21 CFR 117.405
Requirement to establish and implement a supply-chain program
21 CFR 117.405 is the regulation titled “Requirement to establish and implement a supply-chain program” in 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. Since 2021, 1 FDA warning letter has cited it.
- Letters citing it
- 1 since 2021
- Jan 1 to Oct 30, 2026
- 0 against 0 on the same dates in 2025
- Most often cited with
- 21 CFR 101.3, in 1 letter
- Closed out
- 100% of these letters have a published close-out
Letters citing it, by year issued
It is a drug letter. 2026 runs to Oct 30, 2026. Pick a year to see its letters.
- 02021
- 02022
- 12023
- 02024
- 02025
- 02026
The regulation
Read the text of 21 CFR 117.405 (eCFR, as of Sep 1, 2026)
(a)(1) Except as provided by paragraphs (a)(2) and (3) of this section, the receiving facility must establish and implement a risk-based supply-chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain-applied control.
(2) A receiving facility that is an importer, is in compliance with the foreign supplier verification program requirements under part 1, subpart L of this chapter, and has documentation of verification activities conducted under § 1.506(e) of this chapter (which provides assurance that the hazards requiring a supply-chain-applied control for the raw material or other ingredient have been significantly minimized or prevented) need not conduct supplier verification activities for that raw material or other ingredient.
(3) The requirements in this subpart do not apply to food that is supplied for research or evaluation use, provided that such food:
(i) Is not intended for retail sale and is not sold or distributed to the public;
(ii) Is labeled with the statement “Food for research or evaluation use”;
(iii) Is supplied in a small quantity that is consistent with a research, analysis, or quality assurance purpose, the food is used only for this purpose, and any unused quantity is properly disposed of; and
(iv) Is accompanied with documents, in accordance with the practice of the trade, stating that the food will be used for research or evaluation purposes and cannot be sold or distributed to the public.
(b) The supply-chain program must be written.
(c) When a supply-chain-applied control is applied by an entity other than the receiving facility's supplier (e.g., when a non-supplier applies controls to certain produce (i.e., produce covered by part 112 of this chapter), because growing, harvesting, and packing activities are under different management), the receiving facility must:
(1) Verify the supply-chain-applied control; or
(2) Obtain documentation of an appropriate verification activity from another entity, review and assess the entity's applicable documentation, and document that review and assessment.
[80 FR 56145, Sept. 17, 2015; 81 FR 3956, Jan. 25, 2016]
Text from eCFR as of Sep 1, 2026.
Cited alongside it
Regulations that appear in the same letters as 21 CFR 117.405.
- 21 CFR 101.3Identity labeling of food in packaged form1 letter cites both
- 21 CFR 101.4Food; designation of ingredients1 letter cites both
- 21 CFR 101.5Food; name and place of business of manufacturer, packer, or distributor1 letter cites both
- 21 CFR 101.54Nutrient content claims for “good source,” “high,” “more,” and “high potency.”1 letter cites both
- 21 CFR 101.7Declaration of net quantity of contents1 letter cites both
- 21 CFR 101.9Nutrition labeling of food1 letter cites both
- 21 CFR 117.126Food safety plan1 letter cites both
- 21 CFR 117.130Hazard analysis1 letter cites both
Latest letters citing it
The letter citing 21 CFR 117.405 that FDA posted most recently.
See the letter citing 21 CFR 117.405 →Put this kind of reading to
work on your own records.
Botable builds and runs a custom AI layer around the software you already use, so your team can do the job you hired them for.
Counts include every citation in a letter, as the Letters filter does. How this database is built.