The Importer Who Thought Everything Was Fine Until the FSVP Review

For a long time, nothing seemed wrong.

The shipments arrived.

The supplier responded to emails.

The products sold.

Customers didn't complain.

The business continued growing.

The importer had an FSVP folder, too.

There were documents inside.

Supplier certifications.

Product specifications.

Audit reports.

Questionnaires.

Verification records.

It looked organized.

So when someone finally suggested conducting an FSVP review, the importer wasn't worried.

The reaction was simple:

“Everything should be fine. We've been doing this for years.”

Then the review began.

And that was when the importer discovered something uncomfortable:

Everything looked fine from a distance.
Up close, there were gaps.

The problem wasn't that the importer didn't care

This is important.

Most FSVP gaps don't exist because an importer deliberately ignored compliance.

They develop because businesses are busy.

The importer is focused on:

• Buying products
• Managing suppliers
• Moving shipments
• Serving customers
• Managing inventory
• Growing sales
• Paying vendors
• Solving operational problems

FSVP is often one responsibility among many.

As the business grows, the compliance process can quietly fall behind.

“We have an FSVP” sounded reassuring

The importer had created an FSVP several years earlier.

At the time, it was appropriate for the business.

There were fewer suppliers.

There were fewer products.

There were fewer shipments.

The team understood where everything was.

Then the business grew.

New products were added.

New suppliers came onboard.

New employees took over responsibilities.

The original FSVP remained in the folder.

That created a problem that is common in growing businesses:

The business changed. The compliance system didn't change at the same speed.

The first gap was surprisingly simple

The reviewer asked:

“Can you provide your current supplier list?”

The importer provided one.

Then the reviewer compared it with recent import activity.

There were suppliers on the import records that weren't clearly reflected in the current FSVP documentation.

Nobody had intentionally left them out.

They were simply newer than the original program.

The first lesson appeared:

A current supplier list is not the same thing as a historical supplier list.

Then came the products

The same thing happened with products.

The importer had an established product list.

But recent shipments included products that had been added later.

The importer assumed:

“They're from our approved suppliers, so they're already covered.”

That assumption needed to be examined.

The FSVP should accurately reflect the foods and supplier relationships to which it applies.

The business had outgrown the original structure

This is where many importers get caught.

The FSVP was designed around:

Supplier A

Product A

Facility A

That worked.

Then the business became:

10 suppliers

30 products

Multiple facilities

Multiple product lines

Multiple shipments

The importer kept using the same basic approach.

It wasn't necessarily a bad system.

It was simply no longer designed for the size of the business.

The supplier files looked complete

Then the reviewer opened the individual supplier files.

They were full.

That initially felt reassuring.

There were certificates.

There were audits.

There were questionnaires.

There were specifications.

But the question changed from:

“Do you have documents?”

to:

“What do these documents establish?”

That changed everything.

A certificate isn't automatically a complete supplier evaluation

The importer had a certification for one supplier.

The document was legitimate.

But the reviewer asked:

“What is the scope?”

Then:

“Which facility does it cover?”

Then:

“Which products does it cover?”

Then:

“When was it issued?”

Then:

“Is it current?”

The importer had the document.

What it lacked was a clearly documented explanation of how the evidence supported the supplier evaluation.

The audit report raised another question

Another supplier had an audit report.

Again, the importer thought:

“We're covered.”

But the reviewer asked:

“What verification activity are you relying on this audit to support?”

Then:

“Who conducted the audit?”

“What was the scope?”

“When was it conducted?”

“Were findings identified?”

“Were corrective actions completed?”

The audit was useful.

But having an audit report and having a documented verification process are not necessarily the same thing.

Then came the question nobody expected

The reviewer asked:

“What has changed since the original FSVP was created?”

The room went quiet.

Someone said:

“Nothing major.”

That sounded reasonable.

Then they started listing the business changes.

New supplier.

New products.

New facility.

New certification.

New quality manager.

New distribution model.

Suddenly:

“Nothing major” wasn't quite accurate.

This is how compliance gaps hide

Individual changes can seem insignificant.

A new product isn't necessarily a compliance emergency.

A new employee isn't necessarily a compliance issue.

A new certificate isn't necessarily a problem.

A new facility isn't necessarily a problem.

But when nobody evaluates the changes collectively, the FSVP can slowly become disconnected from the business.

That's compliance drift.

The supplier had changed facilities

One of the biggest discoveries involved a supplier's manufacturing location.

The supplier name hadn't changed.

The product name hadn't changed.

The purchase order looked the same.

But production had moved.

The importer hadn't updated the supplier file.

The reviewer asked:

“Does your existing evaluation and verification information still apply to the current manufacturing facility?”

The importer couldn't answer immediately.

That was a gap.

The importer wasn't necessarily unsafe

This distinction matters.

The review did not automatically mean:

“The supplier is unsafe.”

It meant:

“The importer needs to evaluate the current facts and demonstrate an appropriate compliance decision.”

That's what a gap assessment is supposed to reveal.

Not guilt.

Not blame.

Not panic.

Uncertainty.

Another supplier had an expired document

The importer had a certification in the file.

It was real.

It had been valid.

But it had expired.

The supplier had already renewed it.

The importer simply hadn't obtained the current version.

This was a relatively straightforward correction.

But it illustrated a bigger problem:

The importer had been relying on yesterday's evidence to represent today's supplier.

The FSVP review exposed a recordkeeping problem

The importer knew certain activities had occurred.

Employees remembered requesting documents.

Someone remembered reviewing an audit.

Someone else remembered discussing a supplier issue.

But the records didn't always clearly show:

• What was reviewed
• When it was reviewed
• Who reviewed it
• What conclusion was reached

That's when the importer learned another important lesson:

Doing the work and documenting the work are two different compliance activities.

Memory isn't a compliance system

The importer had experienced employees.

They knew the suppliers.

They knew the products.

They knew what had happened.

But what happens when:

• An employee leaves?
• A new compliance manager starts?
• An auditor asks for records?
• A regulatory inquiry occurs?
• The company doubles in size?

The system can't depend entirely on institutional memory.

The records need to tell the story.

The importer had never really tested its own FSVP

This was perhaps the biggest discovery.

The importer had maintained the FSVP.

But it had never asked:

“If someone unfamiliar with our business reviewed this program, would they understand why we made these decisions?”

That is a powerful readiness question.

A fresh set of eyes sees different things

Employees who work with a system every day develop context.

They know:

“That's the old document.”

“That's the supplier's previous facility.”

“We updated that last year.”

“The current certificate is somewhere in purchasing.”

They can fill in the gaps mentally.

An independent reviewer doesn't have that context.

They see what the records actually demonstrate.

That is precisely why an outside review can be valuable.

The review wasn't all bad news

There were also things the importer had done well.

The supplier relationships were strong.

The products were generally well controlled.

Many documents were current.

The team had good supplier communication.

Several verification activities had been completed appropriately.

The problem wasn't:

“Everything is wrong.”

The problem was:

“The system needs to catch up with the business.”

That's a very different situation.

The importer finally had something it didn't have before

Clarity.

Instead of asking:

“Are we okay?”

the importer could now say:

These areas are current.

These records need updating.

These suppliers need reassessment.

These products need to be incorporated.

These documents need to be obtained.

These processes need better documentation.

That is what a gap assessment should produce.

A gap assessment should not simply give you a list of problems

A long list of findings can be overwhelming.

A useful assessment should help answer:

What is missing?

What is outdated?

What is inconsistent?

What is potentially significant?

What needs immediate attention?

What can be addressed through routine maintenance?

What should be technically reviewed?

That creates a practical path forward.

The importer learned to separate symptoms from causes

Symptom

Expired supplier certificate.

Immediate solution

Obtain the current certificate.

Underlying cause

No document-expiration monitoring process.

Fixing only the certificate solves today's problem.

Fixing the monitoring process helps prevent the next one.

Another example

Symptom

New supplier missing from the FSVP.

Immediate solution

Complete the applicable supplier evaluation and documentation.

Underlying cause

Purchasing can onboard suppliers without triggering a compliance review.

Now the business has identified a process gap.

The solution might involve connecting:

Supplier onboarding → FSVP review → approval → purchasing

That is much more powerful than simply adding one supplier to a spreadsheet.

The FSVP review became a business improvement exercise

This is where compliance becomes more than paperwork.

The importer started asking:

“How do we prevent this from happening again?”

That led to better workflows.

New supplier?

Trigger compliance review.

New product?

Trigger product assessment.

Supplier change?

Trigger reevaluation.

Document expiration?

Trigger renewal request.

Annual review?

Scheduled automatically.

Now compliance was becoming part of operations.

The importer also discovered the value of ownership

Before the assessment, everyone assumed someone else was monitoring supplier compliance.

Purchasing thought compliance was doing it.

Compliance thought purchasing was collecting the documents.

Operations assumed the supplier was responsible.

The supplier assumed the importer would ask if something was needed.

Nobody had intentionally created confusion.

There simply wasn't a clear ownership model.

The assessment exposed it.

Compliance responsibilities need a home

A good system should identify:

• Who requests the document?
• Who reviews it?
• Who approves it?
• Who records it?
• Who follows up?
• Who evaluates changes?
• Who decides when additional verification is needed?

Without ownership, even good processes eventually break down.

The importer also stopped treating every supplier the same

During the review, the team realized that suppliers were different.

Different:

Products

Hazards

Processes

Certifications

History

Performance

Risk profiles

A mature FSVP process considers the specific circumstances rather than treating every supplier file as identical paperwork.

The purpose isn't to create more work

This is another important lesson.

The importer initially worried:

“Is this review going to create hundreds of new compliance tasks?”

It didn't have to.

The goal was to identify what actually mattered.

Some files needed substantial attention.

Others needed a simple update.

Some were already adequate.

A good gap assessment distinguishes among them.

The review also created confidence

Before the review:

“I think we're compliant.”

After the review:

“We know what our gaps are, and we know what we're doing about them.”

That's a much better place to be.

Compliance confidence doesn't come from having no findings.

It comes from knowing where you stand.

What if an FDA inspection happened tomorrow?

That's the question many importers avoid.

But it can be useful.

Ask:

Could we locate our FSVP records?

Could we explain our supplier evaluations?

Could we demonstrate applicable verification activities?

Could we show how we addressed significant changes?

Could we explain why our current FSVP covers our current imports?

If the answer is yes, that's encouraging.

If the answer is uncertain, now is the time to improve.

The review doesn't have to wait for an inspection

In fact, waiting for one defeats much of the purpose.

A readiness assessment should happen when the importer still has time to:

• Investigate
• Correct
• Update
• Document
• Train
• Implement
• Improve

That's why readiness matters.

What the importer would do differently today

1. Don't assume the old FSVP covers the new business.

New products and suppliers need to enter the compliance workflow.

2. Don't confuse documents with decisions.

Evidence needs to support a documented conclusion.

3. Don't rely on memory.

Important compliance activities need records.

4. Don't wait for annual review to notice major changes.

Significant changes should be evaluated when they occur.

5. Don't treat the FSVP as a finished project.

It needs ongoing maintenance.

The most valuable discovery wasn't a missing document

It was this:

The importer realized that compliance was a process, not a folder.

That changed how the company approached FSVP.

The folder still existed.

The documents still mattered.

But now they were part of a larger system.

Could your business have the same problem?

Ask yourself:

• Was your FSVP created several years ago?
• Have you added suppliers since then?
• Have you added products?
• Have suppliers changed facilities?
• Have certifications expired and been renewed?
• Have employees responsible for compliance changed?
• Are current verification activities documented?
• Can you quickly explain your supplier evaluation decisions?
• Is your FSVP connected to your actual import activity?

If you answered “I'm not sure” to several questions, that doesn't necessarily mean your program is failing.

It means you may need a closer look.

The uncomfortable question can be the most useful one

“Are we actually FSVP compliant?”

It's not an accusation.

It's not an admission of failure.

It's a starting point.

The sooner an importer asks it, the more time there is to find the answer and address whatever comes next.