule: (1) A receiving facility
that is an importer can comply with the foreign supplier verification
requirements in the FSVP rule rather than conduct supplier verification
activities for that raw material or other ingredient under this rule
(Sec.  117.405(a)(2)); (2) a receiving facility may use an alternative
verification activity for a supplier that is a shell egg producer that
is not subject to the requirements established in part 118 because it
has less than 3,000 laying hens (Sec.  117.430(e)); (3) when
applicable, a receiving facility must verify a supply-chain-applied
control applied by an entity other than the receiving facility's
supplier (Sec.  117.405(c); and (4) entities other than the receiving
facility may determine, conduct, and document certain specified
supplier verification activities, provided that the receiving facility
reviews and assesses the other entity's applicable documentation, and
documents its review and assessment (Sec.  117.415). We are
establishing the associated documentation requirements in Sec.
117.475(c)(2), (14), (17), and (18), respectively.
    In the following sections, we discuss comments on the proposed
records for the supplier program. After considering these comments, we
have revised the proposed requirements as shown in table 51.

            Table 51--Revisions to the Proposed Requirements for Records for the Supply-Chain Program
----------------------------------------------------------------------------------------------------------------
                                                                                Did we revise
                                                                                the
                                                                                documentation
                                                                                requirement
                                                                                other than
                                                                            Did we receive        editorial and
Final section designation       Proposed section         Description    comments regarding the     conforming
                                  designation                            proposed requirement?       changes
                                                                                associated with
                                                                                the final
                                                                                requirements for
                                                                                the supply-chain
                                                                                program?
----------------------------------------------------------------------------------------------------------------
117.475(a)...............  N/A......................  The records       N/A...................  Consequential
                                                       documenting the                           change
                                                       supply-chain                              associated with
                                                       program are                               establishing
                                                       subject to the                            the
                                                       requirements of                           requirements
                                                       subpart F.                                for a supplier
                                                                                in subpart G
                                                                                rather than
                                                                                subpart C.
117.475(b)...............  117.136(g)...............  The receiving     Yes...................  No.
                                                       facility must
                                                       review the
                                                       records in
                                                       accordance with
                                                       Sec.
                                                       117.165(a)(4).
117.475(c)(1)............  117.136(g)(1)............  The written       No....................  N/A.
                                                       supply-chain
                                                       program.
117.136(b)(2)............  117.136(g)(3)............  Annual written    Yes...................  Shifted to be in
                                                       assurance from                            provisions
                                                       a receiving                               outside the
                                                       facility's                                framework of
                                                       customer.                                 the supply-
                                                                                chain program
                                                                                in subpart G.
117.475(c)(2)............  N/A......................  Documentation     N/A...................  N/A.
                                                       obtained from
                                                       an importer.
117.475(c)(3)............  117.136(g)(1)............  Documentation of  No....................  No.
                                                       the approval of
                                                       a supplier.
117.475(c)(4)............  117.136(g)(1)............  Written           No....................  No.
                                                       procedures for
                                                       receiving raw
                                                       materials and
                                                       other
                                                       ingredients.
117.475(c)(5)............  117.136(g)(4)............  Documentation     Yes...................  Yes.
                                                       demonstrating
                                                       use of the
                                                       written
                                                       procedures for
                                                       receiving raw
                                                       materials and
                                                       other
                                                       ingredients.
117.475(c)(6)............  117.136(g)(2)............  Documentation of  No....................  No.
                                                       the
                                                       determination
                                                       of the
                                                       appropriate
                                                       supplier
                                                       verification
                                                       activities for
                                                       raw materials
                                                       and other
                                                       ingredients.
117.475(c)(7)............  117.136(g)(5)............  Documentation of  Yes...................  Added a
                                                       the conduct of                            requirement for
                                                       an onsite audit.                          the
                                                                                documentation
                                                                                to include the
                                                                                name of the
                                                                                supplier
                                                                                subject to the
                                                                                onsite audit.
117.475(c)(8)............  117.136(g)(6)............  Documentation of  Yes...................  Specify that the
                                                       sampling and                              documentation
                                                       testing                                   include the
                                                       conducted as a                            date(s) on
                                                       supplier                                  which the
                                                       verification                              test(s) were
                                                       activity.                                 conducted and
                                                                                the date of the
                                                                                report.
117.475(c)(9)............  117.136(g)(7)............  Documentation of  No....................  Specify that the
                                                       the review of                             documentation
                                                       the supplier's                            must include
                                                       relevant food                             the general
                                                       safety records.                           nature of the
                                                                                records
                                                                                reviewed and
                                                                                conclusions of
                                                                                the review.

117.475(c)(10)...........  117.136(g)(8)............  Documentation of  Yes...................  Specify that the
                                                       other                                     other
                                                       appropriate                               appropriate
                                                       supplier                                  supplier
                                                       verification                              verification
                                                       activities.                               activities are
                                                                                based on
                                                                                supplier
                                                                                performance and
                                                                                the risk
                                                                                associated with
                                                                                the raw
                                                                                material or
                                                                                other
                                                                                ingredient.
117.475(c)(11)...........  117.136(g)(9)............  Documentation of  No....................  No.
                                                       any
                                                       determination
                                                       that
                                                       verification
                                                       activities
                                                       other than an
                                                       onsite audit,
                                                       and/or less
                                                       frequent onsite
                                                       auditing of a
                                                       supplier,
                                                       provide
                                                       adequate
                                                       assurance that
                                                       the hazards are
                                                       controlled when
                                                       a hazard in a
                                                       raw material or
                                                       other
                                                       ingredient will
                                                       be controlled
                                                       by the supplier
                                                       and is one for
                                                       which there is
                                                       a reasonable
                                                       probability
                                                       that exposure
                                                       to the hazard
                                                       will result in
                                                       serious adverse
                                                       health
                                                       consequences or
                                                       death to humans.
117.475(c)(12)...........  117.136(g)(10)...........  Documentation of  No....................  Provide for
                                                       an alternative                            documentation,
                                                       verification                              when
                                                       activity for a                            applicable, of
                                                       supplier that                             a written
                                                       is a qualified                            assurance that
                                                       facility.                                 the supplier is
                                                                                producing the
                                                                                raw material or
                                                                                other
                                                                                ingredient in
                                                                                compliance with
                                                                                relevant laws
                                                                                and regulations
                                                                                of a country
                                                                                whose food
                                                                                safety system
                                                                                FDA has
                                                                                officially
                                                                                recognized as
                                                                                comparable or
                                                                                has determined
                                                                                to be
                                                                                equivalent to
                                                                                that of the
                                                                                United States.
117.475(c)(13)...........  117.136(g)(11)...........  Documentation of  Yes...................  No.
                                                       an alternative
                                                       verification
                                                       activity for a
                                                       supplier that
                                                       is a farm that
                                                       supplies a raw
                                                       material or
                                                       other
                                                       ingredient that
                                                       would not be a
                                                       covered farm
                                                       subject to the
                                                       forthcoming
                                                       produce safety
                                                       rule.
117.475(c)(14)...........  N/A......................  Documentation of  N/A...................  N/A.
                                                       an alternative
                                                       verification
                                                       activity for a
                                                       supplier that
                                                       is a shell egg
                                                       producer that
                                                       is not subject
                                                       to the
                                                       requirements
                                                       established in
                                                       part 118
                                                       because it has
                                                       less than 3,000
                                                       laying hens.
117.475(c)(15)...........  117.136(g)(12)...........  The written       No....................  No.
                                                       results of an
                                                       appropriate
                                                       inspection of
                                                       the supplier
                                                       for compliance
                                                       with applicable
                                                       FDA food safety
                                                       regulations by
                                                       FDA, by
                                                       representatives
                                                       of other
                                                       Federal
                                                       agencies (such
                                                       as USDA), or by
                                                       representatives
                                                       from State,
                                                       local, tribal,
                                                       or territorial
                                                       agencies, or
                                                       the food safety
                                                       authority of
                                                       another country
                                                       when the
                                                       results of such
                                                       an inspection
                                                       is substituted
                                                       for an onsite
                                                       audit.
117.475(c)(16)...........  117.136(g)(13)...........  Documentation of  No....................  No.
                                                       actions taken
                                                       with respect to
                                                       supplier non-
                                                       conformance.
117.475(c)(17)...........  N/A......................  Documentation of  N/A...................  N/A.
                                                       verification of
                                                       a supply-chain-
                                                       applied control
                                                       applied by an
                                                       entity other
                                                       than the
                                                       receiving
                                                       facility's
                                                       supplier.
117.475(c)(18)...........  N/A......................  When applicable,  N/A...................  N/A.
                                                       documentation
                                                       of the
                                                       receiving
                                                       facility's
                                                       review and
                                                       assessment of
                                                       documentation
                                                       of a supplier
                                                       verification
                                                       activity
                                                       provided by a
                                                       supplier or by
                                                       an entity other
                                                       than the
                                                       receiving
                                                       facility.
----------------------------------------------------------------------------------------------------------------

A. Applicability of the Recordkeeping Requirements of Subpart F

    We have added new Sec.  117.475(a) to specify that the records
documenting the supply-chain program in subpart G are subject to the
requirements of subpart F. Under the proposed human preventive controls
rule, the documentation requirements would have been in subpart C, and
the applicability of subpart F was specified in Sec.  117.190 in
subpart C. The new provision specifying the applicability of subpart F
to the records associated with the supply-chain program is a
consequential change associated with establishing the requirements for
a supply-chain program in subpart G, rather than in subpart C.

B. Requirement To Review Records of the Supply-Chain Program (Final
Sec.  117.475(b))

    We proposed that a receiving facility must review records
documenting the supplier program in accordance with the requirements
applicable to review of records as a verification activity (i.e., in
accordance with Sec.  117.165(a)(4)). (Proposed Sec.  117.136(g))
    (Comment 706) Some comments ask us to provide consideration for
records associated with the supplier program to be administered and
maintained at corporate headquarters rather than at individual
facilities, because this is common industry practice.
    (Response 706) We are aware that certain programs are administered,
and records are maintained, at corporate headquarters rather than at
individual facilities. The rule provides that offsite storage of
records is permitted if such records can be retrieved and provided
onsite within 24 hours of request for official review and electronic
records are considered to be onsite if they are accessible from an