Your FSVP Program May Be Working—But Can You Prove It?

There is a difference between doing the right thing and being able to demonstrate that you did the right thing.

That difference is easy to overlook.

An importer may have a good relationship with its foreign supplier.

The supplier may consistently provide quality products.

The importer may regularly review certifications.

Employees may communicate with the supplier.

Audits may be performed.

Problems may be addressed.

The FSVP process may actually be working.

But then someone asks:

“Can you prove it?”

And suddenly the conversation changes.

The importer who knew the program was working

The company had confidence in its suppliers.

Its compliance team was experienced.

The importer had been purchasing from the same foreign suppliers for years.

When a supplier sent a document, someone reviewed it.

When an issue came up, someone addressed it.

When a supplier changed something important, the team discussed it.

From an operational perspective, the process worked.

But the importer had never really tested whether the records demonstrated the process.

That distinction became important when the company conducted an FSVP readiness review.

“We do that” is not always enough

During the review, the team was asked:

“How do you verify this supplier?”

The answer came quickly:

“We review their certification and audit information.”

Good.

Then came the next question:

“Can you show me the record of that review?”

The team found the documents.

But there wasn't always a clear record showing:

What was reviewed

When it was reviewed

Who reviewed it

What conclusion was reached

The activity may have happened.

The documentation didn't clearly demonstrate it.

This is where many importers get uncomfortable

Nobody wants to hear:

“You didn't do it.”

when they know they did.

But that's not always the problem.

Sometimes the actual issue is:

“You may have done it, but your records don't clearly demonstrate what you did.”

That is a very different problem.

And it is often much easier to fix.

Why documentation matters

FSVP records aren't simply administrative paperwork.

They provide evidence of the importer's compliance activities and decisions.

FDA's FSVP framework includes requirements for maintaining records that document applicable FSVP activities and determinations.

That means the record needs to do more than exist.

It needs to be useful.

A document should answer questions

What happened?

What activity was performed?

When?

When was it performed?

By whom?

Who performed or reviewed it?

Why?

What was the purpose or basis?

What was found?

What information or findings resulted?

What was decided?

What conclusion did the importer reach?

What happened next?

Was follow-up required?

Not every record needs to answer every question in exactly the same format.

But the overall FSVP file should tell a coherent story.

The difference between evidence and explanation

Imagine an employee says:

“We approved this supplier because they have an excellent food safety history and strong audit results.”

That's useful.

Now imagine the employee leaves.

A new compliance manager opens the file.

The file contains:

Supplier certificate

Audit report

Product specification

But no clear record of the evaluation.

The knowledge left with the employee.

The company now has to reconstruct the decision.

That is a documentation weakness.

Institutional knowledge can disappear overnight

People change.

Someone who has managed the supplier for five years may leave.

Someone else takes over.

The new employee asks:

“Why did we choose this verification activity?”

Nobody knows.

Or:

“When was the supplier last reassessed?”

Nobody is sure.

Or:

“Why did we accept this audit?”

Someone says:

“That was before my time.”

This is why a compliance system should preserve important decisions.

A strong FSVP shouldn't depend on memory

Memory is useful.

It shouldn't be the primary record.

A well-managed system preserves:

Supplier history

Product information

Evaluations

Verification activities

Findings

Corrective actions

Reevaluations

Current status

The objective is continuity.

The importer may have excellent suppliers

Supplier quality and FSVP documentation are related, but they aren't the same thing.

You can have an excellent supplier and a weak documentation system.

You can also have a well-organized file and a supplier relationship that needs improvement.

A readiness assessment looks at both.

“We've never had a problem” isn't proof

This is one of the most common forms of false reassurance.

The importer says:

“We've imported from them for years and never had a problem.”

That's good business history.

But it doesn't answer:

“What verification activities were performed?”

or:

“What evidence supports the current supplier evaluation?”

Past success is valuable context.

It isn't a substitute for current documentation.

The same applies to certifications

An importer may say:

“Our supplier is BRCGS certified.”

or:

“Our supplier is SQF certified.”

or:

“Our supplier is FSSC 22000 certified.”

Those certifications can be important sources of information.

But the importer should still understand how that evidence fits into the FSVP process.

The question isn't simply:

“Does the supplier have a certificate?”

It's:

“What does the certificate tell us, and how does it support our compliance determination?”

The audit report test

Take one supplier audit.

Put it on the table.

Ask:

“What did we do with this?”

Can the team explain:

• Who performed the audit
• When it occurred
• What facility it covered
• What it evaluated
• What findings were identified
• How the findings were addressed
• How the importer used the information

If yes, good.

Now ask:

“Can someone determine that from the records?”

That's the stronger test.

The current-status test

Take one supplier.

Ask:

“What is their current compliance status?”

The answer shouldn't require a scavenger hunt.

You should be able to determine:

Current supplier information

Current facility

Current products

Current supporting documents

Current verification status

Open issues

Next review

If the team can do that, the system is becoming much more useful.

The “show me the decision” test

This may be the most powerful question in an FSVP review.

Don't ask:

“Do we have the supplier's audit?”

Ask:

“Show me the decision we made based on the information available.”

That shifts the review from document collection to compliance management.

Compliance isn't a document-collection exercise

It can be tempting to think:

More documents = better compliance.

Not necessarily.

You can have a folder full of:

Audits

Certificates

Testing results

Questionnaires

and still struggle to demonstrate what the importer actually concluded.

The value comes from connecting the information to decisions.

What does a strong record look like?

Consider a simplified example.

Instead of simply storing:

Supplier_Audit_2026.pdf

the compliance record could establish:

Supplier: Supplier A

Facility: Current manufacturing facility

Food: Product category being imported

Audit date: Current review period

Audit scope: Applicable supplier/facility evaluation

Findings: Documented findings, if any

Corrective action: Status of identified issues

Importer conclusion: Determination based on the available information

Next action: Follow-up or continued monitoring, as applicable

The exact format depends on the FSVP program.

The principle is simple:

The evidence should connect to the decision.

The importer may discover that its records are too fragmented

Another common problem is information fragmentation.

The supplier's:

Certificate is in one folder.

Audit is in another.

Questionnaire is in email.

Corrective action is in a spreadsheet.

FSVP evaluation is somewhere else.

Everything exists.

But nothing is connected.

That creates friction.

Fragmentation makes proving compliance harder

Imagine an FDA records request.

Instead of retrieving one coherent supplier record, the team has to search:

Email

Purchasing

Quality

Regulatory

Operations

Shared drives

The information may eventually be found.

But the response takes longer and creates unnecessary uncertainty.

A structured system makes retrieval easier.

The importer should be able to tell the story

Think of the FSVP as a story.

It begins with:

“This is the food we're importing.”

Then:

“This is the foreign supplier.”

Then:

“These are the relevant food safety considerations.”

Then:

“This is how we evaluated the supplier.”

Then:

“This is how we verified the supplier.”

Then:

“This is what we found.”

Then:

“This is what we did about it.”

Then:

“This is why we continue, modify, or reevaluate the relationship.”

When the story is clear, the program becomes easier to understand.

What happens when something changes?

This is where documentation becomes especially important.

Suppose a supplier:

• Changes facility
• Changes formulation
• Changes manufacturing process
• Receives a significant audit finding
• Changes certification status
• Experiences a food safety event

The importer learns about the change.

What happens next?

A strong system captures:

The change

The date

The information received

The evaluation

The decision

Any follow-up

FDA's FSVP framework provides for reevaluation when applicable new information or significant changes could affect the adequacy of the FSVP.

The record demonstrates that the importer didn't simply receive the information and ignore it.

The difference between doing and documenting

Doing

You review the supplier's audit.

Documenting

You maintain evidence showing the review and resulting determination.

Doing

You notice a supplier changed facilities.

Documenting

You record the change, evaluate its significance, and document the resulting action or determination as appropriate.

Doing

You request a current certificate.

Documenting

You maintain the current certificate and appropriate records demonstrating its review and status.

The two activities work together.

“But our supplier keeps everything”

That's helpful.

But the importer shouldn't assume that the supplier's file is the importer's FSVP record.

The foreign supplier can provide valuable evidence.

The importer still has its own FSVP responsibilities.

That means the importer should know:

What it received

What it reviewed

What it relied upon

What it decided

“But our consultant created the FSVP”

A consultant can help establish a strong program.

But the importer still needs to operate and maintain it.

A beautifully prepared FSVP from several years ago isn't automatically current today.

The importer needs to ensure that the program continues to reflect:

Current suppliers

Current foods

Current circumstances

Current verification information

“But we use a spreadsheet”

That's okay.

A spreadsheet can be useful.

The question is:

Does the spreadsheet actually help you demonstrate what you did?

Can it track:

Current status

Review dates

Supplier changes

Open actions

Document status

Verification information

If yes, it may be serving its purpose.

If it has become a collection of disconnected notes, the system may need improvement.

The test isn't whether your system is sophisticated

You don't need the most expensive software.

You need a system that works.

A small importer may manage a limited supplier base with structured records.

A larger importer may require a more sophisticated FSVPQI management system.

The appropriate solution depends on:

Number of suppliers

Number of products

Import volume

Internal resources

Complexity

Verification activities

Need for ongoing monitoring

The importer who can prove compliance sleeps differently

This is the human side of the issue.

There is a big emotional difference between:

“I think we have everything.”

and:

“I know where everything is.”

Between:

“I think we reviewed that.”

and:

“Here is the review record.”

Between:

“The supplier is fine.”

and:

“Here is the current evaluation and supporting evidence.”

That difference creates confidence.

Proving it doesn't mean assuming the worst

Some importers avoid reviewing their records because they're afraid of discovering gaps.

But the purpose of an assessment isn't to create problems.

It's to identify them while they are manageable.

Maybe your program is strong.

Maybe it needs minor improvements.

Maybe it needs significant restructuring.

The important thing is knowing.

A practical self-test

Take one current supplier.

Don't choose your best-organized supplier.

Choose one at random.

Now ask your team to produce:

1. Current supplier information

Can you identify the relevant entity and facility?

2. Current product information

Can you identify what food you're importing from that supplier?

3. Supplier evaluation

Can you show the basis for the evaluation?

4. Verification records

Can you demonstrate the applicable verification activity?

5. Changes

Can you identify significant changes since the last review?

6. Reevaluation

Can you show what happened when applicable new information or significant changes arose?

7. Current status

Can you determine whether the supplier file is current?

If the answer to each question is yes, that's a strong sign.

If not, you've identified areas for improvement.

Then do the same thing with a recent shipment

Pick a shipment from the last few months.

Ask:

“Can we trace this shipment back to the applicable FSVP records?”

If you can:

Excellent.

If you can't:

Don't panic.

You've found a gap between operations and compliance.

Now you can address it.

The outside perspective can be extremely useful

Internal teams may be too close to the system to recognize these gaps.

An independent reviewer can ask:

“Show me.”

“How do you know?”

“Where is that documented?”

“What changed?”

“Why was this decision made?”

Those questions can reveal weaknesses that employees don't notice because the process is familiar.

A gap doesn't mean your program isn't working

This is important.

You may discover:

“Our verification process is working, but the documentation is inconsistent.”

That's useful.

Or:

“Our supplier monitoring is good, but we need better expiration tracking.”

Also useful.

Or:

“Our FSVP is strong, but our new-product onboarding doesn't trigger compliance review.”

Again, useful.

The goal is to understand the specific problem, not label the entire program as good or bad.

Prove the process, not just the paperwork

Ultimately, the strongest FSVP file demonstrates a process.

It shows:

Evaluation

→

Decision

→

Verification

→

Monitoring

→

Change management

→

Reevaluation

→

Current status

That is much more meaningful than a folder full of disconnected documents.

The best time to test your evidence

Before:

An FDA inspection

A records request

A supplier crisis

A shipment issue

A major customer inquiry

An employee departure

That's when you still have time to improve the system without the pressure of an active problem.

What if you discover that your program isn't fully documented?

Start with the gaps.

Don't automatically rebuild everything.

Identify:

What is missing?

What can be reconstructed?

What needs current evidence?

What needs technical review?

What needs a new process?

Then prioritize.

The objective is defensibility

An effective compliance program should allow the importer to explain and support its actions.

Not because the importer expects trouble.

Because responsible compliance requires being able to demonstrate what was done.

Your FSVP may already be working

It may be.

Your supplier may be reliable.

Your team may be doing the right things.

Your verification process may be effective.

Your records may simply need better structure.

That is why the question shouldn't be:

“Is our FSVP good or bad?”

It should be:

“Can our records demonstrate how our FSVP works?”

That's a much more useful question.