Technically, the FDA regulates precisely one thing: labelling. They regulate what can be marketed as a name with a conventional meaning ("cheese" or "beef") or what claims can be made about a product in its marketing ("treats headaches", etc.)
The FDA audit for adulteration because e.g. "beef with high levels of thyroid hormone in it" isn't what people expect to be getting if they buy something called "beef." If you label the product as "beef with high levels of thyroid hormone in it", then it's fine! (Same reason "Cheez Whiz" isn't legally able to market itself as "cheese" — it doesn't contain what people expect "cheese" to conventionally contain.)
The FDA audit for drug safety and efficacy because you can't say "makes your headache go away" if it actually doesn't; and you can't leave out "causes cancer in 1/10th of people who take it" if it does. (And for a novel substance, you can't know what claims you're able to make or leave out, without first doing a trial; so any claims you make are considered invalid by default without such a trial.)
If you don't make any claims, you don't have to prove safety or efficacy. Supplements are just drugs that don't make any claims.
This is also why there are products on the market that contain the active ingredients of prescription-only drugs, but are freely purchasable — these aren't marketed as being for human consumption. (GBL, a recreational drug related to GHB, is sold on the open market as a "brake-drum cleaning fluid." And it actually does work as a brake-drum cleaning fluid, so it's not like the FDA can challenge that.)
If you're wondering about making drugs illegal: the FDA doesn't (and can't) do that. The DEA does that.
If you're wondering about making drugs "controlled substances": Congress does that. Then the DEA and the FDA both enforce those rules — the DEA by preventing importation; and the FDA by preventing drugs from being marketed for sale that contain that active ingredient — basically treating it as an adulterant regardless of labelling. (Note that these are both commercial trade activities that are being restricted. Any chemical, no matter its controlled status, can be created, possessed, handled, and consumed within the confines of a secure facility — "secure" meaning that the facility takes measures to ensure that the substances won't leave the premises. This is how e.g. MDMA trials are able to continue at some universities, despite MDMA being a controlled substance.)
If you're wondering about making drugs prescription-only: the FDA does determine this, but only kinda. More like, the Act of Congress that defines the FDA into existence, also defines the rules for whether a drug should be prescription-only. Drug companies are aware of the rules, and so they usually just make the drug prescription-only when it should be. The FDA is charged with catching violations, where a drug that should be prescription-only was marketed OTC. (What is the rule itself? It basically boils down to "if the necessary claims made by the drug are arcane and/or subtle enough, that a non-medically-trained lay-person couldn't reasonably be expected to evaluate their own safety in taking the drug, without a medical professional to act as an interpreter — then lay-people should only be able to access the drug through a scrip from such a qualified medical interpreter." It's still fundamentally about claims and labelling!)
The FDA audit for adulteration because e.g. "beef with high levels of thyroid hormone in it" isn't what people expect to be getting if they buy something called "beef." If you label the product as "beef with high levels of thyroid hormone in it", then it's fine! (Same reason "Cheez Whiz" isn't legally able to market itself as "cheese" — it doesn't contain what people expect "cheese" to conventionally contain.)
The FDA audit for drug safety and efficacy because you can't say "makes your headache go away" if it actually doesn't; and you can't leave out "causes cancer in 1/10th of people who take it" if it does. (And for a novel substance, you can't know what claims you're able to make or leave out, without first doing a trial; so any claims you make are considered invalid by default without such a trial.)
If you don't make any claims, you don't have to prove safety or efficacy. Supplements are just drugs that don't make any claims.
This is also why there are products on the market that contain the active ingredients of prescription-only drugs, but are freely purchasable — these aren't marketed as being for human consumption. (GBL, a recreational drug related to GHB, is sold on the open market as a "brake-drum cleaning fluid." And it actually does work as a brake-drum cleaning fluid, so it's not like the FDA can challenge that.)
If you're wondering about making drugs illegal: the FDA doesn't (and can't) do that. The DEA does that.
If you're wondering about making drugs "controlled substances": Congress does that. Then the DEA and the FDA both enforce those rules — the DEA by preventing importation; and the FDA by preventing drugs from being marketed for sale that contain that active ingredient — basically treating it as an adulterant regardless of labelling. (Note that these are both commercial trade activities that are being restricted. Any chemical, no matter its controlled status, can be created, possessed, handled, and consumed within the confines of a secure facility — "secure" meaning that the facility takes measures to ensure that the substances won't leave the premises. This is how e.g. MDMA trials are able to continue at some universities, despite MDMA being a controlled substance.)
If you're wondering about making drugs prescription-only: the FDA does determine this, but only kinda. More like, the Act of Congress that defines the FDA into existence, also defines the rules for whether a drug should be prescription-only. Drug companies are aware of the rules, and so they usually just make the drug prescription-only when it should be. The FDA is charged with catching violations, where a drug that should be prescription-only was marketed OTC. (What is the rule itself? It basically boils down to "if the necessary claims made by the drug are arcane and/or subtle enough, that a non-medically-trained lay-person couldn't reasonably be expected to evaluate their own safety in taking the drug, without a medical professional to act as an interpreter — then lay-people should only be able to access the drug through a scrip from such a qualified medical interpreter." It's still fundamentally about claims and labelling!)