The Supplier File That Looked Complete—Until Someone Actually Reviewed It

At first glance, the supplier file looked excellent.

There were folders.

There were certificates.

There was an audit report.

There were product specifications.

There was a supplier questionnaire.

There were emails showing communication with the manufacturer.

Nothing appeared to be missing.

So the importer assumed:

“We're covered.”

Then someone actually reviewed the file.

Not just opened it.

Not just counted the documents.

Not just confirmed that a certificate existed.

They reviewed the file as a compliance record.

And that's when the questions started.

“Is this certificate still current?”

“Does this certification actually cover this facility?”

“Is this the product we're importing today?”

“Who reviewed this audit?”

“When was the supplier last evaluated?”

“What did we conclude from these documents?”

“Where is the evidence supporting that conclusion?”

Suddenly, a file that looked complete didn't look quite so complete anymore.

---

The problem wasn't the number of documents

This is where supplier compliance can be misunderstood.

A supplier file can contain 50 documents and still have gaps.

Another file can contain 15 documents and be much better organized and more meaningful.

The question isn't:

“How many documents do we have?”

The question is:

“Do the records support the compliance decisions we are making?”

That is a very different standard.

---

A full folder isn't necessarily a complete FSVP file

Imagine opening a supplier folder and seeing:

• Supplier questionnaire
• HACCP plan
• Food safety certification
• Audit report
• Product specification
• Certificate of analysis
• Allergen statement
• Product label
• Insurance certificate
• Supplier agreement

It looks impressive.

But then ask:

Which documents are actually relevant to the FSVP?

Which are current?

Which relate to the specific food being imported?

Which relate to the specific foreign supplier?

Which were evaluated?

What decisions were made based on them?

Are the records organized so another person can understand the reasoning?

Now the review becomes more interesting.

---

The importer who thought document collection was compliance

This happens often.

The importer creates a checklist:

“Get the certificate.”

“Get the audit.”

“Get the HACCP plan.”

“Get the specification.”

Once everything is received, the checklist is marked:

COMPLETE

But a compliance checklist can answer only one question:

Did we receive the documents?

It doesn't necessarily answer:

Did we evaluate what the documents mean?

That's the difference between document collection and compliance assessment.

---

The first problem: the certificate was expired

The file had a certification.

So everyone assumed certification was covered.

Then someone checked the date.

The certificate had expired.

That doesn't automatically mean the supplier became unacceptable.

The supplier may have renewed the certification.

But the importer didn't have the current evidence in the file.

The issue wasn't necessarily the supplier.

It was the currency of the evidence.

---

The second problem: the new certificate was somewhere else

The supplier had actually renewed its certification.

The new certificate existed.

It just wasn't in the supplier's compliance folder.

It was sitting in an email.

This is an extremely common operational problem.

The business technically possessed the document.

But the compliance system did not.

That's an important distinction.

---

The third problem: the audit report was old

The file contained an audit report.

Again:

“Great. We have an audit.”

But the report was several years old.

The importer had never stopped to ask whether the available audit information was still appropriate for the current supplier and food.

An old audit can provide useful historical information.

But historical evidence is not automatically current evidence.

The importer needs to determine whether the existing verification information remains appropriate.

---

The fourth problem: the audit scope didn't match the product

This is where a closer review can become particularly valuable.

The supplier had a legitimate certification and audit.

But the importer was importing a product that wasn't clearly within the scope of the documentation being relied upon.

The supplier itself wasn't necessarily the problem.

The assumption was.

Someone had concluded:

“They're certified, so we're covered.”

But the better question is:

“What exactly does this certification establish?”

---

A certificate is evidence—not a conclusion

This principle is worth remembering.

A certification can be useful evidence.

An audit can be useful evidence.

A testing report can be useful evidence.

A supplier questionnaire can be useful evidence.

But the importer still needs to determine how that information fits into the applicable FSVP process.

The document doesn't make the compliance decision for you.

---

The fifth problem: the product had changed

The supplier file contained a product specification.

It looked complete.

But the specification was from several years earlier.

The supplier had since changed the formulation.

The product name remained similar.

The packaging looked almost identical.

But an ingredient had changed.

Now the importer had a new question:

Does the existing FSVP evaluation still accurately address the current product?

That's the type of question that a real review is designed to uncover.

---

The sixth problem: the facility information didn't match

The supplier questionnaire listed one facility address.

The certification listed another.

The audit report referenced another location.

At first, everyone assumed it was an administrative difference.

But someone finally asked:

“Where is this food actually manufactured?”

That question mattered.

Because the identity of the foreign supplier and the facility involved in producing the food are important to understanding the supplier relationship and verification evidence.

---

The seventh problem: nobody documented the supplier evaluation

The importer had plenty of supplier documents.

But there was no clear record showing:

Why was this supplier approved?

The documents were there.

The conclusion wasn't.

This is a subtle but important weakness.

A reviewer should be able to understand the relationship between:

Information

→ Evaluation

→ Decision

The file shouldn't require someone to reconstruct the decision from old emails.

---

The eighth problem: the supplier questionnaire was never reviewed

The supplier had completed a questionnaire.

Every field was filled in.

The importer considered it complete.

But nobody had actually evaluated the answers.

One answer indicated that the supplier had experienced a significant food safety event.

It wasn't necessarily disqualifying.

But it deserved attention.

The problem was that the questionnaire had become a formality instead of an assessment tool.

---

The ninth problem: the documents contradicted each other

This is one of the most valuable things a fresh review can uncover.

One document said:

Facility A

Another said:

Facility B

One product specification listed:

Ingredient X

Another listed:

Ingredient Y

One certificate had:

Product category A

The supplier questionnaire referenced:

Product category B

No single document necessarily looked wrong.

The problem appeared only when the documents were compared.

---

Compliance requires connecting the dots

This is why a supplier file should not be reviewed document by document only.

A reviewer needs to look across the file.

Ask:

Does the supplier questionnaire agree with the certification?

Does the certification agree with the audit?

Does the audit correspond to the facility?

Does the product specification correspond to the imported product?

Does the FSVP reflect the current supplier?

Does the verification activity make sense for the food?

The file becomes a system rather than a pile of paperwork.

---

The tenth problem: nobody was tracking expiration dates

The importer had a document repository.

But it wasn't a compliance management system.

There was no simple answer to:

“Which supplier documents expire next month?”

That meant the business had to discover expired documents after the fact.

A better process tracks:

Document

Issue date

Expiration date

Supplier

Facility

Product

Status

Next action

Now compliance becomes proactive.

---

The eleventh problem: the supplier contact had left

The file contained the contact information of someone who had left the supplier two years earlier.

This seems minor.

But it becomes a problem when:

“We need an updated certificate.”

The importer sends the request.

No response.

The email bounces.

Now someone has to find the new contact.

A current supplier assessment can reveal simple operational gaps like this before they become urgent.

---

The twelfth problem: the importer assumed the supplier was responsible for the FSVP

This is one of the most important distinctions.

The foreign supplier provides information.

The importer has FSVP responsibilities.

FDA's FSVP framework requires the importer to perform activities related to evaluation and verification of the foreign supplier and the food being imported.

So when the importer says:

“Our supplier gave us everything.”

the next question should be:

“What did we do with the information?”

---

The thirteenth problem: the file was complete, but the FSVP wasn't

This is the moment when the importer finally sees the difference.

They had:

Documents.

But they didn't necessarily have:

A coherent FSVP record demonstrating the applicable evaluation and verification process.

The file was full.

The program wasn't necessarily complete.

That's an uncomfortable realization.

But it is also useful.

Because now the problem can be fixed.

---

What a real supplier file should accomplish

A supplier file should help a qualified reviewer understand:

Who is the supplier?

The legal and operational identity should be clear.

What food is being imported?

The product relationship should be clear.

Where is it manufactured?

The relevant facility should be clear.

What hazards are relevant?

The applicable food safety considerations should be documented appropriately.

How was the supplier evaluated?

The basis for the supplier decision should be understandable.

What verification activities were performed?

The records should show what was done.

What happened when problems were identified?

Corrective actions and reevaluation should be documented where applicable.

Is the file current?

The records should reflect the current supplier and food relationship.

---

The difference between “complete” and “defensible”

This is perhaps the best way to think about it.

A complete-looking file has lots of documents.

A defensible compliance file tells a coherent story.

It can answer:

Why was this supplier approved?

What evidence supported the decision?

What verification was performed?

When was it performed?

What changed?

What did the importer do about the change?

Why does the importer continue to rely on this supplier?

That's a much higher standard.

---

The review that nobody wanted to do

Sometimes the importer doesn't want to open the file.

Because they already suspect what might happen.

They think:

“If we look too closely, we'll find problems.”

But avoiding the review doesn't eliminate the problem.

It simply means the importer doesn't know about it.

And unknown problems are harder to manage than known ones.

---

The emotional turning point

At the beginning of the review:

“We have everything.”

Then:

“Wait.”

Then:

“Where is the current version?”

Then:

“Why doesn't this address match?”

Then:

“When did we last review this?”

Then:

“Did we ever document the conclusion?”

And finally:

“Okay. Now we know what needs to be fixed.”

That final moment is actually progress.

---

Finding a gap doesn't mean the supplier failed

This distinction matters.

Suppose the review finds:

Expired certificate

The supplier may have already renewed it.

Old specification

The supplier may have an updated version.

Missing audit

The supplier may be able to provide it.

Outdated contact

The relationship may still be excellent.

The assessment identifies what needs to be verified.

It doesn't automatically assign blame.

---

What if the supplier really has a problem?

Then the assessment has done something even more important.

It has identified a risk that needs to be addressed.

Depending on the situation, the importer may need to:

• Request additional information
• Obtain corrective action
• Conduct additional verification
• Reevaluate the supplier
• Modify verification activities
• Consider whether continued approval remains appropriate

FDA's FSVP framework includes corrective-action and reevaluation provisions for applicable circumstances.

---

The value of an independent review

Sometimes the importer has been looking at the same file for years.

That familiarity can make problems invisible.

An outside reviewer may ask simple questions:

“What does this document establish?”

“Why is this being relied upon?”

“Is this current?”

“Does this apply to the actual product?”

“Where is the evidence?”

Those questions can be uncomfortable.

They can also be extremely valuable.

---

A fresh set of eyes doesn't mean starting over

The goal isn't to throw away everything.

A professional assessment should identify:

Keep

Information that remains current and useful.

Update

Information that is outdated but readily replaceable.

Clarify

Information that is ambiguous or inconsistent.

Verify

Information that requires additional evidence.

Correct

Actual gaps requiring action.

This makes the review efficient.

---

The supplier file should evolve with the business

Your original supplier file may have been appropriate when the relationship began.

But businesses aren't static.

Maybe you now have:

• More products
• More suppliers
• More facilities
• More customers
• More import volume
• More regulatory exposure

The compliance file should evolve accordingly.

---

When a supplier file becomes too large

There is another problem.

Sometimes the issue isn't missing documents.

It's too many documents.

The file contains:

• Five versions of the certificate
• Three old questionnaires
• Multiple audit reports
• Duplicate specifications
• Old supplier contacts
• Old product labels

Nobody knows which version is current.

A mature document-control process should make the current status obvious.

---

Version control matters

Consider:

Product Specification — Version 1

Product Specification — Version 2

Product Specification — Version 3

Which one applies?

A good compliance system should make that answer clear.

Otherwise, the importer may accidentally rely on obsolete information.

---

The file should tell someone what to do next

A good compliance record doesn't just store history.

It should help manage the future.

For example:

Certification expires November 30, 2026.

Action:

Request renewal documentation by October 15, 2026.

Now the record is operational.

It isn't simply archival.

---

This is where ongoing maintenance becomes valuable

For one supplier, the importer may be able to manage this internally.

For several suppliers, the workload grows.

For dozens, it can become a dedicated operational process.

That is where ongoing FSVP verification maintenance or end-to-end supplier compliance management can provide meaningful value.

The objective is simple:

Don't wait for the annual review to discover that the file hasn't been maintained.

---

What a supplier compliance review can uncover

A real review may discover:

• Expired certifications
• Outdated audits
• Missing verification records
• Changed facility information
• Product changes
• Missing specifications
• Outdated supplier contacts
• Inconsistent documents
• Unresolved corrective actions
• Unclear approval decisions
• Untracked expiration dates
• Unclear responsibility
• Incomplete FSVP records

Not every supplier will have these problems.

But you don't know until you review.

---

The importer may discover something even better

Sometimes the review ends with:

“Everything is current.”

The certificate is current.

The audit is current.

The facility is confirmed.

The product is confirmed.

The supplier remains acceptable.

The FSVP records are organized.

No significant changes were identified.

That's an excellent outcome.

The assessment didn't create a problem.

It created confidence.

---

What happens if you don't review?

Maybe nothing.

The supplier may remain fine.

The documents may remain valid.

The relationship may continue normally.

But if something does change, you may not know when it changed.

And that makes it harder to determine:

What happened?

When did it happen?

What did we know?

What did we do?

A periodic assessment creates a documented baseline.

---

The annual review becomes a moment of truth

Every supplier eventually reaches this point.

Someone asks:

“Show me the supplier file.”

The question is simple.

What happens next depends on how the file was managed.

If the file is current:

“Here it is.”

If the file is incomplete:

“We're working on it.”

If nobody knows:

“I'm not sure where everything is.”

Those three answers represent very different levels of compliance maturity.

---

A practical supplier file review

If you're reviewing a supplier today, start with these questions:

1. Is the supplier identity current?

Confirm the legal entity, facility, address, and relevant contact information.

2. Is the product information current?

Confirm the foods actually being imported.

3. Are certifications current?

Check issue dates, expiration dates, scope, and applicable facility information.

4. Is the audit information current and relevant?

Determine whether the available audit evidence remains appropriate.

5. Has anything changed?

Ask the supplier directly.

6. Are there relevant food safety events?

Review available information concerning recalls, complaints, regulatory actions, and significant findings.

7. What verification activities have been performed?

Make sure the records reflect the applicable activities.

8. What conclusions were reached?

The file should demonstrate the importer's decision-making.

9. Are corrective actions documented?

If issues were identified, determine what happened next.

10. Is the FSVP current?

The supplier file and FSVP should reflect the actual current importing relationship.

---

Don't wait for an audit to discover the file

One of the worst times to discover a supplier file problem is when an auditor, regulator, customer, or business partner asks for it.

At that point, you're no longer conducting a controlled internal review.

You're responding to someone else's deadline.

Internal assessment gives you control.

---

The goal isn't a perfect folder

It is tempting to think compliance means creating the most impressive folder possible.

It doesn't.

The goal is a file that is:

Relevant

Current

Organized

Traceable

Understandable

Supported by evidence

Connected to the actual FSVP

That's much more valuable than simply having a lot of documents.

---

The supplier file is a story about a decision

At the end of the day, the file should answer one fundamental question:

Why is this importer comfortable continuing to use this foreign supplier for this food?

The answer should be supported by evidence.

Not memory.

Not assumption.

Not:

“We've always used them.”

Evidence.

---

Sometimes the problem is simply that nobody looked

That's the uncomfortable truth behind many compliance gaps.

Nothing dramatic happened.

No major failure.

No bad supplier.

No emergency.

The file simply wasn't reviewed.

And because it wasn't reviewed, nobody knew that some information had become outdated or disconnected from the current operation.

---

The value of finally opening the file

Once you review it, you have options.

You can:

Update

Clarify

Verify

Correct

Maintain

or simply:

Confirm that everything is still appropriate.

Any of those outcomes is better than guessing.

---

The question to ask your team

Instead of asking:

“Do we have a supplier file?”

Ask:

“If someone unfamiliar with our business opened the file today, would they understand why this supplier is approved and how we verify them?”

If the answer is yes, you're in a much stronger position.

If the answer is no, that's exactly what the review is for.

---