The Importer Who Had Every FSVP Document Except a Complete FSVP

The importer was confident.

They had the supplier questionnaire.

They had the HACCP plan.

They had the product specification.

They had the certificate of analysis.

They had the food safety certification.

They had the supplier's FDA registration information.

They had laboratory results.

They had an allergen statement.

They even had a folder labeled:

FSVP — Complete

There was only one problem.

When someone finally asked:

“Can you show me your FSVP?”

the importer wasn't sure what to hand them.

The folder was full.

But the FSVP wasn't necessarily complete.

This is a frustrating situation because the importer had actually done a lot of work.

They had collected information.

They had communicated with the supplier.

They had saved documents.

They had tried to be responsible.

The problem was that they had built a document collection, not necessarily a complete Foreign Supplier Verification Program.

And those are not the same thing.

When having more documents doesn't necessarily mean being more compliant

It is easy to assume that compliance works like this:

More documents = better compliance.

But FSVP doesn't work that way.

A strong FSVP isn't measured by the thickness of the folder.

It's measured by whether the applicable requirements have been addressed and whether the records support the decisions made by the importer.

FDA describes FSVP as a risk-based program that requires covered importers to perform activities related to hazard analysis, food and supplier evaluation, supplier verification, corrective actions, and recordkeeping, among other requirements.

That means a supplier's documents can be important evidence.

But they are not automatically the importer's completed FSVP.

The importer who did everything they thought they were supposed to do

Let's look at what happened.

The importer was preparing to bring a packaged food product into the United States.

The supplier was experienced.

They had exported to the United States before.

The supplier provided a large compliance package.

The importer saved everything.

They thought:

“This supplier is certified. Their facility is registered. They have a HACCP plan. We should be covered.”

Then the importer was asked:

“Where is your FSVP evaluation?”

Silence.

They had the supplier's information.

But they hadn't necessarily evaluated it within their own FSVP process.

That distinction changed everything.

The supplier's HACCP plan isn't the importer's FSVP

This is one of the most common misunderstandings.

A foreign supplier may provide a detailed HACCP plan.

That's valuable.

It can help the importer understand:

• The product
• The process
• The hazards
• The controls
• The supplier's food safety system

But the supplier's HACCP plan is not automatically the importer's FSVP.

FDA's FSVP requirements place responsibility on the importer to perform the applicable risk-based evaluation and verification activities. FDA also allows importers, in certain circumstances, to rely on analyses or activities performed by other entities, provided the importer reviews and assesses the relevant documentation.

The distinction is important:

The supplier provides information.

The importer evaluates the information.

The supplier's certification isn't automatically the FSVP either

Suppose the supplier has a recognized food safety certification.

The importer attaches the certificate to the file.

That's good recordkeeping.

But someone may still ask:

“How did this certification factor into your supplier evaluation?”

That's the next level.

Was it current?

Was the certification scope relevant?

Did it cover the facility producing the imported food?

What did the certification tell you about the supplier's food safety system?

Did you consider any audit findings?

Did the certification support the verification approach?

A certificate is evidence.

The evaluation is the compliance activity.

The importer had the product specification—but hadn't evaluated the food

This is another subtle difference.

A product specification might tell you:

• Ingredients
• Product characteristics
• Packaging
• Storage conditions
• Shelf life
• Allergen information
• Microbiological specifications

That's useful.

But FSVP may require the importer to identify and evaluate known or reasonably foreseeable hazards associated with the food.

FDA explains that hazard analysis under FSVP involves identifying and evaluating hazards, including biological, chemical, and physical hazards, and considering factors such as formulation, ingredients, processing, packaging, storage, transportation, sanitation, and intended use.

A product specification gives you information.

It doesn't automatically perform the hazard analysis.

The folder contained testing—but nobody knew why

The importer also had laboratory results.

That sounded reassuring.

But then came another question:

“What did this testing verify?”

The importer wasn't sure.

They knew the supplier had tested the product.

But they hadn't clearly connected the testing to the supplier verification process.

Testing can be useful.

But the important question is not simply:

“Was the product tested?”

It is:

“What was tested, why was it tested, what did the results show, and how did the importer use that information?”

That's the difference between collecting a laboratory report and using testing as part of a documented verification process.

The problem wasn't a lack of effort

This is important.

The importer wasn't careless.

In fact, they had probably spent more time collecting documents than many businesses ever do.

They were trying to do the right thing.

They just misunderstood what FSVP required them to do with those documents.

This happens because supplier compliance information and FSVP documentation can look very similar from the outside.

Both involve:

• Food safety
• Suppliers
• Hazards
• Certifications
• Testing
• Records

But the purpose is different.

Supplier documentation answers “What does the supplier have?”

FSVP asks additional questions:

What did the importer evaluate?

What did the importer conclude?

Why was the supplier approved?

What verification was selected?

Why was that verification appropriate?

What happened when verification was performed?

What happens if something changes?

Those questions create the actual FSVP process.

The missing piece was the connection between the documents

This is often the real problem.

The importer had:

Document A

and

Document B

and

Document C

and

Document D.

But there was no clear connection between them.

For example:

The hazard analysis wasn't clearly connected to the verification decision.

The supplier evaluation wasn't clearly connected to the certification.

The testing wasn't clearly connected to the relevant hazards.

The supplier approval wasn't clearly connected to the overall risk evaluation.

The records existed.

The reasoning didn't.

That's when an FSVP file can look complete while still being incomplete as a program.

Think of the FSVP as a chain

A useful way to think about it is:

Food

↓

Hazards

↓

Controls

↓

Supplier

↓

Supplier performance

↓

Risk evaluation

↓

Verification decision

↓

Verification evidence

↓

Conclusion

↓

Ongoing monitoring and reevaluation

Every link should make sense.

If one link is missing, the file may become difficult to defend.

The importer who had a supplier questionnaire

A supplier questionnaire can be helpful.

It can collect information about:

• Facility
• Products
• Certifications
• Food safety systems
• Regulatory history
• Testing
• Audits
• Complaints
• Recalls

But a completed questionnaire isn't automatically a supplier evaluation.

Imagine the questionnaire asks:

“Do you have a HACCP plan?”

The supplier checks:

Yes.

That's information.

The importer still needs to determine what that means in the context of the supplier evaluation.

The same principle applies to every checkbox.

Checkboxes don't create conclusions

This is a good rule for DIY importers:

Never confuse a checkbox with an evaluation.

A supplier can check:

☑ HACCP plan available

☑ FDA registered

☑ Third-party certified

☑ Product tested

☑ No recalls

The importer still needs to evaluate the relevant information.

The goal isn't to create a perfect-looking questionnaire.

The goal is to make informed and documented decisions.

The importer had an FDA registration number

This is another common misconception.

The importer had the supplier's FDA registration number.

They thought:

“The facility is registered, so the supplier is compliant.”

But FDA explains that registration is not itself an approval or endorsement of a facility or its products.

FDA facility registration and FSVP are separate regulatory concepts.

A facility can be registered while the importer still has FSVP responsibilities.

The registration may be relevant information.

It is not a substitute for the FSVP process.

The importer had a U.S. Agent

The foreign facility also had a U.S. Agent.

Again, useful.

But having a U.S. Agent doesn't automatically establish the importer's FSVP.

A U.S. Agent for a foreign facility and an FSVP Agent have different functions.

The importer needs to understand which party is performing which regulatory role.

This is one reason importers should avoid assuming that one regulatory service automatically satisfies another.

The importer had a customs broker

The customs broker handled the entry.

Everything seemed organized.

But the customs broker's role doesn't automatically mean the FSVP program has been completed.

FDA specifically notes that the FSVP importer may not be the same entity serving as the importer of record for U.S. Customs purposes.

So the importer should not assume:

“The broker cleared the shipment, therefore our FSVP must be okay.”

Customs clearance and FSVP are related parts of the import process, but they are not interchangeable responsibilities.

The importer had a folder. What they needed was a system.

This is the turning point.

Instead of asking:

“What document are we missing?”

the importer should ask:

“What part of the FSVP process have we not completed?”

That question changes the review.

Maybe the missing piece is:

Hazard analysis.

Maybe:

Supplier evaluation.

Maybe:

Verification determination.

Maybe:

Verification evidence.

Maybe:

Corrective action.

Maybe:

Qualified Individual documentation.

Maybe:

Recordkeeping.

Maybe:

Reevaluation.

The answer depends on the actual situation.

The FSVP records should tell the story

FDA requires covered importers to develop, maintain, and follow FSVP records, and FDA has published a list of records associated with the FSVP regulation.

That means your records should allow someone reviewing the program to understand what happened.

For example:

We evaluated this food.

We identified these relevant hazards.

We evaluated this supplier.

We considered this information.

We approved the supplier based on this evaluation.

We selected this verification approach.

We performed the verification.

We reviewed the result.

We will reevaluate when appropriate.

That's a much stronger story than:

“Here are 37 documents the supplier sent us.”

A complete file doesn't have to be enormous

Another misconception is that a complete FSVP must be hundreds of pages.

Not necessarily.

The amount of documentation depends on the food, supplier, circumstances, and applicable requirements.

The objective is not to create maximum paperwork.

The objective is to maintain the records necessary to demonstrate the applicable FSVP activities and decisions.

FDA itself notes that not every record on its published list will apply to every importer; applicability depends on the circumstances, including whether exemptions or modified requirements apply.

So don't chase document volume.

Chase completeness.

What does “complete” actually mean?

A practical definition is:

A complete FSVP contains the applicable evaluations, verification activities, decisions, supporting evidence, and records necessary for the importer to demonstrate how it is meeting its responsibilities for the food and foreign supplier.

That is very different from:

“We have a lot of documents.”

Start by mapping what you already have

If your folder is already full, don't start over.

Create a simple inventory.

Supplier information

What do you already have?

Product information

What do you already have?

Hazard information

What has been evaluated?

Supplier evaluation

Has the supplier actually been evaluated?

Verification

What verification activity was selected?

Verification evidence

Do you have the results?

Corrective action

What happens if something goes wrong?

Records

Can you retrieve everything?

Reevaluation

What is your process for changes?

Now the gaps become much easier to see.

The “document gap” isn't always the real gap

Suppose your supplier evaluation form is missing.

You might think:

“We need a supplier evaluation form.”

But perhaps you already have all the relevant information and just need to document the evaluation properly.

Or suppose your verification form is missing.

You might think:

“We need another template.”

But perhaps the real issue is that nobody determined which verification activity was appropriate.

Buying another template won't solve that.

This is why gap assessment should focus on the process, not just the paperwork.

What if your supplier already performs the work?

FDA allows importers, in certain circumstances, to rely on analyses, evaluations, and verification activities performed by other entities, provided the importer reviews and assesses the relevant documentation.

That can be useful.

For example, a supplier may already have:

• Hazard analysis
• Food safety audit
• Testing program
• Certification
• Other relevant evaluations

The importer may be able to use some of that information.

But the importer shouldn't simply file it away.

The importer needs to review and assess the relevant documentation as part of its FSVP process.

This is where the qualified individual matters

FSVP activities must be performed by individuals who meet the applicable qualification requirements.

FDA explains that FSVP activities involving technical or scientific evaluation must be performed by qualified individuals with the appropriate education, training, or experience.

So if the importer is doing the work internally, it should ask:

“Who is actually qualified to perform these activities?”

It shouldn't simply be:

“Who has time to fill out the spreadsheet?”

That distinction matters.

The importer who wanted to be prepared

This is the positive side of the story.

The importer didn't need to throw away the entire folder.

They didn't need to start from zero.

They already had something valuable:

Information.

What they needed was to transform that information into a structured FSVP process.

That's often much easier than starting from nothing.

A practical way to turn the folder into an FSVP

Step 1 — Separate supplier records from FSVP records

Don't treat everything as one giant folder.

Identify which documents came from the supplier and which documents represent the importer's own evaluations and decisions.

Step 2 — Identify the food

Make sure the product is clearly defined.

Step 3 — Identify the foreign supplier

Make sure the correct manufacturing entity is identified.

Step 4 — Review the hazard information

Understand the relevant hazards and controls.

Step 5 — Evaluate the supplier

Use the relevant information to assess supplier performance and food safety practices.

Step 6 — Determine verification

Establish appropriate verification activities based on the risk evaluation.

Step 7 — Document the results

Keep the evidence and the importer's conclusions together.

Step 8 — Establish corrective action procedures

Determine what happens when verification identifies a problem.

Step 9 — Establish recordkeeping

Make sure the records are organized and retrievable.

Step 10 — Establish reevaluation

Know what changes trigger another review.

Now the folder starts functioning like a program.

What if you discover that your FSVP is incomplete?

Don't panic.

An incomplete program can be addressed.

Start by determining:

What is missing?

Why is it missing?

Can the information be obtained?

Can an existing evaluation be documented properly?

Does the supplier need to provide additional information?

Does the verification approach need to be reconsidered?

Does the program need technical review?

The important thing is to fix the underlying gap rather than simply adding another form.

The cost of ignoring the gap

The biggest problem with an incomplete FSVP is not that the folder looks messy.

The bigger problem is that the importer may believe the business is compliant when it isn't.

That's a dangerous position.

False confidence can lead to:

• Delayed corrective action
• Missed supplier changes
• Expired documentation
• Poor verification decisions
• Difficult FDA record requests
• Increased compliance exposure

FDA maintains an FSVP records submission process for situations in which the agency requests FSVP records from an importer.

You don't want to discover what is missing only after someone asks for the records.

“But we've been importing this product for years”

That doesn't automatically solve the problem.

Experience is valuable.

It can provide supplier history.

It can provide performance information.

It can provide knowledge about the food.

But experience isn't a substitute for maintaining the applicable FSVP.

In fact, your history may be useful evidence within the supplier evaluation.

The question is whether that history is being considered and documented appropriately.

“We've never had a problem”

That's good.

But absence of a known problem doesn't automatically eliminate the need for an applicable verification program.

A supplier can have a good history and still require appropriate evaluation and verification.

The goal of FSVP is preventive.

You're not waiting for something to go wrong before thinking about supplier verification.

“The supplier has never had a recall”

Also useful.

But again, that's one piece of information.

A strong supplier evaluation may consider multiple relevant factors.

The importer should avoid reducing the entire evaluation to one favorable fact.

“The supplier says everything is compliant”

That is information too.

But compliance decisions should be based on evidence and evaluation, not simply assurances.

This is especially important when the importer is responsible for demonstrating how the supplier was evaluated.

The difference between confidence and evidence

A supplier may say:

“We've been doing this for 20 years.”

The importer may believe them.

That's confidence.

But the FSVP process asks for evidence and evaluation.

The strongest programs combine:

Supplier statements

with

documentary evidence

with

independent or other appropriate verification

with

documented importer evaluation.

That's how confidence becomes defensible.

The folder should answer questions before someone asks them

Imagine an FDA investigator asks:

“Who is the foreign supplier?”

The answer should be obvious.

“What food does this FSVP cover?”

Obvious.

“What hazards did you identify?”

Documented.

“How did you evaluate the supplier?”

Documented.

“What verification did you perform?”

Documented.

“Why did you choose that verification?”

Documented.

“What were the results?”

Documented.

“What happens if the supplier changes?”

Documented.

That is what a useful FSVP file looks like.

Don't build a document collection. Build a compliance story.

The strongest mindset shift is simple:

Don't ask, “What documents do we have?”

Ask:

“What does our FSVP demonstrate?”

That question changes how you organize everything.

Your supplier's HACCP plan becomes evidence.

Your certification becomes evidence.

Your testing becomes evidence.

Your audit becomes evidence.

Your supplier questionnaire becomes evidence.

Your own evaluation becomes a documented decision.

Your verification results become evidence of verification.

Your records become the story of how you manage the supplier.

The importer didn't need more paperwork. They needed the pieces connected.

That's the real lesson.

They had almost everything.

What was missing was the architecture.

They needed to connect:

Product

to

Hazards

to

Supplier

to

Risk evaluation

to

Verification

to

Evidence

to

Decision

to

Maintenance.

Once those pieces are connected, the folder stops being a collection of documents.

It becomes an FSVP.

Before you add another document, ask this

If your FSVP folder is already getting crowded, stop downloading.

Ask:

“What requirement or decision does this document support?”

If you can answer, keep it.

If you can't, determine whether it is actually needed.

Then ask:

“What part of our FSVP does this document connect to?”

If the answer is unclear, you may have a document-management problem rather than an FSVP solution.

A complete FSVP is about understanding, not volume

The importer in this story didn't fail because they didn't care.

They cared enough to collect everything.

They simply believed that collecting documents was the same as performing the program.

It isn't.

A strong FSVP doesn't need to be the biggest file on your computer.

It needs to be a coherent record of the importer’s applicable evaluations, decisions, verification activities, and ongoing management.

That's a much higher standard.

But it's also a much more useful one.

If your FSVP folder is full but you still aren't confident, that's your signal

You don't necessarily need more documents.

You may need someone to look at what you already have.

A professional review can help determine:

What is complete?

What is missing?

What is redundant?

What needs clarification?

What needs to be reevaluated?

What should be maintained going forward?

That can save you from rebuilding everything unnecessarily.

You may be closer than you think

This is the encouraging part.

If you've already collected supplier documents, product information, testing, certifications, and food safety records, you may have already completed a significant portion of the information-gathering work.

The next step is turning that information into an organized, risk-based FSVP.

You don't necessarily need to start over.

You need to understand what you've already built.

Then fill the actual gaps.

Your FSVP should tell a story

At the end of the process, someone reviewing the file should be able to understand:

This is the food.

These are the relevant hazards.

This is how the supplier controls them.

This is what we know about the supplier.

This is how we evaluated the risk.

This is why we selected these verification activities.

This is what the verification showed.

This is what we did with the results.

This is how we will respond when something changes.

That's a complete compliance story.

And that's far more valuable than simply having a folder full of documents.