By: Fabiola Negrón, Director of Food Safety at Registrar Corp
Most importers feel confident in their Foreign Supplier Verification Program until one moment: the FDA issues a Notice of Inspection. What surprises companies is not the inspection itself, but the speed, precision, and thoroughness with which investigators assess whether your FSVP is in place, implemented correctly, and accurately reflects the risks in your supply chain.
FSVP audits are among the most unforgiving reviews FDA conducts. They are designed to expose gaps quickly and to hold the U.S. importer accountable, even when the foreign supplier’s systems appear strong. This guide breaks down what really happens during an FSVP audit and why importers who think they are prepared often aren’t.
Why the FDA’s FSVP Audit Model Feels Different
Most regulatory audits allow for conversation, clarification, or corrective demonstrations. FSVP is different. Almost every conclusion the FDA reaches is based on whether your records match:
- The hazards associated with your products
- The controls implemented by your foreign supplier
- The risk-based verification activities you selected
If these three elements don’t align, investigators deem the program inadequate. It’s common for importers to discover during the audit that their written procedures don’t match the actual actions of their personnel, one of the most frequent reasons for enforcement.
The Audit Trigger: How FDA Decides to Inspect You
FSVP audits may occur:
- As routine FSMA surveillance
- Following import entry reviews
- After significant supplier incidents
- In response to consumer complaints or outbreak investigations
Most companies receive no advance notice beyond Form 482, the standard notification of inspection. From that moment, the clock starts.
What Happens in the First Minutes of an FSVP Audit
Once the investigator arrives, they will immediately request:
- Your written FSVP
- Hazard analyses
- Supplier evaluations and approval rationale
- Verification activity records
- Evidence of reanalysis
Unlike facility inspections, the FDA does not tour your operations or observe production. The audit is almost entirely a document-for-document evaluation. If your records are incomplete, inconsistent, or not readily retrievable, the investigator writes the deficiency into the file.
The Core Review: What the FDA Examines Most Closely
Investigators focus on five areas because they reveal the strength or failure of an FSVP:
- Hazard Analysis Quality
Is the hazard analysis product-specific, risk-based, and reviewed by a qualified individual? Does it identify who controls each hazard? If your analysis is generic or outdated, the FDA notes it immediately.
- Supplier Approval Decisions
Does your supplier’s performance justify approval? Many importers list a supplier as “approved” with no written rationale, no historical review, and no evaluation of corrective actions.
- Verification Activities
Were the activities selected appropriate for the hazards? For example, testing alone rarely satisfies verification for high-risk suppliers. The FDA expects logic, not convenience.
- Alignment Between Records and Reality
Do your written procedures match your actual practices? If the investigator interviews staff and hears a different process than what appears in your FSVP, this misalignment is cited.
- Qualified Individual Involvement
Was a properly trained individual involved in the evaluation and approval process? Lack of PCQI or FSVP training is one of the most consistent findings across Warning Letters. Importers who want clarity on common qualified-individual pitfalls often refer to audit risks PCQIs can prevent.
Where Importers Most Frequently Get Caught
Certain mistakes appear so consistently that investigators expect to find them. These include:
- Missing or Boilerplate Hazard Analyses
Generic hazard analyses signal to FDA that the importer has not evaluated the supplier’s actual process. This often leads investigators to review multiple product lines.
- Supplier Approval Without Documentation
“Approved” means nothing if the rationale isn’t recorded. FDA will consider the supplier effectively “not evaluated” if documents aren’t present.
- Incomplete or Inappropriate Verification Activities
When importers choose minimal verification activities or choose them for convenience, investigators note the gap immediately.
- Failure to Reassess Suppliers
Reassessment is required at least every three years. Many companies fail to document this step, even if their supplier has not changed.
- Broken Internal Communication
When procurement, QA, and leadership are not aligned, the FSVP falls apart under audit pressure. FDA expects that all responsible parties can explain the program.
- Lack of Alignment With HACCP or Preventive Controls
- If supplier controls do not logically align with the hazards in your analysis, FDA views the entire program as structurally weak.
Why FSVP Audits Create Urgency for Training
FSVP is a regulation built on interpretation—and interpretation requires training. The most consistently cited deficiencies are tied to misunderstandings of what FDA considers a risk-based verification.
Companies with formally trained FSVP personnel are significantly more likely to:
- Produce records that meet FDA expectations
- Demonstrate appropriate hazard evaluations
- Justify supplier approval decisions
- Prepare corrective actions when needed
Your Next Step: Strengthen Your Team Before FDA Arrives
An FSVP audit goes beyond merely confirming the existence of your program; it delves into its accuracy, logic, and implementation. If your team is uncertain about evaluating hazards, justifying supplier approval, or selecting verification activities with FDA-level reasoning, formal FSVP training offers immediate alignment and clarity.
Fabiola Negrón is the Director of Food Safety at Registrar Corp. She oversees regulatory specialists that assist domestic and foreign food facilities and U.S. importers with U.S. FDA food safety compliance. Registrar Corp is the world’s largest FDA compliance company, helping food, beverage, cosmetics, medical devices, and drug companies meet compliance requirements.