must be retained at the facility as long as necessary to support the
status of a facility as a qualified facility during the applicable
calendar year.
    (Comment 644) Some comments ask us to delete the proposed
requirement to keep records on site for 6 months or 2 years (depending
on the record) and assert that it should suffice to require that
records be available within 24 hours of request or within a reasonable
period of time. Some comments assert that a facility should be able to
keep records in the location where they are created, which may be at
corporate headquarters. Comments also assert that specifying the
location for record storage will increase costs but will not contribute
to improvements in public health. Some comments ask us to permit off-
site storage for all records more than 6 months old, in contrast to the
2-year retention period we proposed for records relating to the general
adequacy of equipment or processes being used by a facility, including
the results of scientific studies and evaluations.
    (Response 644) We have revised the provisions to provide for
offsite storage of all records (except the food safety plan), provided
that the records can be retrieved and made available to us within 24
hours of request for official review. We expect that many records will
be electronic records that are accessible from an onsite location and,
thus, would be classified as being onsite (see Sec.  117.315(c)). As a
companion change, we have revised the proposed provision directed to
the special circumstance of storing records when a facility is closed
for prolonged periods of time so that it only relates to the offsite
storage of the food safety plan in such circumstances (see Sec.
117.315(d)).
    (Comment 645) Some comments assert that a two year retention period
for records is much longer than needed for a product with a short shelf
life (such as milk) and may not be long enough for products with very
long shelf lives (such as oils). These comments ask us to establish a
retention period that is risk-based and related to the shelf life of
the product rather than ``one-size-fits-all.'' As an example, these
comments suggest that we could set the retention requirement as 2 years
past the date of manufacture or 1 year past an ``expiration'' date,
whichever is longer. These comments also suggest that documentation on
raw materials could be maintained for two years after final product lot
is manufactured.
    (Response 645) We decline these requests. The proposed 2-year
retention period is authorized by the statute (see section 418(g) of
the FD&C Act). Moreover, the reasons discussed by the comments for
linking the retention period to shelf life are more relevant to the
record retention requirements for the purpose of tracking potentially
contaminated food (21 CFR part 1, subpart J; see Sec.  1.360) than to
the record retention requirements for the purpose of evaluating
compliance with this rule.
    (Comment 646) Some comments ask us to require that qualified
facilities keep financial and sales records for 3 or 4 years, because a
qualified facility must document that the average value of food it sold
during the prior 3 years did not exceed $500,000 annually.
    (Response 646) We have revised the record retention provisions to
specify that records that a facility relies on during the 3-year period
preceding the applicable calendar year to support its status as a
qualified facility must be retained at the facility as long as
necessary to support the status of a facility as a qualified facility
during the applicable calendar year. As discussed in Response 155, the
definition of very small business established in this rule is based on
an average (of sales plus market value of human food held without sale)
during the 3-year period preceding the applicable calendar year. Thus,
both of the criteria for the qualified facility exemption are based on
financial records associated with the preceding 3-year period. The
actual retention time necessary to support the status of a qualified
facility during the

applicable calendar year could be as long as 4 years. For example, if
we inspect a facility on May 1, 2024, the facility would have retained
the records from 2021-2023 for 3 years and 4 months. If we inspect the
facility on December 28, 2024, the facility would have retained the
records from 2021-2023 for nearly 4 years.

E. Proposed Sec.  117.320--Requirements for Official Review

    We proposed that all records required by proposed part 117 be made
promptly available to a duly authorized representative of the Secretary
of HHS upon oral or written request. We asked for comment on whether we
should require a facility to send records to us rather than make the
records available for review at a facility's place of business and, if
so, whether we should require that the records be submitted
electronically.
    (Comment 647) Some comments assert that we should not copy
documents as part of routine investigations so as to prevent critical
documents from release under the Freedom of Information Act (FOIA).
These comments are particularly concerned that our ability to copy
verification records (such as testing records) and potentially release
these records under the FOIA would discourage facilities from testing
as a verification activity. These comments also express concern that
some facilities would include in their food safety plans elements, not
required by the proposed rule, that address food defense as well food
safety, and that disclosure of such a food safety plan without proper
redaction could provide useful information to persons seeking to defeat
the facility's food defense strategies. In addition, these comments
express concern that the task of reviewing all of these records and
redacting trade secrets and confidential information would further set
back FDA's already overburdened FOIA offices and create even longer
delays in responding to FOIA requests.
    As discussed in Comment 649, some comments suggest that we revise
the proposed public disclosure requirements (proposed Sec.  117.325) to
be analogous to the public disclosure requirements in our HACCP
regulations for seafood and juice (see Sec. Sec.  123.9(d) and
120.12(f), respectively).
    (Response 647) We have revised the proposed requirement to specify
that all required records must be made promptly available ``for
official review and copying'' to increase the alignment of the
recordkeeping requirements of this rule with those of our HACCP
regulations for seafood and juice. The issues raised by these comments
are similar to some of the issues raised by comments during the
rulemaking to establish our HACCP regulations for seafood (see the
discussion at 60 FR 65096 at 65137-65140, December 18, 1995) and our
regulations in part 118 for the prevention of Salmonella Enteritidis in
shell eggs. We intend to copy records on a case-by-case basis as
necessary and appropriate. We may consider it necessary to copy records
when, for example, our investigators may need assistance in reviewing a
certain record from relevant experts in headquarters. If we are unable
to copy the records, we would have to rely solely on our investigators'
notes and reports when drawing conclusions. In addition, copying
records will facilitate follow-up regulatory actions. We primarily
intend to copy records such as the results of product testing or
environmental monitoring when we conduct an inspection for cause--e.g.,
as a result of an outbreak investigation, violative sample results, or
follow up to a consumer complaint. See Response 650 for a discussion of
how the FOIA would apply to records, such as records of testing as a
verification activity, that we copy during an inspection and maintain
in our system.
    See also Response 649 for a discussion of how the public disclosure
requirements of this rule align with those of our HACCP regulations for
seafood and juice.
    (Comment 648) Some comments strongly oppose any requirement for
submission of records to FDA remotely and assert that there is no basis
in FSMA for such a requirement. Some comments express concern about our
ability to protect confidential information (such as supplier and
customer records received by a facility under the protection of
confidentially agreements) that is transmitted electronically (e.g.,
the information might be released through computer hacking or leaks).
Some comments note that inadvertent disclosure of information related
to specific products, hazards, and preventive controls implemented at
food facilities could both prove harmful from a commercial or
competitive standpoint and expose existing vulnerabilities in the U.S.
food supply, thus potentially rendering food facilities susceptible to
malicious attack.
    Some comments oppose the concept of a ``desk audit'' whereby our
investigators conduct their inspections from a remote office without
actually visiting the facility and assert that our access to company
records must be conducted on-site in the course of an authorized
inspection so that we may understand the full context of what the
records show. Some comments point out that there would be challenges
associated with credential validation when we asked for records to be
sent remotely, such as in an email request. Some comments ask that we
modify the proposed requirement to specify that records would only be
made available to us during a facility inspection.
    (Response 648) We have decided not to establish any requirements
for a facility to send records to us. We will review records when we
are onsite in the course of an authorized inspection, and copy records
as necessary and appropriate. (See also Response 647.)
    We are not modifying the proposed requirement to specify that
records would only be made available to us during a facility inspection
because it is not necessary to do so. The regulatory text specifying
that the records be made available to a duly authorized representative
of the Secretary of Health and Human Services provides the context that
the records would be made available during inspection.

F. Proposed Sec.  117.325--Public Disclosure

    We proposed that records required by proposed part 117 are subject
to the disclosure requirements under part 20 (21 CFR part 20).
    (Comment 649) Some comments assert that the proposed requirements
governing public disclosure are not aligned with other risk-based
preventive controls programs, such as HACCP programs. These comments
argue that the proposed requirements should be realigned with other
risk-based preventive controls programs to preserve the privacy of
information maintained in required records unless that information has
been otherwise made publicly available. Some comments suggest that we
revise the proposed requirements to be analogous to the public
disclosure requirements in our HACCP regulations for seafood and juice
(see Sec. Sec.  123.9(d) and 120.12(f), respectively). One comment
acknowledged our statements that the proposed requirements governing
public disclosure are consistent with, but framed differently than, the
disclosure provisions of our HACCP regulations for seafood and juice
(79 3646 at 3783), but nonetheless asks us to provide a more detailed
explanation of how our proposed approach is consistent with the
disclosure provisions in our HACCP regulations for seafood and juice.
    (Response 649) We disagree that the proposed provisions governing
public disclosure are not aligned with the

public disclosure provisions of our HACCP regulations for seafood and
juice. Our regulations in part 20 regarding public information apply to
all agency records, regardless of whether a particular recordkeeping
requirement says so. In the case of the recordkeeping requirements for
our HACCP regulations for seafood and juice, we framed the provisions
regarding public disclosure by providing specific details about how
particular provisions in part 20 (i.e., Sec.  20.61 (Trade secrets and
commercial or financial information which is privileged or
confidential) and Sec.  20.81 (Data and information previously
disclosed to the public)) would apply to the applicable records,
because we recognized that such details were of particular interest to
the regulated industries. In the case of the recordkeeping requirements
for this rule, we framed the provisions regarding public disclosure by
more broadly referring to all the requirements of part 20, consistent
with our more recent approach for framing the provisions regarding
public disclosure in the rule ``Prevention of Salmonella Enteritidis in
Shell Eggs During Production, Storage, and Transportation'' (part 118;
see Sec.  118.10(f)). For example, provisions such as Sec.  20.20
(Policy on disclosure of Food and Drug Administration records) apply to
all records that we have in our system, including HACCP records, even
though the HACCP regulations do not specify that this is the case.
    As discussed in Response 647, to increase the alignment between
this rule and our HACCP regulations for seafood and juice, we have
revised the proposed requirement regarding our access to records to
specify that all required records must be made promptly available ``for
official review and copying.''
    (Comment 650) Some comments ask us to clarify that the disclosure
requirements of part 20 include protections for trade secrets and
privileged or confidential commercial information and financial
information. Other comments ask us to clarify that written food safety
plans and associated records are not subject to public disclosure
because they represent trade secret or confidential commercial
information. Other comments ask us to clarify how the disclosure
requirements of part 20 would apply to verification records (such as
testing records).
    (Response 650) The questions raised in these comments are similar
to some of the questions raised during the rulemaking to establish our
HACCP regulation for seafood (see the discussion at 60 FR 65096 at
65137-65140). Our experience in conducting CGMP inspections in
processing plants, our experience with enforcing our HACCP regulations
for seafood and juice, and our understanding from the FRIA for this
rule make it clear that food safety plans will take each facility some
time and money to develop. Thus, we conclude that food safety plans
generally will meet the definition of trade secret, including the
court's definition in Public Citizen Health Research Group v. FDA, 704
F.2d 1280 (D.C. Cir. 1983). Plans that incorporate unique regimens or
parameters to achieve product safety, which are the result of
considerable research and effort, will surely meet this definition.
    Moreover, there is value in a plan to a company that produces it
for no other reason than that it took work to write. The equity in such
a product is not readily given away to competitors. We expect that
plant configurations will be unique to individual processors, or at
least have unique features, as was the case in the seafood industry
(Ref. 88). While generic plans will have great utility in many
circumstances, they serve primarily as starting points for processors
to develop their own plans. Facilities will still need to expend time
and money to tailor a generic plan to their individual circumstances.
    We would establish the status of verification records, such as the
results of product testing and environmental monitoring, as available
for, or protected from, public disclosure on a case-by-case basis. As
discussed in Response 647, we primarily intend to copy such records
when we conduct an inspection for cause. We also intend to copy such
records if the preliminary assessment by our investigator during a
routine inspection is that regulatory follow-up may be appropriate
(e.g., if these records demonstrate that an environmental pathogen has
become established in a niche environment in a food processing plant).
    (Comment 651) Some comments assert that our regulations in
Sec. Sec.  20.47 and 20.48 require us to consult with the entity
providing information prior to disclosing such information. These
comments ask us to provide a small business compliance guide that would
allow smaller entities to understand our procedures for publicly
disclosing information, including information maintained in records
required by this rule, to allow opportunity for redaction of
``confidential'' information prior to disclosure.
    (Response 651) We disagree with the comments' interpretation of
Sec. Sec.  20.47 and 20.48. Section 20.47 requires consultation with
the person providing data or information only when the confidentiality
of data or information is uncertain. During any such consultation FDA
would provide any necessary information to the person who provided the
data or information at issue.
    (Comment 652) Some comments ask us to modify the proposed
requirement to clarify that it is ``records required by this part and
provided to the Agency,'' rather than ``records obtained by the
Agency'' that are subject to public disclosure.
    (Response 652) We agree that it is appropriate to specify that the
disclosure requirements of this rule apply to information that we
maintain as a record (see the description of ``record'' in Sec.
20.20(e)). (See also the discussion (in the proposed rule to establish
our seafood HACCP regulation, 59 FR 4142 at 4160, January 28, 1994)
that there are significant legal and practical questions as to whether
FDA has the authority to require disclosure of industry records that
are not in FDA's possession.) However, we see no meaningful distinction
between records ``provided to FDA'' and records ``obtained by FDA,''
and have revised the provision to specify that records obtained by FDA
in accordance with this part are subject to the disclosure requirements
under part 20. The revised regulatory text makes clear that the
requirements of Part 20 attach to those documents obtained by FDA. To
the extent that these comments are addressing the difference between
records provided during inspection and records submitted to us, as
already discussed we have decided not to require submission of certain
records to us (see Response 648).

G. Proposed Sec.  117.330--Use of Existing Records

    We proposed that existing records (e.g., records that are kept to
comply with other Federal, State, or local regulations, or for any
other reason) do not need to be duplicated if they contain all of the
required information and satisfy the requirements of subpart F.
Existing records may be supplemented as necessary to include all of the
required information and satisfy the requirements of subpart F. We also
proposed that the information required by part 117 does not need to be
kept in one set of records. If existing records contain some of the
required information, any new information required by part 117 may be
kept either separately or combined with the existing records.
    Comments that address this proposed requirement support it. For
example, some comments state that this provision would provide
flexibility to facilities to

comply with the record requirements in an efficient manner. Other
comments state that this provision would prevent companies from having
to duplicate records or create new records solely to satisfy
recordkeeping requirements.
    (Comment 653) Some comments state that food safety plan records are
a ``web of related documents'' that may be used in other programs and
cannot be collected or ``reduced to a binder.''
    (Response 653) We agree that food safety plan records could be
considered a ``web of related documents''--i.e., a set of records that
could include documents used in other programs. We also agree that the
food safety plan records need not be collected in a single location or
``reduced to a binder.'' See the discussion in Response 215 about how a
food safety plan could consist of one or more existing HACCP plans, one
or more prerequisite programs that include food safety controls, and
other components required by the rule, and be dated and signed even if
its components are not kept in a single location.
    Likewise, the records documenting implementation of the plan could
be a ``web of related documents.'' For example, a facility that
collects samples of product and sends them to a laboratory for testing
would have records documenting its collection of samples, as well as
records documenting the laboratory's test results. Consistent with the
requirements of the rule for written procedures for product testing
(Sec.  117.165(b)(2)) and the general recordkeeping requirements of
subpart F (Sec.  117.305), the sampling records would contain
information such as the name and location of the facility, the date
when the samples were collected, the signature or initials of the
person collecting the samples, and the identity and lot code of the
sampled product. Likewise, the laboratory report would contain
information identifying the laboratory, the product tested (and
associated lot code), the test analyte, the test(s) conducted
(including the analytical method(s) used), the date of the test(s), the
test results, and the signature or initials of the person who conducted
the test. Alternatively, it would be acceptable to have the signature
or initials of the person who approved the release of the test results
from the laboratory. Together, these records contain all the required
information to associate them with a facility, a specific lot of
product, and the results of laboratory testing on that product.
    Although the provisions for use of existing records provide
flexibility, there are some limitations. For example, monitoring
records must be created concurrently with the monitoring activity and
contain the signature or initials of the person conducting the
monitoring. If the facility has an existing form that it uses to
document the monitoring activity, and that form does not provide (or
have space to add) information adequate to identify the plant or
facility (e.g., the name and, when necessary, the location of the
facility), and does have (or have space to add) a place for the
signature of the person performing the activity, we expect the facility
to modify the form rather than use the existing form. The provisions
for ``supplementing'' existing records do not extend to providing
information identifying the facility, or signatures, on separate pages.
    (Comment 654) Some comments state that our review of records should
be limited to issues under our jurisdiction, regardless of the other
information that may be contained in the record. Other comments ask us
to ensure that inspectors are adequately trained on how to review
facility records for the requisite information across multiple sets of
documents, as needed.
    (Response 654) Section 418(h) of the FD&C Act requires that the
written plan that documents and describes the procedures used by the
facility to comply with the requirements of section 418, together with
the documentation of monitoring of preventive controls, instances of
nonconformance material to food safety, the results of testing and
other means of verification, instances when corrective actions were
implemented, and the efficacy of preventive controls and corrective
actions, be made available to FDA. Our inspectors will be trained to
focus on the written food safety plan and the records documenting
implementation of the plan during inspections. Our inspectors have
experience in the review of records that a food business establishes
and maintains for more than one purpose--e.g., during the review of
records kept under the section 414 recordkeeping regulations during the
investigation of an outbreak of foodborne illness.

H. Final Sec.  117.335--Special Requirements Applicable to a Written
Assurance

    As discussed in section XXVII, new Sec.  117.335 establishes
requirements applicable to the written assurance a manufacturer/
processor obtains from its customer. New Sec.  117.335(a) applies to
all written assurances required by the rule--i.e., the assurance must
contain the effective date; printed names and signatures of authorized
officials; and the applicable assurance.
    The provisions of Sec.  117.335(b), together with another new
provision (Sec.  117.137), establish legal responsibilities under the
rule for a facility that provides a written assurance regarding a food
product that a manufacturer/processor distributes without application
of a preventive control that is needed to control a hazard. This
responsibility exists even for a facility that is not itself a
manufacturer/processor, such as for a facility that is a distributor.
We are establishing legal responsibilities for the facilities that
provide these written assurances because following these assurances is
critical to ensuring that required preventive controls are applied to
the food by an entity in the distribution chain before the food reaches
consumers.

I. Other Comments on the Recordkeeping Requirements of Subpart F

    (Comment 655) Some comments assert that the extensive recordkeeping
requirements of every aspect of farm and food production would be
crushing to small and mid-sized businesses. These comments ask us to
replace the proposed recordkeeping requirements with a brief farm plan
that outlines perceived risks and how the farmer plans to address those
risks.
    (Response 655) We decline this request, which is largely moot in
light of the changes we have made to the ``farm'' definition and to the
classification of activities on-farm and off-farm (see the discussion
in section IV of this document and table 1 in the Appendix to the 2014
supplemental human preventive controls notice (79 FR 58524 at 58571-
58572)). None of the activities within the ``farm'' definition (i.e.,
packing and holding RACs, and certain processing activities (such as
drying grapes to produce raisins, and packaging RACs such as
strawberries, without additional manufacturing/processing), will be
subject to this rule if performed on a farm.

XLII. Subpart G: General Comments on Proposed Requirements for a
Supply-Chain Program

    In the 2014 supplemental human preventive controls notice, we
provided an opportunity for public comment on potential requirements
for a supplier program as a preventive control. The supplier program
for a receiving facility would be limited to those raw materials and
other ingredients for which the receiving facility has identified a
significant hazard (which we now refer

to as ``hazard requiring a preventive control''). Under the definitions
established in this rule, ``supplier'' means the establishment that
manufactures/processes the food, raises the animal, or grows the food
that is provided to a receiving facility without further manufacturing/
processing by another establishment, except for further manufacturing/
processing that consists solely of the addition of labeling or similar
activity of a de minimis nature; ``receiving facility'' means a
facility that is subject to subparts C and G and that manufactures/
processes a raw material or other ingredient that it receives from a
supplier (see Sec.  117.3).
    We previously explained our understanding that, particularly for
RACs, there may be multiple establishments, including cooperatives,
packinghouses, and distributors, between a receiving facility and the
establishment that would be considered the supplier, which would make
supplier verification very challenging under certain circumstances (79
FR 58524 at 58548). We requested comment on what verification
activities would be appropriate for receiving facilities to conduct
when a raw material or ingredient passes through more than one facility
that would not be required to verify control of hazards if supplier
programs are limited to manufacturers/processors. We discussed an
example in which a receiving facility is a fresh-cut processing
facility that receives produce from a distributor, who receives produce
from a cooperative, and neither the distributor nor the cooperative is
required to establish supplier controls for the farms where the hazards
are being controlled, and we asked what supplier controls should be
applied for the produce coming from the farms. We requested comment on
whether and how the requirements for supplier verification should
address such situations. We also requested comment regarding whether
(and, if so, how) the final human preventive controls rule should
address the potential for gaps in supplier controls when a hazard is
controlled at Point A in the supply chain (e.g., by Supplier A, a
farm), and Point B in the supply chain is a facility (such as Warehouse
B, Distributor B, or Packing Shed B) that only packs or holds food, but
does not manufacture/process food (and therefore would not be required
to have a supplier program) before passing it on to Point C in the
supply chain, which also would not be required to have a supplier
program (e.g., Retail Food Establishment C or Consumer C). We discussed
an example in which Packing Shed B distributes produce it packs after
receiving the produce from Farm A directly to retail facilities (which
would not be subject to the requirements of the human preventive
controls rule); under the proposed suppler control program no supplier
controls would be applied to Farm A. We requested comment on whether
verification activities should be required in circumstances in which a
RAC such as fresh produce will not be sent to any facilities that would
be required to have preventive controls before reaching consumers.
    In the remainder of this section, we discuss comments that address
our request for comment on complex supply-chain scenarios such as those
described in the 2014 supplemental human preventive controls notice. We
also describe our reasons for revising the proposed requirements for a
supplier program to provide additional flexibility for an entity other
than the receiving facility to determine, conduct, and document the
appropriate supplier verification activities. When an entity other than
the receiving facility determines, conducts, or both determines and
conducts the appropriate supplier verification activities, the
receiving facility must review and assess that entity's applicable
documentation, and document the receiving facility's review and
assessment. Providing this additional flexibility required a series of
changes to multiple proposed provisions. To improve clarity and
readability we redesignated proposed Sec.  117.136 into eight distinct
sections of regulatory text in a newly established subpart G (Supply-
Chain Program), with editorial changes associated with the new
structure of the redesignated regulations. See table 44 for the section
numbers and titles in subpart G. See table 45 for an overview of the
major revisions to the proposed requirements for a supplier program.
See sections XLIII through XLIX for a discussion of the specific
provisions of the final requirements for a supplier program, and table
46, table 47, table 48, table 49, table 50, and table 51 for more
detailed summaries of revisions to these specific provisions. Because
table 45 is an overview, the changes identified in table 45 appear
again in table 46, table 47, table 48, table 49, table 50, and table
51. Because the editorial changes associated with the redesignation are
extensive, we do not list them in table 52.
    The title of subpart G is ``Supply-Chain Program'' rather than
``Supplier Program.'' As shown in table 45 and discussed in more detail
in section XLIII.D, we have added one requirement applicable to non-
suppliers. ``Supply-chain program'' is a more appropriate term to
reflect a subpart that includes a requirement applicable to non-
suppliers in addition to the requirements applicable to suppliers. In
the remainder of this document, we use the phrase ``supply-chain
program'' in section headings and when referring to the provisions of
the final rule. We continue to use the term ``supplier program'' when
describing the proposed provisions and the comments regarding the
proposed provisions.

 Table 44--Redesignation of the Requirements for a Supply-Chain Program
                              in Subpart G
                         [Supply-chain program]
------------------------------------------------------------------------
               Section                            Description
------------------------------------------------------------------------
117.405..............................  Requirement to establish and
                                        implement a supply-chain
                                        program.
117.410..............................  General requirements applicable
                                        to a supply-chain program.
117.415..............................  Responsibilities of the receiving
                                        facility.
117.420..............................  Using approved suppliers.
117.425..............................  Determining appropriate supplier
                                        verification activities
                                        (including determining the
                                        frequency of conducting the
                                        activity).
117.430..............................  Conducting supplier verification
                                        activities for raw materials and
                                        other ingredients.
117.435..............................  Onsite audit.
117.475..............................  Records documenting the supply-
                                        chain program.
------------------------------------------------------------------------

             Table 45--Overview of Revisions to the Proposed Requirements for a Supply-Chain Program
----------------------------------------------------------------------------------------------------------------
   Final section designation     Proposed section designation        Description                Revision
----------------------------------------------------------------------------------------------------------------
Throughout....................  Throughout....................  The type of            Refer to ``supply-chain-
                                                                 preventive control     applied control'' rather
                                                                 applicable to the      than ``preventive
                                                                 supply-chain program.  control'' or variations
                                                                                such as ``hazard
                                                                                requiring a preventive
                                                                                control when the hazard
                                                                                is controlled before
                                                                                receipt of the raw
                                                                                material or other
                                                                                ingredient.''
117.136(a)(2).................  117.136(a)(1)(ii).............  A supply-chain         Shifted to be in
(in subpart C)................                                   program is not         provisions outside the
                                                                 required when the      framework of the supply-
                                                                 hazard will be         chain program in subpart
                                                                 controlled by the      G.
                                                                 receiving facility's
                                                                 customer in the
                                                                 distribution chain.
117.405(a)(2).................  N/A...........................  Circumstances that do  The receiving facility
                                                                 not require a supply-  does not need a supply-
                                                                 chain program.         chain program when the
                                                                                receiving facility is an
                                                                                importer, is in
                                                                                compliance with the
                                                                                forthcoming FSVP
                                                                                requirements, and has
                                                                                documentation of
                                                                                verification activities
                                                                                conducted under the
                                                                                forthcoming FSVP
                                                                                program.
117.405(a)(3).................  N/A...........................  Exemption from the     Exemption for food
                                                                 requirements for a     supplied for research or
                                                                 supply-chain program.  evaluation.
117.405(c)....................  N/A...........................  Requirements           When a supply-chain-
                                                                 applicable to non-     applied control is
                                                                 suppliers.             applied by an entity
                                                                                other than the receiving
                                                                                facility's supplier
                                                                                (e.g., when a non-
                                                                                supplier applies
                                                                                controls to certain
                                                                                produce (i.e., produce
                                                                                that will be subject to
                                                                                the forthcoming produce
                                                                                safety rule), because
                                                                                growing, harvesting, and
                                                                                packing activities are
                                                                                under different
                                                                                management), the
                                                                                receiving facility must
                                                                                (1) verify the supply-
                                                                                chain-applied control;
                                                                                or (2) obtain
                                                                                documentation of an
                                                                                appropriate verification
                                                                                activity from another
                                                                                entity, review and
                                                                                assess the entity's
                                                                                applicable
                                                                                documentation, and
                                                                                document that review and
                                                                                assessment.
117.410(c)....................  117.136(a)(3)(ii).............  Purpose of the supply- Specify only that the
                                                                 chain program.         supply-chain program
                                                                                must provide assurance
                                                                                that a hazard requiring
                                                                                a supply-chain-applied
                                                                                control has been
                                                                                significantly minimized
                                                                                or prevented.
117.410(d)....................  117.136(b)....................  Factors that must be    Clarification
                                                                 considered in          that these factors must
                                                                 determining            be considered in
                                                                 appropriate supplier   approving suppliers, as
                                                                 verification           well as in determining
                                                                 activities.            appropriate supplier
                                                                                verification activities.
                                                                                Flexibility in
                                                                                the factors that must be
                                                                                considered if a supplier
                                                                                is a qualified facility,
                                                                                a produce farm that will
                                                                                not be subject to the
                                                                                forthcoming produce
                                                                                safety rule on the basis
                                                                                of size and/or direct
                                                                                farm marketing, or a
                                                                                shell egg producer that
                                                                                is not subject to the
                                                                                requirements of 21 CFR
                                                                                part 118 (production,
                                                                                storage, and
                                                                                transportation of shell
                                                                                eggs) because it has
                                                                                less than 3,000 laying
                                                                                hens.
117.415(a)....................  N/A...........................  Responsibilities of    Provide flexibility for
                                                                 the receiving          an entity other than the
                                                                 facility.              receiving facility to
                                                                                determine, conduct, and
                                                                                document supplier
                                                                                verification activities,
                                                                                provided that the
                                                                                receiving facility
                                                                                reviews and assesses
                                                                                applicable documentation
                                                                                from that entity and
                                                                                documents the receiving
                                                                                facility's review and
                                                                                assessment.
117.415(b)....................  N/A...........................  Responsibilities of    Specify documentation
                                                                 the receiving          that a receiving
                                                                 facility.              facility may not accept
                                                                                from a supplier to
                                                                                satisfy the receiving
                                                                                facility's
                                                                                responsibilities for its
                                                                                supply-chain program.
117.420(a)....................  117.136(a)(3)(i)..............  Approval of suppliers  Explicit requirement for
                                                                                a receiving facility to
                                                                                approve its suppliers.
117.420(b)....................  117.136(a)(3)(i)..............  Approval of suppliers  Explicit requirement for
                                                                                a receiving facility to
                                                                                establish and follow
                                                                                written procedures for
                                                                                receiving raw materials
                                                                                and other ingredients.
117.430(e)....................  N/A...........................  Alternative supplier   Provide for an
                                                                 verification           alternative supplier
                                                                 activity.              verification activity
                                                                                when the supplier is a
                                                                                shell egg producer with
                                                                                less than 3,000 laying
                                                                                hens.
117.430(f)....................  N/A...........................  Independence of the    Specify that there must
                                                                 supplier.              not be any financial
                                                                                conflicts of interests
                                                                                that influence the
                                                                                results of the
                                                                                verification activities
                                                                                listed in Sec.
                                                                                117.410(b) and payment
                                                                                must not be related to
                                                                                the results of the
                                                                                activity.
117.435(c)(1).................  117.136(e)....................  Substitution of an     Provide additional
                                                                 inspection for an      flexibility for domestic
                                                                 audit.                 inspection by
                                                                                representatives of other
                                                                                Federal agencies (such
                                                                                as USDA), or by
                                                                                representatives of
                                                                                State, local, tribal, or
                                                                                territorial agencies.
117.475.......................  117.136(g)....................  Records documenting    List additional records
                                                                 the supply-chain       associated with the
                                                                 program.               revised provisions.
----------------------------------------------------------------------------------------------------------------

    (Comment 656) Several comments ask us to issue guidance rather than
establish requirements for a supplier program in the rule. Some
comments assert that the benefits of a supplier verification program do
not outweigh

the costs, that we did not consider the effects of such a requirement
on farms and small businesses, and that FSMA does not actually contain
a requirement for a supplier verification program. Conversely, other
comments support including a mandatory supplier program in the rule for
hazards that are controlled in raw materials and other ingredients
before receipt by the receiving facility, although many comments assert
that a supplier verification program should be viewed as a verification
activity rather than a preventive control. Some comments assert that a
mandatory domestic supplier program is necessary to provide parity with
the requirements of the FSVP rule authorized by FSMA, while other
comments assert that FSMA's authorization of foreign supplier
verification should not be used to justify a domestic supplier program.
Some of these comments single out our request for comment, in the
proposed FSVP rule, on whether to allow an entity that would be both an
importer (under the FSVP rule) and a receiving facility (under the
human preventive controls rule) to be deemed in compliance with the
FSVP rule if it was in compliance with the supplier verification
provisions of the human preventive controls rule, and agree with such
an approach (78 FR 47730 at 45748).
    (Response 656) We agree that it is necessary to include a mandatory
supply-chain program in the rule to ensure the safety of food where
hazards are controlled in raw materials and other ingredients before
receipt by a receiving facility, and we are finalizing such a
requirement in this rule. The statute specifically identifies supplier
verification activities as a preventive control (see section 418(o)(3)
of the FD&C Act). Further, we believe a supply-chain program is a
measure that a person knowledgeable about food safety would establish
and implement in order to significantly minimize or prevent hazards
requiring a preventive control in an incoming raw material or other
ingredient.
    Supplier verification is sufficiently important for the control of
hazards in both domestic and imported foods that FSMA contains
provisions for both domestic and foreign supplier verification
(sections 418(o)(3) and 805 of the FD&C Act). Because we have aligned
the provisions for supplier verification in the FSVP rule with the
provisions for a supply-chain program in this rule, we are allowing
importers and receiving facilities to take advantage of that fact in
considering compliance with both part 117 and our forthcoming FSVP
regulations that we proposed to establish in part 1, subpart L, so that
they do not have to duplicate verification activities (see Sec.
117.405(a)(2)).
    (Comment 657) Some comments that addressed questions we asked in
the 2013 proposed human preventive controls rule and the 2014
supplemental human preventive controls notice recommend that we add
flexibility to the requirements for a supplier program such that any
entity in the supply chain between the supplier and the receiving
facility can perform supplier verification activities. Some comments
ask us to allow a receiving facility to have a supplier program
established for it by another entity. Other comments assert that it
would be too burdensome for a receiving facility to consider any
information related to the supplier's supplier or to go further back in
the supply chain beyond the entity that is one back from the receiving
facility. Other comments assert that we should eliminate any
requirements for a supplier program from the rule because a supplier
program involving more entities than just the receiving facility and
the supplier would become too complex. Some comments express concern
that we would be creating ``an environment where our supply chain is
required to be disclosed to our customers via product testing, audits
and supplier verification,'' asserting that this would discourage
customers from buying from entities such as re-packers when they could
go to the source. Some comments state that we have not taken into
account the low-risk nature of specific industries such as those that
re-pack already processed foods. Other comments ask us to confirm that
distributors and warehouses are not included in the requirements for a
supplier program because they would not likely meet the definition of a
receiving facility or a supplier.
    (Response 657) We agree with comments recommending additional
flexibility in the supply-chain program with regard to who can perform
certain activities and have added this flexibility to the final rule
(see Sec.  117.415). Because the receiving facility and the supplier
may be separated by several entities in a supply chain, we are allowing
such entities (e.g., distributors, brokers, aggregators) to determine,
conduct, and document supplier verification activities as a service to
the receiving facility, provided that the receiving facility reviews
and assesses applicable documentation provided by the other entity and
documents that review and assessment. However, because the approval of
suppliers is ultimately the responsibility of the receiving facility,
the rule specifies that only a receiving facility can approve suppliers
(see Sec. Sec.  117.415(a)(1) and 117.420(a) and Response 658).
    We disagree that complex supply chains make a supply-chain program
too difficult and that a receiving facility cannot be expected to reach
further back in a supply chain than the entity immediately before it in
the supply chain. Supply-chain programs are currently used by
facilities as a standard business practice and we understand that some
of those supply chains are complex, with entities between the receiving
facility and the supplier. We acknowledge that complex supply chains
present a challenge because information will need to flow through
several entities to allow the link between the receiving facility and
the supplier. However, we believe a supply-chain program is a critical
preventive control for receiving facilities that will rely on suppliers
to control hazards in raw materials and other ingredients. Although
distributors, brokers, and other entities in the supply chain between a
receiving facility and its supplier are not required to have a role in
supplier verification, they have the option to determine, conduct, and
document supplier verification activities as a service to the receiving
facility if they so choose. If these entities choose not to participate
in supplier verification, the receiving facility will need to reach
back in the supply chain past them. In such situations, it may be
necessary for the entities between the receiving facility and the
supplier to provide the identity of the supplier to the receiving
facility, if that identity is not available on the raw material or
other ingredient or otherwise apparent. In such cases, the role that
distributors, brokers, aggregators, and similar entities would play in
supplier verification would be minimal. We cannot determine whether
having to provide the identity of the supplier to the receiving
facility would change buying practices. However, we believe that
manufacturers consider a number of factors in determining who they will
purchase from, including the services provided, and that there will
continue to be a role for aggregators, re-packers, brokers, and others.
We have provided flexibility for these entities to play a role in
supplier verification if the receiving facility and the business entity
determine there is a benefit to do so.
    See also the discussion in section XLV regarding the specific
provisions of Sec.  117.415. Although comments focus on flexibility for
an entity in the supply chain between the supplier and the

receiving facility to perform supplier verification activities, and
such entities are the most likely entities to be the entities
determining, conducting, and documenting supplier verification
activities, the flexibility provided by the rule is not limited to such
entities.
    (Comment 658) Some comments ask us to establish a general
requirement for a supplier program without specifying roles and
responsibilities for the various entities involved. Other comments ask
us to define ``supplier'' as the entity with which the receiving
facility has a commercial relationship.
    (Response 658) We disagree that we should establish a general
requirement for a supply-chain program without specifying roles and
responsibilities for the various entities involved. Although we have
added flexibility to provide that an entity other than the receiving
facility may determine, conduct, and document supplier verification
activities (see Sec.  117.415), we continue to believe it is important
to clearly define two roles in the supply chain that share the primary
responsibility in the supplier verification process--i.e., the
receiving facility and the supplier. In all cases where we have added
flexibility for participation by an entity other than the receiving
facility, the responsibility for the supply-chain program is clearly
lodged with the receiving facility, and linked to the supplier (see
Sec.  117.415). To emphasize the responsibility of the receiving
facility and its link to the supplier, the final rule clearly states
that the receiving facility must approve its suppliers before receiving
raw materials and other ingredients (see Sec.  117.420(a)).
    For the supply-chain program to be meaningful and robust, there
must be an exchange of information between these two entities--the
entity receiving the food and the entity that controlled the hazard--
even when an entity other than the receiving facility participates by
determining, conducting, and documenting some supplier verification
activities. The ultimate responsibility for supplier verification rests
with the receiving facility through its determination in approving
suppliers and in reviewing and assessing applicable documentation
provided by another entity. Therefore, we also disagree that the
definition of ``supplier'' should be revised to be the next entity back
in a supply chain (e.g., the entity with which a receiving facility has
a commercial relationship). The entity with which a receiving facility
has a commercial relationship might be a distributor, broker, or
aggregator. A distributor, broker, or aggregator does not control an
identified hazard and, therefore, cannot assume the same role as an
establishment that manufactures/processes the food, raises the animal,
or grows the food.
    (Comment 659) Some comments ask us to provide flexibility in the
content of the supplier program. Some comments assert that specifying
the content of the supplier program would result in duplicative
requirements on suppliers, who must first comply with certain
regulations and then demonstrate that compliance in order to comply
with a different regulation.
    (Response 659) We disagree that a requirement for a supply-chain
program in which compliance with an underlying regulation is
demonstrated is duplicative with the need to comply with the underlying
regulation. The requirement for a supply-chain program is not mandating
that the facility or farm comply twice with the human preventive
controls rule or the produce safety rule; it is merely requiring that
the compliance by the facility or the farm with the applicable
regulation be verified to ensure that hazards requiring a preventive
control are being controlled.
    We are continuing to specify the basic content of a supply-chain
program--i.e., using approved suppliers; determining appropriate
supplier verification activities; conducting supplier verification
activities; and establishing records documenting these activities (see
Sec.  117.410(a)). However, the rule provides flexibility in the choice
of supplier verification activities and how often such activities must
be performed. (See Sec. Sec.  117.410(b)(4) and 117.430(b)(2), (c),
(d), and (e)). In addition, the rule provides for an alternative
supplier verification activity for certain entities (see Sec.
117.430(c), (d), and (e)) regarding alternative supplier verification
activities for qualified facilities, certain produce farms, and certain
shell egg producers, respectively).
    (Comment 660) As already noted in this section, in the 2014
supplemental human preventive controls notice we asked for comment on
whether verification activities should be required in circumstances in
which a RAC such as fresh produce will not be sent to any facilities
that would be required to have preventive controls before reaching
consumers. In response, we received comments both in support of, and in
opposition to, a requirement that verification activities be conducted
in circumstances in which produce would go directly from an
establishment that would not be required to have supplier controls
(e.g., farm, warehouse, distributor) to another establishment not
required to have supplier controls (e.g., retail food establishment) or
to a consumer. Some comments assert that any firm that sells directly
to retail food establishments or consumers should have a supplier
program in place, while other comments assert that this is not
necessary, particularly in the case of RACs.
    Some comments maintain that the produce safety rule will provide
adequate assurances of safety for covered produce and that covering
such products with the supplier verification requirements of the human
food preventive controls rule would be subjecting this produce to
duplicative requirements. These comments recommend that, if some
verification is required in these ``gaps'' on which we asked for
comment, entities in these categories be allowed to voluntarily apply
certain supplier verification best practices rather than be subject to
the supplier program requirements of this rule.
    (Response 660) As previously discussed (79 FR 58524 at 58548),
fresh produce often goes directly from the farm to a distributor and
then on to retail food establishments and/or consumers. We are not
requiring any of the entities in this supply chain to do supplier
verification under part 117, so the farm's compliance with the produce
safety rule, if applicable, will not be verified unless done
voluntarily. In contrast, we are requiring that a manufacturer/
processor that uses covered produce to make a processed product such as
fresh-cut produce establish and implement a supply-chain program. As we
have previously discussed, processing fresh produce into fresh-cut
products increases the risk of bacterial growth and contamination (Ref.
89). This has the potential to increase the exposure to pathogens,
because contamination of a few pieces of raw produce can be spread to
many servings of processed fresh-cut produce. Disturbing the physical
barriers of produce (e.g., by cutting the produce) and inadequate
temperature control of fresh-cut produce can enhance bacterial growth
(including growth of pathogens, if present). The increased risk
presented by processing of fresh produce makes it appropriate to
subject this processed food to the full requirements of the human
preventive controls rule in addition to the requirements of the
forthcoming produce safety rule for the RACs that are used to make this
processed food.

XLIII. Subpart G: Comments on Requirement To Establish and Implement a
Supply-Chain Program

    We proposed that the receiving facility must establish and
implement a

risk-based supplier program for those raw materials and ingredients for
which the receiving facility has identified a significant hazard when
the hazard is controlled before receipt of the raw material or
ingredient (proposed Sec.  117.136(a)). We also proposed circumstances
when a receiving facility would not be required to have a supplier
program.
    In the following sections, we discuss comments that ask us to
clarify the proposed requirement to establish and implement a written
supplier program or that disagree with, or suggest one or more changes
to, the proposed requirements. After considering these comments, we
have revised the regulatory text as shown in table 46.

       Table 46--Revisions to the Proposed Requirements To Establish and Implement a Supply-Chain Program
----------------------------------------------------------------------------------------------------------------
                                       Proposed section
    Final section  designation           designation               Description                  Revision
----------------------------------------------------------------------------------------------------------------
N/A...............................  117.136(a)(2)(i).....  A supplier program is not   Deleted as unnecessary.
                                                            required when there are
                                                            no hazards requiring a
                                                            preventive control.
N/A...............................  117.136(a)(2)(i).....  A supplier program is not   Deleted as unnecessary.
                                                            required when the
                                                            preventive controls at
                                                            the receiving facility
                                                            are adequate to
                                                            significantly minimize or
                                                            prevent each of the
                                                            hazards requiring a
                                                            preventive control.
117.136(a)(2).....................  117.136(a)(2)(iii)...  A supplier program is not   Shifted to be in
                                                            required when the hazard    provisions outside the
                                                            will be controlled by the   framework of the supply-
                                                            receiving facility's        chain program in subpart
                                                            customer in the             G.
                                                            distribution chain.
117.405(a)(2).....................  N/A..................  Circumstances that do not   A receiving facility is
                                                            require a supply-chain      an importer, is in
                                                            program even though the     compliance with the
                                                            receiving facility's        forthcoming FSVP
                                                            hazard analysis             requirements, and has
                                                            determines that a hazard    documentation of
                                                            requires a supply-chain-    verification activities
                                                            applied control.            conducted under the
                                                                                forthcoming FSVP
                                                                                program.
117.405(a)(3).....................  N/A..................  Exemption from the          Exemption for food
                                                            requirements for a supply-  supplied for research or
                                                            chain program.              evaluation.
117.405(c)........................  N/A..................  Requirements applicable to  When a supply-chain-
                                                            non-suppliers.              applied control is
                                                                                applied by an entity
                                                                                other than the receiving
                                                                                facility's supplier
                                                                                (e.g., when a non-
                                                                                supplier applies
                                                                                controls to certain
                                                                                produce (i.e., produce
                                                                                that will be subject to
                                                                                the forthcoming produce
                                                                                safety rule), because
                                                                                growing, harvesting, and
                                                                                packing activities are
                                                                                under different
                                                                                management), the
                                                                                receiving facility must
                                                                                (1) verify the supply-
                                                                                chain-applied control;
                                                                                or (2) obtain
                                                                                documentation of an
                                                                                appropriate verification
                                                                                activity from another
                                                                                entity, review and
                                                                                assess the entity's
                                                                                applicable
                                                                                documentation, and
                                                                                document that review and
                                                                                assessment.
----------------------------------------------------------------------------------------------------------------

A. Requirement for a Written Supply-Chain Program (Final Sec.
117.405(a)(1) and (b))

    We proposed that the receiving facility must establish and
implement a risk-based supplier program for those raw materials and
ingredients for which the receiving facility has identified a
significant hazard when the hazard is controlled before receipt of the
raw material or ingredient. We also proposed that the supplier program
must be written. (See proposed Sec.  117.136(a)(1)(i) and (2).) To
improve clarity, we have revised the revision to substitute the phrase
``hazard requiring a supply-chain-applied control'' for the phrase
``significant hazard when the hazard is controlled before receipt of
the raw material or ingredient.'' We have added a definition for the
term ``supply-chain-applied control'' to mean a preventive control for
a hazard in a raw material or other ingredient when the hazard in the
raw material or other ingredient is controlled before its receipt (see
Sec.  117.3) and use the more specific term ``supply-chain-applied
control,'' rather than the broader term ``preventive control,''
throughout the provisions for a supply-chain program.
    (Comment 661) As discussed in Comment 656, several comments ask us
to issue guidance rather than establish requirements for a supplier
program in the rule.
    (Response 661) See Response 656 for a discussion of our reasons for
declining this request and establishing requirements for a supply-chain
program in the rule.
    (Comment 662) Some comments ask us to revise the regulatory text to
remove the condition that all hazards be foreseeable so that the
supplier program can address economically motivated adulteration.
    (Response 662) This comment is unclear. The requirement for a
supply-chain program applies when the outcome of a hazard analysis is
that a known or reasonably foreseeable hazard requires a preventive
control, and the hazard would be controlled by the receiving facility's
supplier. The requirement applies regardless of whether the hazard
requiring a preventive control is, or is not, a hazard that would be
introduced into a food for the purposes of economic gain.
    (Comment 663) Some comments ask us to specify that a Certificate of
Analysis or other documentation of the existence and/or level of a
hazard could be provided to the receiving facility to indicate the
potential for an actual existence of a hazard so that the receiving
facility could evaluate whether the hazard requires a preventive
control. One comment explains that chemical contaminants such as lead
are not controlled through easily described ``procedures'' but are
instead controlled through factors such

as product formulation (e.g., controlling the levels of contaminants in
each ingredient depending on the proportion of the ingredient in the
finished food) and serving size. These comments explain that chemical
contaminants such as lead may require control in one context (e.g., if
children are the target consumers) but not in another context (e.g., if
adults are the target consumers and the product is unlikely to be
consumed by children). This comment expresses concern about whether
customers would be willing to provide the receiving facility with
confidential information about the customer's own hazard analysis with
respect to sensitive topics (e.g., how much lead it has decided to
allow in its finished products, or how its product formulation controls
the level of lead in its finished food). Furthermore, in such cases the
receiving facility will not even know whether the chemical contaminant
constitutes an actual ``hazard'' for the purposes of the customer's
finished food. This comment also asserts that a Certificate of Analysis
provided to a receiving facility constitutes ``control before receipt
of the raw material or ingredient.''
    (Response 663) We do not understand the concern of this comment. A
receiving facility and a supplier do not need to share all of the
details of product formulation for a receiving facility to communicate
its requirements to a supplier. In the example provided by the comment,
the receiving facility could provide the supplier with a written
specification for a contaminant such as lead, and the supplier could
demonstrate that it satisfied the receiving facility's specification by
providing a Certificate of Analysis showing the results of laboratory
testing for lead. Neither the written specification provided by the
receiving facility, nor the Certificate of Analysis provided by the
supplier, would disclose confidential information about the
formulations or procedures of either entity.
    This comment also appears to misunderstand the applicability of the
supply-chain program. The rule requires a supply-chain program when the
receiving facility has identified, through its hazard analysis, that
there is a hazard requiring a supply-chain-applied control. In the
circumstances described by the comment, a Certificate of Analysis or
other documentation of test results from the supplier to the receiving
facility could demonstrate that the supplier has controlled the hazard
to the receiving facility's specifications, but would not overturn the
outcome of the receiving facility's hazard analysis that there is a
hazard requiring a preventive control, and that the appropriate control
is applied by the supplier. On the contrary, the Certificate of
Analysis simply demonstrates that the supply-chain-applied control
functioned as intended.
    (Comment 664) One comment asks us to specify in the regulatory text
that the supplier program must be written ``if required'' because there
are specified circumstances when a supplier program is not required.
    (Response 664) We decline this request. Although the rule provides
circumstances when a supply-chain program is not required (see Sec.
117.405(a)(2)), it is not necessary to specify, for all other
provisions of the supply-chain program, that the provision only applies
``if required.''

B. Circumstances That Do Not Require a Written Supply-Chain Program
(Final Sec.  117.405(a)(2))

    We proposed that the receiving facility is not required to
establish and implement a supplier program for raw materials and
ingredients for which there are no significant hazards; the preventive
controls at the receiving facility are adequate to significantly
minimize or prevent each of the significant hazards; or the receiving
facility relies on its customer to control the hazard and annually
obtains from its customer written assurance that the customer has
established and is following procedures (identified in the written
assurance) that will significantly minimize or prevent the hazard. (See
proposed Sec.  117.136(a)(1)(ii)(A), (B), and (C).)
    We are deleting the proposed provision that a supplier program is
not required for raw materials and ingredients for which there are no
``significant hazards'' (which we now refer to as ``hazards requiring a
preventive control'') because it is unnecessary. The supply-chain
program is required when a hazard identified in the receiving
facility's hazard analysis identifies a hazard requiring a supply-
chain-applied control; it is not necessary to also state the converse.
Likewise, we are deleting the proposed provision that a supplier
program is not required if the preventive controls at the receiving
facility are adequate to significantly minimize or prevent each of the
significant hazards. In such a case, the outcome of the hazard analysis
would not be that the hazard requires a supply-chain-applied control.
    As discussed in section XXVII, after considering comments, we are
shifting the provision in which the receiving facility relies on its
customer to control the hazard from the requirements for a supply-chain
program to a series of provisions that apply when a manufacturer/
processor identifies a hazard requiring a preventive control, but can
demonstrate and document that the hazard will be controlled by an
entity in its distribution chain (see Sec. Sec.  117.136 and 117.137).
However, as discussed in Response 665 and section XLIII.C, we also are
establishing two additional circumstances when a supply-chain program
is not required (see Sec.  117.405(a)(2) and (3)).
    (Comment 665) As noted in Comment 656, some comments single out our
request for comment, in the proposed FSVP rule, on whether to allow an
entity that would be both an importer (under the FSVP rule) and a
receiving facility (under the human preventive controls rule) to be
deemed in compliance with the FSVP rule if it was in compliance with
the supplier verification provisions of the human preventive controls
rule, and agree with such an approach (78 FR 47730 at 45748).
    (Response 665) As noted in Response 656, we have aligned the
provisions for supplier verification in the FSVP rule with the
provisions for a supply-chain program in this rule, and we are allowing
importers that are receiving facilities to take advantage of that fact
in considering compliance with our forthcoming FSVP regulations that we
proposed to establish in part 1, subpart L, so that they do not have to
duplicate verification activities (see Sec.  117.405(a)(2)).
    (Comment 666) Some comments support the specified criteria for when
a receiving facility would not be required to establish and implement a
supplier program. Other comments express concern that these criteria
suggest no supplier verification is needed at all in some circumstances
despite supplier verification activities being potentially informative
about a particular supplier. These comments ask us to establish some
general requirement to perform verification activities for all
suppliers.
    (Response 666) We decline this request because it is neither risk-
based nor consistent with the nature and purpose of the supply-chain
program, which is to provide assurance that a hazard requiring a
supply-chain-applied control has been significantly minimized or
prevented (see the regulatory text of Sec.  117.410(c)). We agree that
some degree of verification of all suppliers may prove useful to a
receiving facility for various purposes, and the rule would not prevent
a receiving facility from establishing a

supply-chain program for all of its suppliers regardless of risk and
regardless of whether the applicable hazard in a raw material or other
ingredient is controlled before its receipt.
    (Comment 667) Some comments ask us to specify that a ``kill step''
would be an adequate indicator to significantly minimize or prevent
significant hazards identified by the receiving facility when the
receiving facility controls the hazard.
    (Response 667) These comments appear to misunderstand the
applicability of the supply-chain program. The rule requires a supply-
chain program when the receiving facility has identified, through its
hazard analysis, that there is a hazard requiring a preventive control
and the receiving facility's manufacturing/processing will not control
the hazard. In the circumstances described by the comment, the
receiving facility is controlling the hazard and a supply-chain program
for the raw material or other ingredient is not required. It is not
necessary to specify the types of controls that the receiving facility
may use to control the hazard.
    (Comment 668) Some comments ask us to specify that a receiving
facility need not establish and implement a supplier program for raw
materials and ingredients if those raw materials or ingredients were
received from an affiliated party within the same corporate or
controlling entity.
    (Response 668) We decline this request. With the revisions we have
made to the proposed requirements for a supplier program, the supply-
chain program that we are establishing in this rule provides ample
opportunities for an affiliated party within the same corporate or
controlling entity to establish and implement a supply-chain program
that is suited to its relationship to these entities. For example, as
discussed in Response 687, a receiving facility might be able to
determine and document a justification for a supplier verification
activity other than an annual audit when a supplier is an affiliated
party based on the receiving facility's knowledge of the corporate
policies regarding food safety practices (see Sec.  117.430(b)(2)). In
addition, as discussed in Response 690, we have agreed that the
corporate parent of a facility can be active in developing and
implementing the facility's food safety plan (see section XXIV.A). If,
for example, a corporate headquarters establishes and implements a
supply-chain program for use company-wide, a receiving facility could
rely on supplier verification activities conducted by its corporate
headquarters, with applicable documentation available during
inspection.

C. Exemption for Food Supplied for Research or Evaluation (Final Sec.
117.405(a)(3))

    We are establishing an exemption from the requirement for a
receiving facility to establish and implement a supply-chain program
when it receives food for the purposes of research or evaluation,
provided that certain conditions are met (see Sec.  117.405(a)(3)).
Those conditions are that the food: (1) Is not intended for retail sale
and is not sold or distributed to the public; (2) is labeled with the
statement ``Food for research or evaluation use''; (3) is supplied in a
small quantity that is consistent with a research, analysis, or quality
assurance purpose, the food is used only for this purpose, and any
unused quantity is properly disposed of; and (4) is accompanied with
documents, in accordance with the practice of the trade, stating that
the food will be used for research or evaluation purposes and cannot be
sold or distributed to the public. The exemption is analogous to an
exemption we proposed for the FSVP rule under section 805(f) of the
FD&C Act. (See proposed Sec.  1.501(c), 78 FR 45730 at 45745). We
believe it is not necessary to conduct supplier verification activities
when food is obtained in this limited circumstance.

D. Additional Requirements for Non-Suppliers (Final Sec.  117.405(c))

    As discussed in section IV.B, the final rule includes several
revisions to the ``farm'' definition in response to comments. For
example, as discussed in Comment 23 comments emphasize that farming
operations can have complex business structures, and ask us to revise
the ``farm'' definition to provide for these business models. In
response to these comments, we have added a new definition for a
``secondary activities farm,'' which provides for practices such as
packing by cooperatives and packinghouses under the ownership of
multiple growers to remain within the ``farm'' definition (See Response
25). Another change to the ``farm'' definition accommodates business
models in which one operation grows crops but does not harvest them,
and another operation, not under the same management, harvests crops
but does not grow them (see Response 32). As discussed in Response 32,
this revision is a change from the ``farm'' definition established in
the section 415 registration regulations in 2003, and the proposed
revisions to the ``farm'' definition in the 2013 proposed human
preventive controls rule and the 2014 supplemental human preventive
controls notice, which all describe a ``farm'' as an entity ``devoted
to the growing and harvesting of crops'' (emphasis added).
    We proposed the requirements for a supplier program in the context
of a single business entity ``devoted to the growing and harvesting of
crops'' (emphasis added), in which packing operations were often done
by that same business entity. The final ``farm'' definition
accommodates business models where growing, harvesting, and packing
operations will be done by different business entities. Harvesting and
packing operations include some supply-chain-applied controls, such as
controls on worker hygiene, quality of water used during harvesting and
packing operations, and establishing and following water-change
schedules for recirculated water, even though the harvesting and
packing operations do not fall within the definition of ``supplier.''
    A receiving facility has an obligation to identify and implement
preventive controls to provide assurances that any hazards requiring a
preventive control will be significantly minimized or prevented and the
food manufactured, processed, packed, or held by the facility will not
be adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act (see section 418(c) of the FD&C Act and
Sec.  117.135(a)). That obligation includes responsibilities for raw
materials and other ingredients when a supply-chain-applied control is
applied by an entity other than the receiving facility's supplier. An
example of such a situation is when produce that will be covered by the
forthcoming produce safety rule is grown, harvested, and packed under
different management. To clarify the receiving facility's
responsibilities when a supply-chain-applied control is applied by a
non-supplier, we are establishing a requirement specifying that when a
supply-chain-applied control is applied by an entity other than the
receiving facility's supplier (e.g., when a non-supplier applies
controls to certain produce (i.e., produce that will be subject to the
forthcoming produce safety rule), because growing, harvesting, and
packing activities are under different management), the receiving
facility must: (1) Verify the supply-chain-applied control; or (2)
obtain documentation of an appropriate verification activity from
another entity, review and assess the entity's applicable
documentation, and document that review and assessment. See

Sec.  117.405(c). Because Sec.  117.405(c) refers to provisions in a
future produce safety rule, we will publish a document in the Federal
Register announcing the effective date of that provision once we
finalize the produce safety rule.
    We do not expect the receiving facility to follow all of the
requirements of subpart G applicable to ``suppliers'' when verifying
control by a ``non-supplier,'' as required by Sec.  117.405(c).
Instead, we expect the receiving facility will take steps such as a
review of the non-supplier's applicable food safety records. For
example, if a receiving facility receives produce from a supply chain
that includes a separate grower, harvester, and packer, the grower is
the supplier and the requirements of subpart G applicable to
``suppliers'' apply to the grower. To verify controls applied by the
harvester, the receiving facility could review the harvester's records,
such as records of training for harvest workers and records of
agricultural water quality used in harvest operations. To verify
controls applied by the packer, the receiving facility could review the
packer's records, such as records of agricultural water quality used in
packing operations. As discussed in Response 657, we are allowing
entities such as distributors, brokers, and aggregators to determine,
conduct, and document verification activities that apply to suppliers
as a service to the receiving facility, provided that the receiving
facility reviews and assesses applicable documentation provided by the
other entity and documents that review and assessment. Likewise, under
Sec.  117.405(c)(2) a receiving facility could obtain documentation of
review of applicable records maintained by the harvester or packer from
another entity, review and assess the entity's applicable
documentation, and document that review and assessment.

E. Proposed General Requirements for the Supply-Chain Program That We
Are Not Including in the Final Rule (Proposed Sec.  117.136(a)(4) and
(5))

    We proposed that when supplier verification activities are required
for more than one type of hazard in a food, the receiving facility must
conduct the verification activity or activities appropriate for each of
those hazards. We also proposed that for some hazards, in some
situations it will be necessary to conduct more than one verification
activity and/or to increase the frequency of one or more verification
activities to provide adequate assurances that the hazard is
significantly minimized or prevented. We have concluded that these
provisions are largely self-evident and need not be included in the
regulatory text. Therefore, we are not finalizing these proposed
provisions. We will consider whether it will add value to discuss the
principles in these proposed provisions in guidance that we intend to
develop for the supply-chain program.

XLIV. Subpart G: Comments on General Requirements Applicable to a
Supply-Chain Program

    We proposed several requirements generally applicable to the
supplier program (such as factors to consider in determining
appropriate supplier verification activities (proposed Sec.
117.136(b)), as well as several requirements more narrowly targeted to
specific aspects of the supplier program (such as requirements
applicable to onsite audits). As part of the redesignation of proposed
Sec.  117.136 into subpart G, with eight distinct sections, we are
establishing the more general requirements in Sec.  117.410 (see table
47).
    Most comments that support the proposed provisions suggest
alternative or additional regulatory text (see, e.g., Comment 671,
Comment 672, Comment 675, Comment 676, and Comment 678). In the
following sections, we discuss comments that ask us to clarify the
proposed requirements or that disagree with, or suggest one or more
changes to, the proposed requirements. After considering these
comments, we have revised the regulatory text as shown in table 47.

          Table 47--Revisions to the Proposed General Requirements Applicable to a Supply-Chain Program
----------------------------------------------------------------------------------------------------------------
   Final section designation     Proposed section designation        Description                Revision
----------------------------------------------------------------------------------------------------------------
117.410(a)....................  117.136(a)(3).................  What the supply-chain  Add that the supply-chain
                                                                 program must include.  program includes, when
                                                                                applicable, verifying a
                                                                                supply-chain-applied
                                                                                control applied by an
                                                                                entity other than the
                                                                                receiving facility's
                                                                                supplier and documenting
                                                                                that verification, or
                                                                                obtaining documentation
                                                                                of an appropriate
                                                                                verification activity
                                                                                from another entity,
                                                                                reviewing and assessing
                                                                                that documentation, and
                                                                                documenting the review
                                                                                and assessment.
117.410(b)....................  117.136(c)(1).................  Appropriate supplier   N/A.
                                                                 verification
                                                                 activities.
117.410(c)....................  117.136(a)(3)(ii).............  Purpose of supplier    Specify only that the
                                                                 verification           supply-chain program
                                                                 activities for raw     must provide assurance
                                                                 materials and other    that a hazard requiring
                                                                 ingredients.           a supply-chain-applied
                                                                                control has been
                                                                                significantly minimized
                                                                                or prevented.
117.410(d)....................  117.136(b)....................  Factors that must be   Clarify that the factors
                                                                 considered when        apply in approving
                                                                 approving suppliers    suppliers, as well as in
                                                                 and determining        determining appropriate
                                                                 appropriate supplier   supplier verification
                                                                 verification           activities.
                                                                 activities for raw
                                                                 materials and other
                                                                 ingredients.
117.410(d)....................  117.136(b)....................  Factors that must be    Specify that
                                                                 considered when        three of the factors
                                                                 approving suppliers    relate to ``supplier
                                                                 and determining        performance.''
                                                                 appropriate supplier   Specify ``The
                                                                 verification           entity or entities that
                                                                 activities for raw     will be applying
                                                                 materials and other    controls for the hazards
                                                                 ingredients;           requiring a supply-chain-
                                                                 Supplier performance.  applied control'' rather
                                                                                than ``Where the
                                                                                preventive controls for
                                                                                those hazards are
                                                                                applied for the raw
                                                                                material and
                                                                                ingredients--such as at
                                                                                the supplier or the
                                                                                supplier's supplier.''
                                                                                Add ``other FDA
                                                                                compliance actions
                                                                                related to food safety''
                                                                                as an example of
                                                                                information relevant to
                                                                                the supplier's
                                                                                compliance with
                                                                                applicable FDA food
                                                                                safety regulations

                                                                                Clarify that
                                                                                consideration of
                                                                                supplier performance
                                                                                includes, when
                                                                                applicable, relevant
                                                                                laws and regulations of
                                                                                a country whose food
                                                                                safety system FDA has
                                                                                officially recognized as
                                                                                comparable or has
                                                                                determined to be
                                                                                equivalent to that of
                                                                                the United States and
                                                                                information relevant to
                                                                                the supplier's
                                                                                compliance with those
                                                                                laws and regulations
                                                                                Provide
                                                                                flexibility in the
                                                                                factors that must be
                                                                                considered if a supplier
                                                                                is a qualified facility,
                                                                                a produce farm that will
                                                                                not be subject to the
                                                                                forthcoming produce
                                                                                safety rule on the basis
                                                                                of size and/or direct
                                                                                farm marketing, or a
                                                                                shell egg producer that
                                                                                is not subject to the
                                                                                requirements of 21 CFR
                                                                                part 118 (production,
                                                                                storage, and
                                                                                transportation of shell
                                                                                eggs) because it has
                                                                                less than 3,000 laying
                                                                                hens
117.410(e)....................  117.136(f)....................  Supplier non-          N/A.
                                                                 conformance.
----------------------------------------------------------------------------------------------------------------

A. Description of What the Supply-Chain Program Must Include (Final
Sec.  117.410(a))

    We proposed to require that a supplier program include verification
activities, as appropriate to the hazard, and documentation of these
activities, to ensure raw materials and ingredients are received only
from suppliers approved for control of the hazard(s) in that raw
material or ingredient (or, when necessary and appropriate, on a
temporary basis from unapproved suppliers) (proposed Sec.
117.136(a)(3)(i)). We also proposed to require that a supplier program
include verification activities, as appropriate to the hazard, and
documentation of these activities. We also proposed requirements
applicable to the determination and documentation of appropriate
supplier verification activities (proposed Sec.  117.136(b)). We also
proposed specific documentation requirements for records associated
with the supplier program (proposed Sec.  117.136(g)).
    The final rule specifies that the supply-chain program must
include: (1) Using approved suppliers; (2) determining appropriate
supplier verification activities (including determining the frequency
of conducting the activity); (3) conducting supplier verification
activities; and (4) documenting supplier verification activities. For
clarity, Sec.  117.410(a) states this general requirement for the
supply-chain program and Sec. Sec.  117.420, 117.425, 117.430, 117.435,
and 117.475 provide the specific requirements for using approved
suppliers, determining appropriate supplier verification activities,
conducting verification activities, specific requirements for onsite
audits, and records, respectively. See the discussion of the specific
requirements of Sec. Sec.  117.420, 117.425, 117.430, 117.435, and
117.475 in sections XLVI, XLVII, XLVIII, and XLIX, respectively.
    As discussed in section XLIII.D, the final rule establishes a
verification requirement when a supply-chain-applied control is applied
by an entity other than the receiving facility's supplier (see Sec.
117.405(c)). For clarity, Sec.  117.410(a) states this general
requirement for the supply-chain program in Sec.  117.405(a)(5), and
Sec.  117.405(c) provides the specific requirements that apply when a
supply-chain-applied control is applied by an entity other than the
receiving facility's supplier.

B. Appropriate Supplier Verification Activities ((Final Sec.
117.410(b))

    We proposed to require that appropriate supplier verification
activities include: (1) Onsite audits; (2) sampling and testing of the
raw material or ingredient, which may be conducted by either the
supplier or receiving facility; (3) review by the receiving facility of
the supplier's relevant food safety records; or (4) other appropriate
supplier verification activities based on the risk associated with the
ingredient and the supplier (proposed Sec.  117.136(c)(1)).
    (Comment 669) Some comments support the inclusion of onsite audits
as an appropriate supplier verification activity. However, other
comments oppose it, and ask us to remove the onsite audit requirement
from the supplier verification program, stating that Congress
prohibited FDA from requiring third parties to verify or audit
compliance with the rules. These comments express concern that the
supplier verification program effectively imposes an ``entire second
layer of regulation'' on produce farms that are supplying ingredients
to processors, and claim this is an unnecessary burden that is not
authorized by FSMA.
    (Response 669) We are retaining onsite audits as an appropriate
supplier verification activity. As noted in our memorandum on supplier
programs, onsite audits are commonly used by industry in the
verification of supplier performance (Ref. 83). Onsite audits provide
the opportunity to review the food safety plan and written procedures
and to observe the implementation of food safety procedures, as well as
to review the records related to the past application of control
measures, including laboratory test results. Audits also provide the
opportunity to interview employees to assess their understanding of the
food safety measures for which they are responsible. Thus, an audit can
provide for a more comprehensive assessment of food safety
implementation by a facility, and often is used in approving food
suppliers. Comments that oppose including onsite audits as a
verification activity are concerned that farms will be required to have
audits to verify that they are in compliance with produce safety
standards or facilities will be required to have audits to verify
preventive controls. These comments apparently refer to the provision
in section 419(c)(1)(E) of the FD&C Act that the regulation issuing
standards for the safety of produce ``not require a business to hire a
consultant or other third party to identify, implement, certify
compliance with these procedures, processes and practices,'' or the
provision in section 418(n)(3)(D) of the FD&C Act that the preventive
controls regulation ``not require a facility to hire a consultant or
other third party to identify, implement, certify or audit [preventive]
controls.'' The regulations proposed under section 419 of the FD&C Act
do not impose such

requirements. The requirements for supplier verification in this rule
(under section 418 of the FD&C Act) provide for audits as one supplier
verification activity. Although the rule does specify an annual onsite
audit as the appropriate supplier verification activity when a hazard
in a raw material or other ingredient will be controlled by the
supplier and is one for which there is a reasonable probability that
exposure to the hazard will result in serious adverse health
consequences or death to humans, the receiving facility is not required
to hire a third party to conduct the audit. Any qualified auditor,
other than the supplier, may conduct the audit, including an employee
of the receiving facility or another entity, such as an entity in the
supply chain between the supplier and the receiving facility. The rule
also provides that a receiving facility may determine and document that
other verification activities and/or less frequent onsite auditing of
the supplier provide adequate assurance that the hazards are controlled
(see Sec.  117.430(b)(1) and (2)). Audits already conducted on a
supplier's facility or operation for other business purposes may meet
the requirement for supplier verification. In addition, the rule
provides alternative requirements for verification of suppliers that
are farms that are not a covered farm under part 112 in accordance with
Sec.  112.4(a), or in accordance with Sec. Sec.  112.4(b) and 112.5
(see Sec.  117.430(d)). Finally, we have also provided that inspections
may substitute for an audit under specified circumstances (see Sec.
117.435(c)).
    While we realize that some farms may receive audits under the
supplier verification provisions of part 117, we note that farms that
might receive an audit because they are suppliers to a receiving
facility produce a limited subset of the total produce production that
comes from farms. These are products such as leafy greens for fresh-cut
processing operations and fruits and vegetables that are going into
ready-to-eat products like deli salads. These are products for which
there is a history of outbreaks and, therefore, good reason to do
appropriate supplier verification activities.
    (Comment 670) Some comments support the inclusion of sampling and
testing of the raw material or other ingredient as an appropriate
supplier verification activity, and note that verification testing is
more effective when conducted by the supplier than the receiving
facility because the supplier can control the lot of product tested.
However, other comments oppose it, stating that sampling and testing is
not useful for products with short shelf life, such as fresh produce.
    (Response 670) We are retaining sampling and testing as an
appropriate supplier verification activity. As noted in our memorandum
on supplier programs, sampling and testing are commonly used by
industry in the verification of supplier performance (Ref. 83). We have
previously discussed factors that impact the utility and frequency of
raw material/ingredient testing (see the Appendix published in the 2013
proposed human preventive controls rule (78 FR 3646 at 3818-3820);
republished in its entirety with corrected reference numbers on March
20, 2013, 78 FR 17142 at 17149-17151). We agree that there are benefits
in having sampling and testing conducted by the supplier, because the
supplier can then take appropriate action with respect to the findings,
including not shipping contaminated product. However, because
contamination with microbial pathogens is likely to be non-homogeneous
and the numbers of pathogens are likely to be low, a negative does not
guarantee the absence of contamination. This should be taken into
account when deciding which verification activity (or activities) is
appropriate. Because of the limitations of sampling and testing, the
controls the supplier has in place to minimize contamination, and the
management of those controls, are key in determining when sampling and
testing is appropriate as a verification activity. For short shelf life
products, where holding product pending test results can negatively
impact product shelf life, an onsite audit to verify control of hazards
may be more appropriate than sampling and testing.
    (Comment 671) Some comments ask us to specify in the regulatory
text that sampling and testing can be conducted by or on behalf of the
supplier or the receiving facility.
    (Response 671) The provisions of Sec.  117.415 specify the
responsibilities of the receiving facility, and allow a receiving
facility to conduct all supplier verification activities, including
sampling and testing. These provisions also provide that a supplier, or
an entity other than the receiving facility (such as an entity in the
supply chain between the supplier and the receiving facility), can
conduct sampling and testing, provided that the receiving facility
reviews and assesses the documentation provided by the supplier. The
rule places no restrictions on when a receiving facility, a supplier,
or an entity other than the receiving facility could have a business
relationship with a third party (such as a contract laboratory) to
conduct sampling and testing.
    (Comment 672) Some comments suggest that, for a facility regularly
undergoing audits, reviewing a ``supplier's relevant food safety
records'' should allow for the receiving facility to review
documentation related to pre-existing audits. These comments ask us to
revise the provision to add ``including, but not limited to, records
related to audits previously performed on the supplier's facility.''
    (Response 672) We decline this request. The comment misinterprets
what we mean by a ``supplier's relevant food safety records.'' The rule
provides for onsite audits as a verification activity, as well as
reviewing a ``supplier's relevant food safety records.'' When an annual
audit is determined to be an appropriate verification activity (see
Sec.  117.430(b)(1)), the audit would be reviewed by the receiving
facility, but a review of this audit is not what we meant by a
``supplier's relevant food safety records.'' As described in our
memorandum on supplier programs, food safety records are records
documenting that the food safety procedures that have been established
to control hazards are being followed and are adequately controlling
such hazards (Ref. 83). Thus, a receiving facility may obtain
documentation of a supplier's control measures for a particular lot of
a raw material or ingredient provided to the receiving facility, such
as the records created when a process control measure was applied. The
food safety records may also include supplier records that show that
the supplier's supplier has controlled a hazard. Such records may
include audits, for example, when the supplier's supplier controls the
hazard and the supplier's records include records of an audit conducted
with respect to the hazard control activities of the supplier's
supplier. To emphasize that the review of a supplier's relevant food
safety records can include records other than records of audits, we
have revised the documentation requirements applicable to review of a
supplier's food safety records to specify that the documentation must
include the general nature of the records reviewed (see Sec.
117.475(c)(9)). By ``general nature of the records reviewed,'' we mean
information such as ``records of process controls.''
    (Comment 673) Some comments support the inclusion of other
appropriate supplier verification activities based on the risks
associated with the ingredient and the supplier, because it provides
flexibility for

facilities to design risk-based programs that are appropriate for their
operations. Comments suggest other verification activities may include
receiving raw materials and other ingredients from a supplier without a
full audit report if the supplier maintains certification to a standard
recognized by GFSI; providing for documentary verification (such as
fact-specific questionnaires and representations exchanged between the
supplier and the receiving facility); and confirming that a facility,
especially a small manufacturing facility, is licensed by the
appropriate State or local regulatory authority.
    (Response 673) We are retaining this provision to allow other
appropriate supplier verification activities based on supplier
performance and the risk associated with the raw material or other
ingredient. We have revised the regulatory text to refer to ``supplier
performance and the risk associated with the raw material or other
ingredient'' because ``supplier performance'' is more appropriate than
``risk associated with the supplier.'' We use the term ``risk'' as
defined by the Codex Alimentarius Commission to be ``a function of the
probability of an adverse health effect and the severity of that
effect, consequential to a hazard(s) in food'' (Ref. 90). As discussed
in section XLIV.D, the considerations for supplier performance, which
can be related to the probability of a hazard in the raw material or
ingredient and the severity of adverse health effects that can result,
are broader than this.
    We agree that a supplier's certification to a GFSI scheme that
considers FDA food safety regulations can be a consideration in the
determination of the type and frequency of the verification activity
conducted. Similarly, fact-specific questionnaires and representations
exchanged between the supplier and the receiving facility can be a
consideration in the determination of the type and frequency of the
verification activity conducted. Confirming that a facility is licensed
by the appropriate State or local regulatory authority should not serve
as the only verification that a supplier is controlling the hazard,
because the requirements for a license and the degree of inspectional
oversight could vary greatly. We do provide for modified supplier
verification activities for qualified facilities, which are very small
businesses (Sec.  117.430(c)).

C. Purpose of Supplier Verification Activities for Raw Materials and
Other Ingredients (Final Sec.  117.410(c))

    We proposed to require that a supplier program include verification
activities, as appropriate to the hazard, and documentation of these
activities, to verify that: (1) The hazard is significantly minimized
or prevented; (2) the incoming raw material or ingredient is not
adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act; and (3) the incoming raw material or
ingredient is produced in compliance with the requirements of
applicable FDA food safety regulations (proposed Sec.
117.136(a)(3)(ii)). We have revised the provision to specify that the
supply-chain program must provide assurance that a hazard requiring a
supply-chain-applied control has been significantly minimized or
prevented. If the supply-chain program provides assurance that a hazard
requiring a supply-chain-applied control has been significantly
minimized or prevented, it is not necessary to also specify that the
incoming raw material or ingredient is not adulterated under section
402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act.
We also have deleted the requirement that the verification activities
must verify that the incoming raw material or ingredient is produced in
compliance with the requirements of applicable FDA food safety
regulations and instead focused that requirement as a factor that must
be considered in approving suppliers and determining the appropriate
supplier verification activities and the frequency with which they are
conducted rather than as one of the stated purposes of the supply-chain
program. See the regulatory text of Sec.  117.410(d)(i)(iii)(B).
    (Comment 674) Some comments ask us to revise this provision to
state that the receiving facility's use of the incoming raw material or
ingredient will not cause the finished food to be adulterated under
section 402 of the FD&C Act or misbranded under section 403(w) of the
FD&C Act. These comments assert that FSMA does not mandate, nor is it
reasonable to expect, that incoming raw materials and ingredients will
not be adulterated under section 402, and that it is acceptable for a
receiving facility to control the ``adulterating hazard,'' even if it
relies on the supplier to control other hazards.
    (Response 674) We decline this request. We acknowledge that in some
circumstances a receiving facility may rely on the supplier to control
certain hazards, while controlling other hazards itself. For example, a
receiving facility that produces peanut-derived products could rely on
its supplier for the control of the chemical hazard aflatoxin, but
control the biological hazard Salmonella through its own roasting
process. However, the supply-chain program applies to hazards requiring
a supply-chain-applied control, and the supply-chain program must
provide assurance that a hazard requiring a supply-chain-applied
control has been significantly minimized or prevented. In the example
where the receiving facility is relying on the supplier to control
aflatoxin, the provision would require the receiving facility to verify
that the hazard (aflatoxin) has been significantly minimized or
prevented by the supplier.

D. Factors That Must Be Considered When Approving Suppliers and
Determining Appropriate Supplier Verification Activities for Raw
Materials and Other Ingredients (Final Sec.  117.410(d))

    We proposed that in determining and documenting the appropriate
verification activities, the receiving facility must consider the