FSMA compliance gaps: why ingredient verification fails

A receiving facility may have supplier documents, a certificate of analysis and a completed questionnaire, yet still lack the hazard analysis and independent verification needed to support its approval decision. For importers, a separate failure can arise when the Foreign Supplier Verification Program (FSVP) has not been developed for a food at all.

These are distinct regulatory obligations with a shared operational weakness: companies treat records as proof of control before establishing what hazard needs to be controlled, who controls it and how the control is verified. That gap can surface in an FDA inspection as a Form FDA 483 or, if unresolved, contribute to a warning letter or import alert.

The anatomy of FSMA non-compliance: beyond paperwork

FSMA obligations do not reduce to collecting documents from a vendor. Under 21 CFR Part 117, Subpart G, a receiving facility must implement a supply-chain program when a raw material or ingredient has a hazard requiring a supply-chain-applied control managed by an entity before receipt. The program depends on a facility-specific assessment of the ingredient, hazard and supplier.

That sequence matters. If the hazard analysis is incomplete, the company may not identify which supplier controls need verification. If the hazard is identified but the supplier’s role is unclear, the receiving facility may be unable to show that the control is applied at the right point. If the control and supplier are understood but verification is not documented, the approval decision may still lack a defensible basis.

For importers, 21 CFR Part 1, Subpart L sets out FSVP requirements. The U.S. importer of record carries the legal responsibility for the program; a foreign supplier’s food facility registration or quality certificate does not transfer that responsibility. The importer must develop and maintain an FSVP appropriate to the food and supplier, including evaluation and verification activities.

Several recurring failure patterns follow from these requirements:

• Hazard analysis is missing or too general. A file may identify broad categories of risk without connecting them to the specific ingredient, its intended use or the supplier-applied control.
• Supplier approval rests on unsupported assumptions. A vendor’s assurances may be accepted without evaluating relevant food-safety history or determining whether the evidence is adequate for the hazard.
• Verification activity is not matched to risk. The company may have documents on file but no record explaining why those documents, tests or audits provide appropriate verification.
• Records do not show the decision path. Even where activities occurred, the file may not connect hazard identification, supplier approval, verification results and follow-up actions.

A supplier file is only as strong as the chain of decisions it can document: hazard, control, verification and response.

This is where ingredient procurement and regulatory compliance intersect. Purchasing teams may qualify a supplier for availability, price or specification fit, while food-safety personnel assess hazards and verification. If the two processes are not connected, a supplier can remain commercially active after a food-safety concern has emerged, or a new ingredient can enter production before its verification plan is complete.

Regulatory pitfalls in Part 117 and FSVP

The supply-chain program and FSVP share a risk-based logic, but they apply to different parties and circumstances. A receiving facility evaluates the supplier and implements its program where the regulation requires it. An importer develops FSVP for foods from foreign suppliers. Companies operating in both roles need to determine which obligations apply to each ingredient and transaction, rather than assuming one set of records covers both.

Under 21 CFR 117.410, supplier approval and verification are tied to the hazard that requires a supply-chain-applied control. The regulation permits verification activities including onsite audits, sampling and testing of the ingredient, review of the supplier’s food-safety records, or other activities justified by risk. The chosen activity should therefore make sense in relation to the identified hazard and the supplier’s control.

A generic annual questionnaire may provide background information, but it does not automatically establish that a particular hazard is controlled. A certificate of analysis can support a decision about a defined specification or test result; by itself, it does not show that the broader supplier verification process is adequate. Third-party certification can also be relevant evidence, but it does not eliminate the facility’s need to conduct its own evaluation and document its regulatory basis.

Supplier evaluation also includes review of FDA compliance history. Under 21 CFR 117.410(d)(1)(iii)(B), companies evaluating suppliers must formally review relevant FDA compliance histories, including whether a supplier has been subject to a warning letter, import alert or other compliance action. A supplier approval record that omits this review can leave a clear gap, even where other quality documents are current.

For FSVP, reassessment is required under 21 CFR 1.508 when new hazard information emerges, verification reveals a food-safety problem, the foreign supplier changes, or the food is associated with serious adverse health consequences. This means approval cannot be treated as a one-time onboarding event. A change in supplier, new test result or emerging safety information may require reassessment and revised verification.

The practical distinction is straightforward:

Some smaller importers may qualify for modified FSVP requirements. Under 21 CFR 1.511 and 1.512, the stated thresholds are average annual food sales combined with the market value of imported food below $1 million for human food or below $2.5 million for animal food over three years. These are modified requirements, not a blanket exemption from the need to understand which rules apply. Companies should document the basis for any modified treatment and confirm that their status remains accurate as sales and import values change.

Why the vendor questionnaire is not verification

Questionnaires are attractive because they are easy to distribute, collect and file. Their weakness is that they are often treated as a substitute for the supplier verification activities required by the applicable program. A completed form can describe a supplier’s stated practices, but it may not independently establish that the relevant hazard is controlled.

The regulatory question is not whether a vendor returned a questionnaire. It is whether the company selected and documented an appropriate verification activity, taking the ingredient’s hazard and supplier performance into account. Under the permitted approaches in 21 CFR 117.410(b), this may involve an onsite audit, sampling and testing, review of food-safety records, or another risk-justified activity. The file needs to show the rationale and outcome, not just the existence of a vendor response.

If the ingredient presents a hazard that warrants testing, a questionnaire alone will leave an evidentiary gap. If the supplier’s food-safety records are reviewed, the company should retain enough documentation to show what was reviewed and how it informed the decision. If an alternative verification method is used, the record should explain why it is justified by the risk. A generic approval statement does not answer those questions.

The same caution applies to certificates of analysis. A CoA may demonstrate that a particular lot was tested against specified parameters, depending on the test, method and sample basis. It does not necessarily establish that the supplier’s process controls the hazard consistently, that the test addresses the hazard identified in the receiving facility’s analysis, or that the documentation has been independently evaluated.

A workable supplier file should make the logic traceable:

1. Identify the ingredient and the hazard relevant to its use and supply chain.

2. Record which entity applies the control and where it occurs before receipt.

3. Evaluate the supplier, including relevant FDA compliance history.

4. Select verification activities that address the hazard and are justified by risk.

5. Record results, deviations and corrective actions, then reassess when required.

These steps are not a universal checklist that replaces a facility’s food-safety plan. They are a way to test whether the supplier decision can be reconstructed from the records. If the file cannot show why a supplier was approved, what evidence supported that decision and what happened after an adverse result, the company may have a documentation problem and a control problem at the same time.

What the inspection data says about FSVP failures

An analysis of 10,845 FSVP inspection citations across 6,076 FDA inspections conducted between June 30, 2017, and February 12, 2026, identified “Failure to Develop an FSVP” as the most common violation. The finding points to a basic weakness: some importers are inspected without having established the program that should organize supplier evaluation and verification in the first place.

That pattern is operationally significant. A company can have purchase records, specifications, shipping documentation and supplier certificates while still lacking an FSVP. Documents accumulated through ordinary trade do not automatically form a compliant program. The importer needs to identify its role, determine the food and supplier covered, conduct the required evaluation, define verification activity and retain the relevant records.

Inspection findings also have a short response window. When FDA investigators identify deficiencies during an FSVP or preventive-controls inspection, they issue Form FDA 483 or Form FDA 483a for FSVP observations. The recipient typically has 15 working days to provide a written corrective-action response before possible escalation to an advisory warning letter. That period is not a substitute for remediation; it is a limited opportunity to explain corrective action and provide supporting evidence.

Records are part of that response capacity. FSVP records generally must be retained for at least two years. If supplier evaluation, verification results and reassessment decisions are dispersed across purchasing, quality and import files, the company may struggle to establish what its program required and whether it was followed. A record-retention rule is useful only when records remain retrievable and linked to the relevant food and supplier.

The inspection data should not be read as a precise ranking of ingredient categories or as proof that a particular raw material is more likely to fail. The cited analysis identifies a broad program-development failure across inspections. It does, however, reinforce the need to establish the regulatory architecture before relying on routine vendor paperwork.

Reassessment and supplier performance management

Supplier approval should operate as a controlled status, not as a permanent label. Under 21 CFR 1.508, an FSVP reassessment is required when relevant new hazard information appears, verification reveals a food-safety problem, the foreign supplier changes, or the food is associated with serious adverse health consequences. These triggers require a process that moves information from testing, complaints, audits and regulatory monitoring into the supplier record.

The same principle applies to supply-chain programs. A change in ingredient source, process or control can alter the assumptions behind the original hazard analysis. A supplier substitution made to resolve a shortage may therefore have compliance consequences beyond procurement: the new supplier may have a different control history, different verification evidence or a different regulatory record.

A practical internal escalation path should answer a few questions without delay:

• Who owns the decision to pause or restrict receipts when verification fails?
• Which lots and production records are linked to the supplier and ingredient?
• Who determines whether a failure requires reassessment or corrective action?
• Can the company retrieve the evidence supporting approval and verification within the inspection response window?

These are continuity questions as much as compliance questions. If procurement continues ordering while quality investigates a failed result, the company needs a documented decision process for affected lots and future receipts. If an importer changes suppliers, the FSVP record should reflect the new supplier and the evaluation supporting its use. A vendor change entered in an ERP system is not, by itself, a regulatory reassessment.

For manufacturers and importers, the immediate work is to map each ingredient to the applicable obligation, identify hazards requiring supplier-applied controls, and test whether the existing evidence supports the chosen verification approach. Review FDA compliance history as part of supplier evaluation, confirm that FSVP coverage exists for imported foods, and assign an owner to reassessment triggers. Where a file relies mainly on a questionnaire or a CoA, treat that as a prompt to examine the underlying control and verification rationale.

The compliance catch is often visible in hindsight: the company had documents, but not the program those documents were supposed to support. Closing that gap requires a traceable decision record and an operational owner for what happens when supplier evidence changes.