Guide
FSVP: Verifying a Supplier You'll Never Visit, with Records That Hold Up
The Foreign Supplier Verification Program (21 CFR 1 Subpart L) makes US food importers responsible for verifying that the food they bring in is produced to the same level of public-health protection as US-grown food, and is not adulterated or misbranded for allergens. In practice that means an FSVP record per imported food, per foreign supplier — with a hazard analysis, an evaluation of the supplier's performance and the food's risk, and verification activities proportionate to that risk. FDA's FSVP inspections have ramped up sharply since 2024, and the agency now publishes annual lists of importers cited for missing or incomplete records. This guide walks through what a defensible FSVP record looks like, who can sign it, and how to build a programme that scales across hundreds of supplier-food combinations. It is written for FSVP-qualified individuals, import managers, and food safety leads at US importers and customs brokers.
Start free trial Free trial, no credit card, onboard in days, not months.
Who has to do FSVP, and for what foods
Subpart L applies to the US owner or consignee of an imported food at entry — typically the importer of record. If there is no US owner at entry, the US agency or representative designated by the foreign owner is responsible. The rule covers human and animal food, with carve-outs for juice and seafood (covered by their own HACCP rules), meat / poultry / egg products (USDA jurisdiction), low-acid canned foods (their own rule), alcoholic beverages, and food imported for research or personal use. Modified or exempt categories include very small importers, food from very small foreign suppliers, and food from suppliers in countries with FDA-recognised food safety systems (currently New Zealand, Canada, Australia). Map your import portfolio to the right pathway on day one — the wrong category designation is a common finding.
The hazard analysis per food
§1.504 requires a written hazard analysis per imported food, identifying known or reasonably foreseeable biological, chemical (including radiological), and physical hazards. The analysis must consider hazards from raw materials, ingredients, the manufacturing process, transport and storage. For each hazard, evaluate severity and probability and conclude whether a control is required. The 'known or reasonably foreseeable' standard is the same as Preventive Controls — it forces consideration of sector-wide hazards from FDA recall data and outbreak history, not just the importer's own experience. Citing the source for each known hazard is the easiest way to make the analysis defensible.
Evaluation of the supplier and the food
§1.505 requires evaluation of the supplier's performance and the risk posed by the food. Inputs include the supplier's procedures, the supplier's compliance history with FDA (Form 483 history, warning letters, import alerts), the storage and transport practices, the food's risk profile, and any other relevant factors. The evaluation drives the verification activity you'll perform — high risk plus weak supplier performance demands an on-site audit; low risk plus strong performance may justify sampling and testing or records review. The evaluation must be documented, re-evaluated at least every three years (or sooner on change), and signed by a qualified individual.
Verification activities: audit, sampling, records review
§1.506 sets out the verification toolkit: on-site audit of the foreign supplier, sampling and testing of the food, review of the supplier's food safety records, or other appropriate activities. The activity must be appropriate to the hazard and the supplier evaluation. For a serious hazard (e.g. SAHCODHA — serious adverse health consequences or death to humans or animals), §1.506(d)(2) defaults to an annual on-site audit unless a documented written determination supports an alternative. For lower-risk hazards, periodic records review can suffice. The recurring inspection finding is doing the activity but not tying it to the hazard it was meant to address — a supplier audit that exists but doesn't explicitly cover the controls for the identified hazard.
Corrective actions when verification fails
§1.508 requires the importer to take appropriate corrective actions promptly if the supplier has produced food that is adulterated or misbranded for allergens, or if the verification activities reveal that the supplier is not producing food consistent with US standards. Corrective action can include discontinuing use of the supplier until the cause is corrected, and revising the FSVP. The classic gap is failing to act on weak verification results — a lab result outside spec, an audit finding unaddressed, a complaint pattern — without the documented decision either to discontinue or to retain with a corrective plan. Document the decision either way, not just the easy ones.
Records and the DUNS / FDA filing details
§1.510 requires FSVP records to be readily available to FDA on request, typically within 24 hours of an inspection. The records must include the hazard analysis, supplier evaluation, verification activities and results, corrective actions, and the identification of the FSVP-qualified individual. Records can be electronic but must be backed up and protected from loss. Separately, every entry of an FSVP-covered food must be filed with the importer's DUNS number and the FSVP indicator in ACE; an entry filed without the DUNS or with the wrong DUNS is one of the most-cited findings in FDA's published FSVP report.
A 90-day implementation path
Days 1 to 15: inventory every imported food and supplier; categorise each into full FSVP, modified, or exempt; capture DUNS numbers and FDA registration status. Days 16 to 45: build the hazard analysis and supplier evaluation per food-supplier pair, prioritising high-risk combinations first. Days 46 to 70: schedule and complete the first cycle of verification activities (audit, sampling, records review) on the highest-risk pairs; populate the records system. Days 71 to 90: appoint and train the FSVP-qualified individual(s), document the programme procedures, and dry-run an FDA FSVP inspection internally. The 90 days are realistic for a portfolio of up to about 50 supplier-food pairs; larger portfolios scale roughly linearly with the highest-risk tier consuming most of the effort.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Supplier portal
FSVP-qualified suppliers with DUNS, FDA compliance history and verification evidence.
Food safety
Hazard analysis library shared between FSVP and Preventive Controls.
Document control
FSVP records vault — 24-hour FDA request answered in a click.
Audits & corrective actions
Verification-driven corrective actions with QI sign-off captured.
Compliance self-assessment
Score your FSVP programme against the FDA inspection guide on demand.
Industries this hits hardest
Frequently asked
Who can serve as the FSVP-qualified individual?
§1.503 requires a qualified individual with the education, training, or experience necessary to perform the FSVP activities, including the ability to read and understand the language of any records that must be reviewed. The QI can be the importer's employee or a third party (a consultant, broker, or 3PL). Their qualifications must be documented in the FSVP records, and they must be re-evaluated whenever their scope changes.
Does FSVP apply if the food is for further manufacturing in the US?
Yes — the rule applies at import regardless of the food's downstream use. The downstream manufacturer's Preventive Controls plan does not satisfy the importer's FSVP obligation; both regulations apply, and FDA inspects them separately. A clean architecture builds the FSVP record on the same master data as the downstream PC plan, but the two records are distinct.
How does FSVP interact with the Supply-Chain Programme under Part 117?
Subpart G of Part 117 (Supply-Chain Programme) and FSVP cover the same supplier-verification ground for facilities that import food they further process. The rules are designed to avoid duplication: if the receiving facility's Subpart G programme covers the foreign supplier, the FSVP importer can rely on it, with documented evidence. The reliance must be specific, signed, and tied to the actual ingredient lots — not generic.
What happens if we change suppliers?
A change of foreign supplier triggers a re-evaluation under §1.505 before importing from the new supplier — new hazard analysis (if the food is different), new supplier evaluation, and a determination of the appropriate verification activity. Importing under the old FSVP record after switching suppliers is one of the most-cited findings and is essentially impossible to defend in an inspection.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.