§ 117.405 Requirement to establish and implement a supply-chain program.

(a)(1) Except as provided by paragraphs (a)(2) and (3) of this section, the receiving facility must establish and implement a risk-based supply-chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain-applied control. (2) A receiving facility that is an importer, is in compliance with the foreign supplier verification program requirements under part 1, subpart L of this chapter, and has documentation of verification activities conducted under § 1.506(e) of this chapter (which provides assurance that the hazards requiring a supply-chain-applied control for the raw material or other ingredient have been significantly minimized or prevented) need not conduct supplier verification activities for that raw material or other ingredient. (3) The requirements in this subpart do not apply to food that is supplied for research or evaluation use, provided that such food: (i) Is not intended for retail sale and is not sold or distributed to the public; (ii) Is labeled with the statement “Food for research or evaluation use”; (iii) Is supplied in a small quantity that is consistent with a research, analysis, or quality assurance purpose, the food is used only for this purpose, and any unused quantity is properly disposed of; and (iv) Is accompanied with documents, in accordance with the practice of the trade, stating that the food will be used for research or evaluation purposes and cannot be sold or distributed to the public. (b) The supply-chain program must be written. (c) When a supply-chain-applied control is applied by an entity other than the receiving facility's supplier (e.g., when a non-supplier applies controls to certain produce (i.e., produce covered by part 112 of this chapter), because growing, harvesting, and packing activities are under different management), the receiving facility must: (1) Verify the supply-chain-applied control; or (2) Obtain documentation of an appropriate verification activity from another entity, review and assess the entity's applicable documentation, and document that review and assessment.