The Foreign Supplier Verification Program FSVP has been a legal requirement for U.S. food importers since 2017. And yet, FDA warning letters citing FSVP rule violations continue to be issued regularly, including several in the first months of 2026. The most common finding isn’t some obscure technical gap. It’s that importers either had no FSVP at all or had a document that didn’t hold up when an investigator started asking questions.
This article is for food processors and operations teams who import ingredients, finished products, or whose customers require evidence that imported inputs meet U.S. food safety standards. It covers what FSVP actually requires, where companies consistently fall short, and how to build a program that functions as a real operational control rather than a binder on a shelf.
What is a Foreign Supplier Verification Program?
The Foreign Supplier Verification Program (FSVP) is part of the FDA Food Safety Modernization Act (FSMA), codified under 21 CFR Part 1, Subpart L. The rule establishes one principle: food imported into the United States must be produced in a manner that provides the same level of public health protection as food produced domestically.
The obligation sits with the importer. Defined as the U.S. owner or consignee of a food offered for import. If there is no U.S. owner or consignee, the importer is the U.S. agent or representative of the foreign owner at the time of entry.
A separate, documented FSVP is required for each combination of food and foreign supplier. If you import three different ingredients from the same facility, that’s three FSVPs. If you source the same ingredient from two different suppliers, that’s also two FSVPs. The rule is product-specific and supplier-specific by design.
Categories of food exempt from FSVP include:
- Juice and seafood products are subject to HACCP regulations (21 CFR Parts 120 and 123)
- Low-acid canned foods are regulated under 21 CFR Part 113 (with respect to microbiological hazards controlled by that part)
- Food imported for personal consumption, research, or evaluation
- Alcoholic beverages are regulated by the Alcohol and Tobacco Tax and Trade Bureau
- Manufacturers and processors are already subject to supply-chain program requirements under the preventive controls rules. Provided they implement preventive controls for the hazards in the food
Modified, less burdensome requirements apply to very small importers (under $1 million in annual human food sales combined with U.S. food sales, averaged over three years) and importers sourcing from certain small foreign suppliers.
The Five Core Requirements of a Functioning FSVP
Most Foreign Supplier Verification Program violations in FDA warning letters trace back to gaps in one or more of these five areas. A program that addresses all five, with documentation, is a program that holds up under inspection.
1. Hazard Analysis
For each imported food, a qualified individual must identify and evaluate all known or reasonably foreseeable hazards: biological, chemical (including radiological), and physical. The analysis must be product-specific. Boilerplate hazard analyses copied from templates, or analyses that mark hazards as not applicable without documented justification, are among the most frequently cited violations in recent FDA warning letters.
The output of the hazard analysis determines everything downstream. Specifically, which hazards require a control, and therefore what verification activities are appropriate for that supplier.
2. Supplier Evaluation
Before approving a supplier, and for at least every three years thereafter, you must evaluate the risk posed by the food and the performance of the supplier. Factors that must be considered include:
- The food safety history of the supplier, including past FDA inspections, import alerts, and warning letters
- Whether the supplier is subject to and in compliance with the FDA’s preventive controls or produce safety rules
- The supplier’s responsiveness in correcting problems identified in prior audits or inspections
- Any other relevant factors, including storage and transportation practices that could affect food safety
This evaluation must be documented and signed by the qualified individual. Relying on a supplier’s self-attestation without reviewing supporting documentation is not sufficient.
3. Verification Activities
Based on the hazard analysis and supplier evaluation, you must select appropriate verification activities. The rule gives importers flexibility, but the choice of activity and frequency must be risk-based and documented. FDA’s options are:
| Verification activity | When it’s typically required |
| Onsite audit | When a hazard requires a control and could cause serious adverse health consequences or death. Required at least annually unless a less frequent schedule is justified. |
| Sampling and testing | When a hazard requires a control but is lower severity, or as a supplement to auditing for higher-risk commodities. |
| Review of supplier records | When a hazard requires a control but is of lower severity, or as a supplement to auditing for higher-risk commodities. |
| Written supplier assurance | Available to very small importers and importers of food from certain small suppliers, under modified FSVP requirements. |
The key threshold: when a hazard requires a control and could cause Serious Adverse Health Consequences or Death to Humans or Animals (SAHCODHA), an annual onsite audit is the default verification activity. You can substitute a recent government inspection of the facility (within the past year) in place of an on-site audit, but only under specific conditions.
4. Corrective Actions
When you determine through verification activities, supplier communication, customer complaints, FDA alerts, or any other means that a foreign supplier is not producing food in compliance with U.S. safety standards, you must take prompt corrective action. The appropriate response depends on severity, but could include:
- Notifying the supplier and requiring documentation of corrective actions taken
- Temporarily suspending imports from that supplier until the issue is resolved
- Discontinuing the supplier relationship if compliance cannot be restored
- Reassessing the adequacy of your FSVP itself
Every corrective action and the investigation behind it must be documented. One FDA-cited violation involved an importer who recalled a product after a positive Salmonella test but documented no corrective actions whatsoever. This is an example of a situation that compounds a product safety problem into an FSVP compliance problem.
5. Recordkeeping
All FSVP records must be signed and dated upon initial completion and upon modification. They must be retained for at least two years from the date of the activity. FDA can request access to FSVP records with as little as one week’s notice, and records stored offsite must be retrievable and available onsite within 24 hours. This is not a theoretical requirement. FDA investigators conduct FSVP inspections at the importer’s place of business, and the inspections are often random.
What the Qualified Individual Requirement Actually Means
Every Foreign Supplier Verification Program activity must be performed, reviewed, and documented by a qualified individual. The FDA defines a qualified individual as someone with the education, training, experience, or a combination of these necessary to perform the activity. There is no single required credential, but the expectation is defensible competency. Someone who can produce and explain the hazard analysis, justify the verification activities chosen, and interpret audit results.
This matters operationally because it means you can’t delegate FSVP to an administrative function that processes paperwork without food safety expertise. The qualified individual can be an employee, a consultant, or a third party, but their qualifications relative to the FSVP activities they’re performing must be documented.
For manufacturers who are also importers and are already subject to the preventive controls rules, a Preventive Controls Qualified Individual (PCQI) with appropriate experience can fulfill this role. The FSPCA’s standardized curriculum for FSVP provides a recognized pathway, though it is not the only one.
Where Companies Actually Fail: Recent Enforcement Patterns
FDA’s enforcement progression runs from Form 483 observations (no action or voluntary action) through warning letters to Import Alert 99-41, which allows the FDA to detain shipments without physical examination. The following patterns appear consistently in recent warning letters and enforcement actions.
No Foreign Supplier Verification Program Exists
The single most common finding, and the most striking: importers bringing food into the United States with no written FSVP for any of the products they import. In some cases, companies believed they were exempt because their foreign supplier was located in a country with a recognized food safety system — but that exemption is narrower than most assume and still requires specific documentation.
Generic or Template-Based Hazard Analyses
An FSVP that uses boilerplate hazard analysis language applied uniformly across all imported products is a finding. The analysis must be specific to the food, the supplier, and the actual hazards relevant to that combination. Hazards marked not applicable without documented justification are routinely cited.
Verification Activities Not Matching Hazard Risk
Choosing record review as a verification activity for a high-risk commodity that requires a control without documented justification for why an on-site audit isn’t necessary is a compliance gap. FDA investigators check that the verification activity matches the risk level identified in the hazard analysis.
No Documentation of Corrective Actions After a Supplier Problem
When a supplier is involved in a recall, receives an FDA warning letter, or is placed on import alert, your FSVP requires you to investigate and document what you did. Several warning letters cite importers who continued importing from a supplier with known compliance issues without any documented reassessment of their FSVP.
Failure to Re-Evaluate the FSVP Every Three Years
The three-year re-evaluation is a hard requirement, not a suggestion. Re-evaluation is also triggered by any new information that could affect the safety of the food, including supplier recalls, FDA actions against the supplier, or changes in the supplier’s processes or ownership. This is the requirement that most commonly turns an old, technically adequate FSVP into a stale, non-compliant one.
Building an FSVP That Functions as an Operational Control
Most FSVP programs fail not because the written documents are wrong but because the program isn’t connected to day-to-day operations. Here’s what operational integration looks like in practice.
Supplier Approval is a Gate, Not a Formality
Your written procedures must ensure that you import only from approved suppliers or, on a temporary basis, from unapproved suppliers whose products are subjected to adequate verification before import. If your procurement process can add a new foreign supplier and place an order without triggering an FSVP review first, the gate is open. The supplier approval process needs to be structurally connected to purchasing, not parallel to it.
Audit Scheduling Tied to Risk Classification
High-risk suppliers requiring annual onsite audits need to be on a tracked calendar. An audit that slips three months past its anniversary date without documented justification is a finding. The program needs to own the schedule and generate alerts; not depend on someone remembering.
Monitoring Supplier Compliance Status Actively
FDA import alerts, warning letters, and recall databases are public. Importers are expected to monitor them for their active suppliers. A supplier that receives an FDA warning letter between your scheduled re-evaluations triggers an obligation to reassess your FSVP — you can’t wait for the three-year cycle. Building a process to monitor this, rather than reacting only when FDA contacts you, is what distinguishes a program that’s working from one that’s waiting to fail.
Records Available on Demand
FDA investigators may arrive with a week’s notice or less. Every FSVP record — hazard analyses, supplier evaluations, verification activity documentation, corrective actions — must be organized, retrievable, and accessible within 24 hours. That standard is difficult to meet with records spread across email threads, shared drives, and individual employees’ files. If you can’t produce your FSVP records quickly and completely during an inspection, the program doesn’t functionally exist from the FDA’s perspective, regardless of what’s in it.
Frequently Asked Questions
If my foreign supplier is GFSI-certified (SQF, BRC, FSSC 22000), does that satisfy FSVP?
A GFSI-certified supplier can support your FSVP, but it doesn’t replace it. A third-party GFSI audit can substitute for an on-site FSVP audit under certain conditions — specifically, when the audit was conducted by an accredited certification body and covers the hazards relevant to your imported food. You still need a documented hazard analysis, a supplier evaluation, and records of how you reviewed and relied on the certification. The FSVP importer cannot simply point to a certificate; you must demonstrate that you assessed its scope and relevance.
We’re a manufacturer, not an importer. Does FSVP apply to us?
If you are a receiving facility subject to the preventive controls rules and you implement preventive controls for the hazards in the imported food — or are not required to implement a preventive control for that food — you are deemed in compliance with most FSVP requirements for that food. However, you are still required to identify yourself as the FSVP importer when filing with U.S. Customs and Border Protection (§ 1.509). Many manufacturers who import raw materials or ingredients fall into this category and don’t realize they still have an FSVP obligation.
How much notice does the FDA give before an FSVP inspection?
Typically, one week or less, and sometimes no notice at all. FSVP inspections are conducted at the importer’s place of business and are largely random, though FDA prioritizes importers with a history of violations or whose suppliers have been flagged in import alerts or recall actions. The only reliable preparation is maintaining a current, organized program at all times.
Can we use our supplier’s own audit results instead of conducting our own?
Yes — with conditions. You can rely on a third party other than the foreign supplier itself to conduct verification activities, including audits, as long as you review and assess the documentation. You cannot simply accept a supplier-commissioned audit at face value without evaluating whether it was conducted by a qualified auditor, whether it covered the relevant hazards, and whether the findings are current. Self-assessments conducted by the supplier themselves are generally not adequate.
What triggers a required re-evaluation outside the three-year cycle?
Any new information that could affect the safety of the food from that supplier. This includes FDA warning letters or import alerts involving the supplier, recalls or product withdrawals linked to the supplier’s facility, changes in the supplier’s processes or ownership, food safety incidents in the supplier’s country that affect the product category, or adverse findings from your ongoing verification activities. The obligation to re-evaluate is triggered by the information — not by your audit schedule.
About the Author
Severin Studer is the Revenue Operations Lead for Indeavor. He identifies opportunities to streamline and improve the customer lifecycle, go-to-market strategies, and sales process. He works cross-functionally with departments and stakeholders to share insights, centralize information, and report on various KPIs. To learn more or get in touch, connect with Severin on LinkedIn.
