9.1 Approved Suppliers and Purchasing Controls

Food that enters a food establishment has to come from an approved source. FDA Food Code 3-201.11 states the rule in one sentence: food shall be obtained from sources that comply with law. Compliance is not a marketing claim on a van door. It means the supplier is licensed or otherwise authorized, is inspected when the law requires inspection, and can document that the product was produced, packed, and transported under those rules. The Person in Charge (PIC) owns that decision at purchasing, not after the first customer complaint.

An approved source is the first control in the flow of food. Time and temperature later on the line cannot repair product that started as uninspected, untagged, or home-prepared. A receiving clerk who is excellent with a thermometer still fails if the product should never have been on the truck.

Approved Source Means Legal and Inspected

CFPM courses treat approved source as a three-part test the PIC can explain to an inspector:

1. The supplier complies with law — a food processing plant, a permitted distributor, a USDA-inspected meat establishment, a National Shellfish Sanitation Program (NSSP) dealer, or another legally recognized source.
2. The supplier is inspected when inspection is required. A friendly farm and a clean pickup truck are not, by themselves, an approved source.
3. The product arrives with the documents that prove those first two points — invoices, inspection legends, shellstock tags, grade marks, parasite-destruction letters, and process-control records when the hazard demands them.

Inspect supplier facilities when the operation can. A walk-through of a produce house, a commissary, or a seafood dealer is not a courtesy visit. Look at pest control, cold-holding equipment, ice quality, hand sinks, and how the supplier will handle a recall. Review invoices for the legal name of the source, lot codes, and dates. Ask for the supplier's HACCP or process-control summary when the product is high risk. Ask, in writing, how the supplier will notify you during a recall. Then look at the delivery truck before you look at the invoice. Dirty walls, raw juices on the floor, no working refrigeration, or chemicals riding next to ready-to-eat (RTE) food are purchasing failures, not receiving surprises.

Build an approved-supplier list and buy from that list. Adding a vendor is a documented decision: permit or inspection evidence, product list, delivery standards, recall contact, and a backup supplier for the same item. Taking a one-off case from an unknown truck because the price is good is how an unapproved source enters the cooler.

Home Kitchens Are Not Approved

Food Code 3-201.11(B) is blunt. Food prepared in a private home may not be used or offered for human consumption in a food establishment. A cook's weekend salsa, a baker's home cakes, a server's family kimchi, and a manager's leftover chili are not approved sources. A CFPM certificate, a labeled container, a cooled pot, or a "staff meal only" story does not convert a house kitchen into an inspected plant.

Cottage-food laws in some jurisdictions allow limited sales of specific non-TCS foods from a home. That is a legal exception written by a legislature, not a general CFPM permission. Unless the operation has documented that a product is sold under an applicable cottage-food rule and the regulatory authority accepts it, treat home-prepared food as unapproved. On this exam, home-prepared food is a reject.

Product-by-Product Source Rules

Some foods have extra source rules because the hazard is already in the product when it leaves the water, the field, or the plant.

Molluscan Shellfish

Live oysters, clams, mussels, and whole-uncut scallops must come from listed, approved waters under the NSSP and from a certified dealer. Harvest from a closed or unlisted bed is not an approved source, even if the oysters look clean and the ice is fresh. Identification tags travel with the container. Untagged shellstock is not an approved, identifiable source at receiving — section 9.3 turns that into an automatic rejection.

Mushroom Species

Commercially cultivated mushrooms from an inspected grower are the ordinary approved source. Wild mushroom species are different. Food Code 3-201.16 requires that mushrooms picked in the wild come from sources where each mushroom is individually inspected and found safe by an approved mushroom identification expert. A forager's handwritten note, a "we always pick these," or a phone photo is not that expert inspection.

Meat, Poultry, Eggs, and Dairy

Meat and poultry must come from plants under USDA (or equivalent) inspection and arrive with the inspection legend. Eggs come from regulated producers and should arrive clean, uncracked, and with the applicable USDA grade mark. Fluid milk and most dairy products used in a food establishment must be pasteurized and come from a permitted dairy plant. Raw-milk cheese has narrow legal exceptions; do not invent a general "raw dairy is fine if it is local" rule.

Fish

Fish must be commercially and legally harvested or otherwise approved. If the operation will serve fish raw or undercooked, purchasing also requires a supplier who can document parasite destruction (the sushi-grade / freezing letter under Food Code 3-402.11). A fish that is merely cold and pretty is not automatically approved for raw service.

Trust but Verify: The Cheap Produce Vendor

A new vendor offers tomatoes, herbs, and cut lettuce at a price well below the approved distributor. The boxes look fine. The driver is friendly. The vendor cannot produce an inspection report, a permit, or any evidence that a regulatory authority has seen the packing shed.

That is a fail. Price, appearance, and a clean handshake do not create an approved source. Cut lettuce is a time/temperature control for safety (TCS) product. Uninspected water, an ill packer, or a recall the vendor will never hear about becomes the operation's outbreak. The PIC refuses the delivery, keeps the current approved supplier, and does not add the vendor to the list until inspection and documentation exist.

The same trust-but-verify rule applies to vendors already on the list. Review invoices against what actually arrived. Confirm that the name on the case matches the approved list. Watch the truck: leaking raw-poultry boxes over RTE produce, no working refrigeration, or pest evidence in the cargo area means the supplier's control failed before your cooler door opened.

Special-Process Suppliers

Some products need more than a general grocery license.

Sprouts — alfalfa, mung bean, clover, and similar seed sprouts — have a well-documented Salmonella and STEC history. A supplier who sprouts seeds must follow approved controls: treated seed, sanitary water, temperature control, and a recall plan. Sprouting seeds or beans inside the food establishment is a special process that generally needs a variance and a HACCP plan. Do not buy unlabeled bulk sprouts from an unknown grower because they are "just produce."

Reduced-oxygen packaging (ROP) and other modified-atmosphere packs create a Clostridium botulinum and Listeria monocytogenes risk if the supplier's process is sloppy. Buy ROP fish, sous-vide items, and vacuum-packed TCS foods only from processors who follow approved controls, label the pack correctly, and keep the cold chain. If your own kitchen will do ROP, that is a later special-process chapter. Purchasing is not the place to accept an unlabeled vacuum bag from a neighbor's garage.

Juice that has not been treated for a 5-log pathogen reduction, packaged seafood, and other high-risk processed foods follow the same idea: the supplier's process control is part of your approved-source decision.

Required Source Documentation

Purchasing controls exist so receiving has something legal to inspect. The next section is what the clerk does when the truck door opens.