Receiving and Supplier-Program Check

A pre-audit run-through of your supplier program and receiving records — approved-supplier list, supplier verification and COAs, complete receiving logs, and a hold procedure — checked against FDA's supply-chain rule.

Work this list against your actual supplier files and receiving records before an FDA preventive-controls inspection, or before a GFSI audit reviews how you qualify suppliers and take in ingredients. Read each item against what your program really does today and tick it only when the records back it up, so the ones you cannot tick become your fix list. This checklist backs up the lesson on receiving with QC checks, which walks the receiving-and-hold flow step by step.

This is the FDA preventive-controls baseline — confirm your case at the source

These items cover the supply-chain program in 21 CFR Part 117, Subpart G, together with the raw-material receiving duties in Subpart B, for human food made under FDA's preventive-controls rule. A meat, poultry, or egg product regulated by USDA's FSIS follows a different scheme, and a GFSI standard such as SQF can ask for more than this floor. This is a separate thing from FSMA 204, the Food Traceability Rule — that rule's own recordkeeping, with records retrievable within 24 hours of an FDA request, carries a compliance date of July 20, 2028, extended from January 2026. Dollar thresholds and covered-food details move, so read the current section at the source before you rely on a point below. Verified July 2026.

Do this in your operation

You know exactly which ingredients need a supplier program — your hazard analysis decided that, not habit. Confirm your hazard analysis names each raw material and ingredient that carries a hazard requiring a supply-chain-applied control, and that your supply-chain program covers those and only those. Under 21 CFR 117.405 the program is required only where the hazard is meant to be controlled by the supplier rather than by a preventive control in your own plant — so an ingredient you fully control in-house does not belong on the list, and one you rely on the supplier for does.
The supply-chain program is written down. Confirm the program exists as a written document, not a set of practices in one person's head — §117.405 requires it in writing, and an auditor reads the document, not your intentions.
An approved-supplier list exists, and every supplier was approved and documented before you received from them. Confirm you keep a current list of approved suppliers for the covered ingredients, and that each approval was made and written down before the first receipt from that supplier — 21 CFR 117.420 puts approval ahead of receiving, not after the pallet is already in the cooler. The supplier qualification form is where you make and record each approval before that first receipt.
Written receiving procedures keep covered materials coming only from approved suppliers. Confirm you have written procedures for receiving raw materials and ingredients, that your team actually follows them, and that following them is documented (21 CFR 117.420). The procedures have to ensure covered materials arrive only from approved suppliers.
Anything taken in from an unapproved supplier on a temporary basis is verified before it is used. Confirm that on the rare occasion you receive a covered ingredient from an unapproved supplier as a stopgap, that material is put through adequate verification before it is accepted for use, and that this is documented (21 CFR 117.420). "We ran out, so we grabbed a pallet from someone else" is only defensible if you held and verified it first.
Each supplier has a chosen, documented verification activity that actually runs. Confirm that for every approved supplier you have determined an appropriate verification activity — an onsite audit, sampling and testing, a review of the supplier's relevant food safety records, or another activity fit to the risk — set how often it happens, and conducted it before first use and periodically since (21 CFR 117.410 and 117.430).
A supplier controlling a serious hazard gets an onsite audit at least yearly — or a written reason it does not. Confirm that where a supplier is the one controlling a hazard with a reasonable probability of serious adverse health consequences or death, you conduct an onsite audit before first use and at least once a year afterward, or you hold a written determination that other verification activities give adequate assurance instead (21 CFR 117.430). Verified July 2026.
Certificates of analysis are collected against your spec and checked, not just filed. Confirm you receive a certificate of analysis or conformance for the ingredients your spec calls for, that someone compares each one against the spec before the lot is released, and that you treat the COA as evidence for a verification activity rather than an automatic substitute for one. Part 117's supply-chain program names sampling and testing and records review as verification activities but never the certificate itself, so a COA alone may not be adequate verification for a serious hazard.
Every receipt is logged with the facts a trace needs. Confirm each incoming lot is recorded with the supplier, the material, the supplier's lot or date code, the quantity, the receiving date, who received it, and its condition on arrival — including temperature where that matters. These are the records that later let you tie a finished batch back to a specific supplier lot.
Incoming material is inspected on arrival and the check is written down. Confirm received raw materials are inspected and handled to confirm they are clean and suitable before they go into usable stock, with condition, allergen, and any temperature checks recorded — 21 CFR 117.80 requires raw materials be inspected and segregated or otherwise handled to ascertain they are clean and suitable for processing.
The supply-chain program records are complete and someone reviews them. Confirm you hold the full record set the rule lists — the written program, supplier approvals, receiving procedures and evidence they are followed, verification-activity records, and the actions taken on any supplier non-conformance — and that a qualified person reviews them (21 CFR 117.475). Records you cannot produce on the day read to an auditor as records you do not keep.
A written hold procedure keeps unverified material from being used by accident. Confirm you have a procedure that segregates or otherwise holds received material — on the floor or in your system — until it has passed its receiving checks and any pending supplier verification, so nothing gets pulled into a batch before it clears. Both 21 CFR 117.80 and 117.420 turn on holding material out of use until it is confirmed suitable.
Material that fails a check is identified, segregated, and its disposition recorded. Confirm nonconforming or rejected lots are clearly marked and kept apart from usable stock, that their disposition — reject, return, rework, or destroy — is decided and recorded, and that a supplier's failure to control its hazard triggers prompt, documented action (21 CFR 117.410).
Allergen raw materials and rework are identified and held to prevent cross-contact. Confirm every allergen-bearing raw material, and any rework that contains an allergen, is identified and stored so it cannot cross-contact other materials — 21 CFR 117.80 makes this a receiving-and-storage duty, not only a production-line one.

Mark this page complete