Choosing FSVP supplier verification activities

Once your hazard analysis identifies hazards that require control at the foreign supplier, FSVP requires you to perform supplier verification activities to confirm those controls are working. The rule lists four kinds of activity, and before you import you must decide — and write down — which of them you will use for each supplier and how often (21 CFR 1.506(d)(1)(i)).

Four verification activities (21 CFR 1.506(d)(1)(ii)):

• Onsite audit — physical inspection at the supplier's facility, performed by a qualified auditor. Highest evidentiary weight.
• Sampling and testing — laboratory testing of incoming product or raw materials against the controlled hazard.
• Review of the foreign supplier's relevant food safety records — documented evidence of the supplier's preventive controls (HACCP plans, monitoring records, corrective actions, training logs).
• Other appropriate supplier verification activities — any other check that is appropriate given the supplier's performance and the risk of the food (21 CFR 1.506(e)(1)(iv)(A)). Because it has no fixed form, your record of it must include a description of the activity, the date it was done, its findings or results, any corrective actions, and documentation that a qualified individual did it (21 CFR 1.506(e)(1)(iv)(B)).

Picking the right activity (severity-driven):

1. Hazard requiring a preventive control AND severe outcome (e.g., Salmonella in ready-to-eat foods) — if the hazard could cause serious illness or death and your supplier is the one controlling it, the default is an onsite audit before your first import and at least once a year after. You can rely on sampling and testing, a records review, or less frequent audits instead, but only if you make a written determination that they give adequate assurance, and keep it in your FSVP records (21 CFR 1.506(d)(2)).
2. Hazard requiring a preventive control AND moderate outcome — any of the four activities can be the right one, including sampling and testing or a records review. You choose which, and how often, based on your evaluation of the food and the supplier, and you write that choice down before you import (21 CFR 1.506(d)(1)(i)).
3. Hazard that will be controlled after import, by your customer or by someone later in the chain — this is not a supplier-verification case at all. For that hazard you are not required to evaluate the supplier or do verification activities under 21 CFR 1.505 and 1.506 (21 CFR 1.507(a)). Instead, the documents that travel with the food must say it is "not processed to control [the hazard]", and you must get a written assurance from your customer every year (21 CFR 1.507(a)(2)–(4)). What the assurance promises depends on who controls the hazard: that your customer follows procedures that will significantly minimize or prevent it ((a)(2)); that your customer makes the food in line with the food safety requirements that apply to it ((a)(3)); or, when a company after your customer controls it, that your customer will pass the same disclosure on and sell only to a company that agrees in writing to control the hazard or to get the same assurance from its own customer ((a)(4)). Each assurance must carry an effective date and the printed names and signatures of authorized officials (21 CFR 1.507(b)). The rule lists two other cases like this: a food that cannot be eaten without a control being applied, such as coffee beans or cocoa beans ((a)(1)), and a documented system of your own that ensures the hazard is controlled at a later step ((a)(5)).

Produce has its own hazard-analysis rule, not a separate path around FSVP. For a raw fruit or vegetable that is "covered produce" under the Produce Safety Rule (21 CFR 112.3), you don't have to decide whether its biological hazards require a control: the rule treats them as requiring one, addressed by compliance with part 112. You must still decide whether any other hazards require a control (21 CFR 1.504(e)), and the "no hazards requiring a control" shortcut does not apply to covered produce (21 CFR 1.504(f)), so supplier evaluation and verification still apply. Produce from a farm that is not covered by part 112 may qualify for the modified requirements in 21 CFR 1.512.

TIP: Records review is the lowest-cost option but the lowest evidentiary weight. Use it for low-severity hazards or as a supplement to sampling — rarely as the only verification for a high-risk hazard.

Frequency rules:

• Onsite audits for hazards that could cause serious illness or death: before first import and at least annually, unless you have made a written determination that other activities or less frequent audits are adequate (21 CFR 1.506(d)(2))
• Sampling and testing, a records review, or another appropriate activity: the rule sets no fixed interval. You decide how often, and document that decision before you import (21 CFR 1.506(d)(1)(i)). You then do the activity before importing and periodically after that (21 CFR 1.506(e)(1)), and promptly review and document the results (21 CFR 1.506(e)(3)).

Base the frequency on your evaluation of the food and the supplier: the rule requires your choice of activities, and how often you do them, to rest on that evaluation (21 CFR 1.506(d)(1)(i)). A frequency written down with no basis behind it does not meet that requirement.

WARNING: An onsite audit must be performed by a qualified auditor (21 CFR 1.506(e)(1)(i)(A)) — a qualified individual with the technical expertise to audit. The rule's own examples are a government employee and an audit agent of a certification body accredited under 21 CFR part 1, subpart M (21 CFR 1.500); a qualified individual may also be your own employee. The supplier's own internal auditor doesn't count: you may not rely on the foreign supplier or its employees to perform verification activities, except for sampling and testing (21 CFR 1.506(e)(2)(ii)).