A certificate is one input to a supply-chain program

The program starts in the hazard analysis

21 CFR 117.405(a)(1) requires a receiving facility to “establish and implement a risk-based supply-chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain-applied control.” Section 117.3 defines a supply-chain-applied control as a preventive control for a hazard in a raw material or other ingredient “when the hazard in the raw material or other ingredient is controlled before its receipt,” and § 117.405(b) requires the program to be written.

The trigger is therefore an outcome of the facility’s own hazard analysis: a hazard, identified by the facility, that someone upstream controls. Whether an ingredient needs a supply-chain program at all is not something a supplier can state, a certificate can settle or a product page can decide. The facility records it, with its reasoning. What follows in this guide applies where that determination has been made; where it has not, the determination comes before any request to a supplier.

Who counts as the “supplier”

§ 117.3 defines the supplier as “the establishment that manufactures/processes the food, raises the animal, or grows the food that is provided to a receiving facility without further manufacturing/processing by another establishment, except for further manufacturing/processing that consists solely of the addition of labeling or similar activity of a de minimis nature.” The same section’s examples of manufacturing/processing include both packaging and labeling. FDA’s draft supply-chain chapter states the consequence for intermediaries: under subpart G, “entities such as brokers, produce aggregators, food distributors, and cold storage facilities are neither receiving facilities that are required to establish a supply-chain program nor suppliers, because such entities are not manufacturers/processors.”

The same chapter recommends that a facility buying through a broker or distributor “ask the broker or distributor to provide you with information that allows you to approve the establishment that manufactures/processes the food.” Where material is repackaged or relabelled between the producer and the plant, which establishment is the supplier in the rule’s sense is a real question, answered from the definition and the facts rather than from the name on the invoice, and it belongs in writing between the facility’s preventive controls qualified individual and the counterparty. This guide makes that determination for no one, Alliance included. The chapter is a 2018 draft marked on every page as nonbinding and not for implementation; it describes the regulation and adds no requirement to it.

What stays with the receiving facility

§ 117.415(a) is direct about ownership: “The receiving facility must approve suppliers,” and, subject to two exceptions, must “determine and conduct appropriate supplier verification activities, and satisfy all documentation requirements of this subpart.” § 117.410(b) lists the activities that count: onsite audits; sampling and testing of the raw material or other ingredient; review of the supplier’s relevant food safety records; and other activities based on supplier performance and risk. § 117.420 requires approval to be documented before the material is received, and written receiving procedures to be established, followed and documented. Where the supplier controls a hazard for which there is “a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans,” § 117.430(b) makes the verification activity an onsite audit before first use and at least annually thereafter, unless a written determination supports other activities or less frequent auditing.

§ 117.415(b) then closes the obvious shortcut. A receiving facility may not accept, as a supplier verification activity, the supplier’s own determination of the verification it needs, an audit conducted by the supplier, the supplier’s review of its own food safety records, or other verification the supplier conducts for itself. A supplier’s procedures and practices are among the performance factors § 117.410(d) requires a facility to consider when it approves a supplier, so what a supplier says about itself can inform the approval. Under paragraph (b) it cannot be the verification.

Where a certificate fits, and what it has to carry

The one place subpart G lets a supplier’s own work count toward verification is testing. § 117.415(a)(4): “The supplier may conduct and document sampling and testing of raw materials and other ingredients, for the hazard controlled by the supplier, as a supplier verification activity for a particular lot of product and provide such documentation to the receiving facility, provided that the receiving facility reviews and assesses that documentation, and documents that review and assessment.” Three conditions sit in that sentence: the testing addresses the hazard the supplier controls, it is for a particular lot, and the facility’s review and assessment is itself a record.

§ 117.475(c)(8) lists what documentation of sampling and testing must include: identification of the material tested, “including lot number, as appropriate,” and the number of samples tested; the tests conducted, including the analytical methods used; the dates of testing and the date of the report; the results; corrective actions taken in response to detection of hazards; and information identifying the laboratory. Read a certificate against that list. A typical or sample certificate describes what a product has generally looked like and reports no particular lot, so it cannot be documentation of testing for a particular lot: a sample COA is not a lot certificate. FDA’s draft chapter gives a COA as an example of such documentation, “whether of periodic testing or lot-by-lot testing,” and recommends that it document that major analytical parameters for the lots in a specific shipment have been met. How to read the results on a lot certificate—actual values against conformance statements, reporting limits against zeros—is set out in this library’s laboratory and pharmaceutical research collection under “Reading a lot certificate for a monograph product,” and is not repeated here.

What to ask for, and what nobody can send

Alliance sends a Certificate of Analysis when a customer asks, at no charge. For a facility that will review it under subpart G, the request should name the lot, the analytes and methods, the units and reporting limits, and ask for actual results rather than a statement of conformance. Ask separately for what the facility needs to identify the establishment that manufactured or processed the material, and whether it was repackaged or relabelled before delivery. What can be provided depends on the particular product, and the answer belongs in the approval file either way.

What no supplier can send is the facility’s part of the program: its hazard analysis, its approval of the supplier, its choice and frequency of verification activity, and its documented review and assessment of whatever it receives. Nothing here states that any Alliance product, facility or document satisfies a requirement of part 117, that Alliance is or is not a supplier within § 117.3 for any transaction, or that any Alliance product is suitable, approved or recommended for use in food. This is source-based editorial guidance, no original testing was performed for it, and independent specialist review is pending.

• Has the hazard analysis identified a hazard in this material that is controlled before receipt, and who recorded that determination?
• Which establishment manufactured or processed the material, and was it repackaged or relabelled on the way?
• Which verification activity was chosen for this supplier, at what frequency, and who approved the supplier?
• Does the lot document carry the lot number, sample count, methods, dates, results and laboratory, and who reviews and assesses it?

Requirement → evidence → decision boundary

An editorial checklist for your review—not a table of product specifications.

Revision record

1.0 · September 14, 2026 — Source-based editorial edition. No original testing or product qualification is claimed.

For food and beverage manufacturers, their preventive controls qualified individuals and purchasing teams specifying ingredients, processing aids and utility chemistry. This collection does not determine the regulatory status of any use, perform a hazard analysis, approve or verify a supplier, set a use level, dose or feed rate, write a cleaning procedure, or establish that any material is fit for use in food or on food-contact equipment.