| Product identity | The declared species, strain or biological material, plant part or fermentation substrate, and extraction method must be clearly defined. “Cordyceps extract” alone is not a sufficient identity specification. | Technical data sheet, scientific name, strain or culture description, process flow chart, sample label, and product specification. | All identity fields are completed and consistent across the specification, label, certificate of analysis, and purchase documents. | Mislabeling, substitution, ineffective material, or regulatory classification problems. |
| ISO 22000:2018 food safety system | ISO 22000:2018 specifies requirements for a food safety management system, including hazard control, communication, management responsibility, and continual improvement. Certification is issued by an independent certification body. | Valid certificate, certificate scope, covered site address, issue date, expiry date, and certification-body verification route. | Certificate is current, covers the actual manufacturing site and relevant extract category, and has no unresolved suspension or withdrawal. | Uncontrolled food-safety hazards and inability to demonstrate a functioning management system. |
| HACCP implementation | HACCP is based on seven Codex principles: hazard analysis, critical control points, critical limits, monitoring, corrective action, verification, and record-keeping. | HACCP plan, process flow diagram, hazard analysis, CCP records, corrective-action logs, verification records, and recent internal-audit report. | The plan covers receiving, extraction or fermentation, concentration, drying, packing, storage, and dispatch; critical limits are measurable and monitored. | Microbiological, chemical, physical, or allergen hazards may not be adequately controlled. |
| 21 CFR Part 111 readiness | For products intended to be marketed as dietary supplements in the United States, 21 CFR Part 111 establishes current good manufacturing practice requirements for manufacturing, packaging, labeling, and holding operations. | Written specifications, master manufacturing record, batch production record, laboratory controls, quality-control procedures, deviation records, complaint procedure, and finished-product release records. | Supplier can provide controlled records demonstrating identity, purity, strength, composition, and limits on contamination for each lot. | U.S. import, release, labeling, and inspection exposure; incomplete batch traceability. |
| Certificate of analysis | A COA should be lot-specific and linked to a defined specification. A generic or undated COA cannot establish conformity for a shipment. | Lot number, manufacture date, test date, methods, results, units, specification limits, laboratory identity, and authorized quality approval. | Every commercial lot has a complete COA; critical identity and contamination tests are supported by suitable methods and, where required, independent laboratory testing. | Release of nonconforming or adulterated material. |
| Identity and potency testing | Testing should distinguish the declared Cordyceps material from other fungi or carriers and quantify the product’s declared marker or active constituents using a validated or scientifically justified method. | Method description, chromatograms or reference-standard information where applicable, assay results, botanical or fungal identity test, and method-validation or verification summary. | Results meet the agreed product specification and are consistent with the declared extract ratio, marker level, and dosage form. | Economic adulteration, inconsistent potency, or inability to support product claims. |
| Contaminant control | The risk profile can include heavy metals, pesticides, residual solvents, mycotoxins, pathogenic microorganisms, total microbial count, and foreign matter. Applicable limits depend on destination, product form, and intended use. | Recent lot-specific results, analytical methods, laboratory accreditation details, environmental monitoring records, and supplier risk assessment. | All applicable destination-market limits are defined before purchase and every critical result complies with those limits. | Regulatory detention, product recall, consumer safety incident, or failed customer audit. |
| Allergen and cross-contact controls | The supplier must identify intentionally added allergens and assess unintentional cross-contact from shared equipment, air handling, storage, and packaging operations. | Allergen statement, facility allergen map, cleaning validation or verification records, changeover procedure, and ingredient declarations. | No undisclosed allergen risk; controls are documented and aligned with the destination-market labeling requirements. | Undeclared allergen exposure and incorrect labeling. |
| Traceability and recall capability | A robust system should connect raw-material lots, processing records, packaging materials, finished-product lots, and customers through one step forward and one step back. | Traceability procedure, example mock-recall report, lot-coding format, inventory records, and documented recall contacts. | Supplier can identify affected lots and distribution records promptly during a documented mock recall. | Slow or incomplete recall, expanded product exposure, and poor root-cause investigation. |
| Change control and notification | Changes to species or strain, substrate, extraction solvent, processing site, test method, packaging, or specification can affect safety, identity, and regulatory status. | Formal change-control procedure, notification timeline, requalification policy, and examples of approved changes. | No material change is implemented without written notification, impact assessment, and buyer approval where contractually required. | Unexpected product variation or loss of regulatory compliance. |
| Storage and transport stability | Extract quality may be affected by moisture, heat, oxygen, light, and packaging permeability. Storage conditions must be based on stability data rather than a generic recommendation. | Stability protocol, available real-time or accelerated data, packaging specification, temperature and humidity requirements, and transport risk assessment. | Defined shelf life, storage conditions, packaging controls, and deviation procedure are documented and suitable for the shipping route. | Loss of potency, moisture-related microbial growth, caking, or shortened shelf life. |
| Global regulatory fit | Requirements vary by destination. A U.S. dietary-supplement pathway, an EU food or novel-food assessment, and other national pathways should not be treated as interchangeable. | Destination-market regulatory assessment, ingredient status review, label review, permitted-claims review, import documents, and country-of-origin records. | The intended use, product category, claims, documentation, and import route are reviewed for every target market before commercialization. | Customs delay, noncompliant claims, market withdrawal, or refusal of entry. |
| Supplier qualification score | A weighted assessment improves consistency when comparing suppliers without relying on price alone. | Completed questionnaire, document review, sample evaluation, audit report, corrective-action plan, and quality agreement. | Suggested decision rule: 80–100 = approve; 65–79 = conditional approval with corrective actions; below 65 = do not approve. Any critical food-safety failure overrides the total score. | Inconsistent supplier decisions and acceptance of unresolved critical risks. |
