Compliance

FSVP checklist, row by row

Every FSVP requirement on a product's checklist: what the regulation asks, whose work it is, when it applies and how to record it.

Every row of a product's FSVP checklist, in the order the checklist shows them, with the regulation's full wording, who does the work, when it applies and each way to record it. The checklist itself keeps only the row's name, its citation and the buttons to record it.

INFO: FSVP records are held per supplier and per food, not per SKU. The supplier evaluation, approval and verification duties — including importing only from approved suppliers — fall away entirely if your hazard analysis finds no hazards requiring a control.

Qualified individual (21 CFR 1.503(a), once for your company). A person with the education, training, or experience to perform your FSVP activities. This is a person on record, not a document.

Whose work it is: You name this person yourself. They may be your own staff or an outside consultant, but they must be able to read and understand the language of every record they review, including your supplier's.

How it is met:

A qualified individual on file — a record you create in Aleph.
- Also record: Your qualified individual developed the FSVP and performed each required activity (21 CFR 1.503(a))
- Also record: They can read and understand the language of the records they must review (21 CFR 1.503(a))

Source: 21 CFR 1.503(a) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Hazard analysis (21 CFR 1.504(a), for each product). A written analysis of known or reasonably foreseeable hazards for each type of food you import. It must be written regardless of its outcome — including when it finds no hazards requiring a control.

Whose work it is: Either you write it, or you review one your supplier or another company already did — but only if a qualified individual prepared it, and you must document your review. A supplier's HACCP plan sitting on file does not count until that review is recorded.

Ways to meet it (any one):

Your own hazard analysis, signed — a record you create in Aleph.
Your review of another entity's hazard analysis (§1.504(d)) — You are relying on a hazard analysis performed by your supplier or another entity. Record which document you reviewed.
- Also record: The other entity used a qualified individual (21 CFR 1.504(d))
- Also record: You reviewed and assessed it, and documented that review (21 CFR 1.504(d))

Source: 21 CFR 1.504(a) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Foreign supplier evaluation (21 CFR 1.505(a), for each supplier of the product). An evaluation of the supplier's performance and the risk posed by the food. You may instead review and assess an evaluation another entity performed.

Whose work it is: You perform the evaluation, weighing the factors §1.505(a) lists: the hazard analysis, who controls the hazards, and the supplier's performance including FDA warning letters and import alerts. You may instead rely on an evaluation another entity did using a qualified individual (§1.505(d)) — but not one done by the supplier itself, and you must review it and document that review.

When it does not apply (21 CFR 1.504(f)) — once you record that, the row says: “Not required — your hazard analysis found no hazards requiring a control, so §1.504(f) excuses the supplier evaluation and verification activities.”

Ways to meet it (any one):

Your evaluation on file — upload one of: Foreign Supplier Evaluation.
Your review of another entity's evaluation (§1.505(d)) — You are relying on an evaluation performed by another entity. Confirm you reviewed and assessed it.

Source: 21 CFR 1.505(a) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Documented approval of the supplier (21 CFR 1.505(b), for each supplier of the product). You must approve each foreign supplier on the basis of that evaluation, and document the approval. Approval is a separate recorded act from the evaluation it rests on.

Whose work it is: You record your approval of this supplier, based on the evaluation — whether you did it yourself or reviewed another company's under §1.505(d). Unlike the evaluation, §1.505(b) offers no route to rely on another company's approval.

Ways to meet it (any one):

A written approval on file — upload one of: Foreign Supplier Approval.
Your recorded approval — Confirm you approved this supplier on the basis of your evaluation.

Source: 21 CFR 1.505(b) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Import only from approved suppliers (21 CFR 1.506(a)(1), once for your company). Written procedures, which you follow, to ensure you import foods only from foreign suppliers you approved based on your §1.505 evaluation — or, when necessary and appropriate, temporarily from unapproved suppliers whose foods you subject to adequate verification activities before importing. You must document your use of these procedures.

Whose work it is: Yours to set up and follow: written procedures that keep food from being imported from a supplier you have not approved, and records showing you use them. Another company — but not your foreign supplier — may set up and run them for you, if you review and assess its documentation and document that review (§1.506(a)(2)).

When it does not apply (21 CFR 1.504(f)) — once you record that, the row says: “Not required — your hazard analysis found no hazards requiring a control, so §1.504(f) excuses the §1.505 evaluation for supplier approval that these procedures rest on.”

How it is met:

Your recorded confirmation — Confirm you have written procedures, and follow them, to ensure you import foods only from foreign suppliers you approved based on your evaluation (or, when necessary and appropriate, temporarily from unapproved suppliers whose foods you verify before importing), and that you document your use of those procedures.

Source: 21 CFR 1.506(a)(1) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §§1.504–1.506 carry no later amendment note (eCFR title 21, issue date 2026-09-11). Read 2026-09-15.

Written verification procedures (21 CFR 1.506(b), once for your company). Adequate written procedures for ensuring appropriate verification activities are conducted for the foods you import. These are your procedures, held once, not per supplier.

Whose work it is: You set these up: written procedures for making sure the right verification is done for the foods you import. Before you first import from a supplier, you must also document which activity you will use (an onsite audit, sampling and testing, a records review, or another appropriate activity) and how often (§1.506(d)).

How it is met:

Written procedures on file — upload one of: Written Verification Procedures.

Source: 21 CFR 1.506(b) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Supplier verification activities (21 CFR 1.506(e)(1), for each supplier of the product). For each supplier, conduct and document (or obtain documentation of) an onsite audit, sampling and testing, a review of food safety records, or another appropriate activity — before importing and periodically thereafter.

Whose work it is: Usually comes from outside: an onsite audit by a qualified auditor, lab test results, or your supplier's food safety records for your qualified individual to review — whichever you decided on for this supplier. Only an activity already carried out counts — a scheduled one does not, so record the date it was completed. Your supplier cannot verify itself, except for sampling and testing, and you must review each result and document that review.

How it is met:

A completed verification activity on record — a record you create in Aleph.
- Also record: You promptly reviewed and assessed the results, and documented that review (21 CFR 1.506(e)(3))

Source: 21 CFR 1.506(e)(1) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §§1.504–1.506 carry no later amendment note (eCFR title 21, issue date 2026-09-11). Read 2026-09-15.

Onsite audit documentation (21 CFR 1.506(e)(1)(i)(D), for each supplier of the product). If you chose an onsite audit for this supplier, keep documentation of each audit — the audit procedures, the dates it was conducted, its conclusions, any corrective actions taken for significant deficiencies, and documentation that a qualified auditor conducted it.

Whose work it is: Usually the audit report from the qualified auditor who visited the factory — upload it to this supplier, or file Aleph's signed verification activity record. Written results of an FDA or other qualifying government inspection within the year may stand in for the audit (§1.506(e)(1)(i)(E)); say so on that record.

When it does not apply (21 CFR 1.506(d)(1)(i)) — once you record that, the row says: “Not required — you have not chosen an onsite audit for this supplier, or your hazard analysis found no hazards requiring a control (§1.504(f)).”

Ways to meet it (any one):

The audit report, on file for this supplier — upload one of: Third-Party Audit Report.
Your signed verification activity record — a record you create in Aleph.
Held by the entity that conducted it, retrievable for FDA — Another entity conducted an onsite audit and holds its documentation. Write down who holds it and how you would obtain it — you must be able to give it to FDA within 24 hours of a request. Your note is the record, so it is required.

Source: 21 CFR 1.506(e)(1)(i)(D) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.506(e) read verbatim from eCFR title 21, issue date 2026-09-22. Read 2026-09-24.

Sampling and testing documentation (21 CFR 1.506(e)(1)(ii), for each supplier of the product). If you chose sampling and testing for this supplier, keep documentation of each test — the food tested (with lot number, as appropriate), the number of samples, the tests and analytical methods, the test and report dates, the results, any corrective actions, the laboratory that did the testing, and documentation that a qualified individual conducted it.

Whose work it is: Usually a lab report or certificate of analysis — upload it to this supplier, and check it names the lot, the method and the laboratory (a generic factory report often does not). Your supplier may run this test itself — the one activity it may (§1.506(e)(2)(ii)). Or file Aleph's signed verification activity record.

When it does not apply (21 CFR 1.506(d)(1)(i)) — once you record that, the row says: “Not required — you have not chosen sampling and testing for this supplier, or your hazard analysis found no hazards requiring a control (§1.504(f)).”

Ways to meet it (any one):

A lab report or certificate of analysis, on file for this supplier — upload one of: Lab Report, Certificate of Analysis (COA).
Your signed verification activity record — a record you create in Aleph.
Held by the entity that conducted it, retrievable for FDA — Another entity conducted sampling and testing and holds its documentation. Write down who holds it and how you would obtain it — you must be able to give it to FDA within 24 hours of a request. Your note is the record, so it is required.

Source: 21 CFR 1.506(e)(1)(ii) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.506(e) read verbatim from eCFR title 21, issue date 2026-09-22. Read 2026-09-24.

Records review documentation (21 CFR 1.506(e)(1)(iii), for each supplier of the product). If you chose to review this supplier's food safety records, keep documentation of each review — the dates, the general nature of the records reviewed, your conclusions, any corrective actions for significant deficiencies, and documentation that a qualified individual conducted it.

Whose work it is: Yours to write: the record is YOUR review, not the supplier's records themselves — file Aleph's signed verification activity record. The temperature logs or SOPs you review are worth keeping, but they are not what this paragraph requires.

When it does not apply (21 CFR 1.506(d)(1)(i)) — once you record that, the row says: “Not required — you have not chosen a review of this supplier's food safety records, or your hazard analysis found no hazards requiring a control (§1.504(f)).”

Ways to meet it (any one):

Your signed verification activity record — a record you create in Aleph.
Held by the entity that conducted it, retrievable for FDA — Another entity conducted a review of the supplier's food safety records and holds its documentation. Write down who holds it and how you would obtain it — you must be able to give it to FDA within 24 hours of a request. Your note is the record, so it is required.

Source: 21 CFR 1.506(e)(1)(iii) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.506(e) read verbatim from eCFR title 21, issue date 2026-09-22. Read 2026-09-24.

Other verification activity documentation (21 CFR 1.506(e)(1)(iv)(B), for each supplier of the product). If you chose another appropriate verification activity for this supplier, keep documentation of each time you do it — a description of the activity, the date it was conducted, its findings or results, any corrective actions taken for significant deficiencies, and documentation that a qualified individual conducted it.

Whose work it is: Yours to write: file Aleph's signed verification activity record, which asks for each of those elements. The regulation allows another activity only when it is appropriate based on the supplier's performance and the risk of the food (§1.506(e)(1)(iv)(A)).

When it does not apply (21 CFR 1.506(d)(1)(i)) — once you record that, the row says: “Not required — you have not chosen another verification activity for this supplier, or your hazard analysis found no hazards requiring a control (§1.504(f)).”

Ways to meet it (any one):

Your signed verification activity record — a record you create in Aleph.
Held by the entity that conducted it, retrievable for FDA — Another entity conducted another appropriate verification activity and holds its documentation. Write down who holds it and how you would obtain it — you must be able to give it to FDA within 24 hours of a request. Your note is the record, so it is required.

Source: 21 CFR 1.506(e)(1)(iv)(B) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.506(d)(1)(ii)(D) and (e)(1)(iv) read verbatim from eCFR title 21, up to date as of 2026-09-24. Read 2026-09-28.

Which verification activity, and how often (21 CFR 1.506(d)(1)(i), for each supplier of the product). Before importing from a supplier, decide and write down which verification activity you will use — an onsite audit, sampling and testing, a review of the supplier's food safety records, or another appropriate activity — and how often it will be done. The choice must follow from your §1.505 evaluation of that food and supplier.

Whose work it is: Yours to decide, before the first shipment: record the activity and its frequency for this supplier. This is the PLAN, so it counts as soon as it is written down — carrying it out is a separate duty (§1.506(e)(1)). You may instead rely on another entity's determination, if you review and assess whether it is appropriate and document that a qualified individual made it (§1.506(d)(3)).

How it is met:

An activity and frequency on record for this supplier — a record you create in Aleph.

Source: 21 CFR 1.506(d)(1)(i) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.505(c) and §1.506(d) read verbatim from eCFR title 21, issue date 2026-09-11. Read 2026-09-16.

Onsite audit for a serious hazard (before the first import, then at least annually) (21 CFR 1.506(d)(2), for each supplier of the product). When your supplier controls a hazard that could cause serious illness or death, you must conduct or obtain documentation of an onsite audit of the supplier before your first import and at least annually after — unless you make an adequate written determination that other verification activities, or less frequent onsite audits, give adequate assurance.

Whose work it is: Due before your first import from this supplier, then at least once a year. Usually an audit report from a qualified auditor who visited the factory — record it as a completed onsite audit on this supplier's verification, with the date it was done. If you decided that lab testing, records review or less frequent audits are enough, record that decision and your reasoning instead.

When it does not apply (21 CFR 1.506(d)(2)) — once you record that, the row says: “Not required — no hazard your supplier controls is marked as one that could cause serious illness or death.”

Ways to meet it (any one):

A completed onsite audit within the last 12 months — a record you create in Aleph.
Your written determination that other verification is adequate — Write down your determination: which other verification activities (sampling and testing, records review, another activity) or what less frequent audit schedule you use for this supplier, and why that gives adequate assurance. Your note is the record, so it is required.

Source: 21 CFR 1.506(d)(2) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.505(c) and §1.506(d) read verbatim from eCFR title 21, issue date 2026-09-11. Read 2026-09-16.

Re-evaluate the supplier (21 CFR 1.505(c), for each supplier of the product). Re-evaluate a supplier promptly whenever you learn something new that bears on the risk, and in any case if three years pass without a re-evaluation. If the concerns have changed, decide — and write down — whether to keep importing from them and whether your verification activities need to change.

Whose work it is: Yours to do and document. Prompted by new information — an FDA warning letter or import alert, a failed test, a recall, a change at the factory — and otherwise at least every three years. Another company, but not your foreign supplier, may perform it if you review and assess their work and document that a qualified individual did it (§1.505(d)).

Not due yet: Not due yet — your most recent dated evaluation of this supplier is less than three years old (§1.505(c)(2)). If you learn something new that bears on the risk before then, re-evaluate promptly and record it here (§1.505(c)(1)).

Ways to meet it (any one):

A signed reevaluation within the last 3 years — a record you create in Aleph.
Your recorded confirmation — Confirm you re-evaluate this supplier promptly when you learn new information bearing on the risk, and at least once every three years, and that you document each re-evaluation and any action you take as a result.

Source: 21 CFR 1.505(c) — 80 FR 74340, Nov. 27, 2015 — subpart L source; §1.505(c) and §1.506(d) read verbatim from eCFR title 21, issue date 2026-09-11. Read 2026-09-16.

Corrective actions (21 CFR 1.508(a), for each supplier of the product). Required only once you determine a supplier is not producing the food in compliance, or that the food is adulterated or misbranded. A supplier with no such determination has nothing to record here.

Whose work it is: You create these only when something goes wrong. There is nothing to collect until a problem arises — an empty record here is the normal state.

When it does not apply (21 CFR 1.508(a)) — once you record that, the row says: “Not applicable — no finding of supplier non-compliance, adulteration, or misbranding has been recorded.”

How it is met:

A documented corrective action — upload one of: Corrective Actions.

Source: 21 CFR 1.508(a) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Importer identification at entry (21 CFR 1.509(a), once for your company). Your name, email address, and a unique facility identifier FDA accepts must be transmitted electronically when filing entry with CBP. This is filed data, not a document. FDA's guidance names the identifiers it accepts; the regulation itself names none.

Whose work it is: Not a document you file away — it is data your customs broker transmits to CBP at entry: your name, your email address, and the facility identifier FDA recognizes. Ask your broker to confirm YOUR details are on the entry, not the supplier's.

How it is met:

Name, email, and unique facility identifier on file — taken from the details you enter.

Source: 21 CFR 1.509(a) — 80 FR 74340, Nov. 27, 2015, as amended at 81 FR 25327, Apr. 28, 2016 (eCFR title 21, issue date 2026-08-14). Read 2026-08-18.

Not required, but worth holding

Certificate of Analysis (COA) — Supports sampling and testing as a verification activity under §1.506(e)(1)(ii).
Product Specifications — Evidence for the hazard evaluation factors listed at §1.504(c)(3).

INFO: This lists what the checklist records. It is not legal advice, and a row recorded in Aleph is not a finding that the product complies.

Related articles