TL;DR
One of the most fundamental rules in food safety is that food must come from an approved source — a supplier that complies with applicable law and is subject to regulatory oversight. Under the FDA Food Code §3-201.11, food shall be obtained from sources that comply with law, and food prepared in a private home may not be used or offered for sale in a food establishment. "Approved" does not mean a specific government seal on every item; it means the source is acceptable to the regulatory authority because it operates under recognized public-health standards and inspection. The rule exists because contamination often enters the food supply long before food reaches the kitchen, so buying only from legitimate, regulated suppliers is a frontline defense against foodborne illness. Different categories of food carry specific approved-source expectations: shellfish must come from approved, tagged sources; fish intended to be served raw must be frozen for parasite destruction by the supplier or on premises with required records, unless exempt under the Food Code; milk must be Grade A and pasteurized; shell eggs must be clean, sound, and meet grade requirements; and game or wild mushrooms carry extra approval requirements. For a food handler, the practical takeaway is simple: know your suppliers, check that deliveries come from legitimate regulated vendors, and never accept or use food from an unapproved or home source.
What "approved source" means
The phrase "approved source" is defined functionally, not by a single certificate. In Food Code terms, "approved" means acceptable to the regulatory authority based on a determination of conformity with principles, practices, and generally recognized standards that protect public health. In practice, an approved source is a supplier — a processor, distributor, farm, or manufacturer — that operates legally and under the kind of inspection and standards that let a health inspector trust the food it provides.
Section 3-201.11(A) of the Food Code states the core rule plainly: food shall be obtained from sources that comply with law. The flip side is §3-201.11(B): food prepared in a private home may not be used or offered for human consumption in a food establishment. That is why a restaurant cannot serve a pie a cook baked at home, or jam a neighbor made in an unregulated kitchen — those sources are not subject to regulatory oversight and cannot be verified. This is distinct from the temperature and inspection checks done when a delivery arrives; approved source is about where the food legitimately came from, not the condition it is in on arrival. For those receiving procedures, see our guide to receiving and inspecting deliveries.
Why the rule matters
Approved source is a frontline defense because much of the risk in food is determined before it ever reaches a kitchen. Contaminants — pathogens, chemical residues, toxins, undeclared allergens — often enter during growing, harvesting, processing, or distribution. A cook cannot inspect their way out of contamination that happened upstream; cooking to the right temperature kills many pathogens but does not undo, for example, a chemical contaminant or a toxin.
By requiring that food come only from legitimate, regulated suppliers, the approved-source rule pushes safety controls back to the points where they are most effective. A licensed processor is inspected, keeps records, and can be traced and recalled if a problem emerges; an unregulated home kitchen or an unknown vendor cannot. This traceability is also what makes recalls possible: when food comes from an approved, documented source, a contaminated lot can be identified and pulled. For how temperature control complements source control once food is in the building, see our guide to the temperature danger zone.
Approved-source rules by food category
While the general rule is simple, the Food Code sets specific expectations for higher-risk categories:
| Food | Approved-source expectation |
|---|---|
| Molluscan shellfish (oysters, clams, mussels) | From approved sources; kept with shellstock identification tags |
| Fish served raw or undercooked | Supplier-frozen to parasite-destruction standards, frozen on premises with records, or exempt under the Food Code |
| Milk and dairy | Grade A and pasteurized |
| Shell eggs | Clean, sound, and meeting grade requirements; received refrigerated |
| Game animals | Raised, slaughtered, and processed under regulatory inspection |
| Wild mushrooms | Identified as safe by an approved mushroom identification expert |
The Food Code sets a common exam point for shellfish: molluscan shellfish must arrive with shellstock tags identifying the harvester and harvest location, and those tags must be kept on file for 90 days so a shellfish lot can be traced in an illness investigation. Fish to be served raw, as in sushi, must come frozen from a supplier under a documented freezing process, because freezing is what destroys parasites.
What this looks like on the job
For a working food handler, approved source is mostly about vigilance at the back door and in purchasing. Food should arrive from recognizable, licensed vendors — distributors and processors your establishment has an account with — not from someone selling out of a personal vehicle or a home operation. When a delivery arrives, part of receiving is confirming it came from the expected approved supplier and that packaging, labels, and shellfish tags are intact.
A food handler who is unsure whether something came from an approved source should ask the person in charge rather than use it. The safest default is that if a source cannot be verified as legitimate and regulated, the food is not used. This connects directly to the person in charge's duties, since verifying approved sources and supervising receiving are part of active managerial control. For that role, see our guide to the person in charge and certified food protection manager.
Frequently Asked Questions
- What is an approved source in food safety?
- An approved source is a supplier that complies with applicable law and is acceptable to the regulatory authority because it operates under recognized public-health standards and inspection. Under FDA Food Code §3-201.11, food must be obtained from sources that comply with law. It is not a single certificate on each item — it means the processor, distributor, farm, or manufacturer is legitimate, regulated, and traceable.
- Why can't a restaurant serve food made in someone's home?
- Because §3-201.11(B) of the Food Code says food prepared in a private home may not be used or offered for human consumption in a food establishment. A home kitchen is not subject to regulatory inspection, so its food cannot be verified or traced. That is why a business cannot serve home-baked goods, home-canned items, or a dish a cook prepared at home, even if it seems safe.
- Do oysters and clams have special source rules?
- Yes. Molluscan shellfish must come from approved sources and arrive with shellstock identification tags showing the harvester and harvest location. Those tags must be kept on file, typically for 90 days, so a specific lot can be traced if an illness investigation occurs. Shellfish is a frequent exam topic precisely because of this tagging and traceability requirement.
- Does buying from an approved source mean I don't have to check the food?
- No. Approved source is about where the food legitimately came from; it does not replace receiving checks for temperature, condition, packaging, and dates when a delivery arrives. Both matter: a shipment can come from a proper supplier but still be rejected on arrival if it is at an unsafe temperature or the packaging is damaged. Source control and receiving inspection work together.
- Why is fish for sushi required to be frozen?
- Fish intended to be served raw or undercooked must be frozen for parasite destruction by the supplier or on premises with required records, unless the fish is exempt under the Food Code, because proper freezing destroys parasites that cooking would otherwise handle. Since raw fish is never cooked, freezing is the control step. The Food Code allows such fish to be offered only when it is obtained from a supplier that freezes it to the required parameters or it is frozen on premises under those parameters with records kept.
- What should I do if I don't know where food came from?
- Do not use it — ask the person in charge. The safest default is that food which cannot be verified as coming from a legitimate, regulated source is not served. Verifying approved sources is part of the person in charge's active managerial control, so escalating an unknown or suspicious source is the correct action rather than assuming it is fine.
Bottom Line
Approved source is a foundational food-safety rule: under FDA Food Code §3-201.11, food must come from suppliers that comply with law and are acceptable to the regulatory authority, and food prepared in a private home may not be served in a food establishment. The rule matters because contamination often enters upstream during growing, processing, or distribution, where a cook cannot fix it — so buying only from legitimate, regulated, traceable suppliers is a frontline defense and is what makes recalls possible. Specific categories carry specific expectations: shellfish from approved sources with shellstock tags, raw-service fish frozen by the supplier or on premises with required records unless exempt, Grade A pasteurized milk, graded shell eggs, and inspected game or expert-identified wild mushrooms. On the job, it means sourcing from recognized licensed vendors, confirming deliveries came from approved suppliers, and escalating anything unverified to the person in charge. For related topics, see our guides to receiving and inspecting deliveries, the temperature danger zone, and the person in charge.
Source: FDA Food Code 2022 (full document) · Food Code §3-201.11 Compliance with Food Law (codified, Cornell LII) · FDA Retail Food Protection — Food Code