Skip to main content
Heads upFSMA 204 compliance is July 20, 2028 — extended via H.R. 5371 in November 2025. Get the implementation checklist →
HACCPLAN
Solutions / Importers (FSVP)

Solutions / Importers (FSVP)

Food safety software for FSVP importers.

FSVP is the importer's file, in the importer's US office, in English, on the inspector's desk inside 24 hours. The foreign supplier's audit certificate is not the file. HACCPlan is the data model that builds the file — per food, per supplier, every shipment.

Updated 2026SolutionsVertical

Andrew Langevin· 2026-06-04· 14 min read

I am not, technically, an FSVP importer. I run a CFIA-licensed (Canadian Food Inspection Agency) mushroom production facility in Brantford, Ontario, and I ship product into the US under the Safe Food for Canadians Regulations (SFCR). That makes me a foreign supplier under 21 CFR §1.500. My US buyer is the FSVP importer. When that buyer first asked me to "be FSVP-compliant," I almost spent a week building a hazard analysis they did not legally need. I called them back, asked them to read §1.513, and 90 minutes later sent them our SFC licence number, a CFIA registry screenshot, and a one-page Preventive Control Plan attestation. That was the file. Most Canadian operators do not know they can do this. Most US importers do not know they can ask. This article is about the file the US importer has to build — and the shortcut for the ones whose suppliers happen to be in Canada, New Zealand, or Australia.

01The misunderstanding

FSVP is not the supplier's certificate. It is your file.

FSVP stands for Foreign Supplier Verification Program. It was created by Section 301 of FSMA (the Food Safety Modernization Act, 2011), which added Section 805 to the Federal Food, Drug, and Cosmetic Act (codified at 21 U.S.C. §384a). The FDA wrote the implementing rule on November 27, 2015, and the whole regime lives at 21 CFR Part 1 Subpart L — sections §1.500 through §1.514.

Here is the part that gets nearly everyone wrong on the first read. FSVP is not a regime that regulates the foreign production line. It regulates the US-based desk worker who buys the food at entry. If you are a US distributor, ethnic-market wholesaler, e-commerce reseller, drop-shipper, white-label importer, or specialty food broker — and you take title to imported food at the dock or at a US warehouse — you are almost certainly an FSVP importer for that food, regardless of what your customs paperwork says.

70+

FSVP warning letters issued by FDA across 2024 and 2025. Common finding in every single one: "the importer did not develop, maintain, and follow an FSVP."

72 hours

To respond to Form FDA 482d when FDA requests FSVP records under a Remote Regulatory Assessment (RRA). Refusal is treated as a refusal of inspection.

24 hours

To produce records under §1.510 — in English, at your US office, when the investigator asks. Translation has to be cached, not generated under the clock.

The single most common operator failure is not "the file was inadequate." It is "the file did not exist." The supplier had FSSC 22000, BRCGS, or a third-party SGS audit. None of that satisfies FSVP on its own. FSVP is your file — built by your qualified individual, kept at your US office, retrievable in 24 hours, in English. The supplier's certificate is one input into that file. It is not the file.

02Who is the importer

The number-one FSVP misunderstanding — who actually is the "importer."

Per §1.500, the FSVP importer is "the U.S. owner or consignee of an article of food that is being offered for import into the United States." If there is no US owner or consignee at entry (the foreign manufacturer is shipping on consignment), the importer is the US agent or representative of the foreign owner, named on a signed statement of consent.

Three points of confusion that put operators on the wrong side of a Form 483a observation:

  1. 01

    The customs Importer of Record is not always the FSVP importer

    Customs-broker convention often lists the broker or freight forwarder as the IOR (Importer of Record) on CBP (Customs and Border Protection) Form 7501. That has no bearing on who FDA considers the FSVP importer. FDA looks at who actually owns the food at entry — almost always the US business that bought it. Operators see "broker is IOR" on their paperwork and assume the broker handles FSVP. The broker does not.

  2. 02

    Distributors and resellers are importers

    A US ethnic-market wholesaler buying enoki mushrooms in Korea, taking title at the dock in Long Beach, and reselling to retailers is the FSVP importer for those mushrooms. The Korean supplier is the foreign supplier. The wholesaler is the importer. FDA confirmed this in the 2024 enforcement against HH Fresh Trading Corp in Los Angeles (cited below in section 06).

  3. 03

    Drop-shippers, white-label resellers, and Amazon FBA importers are importers

    If a US business has a private-label product made overseas and brings it in under their brand — even if a third-party logistics company physically handles the freight — the US business is the FSVP importer. The brand is the legal target.

From the supplier side

US buyers regularly send me due-diligence questionnaires asking me, the Canadian supplier, to provide hazard analyses and verification audits structured as if I were the one subject to FSVP. I am not. The buyer is. When I send them back our SFC (Safe Food for Canadians) licence number and explain the §1.513 modified-requirements pathway (covered in section 04), they almost always reply with relief — they had been asking for the wrong file from the wrong party. The cleanest FSVP work an importer can do is start by reading §1.500 carefully and figuring out which foods they actually own at entry.

03The five activities

The five mandatory FSVP activities — per food, per supplier.

This is the unit of work that everything else in FSVP hangs off. The FSVP regulation does not ask you to build one program for your whole operation. It asks you to build a record set for each food you import, from each foreign supplier you import it from. Twenty foods from one supplier equals twenty record sets. Two foods from ten suppliers equals twenty record sets. The data model is unforgiving.

For every food × supplier pair, the importer must:

  1. 01

    Conduct a hazard analysis (§1.504)

    Identify the known or reasonably foreseeable hazards — biological, chemical (including radiological), and physical — that apply to this food. Consider formulation, establishment conditions, raw materials, transportation, harvest/process/pack/label procedures, storage and distribution, intended use, and sanitation. For each hazard, determine whether it requires a control. The hazard analysis can rely on the supplier's own analysis as long as your QI (Qualified Individual — see section 05) reviews and signs off on it.

  2. 02

    Evaluate and approve the foreign supplier (§1.505)

    Look at the supplier's performance and the risk posed by the food. Consider their hazard analysis, food-safety practices, FDA compliance history, and reportable food registry or recall history. Approve them before importing. Reevaluate at least every three years — sooner if conditions change (new product line, supplier audit downgrade, recall against an adjacent product). The 3-year reassessment clock is the most-missed deadline in the regime.

  3. 03

    Conduct appropriate verification activities (§1.506)

    Choose the activity matched to the hazard severity and supplier history. The three accepted activities are: onsite audit of the foreign supplier (required at least annually before first import and yearly thereafter when there is a hazard "reasonably likely to cause serious adverse health consequences or death," per §1.506(d)(1)(ii), unless you document an adequate written justification for an alternative); sampling and testing of the food; or review of the supplier's relevant food-safety records. Mix activities by SKU as needed.

  4. 04

    Take corrective actions when warranted (§1.508)

    When verification or any other information reveals a hazard not adequately controlled, take prompt corrective action. That can mean discontinuing the supplier until the cause is found and adequate controls are established. The corrective-action log is part of the FSVP file — keep it, do not just email about it.

  5. 05

    Maintain records (§1.510)

    Retain everything for at least two years after you stop using that supplier or that food. Records must be retrievable within 24 hours of an FDA request. They must be in English, or accompanied by a verified English translation. Electronic records are fine; the inspector does not need to see the paper.

The five activities are not a checklist you do once and walk away from. They are a continuously maintained file, per food × per supplier, with timestamps and signatures, that an FDA investigator can read in your US office without you scrambling. The whole game is the file.

04The shortcuts

The two big shortcuts — §1.512 and §1.513 — that most importers never claim.

The FSVP regulation contains two material relief pathways that small and mid-size importers should evaluate before they commit to the full §§1.504-1.508 buildout. Most consultants and most software vendors do not lead with these — they do not get paid for the file the importer did not need to build.

Very small importer

§1.512

Threshold. Three-year average human-food sales-plus-imported-value under $1 million (adjusted for inflation from the 2011 baseline). For animal food the threshold is $2.5 million. The thresholds get adjusted periodically — check the current eCFR before relying on them.

What changes. Very small importers do not have to conduct hazard analyses or formal verification activities for most foods. They may verify the foreign supplier by obtaining written assurances that the supplier is producing food in compliance with US food-safety requirements — typically a Letter of Continuing Guarantee on the supplier's letterhead, refreshed annually.

What does not change. §1.503 QI requirement, §1.509 UFI at entry, and §1.510 records retention all still apply.

Equivalent system

§1.513

Eligibility. Importing food from a country whose food-safety system FDA has officially recognized as comparable or equivalent — and the food is not intended for further manufacturing or processing in the US. Three countries qualify as of 2026: New Zealand (recognized 2012), Canada (recognized 2016), Australia (recognized 2017).

What changes. The importer is exempt from the entire chain of §§1.504 through 1.508 — hazard analysis, supplier evaluation, verification activities, corrective actions. The 40-hour FSVP build collapses to a 1-to-2-hour record assembly.

What does not change. The importer still complies with §1.503 (QI), §1.509 (UFI at entry), and §1.510 (records). You document annually that the supplier is in good compliance standing with their home regulator (CFIA, FSANZ, or MPI).

The §1.513 pathway is the one I know intimately, because I am on the supplier side of it. When a US buyer wants to source from Nature Lion Inc.'s Brantford facility, they can claim the §1.513 modified-requirements pathway by collecting and keeping the following annually:

  1. 01

    My current SFC licence number

    The Safe Food for Canadians (SFC) licence is the CFIA-issued authorization that allows a Canadian operator to manufacture, process, or store food for export. The number is permanent for the operator but the licence has an expiry — typically two years. The US buyer keeps a copy of the current licence on file.

  2. 02

    A screenshot of the CFIA SFC Licence Registry

    The registry is public and searchable. The screenshot is dated, shows the licence number, and shows "Valid" or equivalent status. Refresh annually.

  3. 03

    A one-page PCP attestation letter from me

    The Preventive Control Plan (PCP) is the Canadian equivalent of the US preventive-controls plan under 21 CFR 117. The attestation says I maintain a PCP, I am compliant with SFCR, and I will notify the buyer of any change in my licence standing. One page. Signed and dated.

  4. 04

    The buyer's own §1.513 determination

    A short internal memo, written by the buyer's QI, that documents (a) the country of origin, (b) the FDA Systems Recognition arrangement, (c) the product category eligibility, (d) the absence of further-processing intent in the US, and (e) the date of determination. This memo is the foundation document the FDA inspector wants to see.

That is the entire file. For a US importer sourcing eligible Canadian-origin food from an SFC-licensed facility, the §1.513 pathway turns a 40-hour FSVP project into a 90-minute one. Most Canadian operators do not know they can hand this packet to their US buyers. Most US importers do not know they can ask. The §1.513 shortcut is the single highest-leverage piece of knowledge in this whole regime.

Limits of the §1.513 pathway

FDA-regulated food only. USDA-jurisdiction meat, poultry, and egg products are governed by a different regime (FSIS) and were already FSVP-exempt under §1.501(b) — §1.513 does not apply to them.

No further processing in the US. If the imported food is destined for further manufacturing or processing at a US facility, §1.513 does not apply. The receiving US facility's preventive-controls plan covers downstream hazards instead.

Product-category scope. The Canada-US Systems Recognition Arrangement covers fruits and vegetables, shelled eggs, dairy (excluding Grade A milk products), fish (excluding farmed catfish and molluscan shellfish), maple and honey, processed and manufactured foods. Verify your product category sits inside the SRA before claiming §1.513.

Annual documentation required. The SFC licence has an expiry. The good-compliance standing has to be re-verified once a year. A 2024 PCP attestation does not cover a 2026 inspection.

05The QI

The Qualified Individual — and why it is not the same as a PCQI.

Per §1.503, the FSVP must be developed and FSVP activities must be performed by a Qualified Individual (QI) — someone with the education, training, or experience necessary to perform those activities, and able to read and understand the language of any records they have to review.

A few things operators get wrong about the QI role:

  1. 01

    A QI is not the same as a PCQI

    PCQI stands for Preventive Controls Qualified Individual — that role lives in 21 CFR 117 and applies to US facilities doing preventive controls under FSMA. The FSVP QI is a separate role with overlapping but distinct competency requirements. A person can hold both. They are not interchangeable.

  2. 02

    The QI does not have to be an employee

    A consultant, third-party auditor, or contracted compliance service can serve as your QI. This is the model many small importers run — one US compliance consultant who acts as QI of record for half a dozen client importers. The arrangement has to be documented and the QI has to actually do the work, not rubber-stamp it.

  3. 03

    There is no FDA-mandated curriculum

    The FDA does not require a specific training course. The FSPCA (Food Safety Preventive Controls Alliance) offers an FDA-recognized "standardized curriculum" — the 2-day FSPCA FSVP Lead Instructor course is the de facto industry standard. Successful completion earns an FSPCA-issued certificate documenting competency. The certificate is the cleanest evidence you can put in the file when an inspector asks how your QI is qualified.

  4. 04

    Language matters

    If the supplier's COA (Certificate of Analysis) is in Mandarin, Spanish, or Italian, the QI either reads that language or works with a translator whose work the QI verifies. Cache the English translation alongside the original — do not generate it under inspector time pressure.

06DUNS and entry

The DUNS number — and why your first shipment can get held at port without one.

Per §1.509, every line entry of a food subject to FSVP must include three things:

  • The importer's name
  • The importer's email address
  • The importer's Unique Facility Identifier (UFI) — which FDA currently recognizes as the D&B DUNS Number (Dun & Bradstreet)

The DUNS is free. You can request one by phone at 866-705-5711 or via the FDA DUNS lookup tool. Most US businesses already have a DUNS for unrelated reasons (government contracting, credit reporting). The number goes in the "Entity Number" field on the CBP entry, and CBP will reject the entry line if the DUNS is missing. Your first shipment gets held at the port. The broker calls you confused. You scramble for a DUNS. The port holds the container at your expense until cleared.

Multiple physical locations need multiple DUNS for unrelated business purposes, but only the office where the FSVP records and the QI are located needs one DUNS for FSVP purposes. Keep that DUNS attached to the QI office, not to the warehouse.

FSVP is also operationally adjacent to — but legally separate from — three other FDA regimes operators routinely confuse it with:

Prior Notice

21 CFR §§1.276-1.285

Submitted before arrival via CBP ACE or FDA PNSI. Tells FDA a food shipment is coming. Separate from FSVP. Required for every imported food, not just FSVP-subject foods.

Facility Registration

21 CFR Part 1 Subpart H

Required of foreign facilities that manufacture, process, pack, or hold food for US consumption. The supplier's obligation, not the importer's. The supplier's FFR (FDA Facility Registration) number goes into the importer's supplier evaluation file but the registration itself is separate from FSVP.

A third regime — FSMA 204 Food Traceability under 21 CFR Part 1 Subpart S — applies separately to foods on the Food Traceability List (FTL) and creates its own set of Key Data Element (KDE) and Critical Tracking Event (CTE) record obligations. If you import leafy greens, soft cheeses, shell eggs, nut butters, fresh-cut produce, or seafood, FSMA 204 applies in parallel to FSVP. Do not treat them as one regime.

07Enforcement

What the 2024 to 2025 enforcement wave looked like — and what every case had in common.

FSVP enforcement visibly accelerated in the second half of 2024 and continued through 2025. Aggregating the FDA warning letter database with Food Safety News coverage, roughly 70 FSVP-related warning letters went out between January 2024 and December 2025. Here are several of the named cases:

2024

HH Fresh

HH Fresh Trading Corp, Los Angeles, CA — July 17, 2024. Fresh enoki mushrooms, seafood mushrooms, bamboo shoots. No FSVP for any food. Facility not registered. The Korean enoki supplier had tested Listeria-positive.

2024

Minland

Minland of Texas, Houston, TX — July 23, 2024. Peanut gluten, soy sauce, rice vinegar. No FSVP. Repeat finding from 2023 — the company had been put on notice and had still not built the file.

2024

Anglo Freight

Anglo Freight USA, Elk Grove Village, IL — August 5, 2024. Flour, kumis, seabuckthorn juice, teas. No FSVP. Prior inspections plus inadequate corrective actions.

2024

Gongora

Gongora USA Corp., Chula Vista, CA — November 14-15, 2024. Fresh cucumbers, white squash, cue ball squash. No FSVP. Repeat from 2020-2021. Three inspections, no plan built.

2025

Zest US

Zest US Wholesale Inc., Anaheim, CA — April 28, 2025. Milk chocolate bars with peanuts, pistachio spread, coconut almond truffles. No FSVP for any imported food. Allergen-bearing products with no supplier verification on file.

2025

Xin Ao

Xin Ao International Group Corp., Staten Island, NY — April to May 2025. Seafood mushrooms, enoki mushrooms. No FSVP. Repeat from May 2023.

2025

San Juan Produce

San Juan Produce LLC, McAllen, TX — March 25, 2025. Husk tomatoes, carrots, cilantro. No FSVP.

2025

A.D. Berries

A.D. Berries @ More LLC, McAllen, TX — August 2025. Fresh Hass avocados, fresh celery. No FSVP. Citation referenced 21 CFR Part 1 Subpart L, 21 CFR 112.3, and FD&C Act §805 (21 U.S.C. 384a) together.

The common thread is unmistakable. None of these companies had a deficient FSVP. None of them had a partially built one. They did not have one at all. The 2025 letters also cite failure to respond to Form 483a observations issued at the time of inspection — which is what often elevates a 483 into a warning letter and an Import Alert 99-41 listing (DWPE — Detention Without Physical Examination).

Half the SMB food importers I clear product for don't know FSVP applies to them. They think because the foreign supplier is FSSC 22000 certified, they're covered. They're not. FSVP is the importer's program, not the supplier's certificate.

Composite — US Customs Bonded Warehouse operator on LinkedIn

The downstream cost of an Import Alert 99-41 DWPE listing is structural. Every future shipment from your suppliers can be held at the port until released, at your expense — typical demurrage, detention, and reconditioning runs $5,000 to $25,000 per container. For perishables (produce, seafood, dairy), DWPE often equals total cargo loss. The warning letter itself becomes public on the FDA's website and is read by your suppliers, customers, and competitors. Section 805 carries personal liability under the Park Doctrine — an LLC's corporate veil does not insulate the responsible individual from a prohibited-act finding.

08The 482d clock

Remote Regulatory Assessments — and the 72-hour response window most importers are not ready for.

Remote Regulatory Assessments (RRAs) were formalized in FDA's July 2025 final guidance and are now a regular tool in FSVP enforcement. The pattern: FDA emails the importer a Form FDA 482d electronically, requesting a specific FSVP record set. The importer has 72 hours to respond via the FSVP Importer Portal.

What the 482d typically asks for:

  1. 01

    The hazard analysis for the named food × supplier pair

    Signed and dated, with the QI's credentials attached.

  2. 02

    The supplier approval evaluation file

    Including the supplier's FFR, audit certifications, FDA compliance history check, and the QI's written approval determination.

  3. 03

    The verification activity records for the most recent year

    Audit reports, sampling and testing results, or records-review documentation — whichever activity you chose for this hazard.

  4. 04

    The corrective action log, if any

    Including the trigger event, the investigation, the action taken, and the QI's sign-off on resumption.

  5. 05

    The DUNS / UFI documentation

    Proof of current DUNS, name and email on file.

  6. 06

    The reassessment cadence proof

    The 3-year clock under §1.505(d) — when was the last reassessment, when is the next.

Refusal to participate in an RRA is treated by FDA as a refusal of inspection and may trigger the same enforcement consequences as physically obstructing an in-person inspection. A mandatory FSVP RRA can result in a Form FDA 483a issued remotely, opening the standard 15-business-day window to respond. That response — not the observation itself — determines whether the case becomes a warning letter, an Import Alert listing, or fades back into the regulatory background.

The 72-hour clock is the part most importers have not architected for. If your supplier files live in three different shared drives, a personal Dropbox, and somebody's laptop that travels with them, you will not assemble a 482d response in 72 hours. You need one workspace with one search box.

09The HACCPlan build

What is inside the FSVP build of HACCPlan.

The HACCPlan data model is built around the FSVP unit of work — the food × supplier pair. Every record in the workspace hangs off that pairing. The features below are not generic compliance modules with an "FSVP" label. They are the specific tools the regulation asks for, in the structure FDA reads them.

  1. 01

    Importer of Record workspace

    One workspace, one DUNS, one QI of record. The QI's training credentials, education, and signed competency declaration attach to the QI profile. When the workspace shares records with FDA (via PDF export or direct portal upload), the QI signature carries through automatically.

  2. 02

    Foreign supplier database

    Per-supplier fields: legal name, FFR (FDA Facility Registration) number, DUNS, country, regulatory standing, audit certifications with expiry tracking, current SFC licence number (when the supplier is Canadian — for §1.513), and a date-stamped approval determination signed by the QI. Reassessment date auto-set to 3 years per §1.505(d).

  3. 03

    Hazard analysis per food × supplier

    A structured template covering every §1.504 factor: formulation, establishment conditions, raw materials, transport, harvest/process/pack, storage, intended use, sanitation, and other relevant factors. Each identified hazard carries a determination (control required, yes or no) and a link to the supplier's control or the importer's verification activity.

  4. 04

    Verification activity scheduler

    Cadence selected by hazard severity. For hazards "reasonably likely to cause serious adverse health consequences or death," the default is annual onsite audit per §1.506(d)(1)(ii). For lower-severity hazards, sampling/testing or records-review at appropriate frequency. The scheduler tracks next-due dates and sends alerts at 60, 30, and 7 days before expiry.

  5. 05

    3-year reassessment clock

    Automatic per §1.505(d). When the clock comes due, the workspace flags the food × supplier pair and prompts the QI to document reevaluation. Reassessment becomes a calendar event, not a thing you remember.

  6. 06

    2-year records retention engine

    Every record carries a "use ended" date and a 2-year retention clock per §1.510. Records are not destroyed when they expire — they are tombstoned with a deletion-eligible date, so the inspector can see what was retained and when retention ended.

  7. 07

    §1.513 streamlined pathway for Canadian, NZ, and Australian suppliers

    For suppliers in countries with FDA Systems Recognition Arrangements, the workspace auto-generates the compressed record set — SFC licence number or equivalent, registry screenshot, supplier attestation letter template, and the QI's §1.513 determination memo. This is the workflow I built first, for my own Nature Lion export operation. The Canadian-side counterpart is in /solutions/canada-sfcr.

  8. 08

    English-translation cache

    For foreign-language records (COAs in Italian, audit reports in Mandarin, supplier attestations in Spanish), the workspace stores both the original and a verified English translation side-by-side, with translator attribution. No more generating translations under 24-hour inspector pressure.

  9. 09

    Form FDA 482d response workspace

    When an RRA arrives, the importer selects the affected food × supplier pairs and the workspace assembles the requested record set in the 72-hour window — hazard analysis, supplier evaluation, verification records, corrective actions, DUNS, QI credentials — into a single export ready for the FSVP Importer Portal.

  10. 10

    Parallel FSMA 204 traceability for Traceability-List foods

    For importers handling foods on the FTL (Food Traceability List) — leafy greens, soft cheeses, shell eggs, nut butters, fresh-cut produce, seafood — the workspace tracks KDE (Key Data Element) and CTE (Critical Tracking Event) records alongside the FSVP file, in one place. The traceability rule and the verification rule are separate; the workflow treating them as one workspace is not.

Where HACCPlan is not the right answer

HACCPlan is built for SME importers — typically 1 to 20 active foreign suppliers, with an in-house or contracted QI, who need a defensible FSVP file at SME pricing. If your operation has 50+ suppliers across multiple ingredient categories and a multi-person QA team, the enterprise platforms (TraceGains, FoodLogiQ) are designed for that scale and worth the price tag. If you have no in-house QI capacity and need someone else to draft your plan from scratch, a managed consulting engagement (Registrar Corp and similar) is the right starting point. HACCPlan sits in between — for the importer who has the operating knowledge but not the time to assemble the file by hand.

10A worked example

What an FSVP file actually contains — a concrete worked example.

Theory only gets you so far. Here is what a single food × supplier FSVP file looks like, fully populated. The example uses dried oregano from a Greek supplier — a hazard profile representative of dried herbs and spices generally.

Food: Dried oregano leaf, food-grade, retail-packaged Foreign supplier: Hellenica Herbs SA, Kalamata, Greece — FSSC 22000 certified, FDA-registered facility

Hazard analysis file (§1.504):

  • Biological: Salmonella in dried spice. Reasonably likely — FDA recall data shows roughly a dozen dried-herb recalls per year industry-wide. Control: supplier process validation plus COA-level Salmonella testing.
  • Chemical: Pesticide residue. Oregano grown in non-EU-aligned regions has variable residue history. Control: per-lot pesticide panel COA.
  • Physical: Foreign material (stones, twigs, plastic fragments). Control: supplier sieving and visual COA.

Supplier evaluation file (§1.505):

  • Current FSSC 22000 certificate
  • Most recent third-party audit report (SGS, 2025)
  • FDA facility registration confirmation (FFR number on file)
  • Letter of Continuing Guarantee, signed and dated
  • Reportable food registry and recall history check (clean)
  • QI-signed approval determination, dated, with reassessment date set 3 years out

Verification activity records (§1.506):

Because Salmonella in a dry herb that does not have a downstream kill step is a "reasonably likely to cause serious adverse health consequences" hazard, the default verification activity is annual onsite audit — or a documented written justification for an alternative. This file uses both:

  • 2025 onsite audit report (SGS, with auditor credentials and signed audit conclusion)
  • Per-lot sampling protocol: 25-gram composite, Salmonella test, n=5 per lot, accredited lab COA on file

Corrective action log (§1.508):

  • 2024-06 incident: supplier exceeded internal moisture specification. Supplier root cause analysis (drying time deviation), corrective action (drying time SOP update), follow-up sampling (3 consecutive lots cleared), QI sign-off on resumption of imports.

Records inventory (§1.510):

All five categories indexed by food × supplier, English versions cached for the Greek originals, 2-year retention clock per record start date. Total file size for this single SKU: about 40 pages. The whole file retrievable in two clicks. That is what FDA wants when the investigator arrives.

11If you are in panic mode

The 72-hour FSVP scramble — if you got a 482d or a 483a this week.

This section exists because somebody reading this article right now is in active inspection or post-483 scramble. If that is you: do not panic, do not refuse to engage, and do not let the 72-hour window expire without acknowledgment.

  1. 01

    Confirm the request — in writing

    Acknowledge the 482d or the 483a via the same channel it arrived in. Confirm the investigator's name, the scope (which foods, which suppliers, what date range), and the deadline. Get the response window in writing if it was a phone call. Buy yourself paper trail.

  2. 02

    Pull the supplier docs you already have

    Letters of Guarantee. Recent COAs. Supplier audit certificates (FSSC 22000, BRCGS, SQF). Photos of the supplier facility if you have them. None of these are an FSVP file by themselves, but they are the raw material for the rapid-build hazard analysis that has to ship in 72 hours.

  3. 03

    Build a defensible placeholder hazard analysis

    Better than nothing. Use the §1.504 factor list as the framework: formulation, establishment, raw materials, transport, harvest/process/pack, storage, intended use, sanitation. Identify the hazards honestly. Mark each as "control required, yes or no" with the supplier's existing controls referenced. Sign and date. The placeholder is not the final file — it is the file you ship in the 72-hour window while the proper version gets built.

  4. 04

    Decide whether to bring in outside help

    For a single-supplier 482d on a low-risk food, the in-house team can usually respond. For a multi-supplier 483a with a complex hazard profile, a FSPCA-credentialed FSVP consultant or a regulatory attorney is the right second call. Cost varies — expect $200 to $500 per hour for consultant time and $400 to $800 per hour for regulatory counsel.

  5. 05

    Submit on time, complete or not

    Better to submit a partial response acknowledging the gaps and laying out a remediation plan than to miss the deadline. FDA reads the response narrative as carefully as the records. A 15-business-day 483a response that documents the corrective action plan, names the QI now responsible, and commits to delivery dates is the difference between a closed inspection and an escalated case.

The single biggest predictor of whether an FSVP inspection ends in a warning letter is the quality of the 483a response. A well-organized response with concrete remediation can close an inspection cleanly. A non-response or a vague response is what gets you into the warning letter database that your customers and competitors will read.

12Starter kit

Where to start — free templates for the foundation records.

If you are not ready to commit to software, start with the day-to-day operational logs that pair with the FSVP file. The records below are not the FSVP file itself — that is built per food × per supplier inside the workspace — but they are the receiving, storage, and handling records every importer should be running regardless. Each is a fillable PDF.

The actual FSVP file — hazard analysis, supplier evaluation, verification activities, corrective actions, records inventory — is what HACCPlan builds inside the workspace. Start with the free templates for your receiving operation, then graduate to the workspace when you are ready to assemble the per-food, per-supplier file.

13Next step

What the first 30 days on HACCPlan actually look like for an importer.

A realistic onboarding for a single-site importer with 5 to 10 active foreign suppliers runs roughly like this:

  1. 01

    Days 1 to 3 — set up the importer workspace

    Create the workspace, enter the DUNS, register the QI of record (with their training credentials and signed competency declaration). Upload any existing FSVP documents you have — even a draft hazard analysis or a Letter of Continuing Guarantee from a supplier is useful as a starting point.

  2. 02

    Days 4 to 10 — load the supplier database

    Add every active foreign supplier with their FFR, country, audit certifications, and reassessment date. For Canadian, NZ, or Australian suppliers in eligible product categories, flag them for the §1.513 streamlined pathway. For very-small-importer eligible operations, document the three-year revenue average and use the §1.512 pathway.

  3. 03

    Days 11 to 20 — build the hazard analysis per food × supplier

    The unit of work. For each food from each supplier, populate the §1.504 hazard analysis template. The workspace surfaces the supplier's own hazard analysis (when on file) as a starting point — the QI reviews, adjusts, and signs off.

  4. 04

    Days 21 to 30 — schedule verification activities and run a 482d drill

    Set the verification activity for each food × supplier pair (audit, sampling-and-testing, or records-review). Schedule the next-due dates with alerts. Then do a 482d drill — pick a random food × supplier pair, simulate a 72-hour record request, and time how long it takes to assemble the response. If you can do it in 30 minutes, the system is working. If not, the gaps are exactly what month two cleans up.

By day 30 you should have a defensible FSVP file for every active food × supplier pair, a working verification schedule, and a tested 482d response workflow. That is what makes the difference between an importer who watches the 2024-2025 warning letter pattern from the sidelines and one who gets pulled into it.

Build your FSVP workspace

Start a free HACCPlan importer workspace — generate your first food × supplier file in under an hour

Free tier covers one importer workspace, three food × supplier files, DUNS and QI of record, and the §1.513 streamlined pathway for Canadian, NZ, and Australian suppliers. Paid tiers add the full hazard analysis library, verification scheduler, 482d response workspace, and parallel FSMA 204 traceability.

Email required to save your FSVP files. No credit card. No upgrade prompts during the free tier.

Footnotes

1.21 CFR Part 1 Subpart L — Foreign Supplier Verification Programs — ecfr.gov

2.21 U.S.C. §384a — Foreign supplier verification program (statute) — law.cornell.edu

3.FDA — Systems Recognition Food (Canada, NZ, Australia FSSRA) — fda.gov

4.FDA — Small Entity Compliance Guide for FSVP (PDF) — fda.gov

5.FDA UFI / DUNS Guidance for Industry — fda.gov

6.CFIA — Exporting food to the US (FSVP requirements library) — inspection.canada.ca

7.Food Safety News — June 2025 FSVP warning letters (Zest, Xin Ao, Gongora, San Juan Produce) — foodsafetynews.com

8.Food Safety News — September 2024 FSVP warning letters (HH Fresh, Minland, Anglo Freight) — foodsafetynews.com

9.FSPCA — FSVP standardized curriculum (FDA-recognized QI training) — fspca.org

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-04· 14 min read· Wikidata Q139112497