Managing Risk in the Global Supply Chain

The supply chain for food and beverage companies has grown to be truly global and interconnected. To offer customers new flavors, products, and ingredients, many businesses have expanded their geographic reach of sourcing ingredients and materials. But entering this vast network of suppliers means companies could be opening themselves up to more risks. FDA recognized these supply-chain complexities and risks when developing the Food Safety Modernization Act (FSMA). As a result, regulators are now requiring companies to take increased measures to ensure the safety of their food.

But even as food and beverage businesses comply with regulation, they must also control costs to stay competitive, so maintaining the efficiency and performance of their supply chain is crucial. The entire end-to-end process must be strategically planned and systematically managed with an emphasis on mitigating any risk from suppliers. Following are six steps to help you protect your business from supply-chain incidents:

1. Identify risks. The first step in managing supply-chain risk is evaluating your own current processes. Do you rely on your suppliers’ audits to verify their food safety practices? Or are second-party or third-party audits conducted? Is testing conducted in-house? Are certificates of analysis (COAs) relied upon? Where and how is information collected and tracked? Taking a critical look at your supply-chain management will not only help you to identify risks, it will pinpoint those with the greatest potential impact, enabling you to devote greater resources to these high-risk areas.
2. Implement FSVP. Recognizing that supply-chain control is critical in managing food safety risks, FDA developed two key rules under FSMA to address this — the Preventive Controls Rule and the Foreign Supplier Verification Program (FSVP). Manufacturers subject to the Preventive Controls Rule must assess supply-chain risks and verify that the risks are being controlled. If it is determined that the supplier is responsible for controlling a risk, the purchasing company must verify that the supplier is doing so effectively. FSMA’s FSVP is similar to the Preventive Controls Rule, except it shifts the burden of ensuring safe food to importers. It is FDA’s expectation that importers will have assessed risks in the supply chain and verified they are being controlled. Conducting the following will help ensure you are meeting these expectations:
   • Hazard Analysis: Look at any hazards present in ingredients, products, and packaging.
   • Risk Evaluation: Identify the types of microbiological, chemical, or physical risks posed, and identify who is responsible for controlling the risk (supplier, processor, or end customer). If the supplier is controlling the risk, it must be verified; if the customer assumes responsibility, FSMA requires a letter of assurance.
   • Use of Approved Suppliers: FDA can request to see a company’s list of approved suppliers and the method used for selection and approval.
   • Corrective Actions: For any supplier problem, corrective action must be taken and documented.
   • Implementation and Recordkeeping: Detailed recordkeeping is a common theme in FSMA, so confirm that records are updated regularly and are well organized.
3. Develop a FSMA approach. For supply-chain risk management, create a list of all ingredients, products, and primary packaging; perform a hazard analysis; document the results in records that can be presented to the FDA; and then assign responsibility for controlling the risks. For a supplier-verification program, compile a list of all suppliers and their manufacturing sites, and ensure onsite audits are conducted at each site where Class 1 risks are being controlled by the supplier. If this cannot be done, you must document why, and explain how the risk will be controlled through an alternative method, such as a testing program. Although a third-party audit can satisfy this requirement, it must be properly documented. Global Food Safety Institute (GFSI) standards are well-aligned with FSMA, so GFSI certification appears to satisfy FDA requirements. However, recently we have heard of situations where FDA is questioning that. COAs also may be used to control some supplier risks, but an accurate understanding of each COA is necessary, and it must be strong and reliable for any high-risk ingredients.
4. Assess existing suppliers. Not all suppliers present equal risks, so it is important to determine which risks are most significant and dedicate the most resources to these. Factors that impact risk can be grouped into three main areas: inherent ingredient risk (e.g., recurring history of problems, country of origin, etc.); supplier risk (their degree of risk control); and ingredient use (e.g., in high-profile or highly brand-associated products, in all products versus a select few, etc.).
5. Rank supplier risk. To rank supplier risks, collect information about their qualifications and certificates, onsite audit results, and any history of problems or regulatory actions. Then, understand how and where the ingredient is used in the production process. How many products does it affect? Does it impact flagship products or those strongly linked to the brand? What is the financial impact of a recall? Taking this approach allows you to not only protect yourself, but also optimize resources; identifying those entities that pose the greatest threats will help ensure risk management dollars are being spent based on an accurate and thorough risk assessment.
6. Collaborate with suppliers. The effectiveness of your supply-chain management lies, to some extent, in the ability to collaborate externally and internally. For new products in development, ensure that all teams involved are collaborating to identify potential risks proactively — not reactively — to understand both the ingredient and supplier risk. This may mean that a food safety manager needs to be involved in the early phases. If it is deemed that an ingredient poses a high risk, it, or the process, may need to be changed. While it is critical to assess new suppliers, it is just as important to monitor existing suppliers to ensure safety at every level of the supply chain. Develop a process to track and trend performance data (e.g., timeliness of deliveries, how well specifications are being met, COAs, corrective actions, etc.). Keep thorough records and analyze them frequently to look for warning signs that a supplier’s performance needs to be addressed.

Transitioning supply-chain management activities toward a more risk-based approach may require an initial investment of time and effort, but it will help you take a more proactive, risk-based and cost-effective stance on food safety. And it could be the very activity that helps your brand succeed even in the face of increasing supply-chain complexity.