What Importers Discover When They Finally Review Their Supplier Again

For months, sometimes years, the supplier relationship appears to work perfectly.

Orders arrive.

Products arrive.

Invoices are paid.

Customers are satisfied.

Nobody is complaining.

So the supplier file stays where it is.

On a shared drive.

In a compliance folder.

In someone's email.

Maybe even in a filing cabinet.

Then one day, someone finally says:

“Let's review this supplier again.”

At first, the importer expects a quick exercise.

Check the certificate.

Check the audit.

Confirm the facility.

Make sure nothing changed.

Done.

But that's not always what happens.

Sometimes, the review reveals something much more important:

The supplier didn't necessarily become worse. The importer simply hadn't looked closely in a long time.

And once someone finally looks, they often discover that the supplier file tells a very different story from what everyone assumed.

---

The supplier looked fine from the outside

This is what makes these reviews so interesting.

The importer may have no obvious reason to be concerned.

The supplier has been reliable.

There haven't been major problems.

The business relationship is strong.

But compliance isn't evaluated only through the lens of commercial performance.

A supplier can be:

Reliable commercially

while still having:

Compliance information that needs updating.

Those two things can exist at the same time.

---

The first discovery: “Some of this is old.”

This is probably the most common realization.

The importer opens the supplier folder.

The first document:

2024.

Next:

2023.

Another:

2022.

Then someone asks:

“Do we have the current version?”

Silence.

The importer realizes that the file wasn't necessarily wrong.

It was simply not being maintained as an active compliance file.

---

A supplier file can age quietly

Documents don't announce that they are becoming outdated.

They just sit there.

A certificate doesn't send an email saying:

“I'm no longer current.”

An audit report doesn't automatically tell the importer:

“You should reconsider whether this evidence still reflects the supplier.”

A product specification doesn't announce:

“The formulation has changed since this document was created.”

The importer has to create a process for monitoring these things.

---

The second discovery: “The certificate expired.”

This can be surprisingly easy to miss.

The importer finds the supplier's certification and feels relieved.

“Good. We have it.”

Then someone checks the date.

It expired months ago.

Maybe the supplier renewed it.

Maybe they didn't.

Maybe the new certificate was sent to someone in purchasing.

Maybe it was sent to an employee who no longer works for the company.

Maybe nobody requested it.

The problem wasn't necessarily that the supplier lost its certification.

The problem was that the importer stopped tracking the evidence.

---

The third discovery: “We have a newer document somewhere.”

This one happens all the time.

The compliance folder contains an old certificate.

But the purchasing department has a newer one.

The supplier sent it six months ago.

It was attached to an email.

Nobody moved it into the FSVP file.

Now there are two versions:

Old document in the compliance file

and

new document in someone's inbox.

Which one represents the current supplier status?

The answer may be obvious to the people involved.

But a compliance file shouldn't require institutional memory to interpret.

---

The fourth discovery: “The supplier changed its address.”

At first, this can look insignificant.

Maybe the supplier moved offices.

Maybe the manufacturing facility is still the same.

Or maybe the address change actually reflects a change in manufacturing location.

That's why seemingly simple information deserves verification.

An importer should know:

Is this merely an administrative address change, or did production move?

Those are very different questions.

---

The fifth discovery: “The supplier has another facility.”

This can be more significant.

A supplier may have expanded.

Perhaps the company now manufactures products at two facilities.

The importer has been ordering from the same supplier name.

But the food is no longer necessarily coming from the same manufacturing location.

The supplier relationship stayed the same.

The compliance picture may not have.

---

The sixth discovery: “The product changed.”

This is another major finding.

The importer says:

“We've been buying the same product for years.”

Then the supplier's current specification is compared with the old one.

Something changed.

Maybe:

• An ingredient changed.
• The formulation changed.
• The processing method changed.
• The packaging changed.
• The product specification was revised.
• A new ingredient supplier was introduced.

The product may still have the same commercial name.

But the underlying food may not be identical to what was originally evaluated.

---

The seventh discovery: “Our old FSVP doesn't match the current business.”

This is where supplier reassessment becomes much more than document collection.

An importer may discover that the original FSVP was created for:

One supplier

One product

One facility

But the business now has:

Three products

Two facilities

Different specifications

A different supplier contact

The original program may have been perfectly reasonable when created.

It simply hasn't evolved with the business.

---

Business growth creates compliance drift

This is a common phenomenon.

The business changes gradually.

Not dramatically.

One new SKU.

Then another.

One new supplier.

Then another.

A new warehouse.

A new sales channel.

A new country of origin.

Each individual change seems manageable.

But over time, the compliance file falls behind.

That's compliance drift.

The business moves forward.

The documentation stays behind.

---

The eighth discovery: “Nobody knows when this was last reviewed.”

This is a surprisingly important finding.

Someone asks:

“When did we last reassess this supplier?”

The answer is:

“I'm not sure.”

Maybe someone reviewed it.

Maybe purchasing reviewed the certificate.

Maybe quality reviewed an audit.

Maybe a consultant reviewed the FSVP years ago.

But there is no clear record of the review.

That creates a different problem:

The importer can't easily demonstrate the history of its supplier evaluation.

---

Documentation is not just about having files

A folder full of documents can look impressive.

But the real question is:

What did the importer conclude from those documents?

For example:

Certificate received: yes.

But:

Was it reviewed?

Was the scope checked?

Was the expiration date checked?

Was the facility confirmed?

Was the information considered in the supplier evaluation?

That is the difference between document storage and compliance management.

---

The ninth discovery: “We were relying on the supplier's claims.”

This can happen without anyone realizing it.

The supplier says:

“We're fully compliant.”

The importer accepts that statement.

The supplier says:

“We have a HACCP plan.”

The importer assumes that solves the issue.

The supplier says:

“We're certified.”

The importer stores the certificate.

But FSVP is not simply a collection of supplier claims.

The importer has its own responsibilities to evaluate the food and foreign supplier and determine appropriate verification activities.

FDA's FSVP framework requires importers to perform activities appropriate to the food and supplier, rather than simply relying on an unsupported statement that the supplier is compliant.

---

The tenth discovery: “The supplier was actually doing more than we knew.”

Not every discovery is negative.

Sometimes the importer finds something encouraging.

The supplier has:

• A newer certification
• Improved audit results
• Better traceability
• Stronger food safety controls
• Updated preventive controls
• Improved corrective action processes

The importer simply hadn't captured the information.

A reassessment can therefore reveal improvement just as easily as it can reveal gaps.

---

The eleventh discovery: “Our supplier is better than our file suggests.”

This is an important lesson.

Sometimes the compliance problem isn't the supplier.

It's the documentation.

The supplier may have a strong food safety system.

But the importer has an outdated file.

That's good news.

It means the business may not need to change suppliers.

It may simply need to update its evidence and records.

---

The twelfth discovery: “The supplier has unanswered questions.”

During an assessment, someone may send a few follow-up questions.

Then the importer waits.

And waits.

The supplier doesn't respond.

Now another issue becomes visible:

Supplier responsiveness.

That can matter.

If an importer needs information to perform its applicable verification activities, a supplier's inability or unwillingness to provide information can affect the practical manageability of the relationship.

---

The thirteenth discovery: “We don't know who owns the file.”

This is another classic problem.

Ask:

“Who maintains the supplier compliance file?”

Purchasing says:

“Quality.”

Quality says:

“Regulatory.”

Regulatory says:

“Operations.”

Operations says:

“I thought the consultant did it.”

The supplier file has become everyone's responsibility.

Which means nobody clearly owns it.

---

Compliance needs an owner

The solution isn't necessarily to create another department.

A small importer may not need one.

But someone needs defined responsibility for:

• Reviewing supplier information
• Tracking documents
• Identifying changes
• Following up with suppliers
• Updating records
• Escalating issues
• Maintaining the FSVP

When responsibility is unclear, compliance becomes dependent on memory.

---

The fourteenth discovery: “Our supplier documents are everywhere.”

A mature supplier relationship can generate a lot of documentation.

There may be:

• Certifications
• Audit reports
• Specifications
• Questionnaires
• Testing records
• Letters
• Corrective actions
• Supplier correspondence
• Regulatory information

Over time, those documents can become scattered across:

Email

Google Drive

Dropbox

SharePoint

Desktop folders

ERP systems

Paper files

The challenge isn't necessarily obtaining the documents.

It's maintaining a coherent compliance record.

---

The fifteenth discovery: “We were tracking documents, but not expiration dates.”

This is an important distinction.

A document repository answers:

“Do we have it?”

A compliance management process answers:

“Is it current?”

Those are completely different questions.

An importer can have 100% document collection and still have poor document maintenance.

---

The sixteenth discovery: “We haven't connected supplier information to the actual product.”

This is where supplier management and FSVP intersect.

The supplier might manufacture:

Product A

Product B

Product C

But the importer may only have evaluated Product A.

Then the importer starts importing Product B.

The supplier is already approved.

The temptation is to say:

“Same supplier, so we're covered.”

But the food itself matters.

FSVP evaluation and verification are not simply supplier-level decisions detached from the food being imported.

---

The seventeenth discovery: “The supplier's certification doesn't cover everything we thought it did.”

A certification may apply to:

One facility

Certain products

A specific scope

A specific standard

A defined production activity

The importer may have assumed it covered everything.

A reassessment can expose that assumption.

The question becomes:

“What exactly does this evidence establish?”

That's a much better compliance question than:

“Do we have a certificate?”

---

The eighteenth discovery: “Our supplier has had corrective actions.”

This doesn't automatically mean the supplier is unacceptable.

Corrective actions happen.

The important questions are:

• What was the issue?
• How significant was it?
• Was it resolved?
• Was the root cause addressed?
• Is additional verification appropriate?
• Does the event affect the supplier's continued approval?

FSVP includes requirements addressing corrective actions and reevaluation where applicable.

The goal is not perfection.

It's informed supplier management.

---

The nineteenth discovery: “Nothing is wrong.”

This may be the best possible outcome.

After reviewing everything, the importer finds:

Current certification

Current supplier information

Current product information

No significant changes

No relevant new concerns

Appropriate verification

Organized records

The conclusion is simple:

The supplier remains acceptable.

That's not wasted effort.

That's evidence-based confidence.

---

The biggest discovery: “We hadn't really been reviewing the supplier.”

This is the realization that often matters most.

The importer wasn't necessarily ignoring compliance.

They were simply treating supplier approval as a one-time task.

The supplier was approved.

The file was created.

The business continued.

Nobody deliberately decided:

“Let's stop maintaining this.”

It just happened.

That's how compliance gaps often develop.

Not through one dramatic failure.

Through small periods of inattention.

---

Why annual reassessment is valuable

An annual review creates a forcing function.

It gives the importer a scheduled opportunity to ask:

“What has changed?”

and:

“Does our current information still support our decision?”

That is much easier than trying to remember to review suppliers whenever someone happens to think about them.

---

Annual does not mean “wait a year when something changes”

This distinction matters.

A scheduled annual review is useful.

But significant events should be addressed when they occur.

For example:

Recall

Major complaint

Regulatory action

Significant product change

Supplier facility change

Significant audit finding

These may warrant attention before the next annual review.

FDA's FSVP framework addresses reevaluation when new information or significant changes may affect the adequacy of the FSVP.

---

What an importer should do after discovering a gap

Don't immediately panic.

First classify the finding.

Administrative

Example:

Old address.

Documentation

Example:

Expired certificate.

Verification

Example:

Current verification evidence is missing.

Supplier change

Example:

Production moved to another facility.

Product change

Example:

Formulation changed.

Food safety concern

Example:

Significant incident or regulatory action.

Each type of finding may require a different response.

---

Don't treat every gap the same

A missing signature isn't the same as a significant food safety event.

An outdated contact isn't the same as a supplier recall.

A new facility isn't the same as a formatting error.

The purpose of assessment is not simply to create a list of “missing documents.”

It's to understand the significance of what was found.

---

The emotional shift that happens during a review

At the beginning:

“This should be quick.”

Then:

“Wait, this document is old.”

Then:

“Where is the current certificate?”

Then:

“Did they change facilities?”

Then:

“Do we have the new specification?”

Then:

“Who was supposed to update this?”

And finally:

“Okay. Now we know what needs to be fixed.”

That final moment is important.

Because uncertainty has become a plan.

---

What a good assessment should produce

At the end of a supplier review, you should ideally know:

What is current

What is outdated

What changed

What did not change

What is missing

What needs follow-up

What needs verification

What needs updating

Whether continued supplier approval is appropriate

That is a useful outcome.

---

A simple supplier reassessment matrix

You can think about findings this way:

The exact assessment should be tailored to the applicable FSVP requirements and the supplier-food relationship.

---

What happens after the assessment?

This is where many supplier reviews fail.

The assessment is completed.

The report is filed.

Everyone moves on.

But the findings aren't addressed.

A useful assessment should produce actions.

For example:

Missing certification → request from supplier

Changed specification → review FSVP

New facility → evaluate implications

Expired audit → determine appropriate verification

No significant changes → document conclusion

The review should lead somewhere.

---

The supplier assessment should create a current baseline

Once the review is complete, the importer should have a new reference point.

Now, when someone asks:

“When was this supplier last reviewed?”

there is an answer.

When someone asks:

“What documents are current?”

there is an answer.

When someone asks:

“Did the supplier change?”

there is an answer.

That is what good compliance management provides.

---

You may discover that your supplier wasn't the problem

This is perhaps the most reassuring part.

The supplier may still be excellent.

The problem may have been:

Outdated records

Unclear ownership

Poor document organization

No expiration tracking

No annual review process

Lack of supplier follow-up

Those are fixable.

---

You may also discover that the supplier needs closer attention

That's useful information too.

Perhaps the supplier has:

• Repeated documentation problems
• Significant audit findings
• Poor corrective action
• New food safety concerns
• Significant process changes

Now the importer can make a deliberate decision.

Continue?

Increase verification?

Require corrective action?

Reevaluate?

Find another supplier?

The important thing is that the decision is informed.

---

The value of fresh eyes

Sometimes the importer has looked at the supplier so many times that the file becomes invisible.

Everything feels familiar.

A fresh review can ask:

“Why is this here?”

“What does this document prove?”

“Is this current?”

“Does this apply to the product?”

“Who reviewed this?”

Those questions can reveal things that routine users stop noticing.

---

Why an independent assessment can help

An outside compliance professional can bring a different perspective.

Not because the importer isn't capable.

But because the importer is close to the business.

The supplier is familiar.

The process is familiar.

The documents are familiar.

An independent reviewer can look at the file without assuming that familiarity equals compliance.

---

The purpose isn't to criticize your past work

A good assessment shouldn't be:

“Everything you did before was wrong.”

It should be:

“Here's what your current file tells us, here's what's still strong, here's what needs updating, and here's what we recommend doing next.”

That's much more useful.

---

The real benefit is knowing where you stand

At the beginning of the assessment:

“I think we're okay.”

At the end:

“We reviewed it, and here's where we stand.”

That is the transition importers are looking for.

---