Keeping your FSVP current: reevaluations, corrective actions and records

Approving a supplier is not the end of an FSVP. The rule asks you to reevaluate suppliers, act on problems, keep your records in a set way, and identify yourself at entry. Each point below cites the paragraph of 21 CFR part 1, subpart L it restates.

When to reevaluate a supplier (21 CFR 1.505(c))

• Promptly, on new information. When you become aware of new information about the factors you considered in the evaluation, reevaluate the concerns and document the reevaluation (21 CFR 1.505(c)(1)).
• If the concerns have changed, promptly decide, and document, whether it is appropriate to keep importing the food from that supplier and whether your verification activities need to change (21 CFR 1.505(c)(1)).
• At the latest, every 3 years. If at the end of any 3-year period you have not reevaluated, you must reevaluate then, and document the reevaluation and any action you take (21 CFR 1.505(c)(2)).
• Someone else's reevaluation. If an entity other than the foreign supplier reevaluated, using a qualified individual, you may review and assess their work instead. Document your review, including that a qualified individual did the reevaluation (21 CFR 1.505(d)).

In Aleph: on a food product's Compliance tab, a supplier whose evaluation is already filed shows Record a reevaluation. It opens the same evaluation form with the type set to reevaluation, and files a signed record. The supplier's Re-evaluate the supplier row reads Not due yet while its most recent dated evaluation or reevaluation is less than 3 years old. That is no reason to wait when you learn something new.

Corrective actions (21 CFR 1.508)

• You must promptly take appropriate corrective actions if you determine that a foreign supplier does not produce the food under processes and procedures that give at least the same level of public health protection as FD&C Act section 418 or 419 (if either applies), or that the food is adulterated under section 402 or misbranded under section 403(w) (21 CFR 1.508(a)).
• That determination can come from complaints, your verification activities, a reevaluation, or any other relevant information. What is appropriate depends on the circumstances, and could include no longer using the supplier until the cause has been adequately addressed. Document any corrective action you take (21 CFR 1.508(a)).
• If you learn of the problem some other way than your verification activities or a reevaluation, you must also promptly investigate whether your FSVP is adequate, change it when appropriate, and document the investigation, the corrective actions and the changes (21 CFR 1.508(b)).
• None of this limits your obligations under other laws FDA enforces, such as those on product recalls (21 CFR 1.508(c)).

In Aleph: Record a corrective action on the product's Compliance tab files a signed corrective-action record. When the problem came from a complaint or other information, the form asks you to describe your investigation and any changes to your FSVP.

A hazard someone controls after import (21 CFR 1.507)

For a hazard that your customer, or a company later in the distribution chain, will control, you need not evaluate the supplier or carry out verification activities under 21 CFR 1.505 and 1.506 when one of the circumstances in 21 CFR 1.507(a) applies. In the customer cases, the documents that go with the food must say it is "not processed to control [identified hazard]", and you must obtain your customer's written assurance annually (21 CFR 1.507(a)(2)–(4)). Each assurance must carry an effective date and the printed names and signatures of authorized officials (21 CFR 1.507(b)). The full list of circumstances is in Choosing FSVP supplier verification activities.

In Aleph: this path is not handled yet. The checklist treats such a hazard like any other hazard requiring a control, and there is no record for the customer's annual assurance, so keep the signed assurances in your own records.

How FSVP records must be kept (21 CFR 1.510)

• Keep them as original records, true copies (such as photocopies, pictures or scans) or electronic records (21 CFR 1.510(a)(1)), legible and stored to prevent deterioration or loss (21 CFR 1.510(a)(3)).
• Sign and date them when first completed and whenever the FSVP is modified (21 CFR 1.510(a)(2)).
• Make them available promptly to an authorized FDA representative on request. If a record is in another language, FDA can ask for an English translation, due within a reasonable time (21 CFR 1.510(b)(1)).
• You may store records offsite only if they can be retrieved and provided onsite within 24 hours of a request for official review. Electronic records that can be reached from an onsite location count as onsite (21 CFR 1.510(b)(2)).
• If FDA asks in writing, send the records electronically or by another means that delivers them promptly (21 CFR 1.510(b)(3)).

How long to keep them (21 CFR 1.510(c)):

• Most records: at least 2 years after you created or obtained them (21 CFR 1.510(c)(1)).
• Records of your processes and procedures, including the results of your evaluations and determinations: at least 2 years after their use is discontinued — for example after you stop importing the food or using the supplier, reevaluate the food and supplier, or change your verification activities for them (21 CFR 1.510(c)(2)).

In Aleph: Aleph does not track these periods. Check them before you delete a record.

Identifying yourself at entry (21 CFR 1.509)

• For each line entry of food offered for import, your name, email address and "unique facility identifier recognized as acceptable by FDA", identifying you as the importer, must be provided electronically when entry is filed with U.S. Customs and Border Protection (21 CFR 1.509(a)).
• If the food has no U.S. owner or consignee, the foreign owner or consignee must designate a U.S. agent or representative as the importer before the food is imported (21 CFR 1.509(b)).
• That identifier identifies you as the importer. It is not a food facility registration number, which identifies a facility; see Your FDA food facility registration. FDA's guidance names the identifiers it accepts; the regulation itself names none.

In practice: this is data sent to CBP with each entry, not a document you file away. Whoever files your entries, usually your customs broker, transmits it, so ask them to confirm that your own name, email address and identifier, not the supplier's, are on every line entry.

Sample filled records

What each signed FSVP form in Aleph produces, filled in for a fictional company. Every page is marked FOR REFERENCE ONLY. They show the layout, not wording to copy: your records state your own evaluation and decisions. Each opens in a new tab.

• Foreign supplier evaluation (21 CFR 1.505(a))
• Foreign supplier approval (21 CFR 1.505(b))
• Verification activity record (21 CFR 1.506(e))
• Corrective action (21 CFR 1.508)
• Written verification procedures (21 CFR 1.506(b))
• Qualified individual (21 CFR 1.503)
• Hazard analysis (21 CFR 1.504)