Track every foreign supplier's reevaluation

1. What is FSVP (the Foreign Supplier Verification Program)?

The Foreign Supplier Verification Programs rule requires U.S. importers of human and animal food to verify that their foreign suppliers produce food meeting applicable U.S. safety standards. Section 1.502 puts it as an assurance obligation rather than a paperwork one: for each food you import you must develop, maintain and follow an FSVP providing adequate assurances that your foreign supplier is producing the food in compliance with processes and procedures offering at least the same level of public health protection as the preventive controls and produce safety requirements would demand of a domestic producer, and that the food is not adulterated and is properly labeled for major food allergens.

The person carrying that is defined narrowly. Under section 1.500, the importer is the U.S. owner or consignee of the food at the time it is offered for entry. Where there is no U.S. owner or consignee at that moment, the importer is the U.S. agent or representative of the foreign owner — and, notably, only where that has been confirmed in a signed statement of consent to serve as the importer under this subpart. So the role is not assigned by who arranged the shipment or who paid the freight. It attaches to a commercial position at a specific instant, and a customs broker filing on your behalf does not occupy it.

Remindax helps you track when each of the resulting dates falls due, per supplier and per food, and reminds the people responsible. It doesn't conduct hazard analyses, evaluate or approve suppliers, arrange or perform audits, prepare FSVP records, or give food-safety advice. This is the same category of recurring, self-scheduled obligation that compliance tracking software exists to keep visible — tracking and reminders, not a GRC platform — and it sits next to the import-side dates covered under logistics tracking, which is document tracking rather than telematics or freight management.

1.1 What the importer must actually do

• 1.Analyze the hazards in the food. Identify the known or reasonably foreseeable hazards for each food you import — biological, chemical including radiological, and physical — and determine which require a control. This is done by a qualified individual and it is documented.
• 2.Evaluate and approve the supplier. Section 1.505 sets out what you must consider: the hazard analysis itself, which entity in the chain is actually controlling the hazard, and the foreign supplier's performance — its procedures and practices, its compliance history including whether it is the subject of an FDA warning letter or import alert, its testing and audit results, and how responsive it has been in correcting problems. You document the evaluation, and you approve on the basis of it.
• 3.Determine, and then perform, verification activities. Onsite audits, sampling and testing, review of the supplier's food safety records, or other appropriate activities — chosen and justified against the evaluation. Crucially, you must determine and document which activity and how often, before importing, and then conduct it before importing and periodically thereafter.
• 4.Reevaluate. Promptly, whenever you become aware of new information about any of those factors — and in any event if three years have gone by without one.
• 5.Keep the records, and be able to reach them. Signed and dated on completion and on any modification, available promptly to FDA, retrievable within twenty-four hours if stored offsite, and retained on the schedule in section 1.510(c).
• →And you are identified at the border. Section 1.509 requires your name, email address and unique facility identifier to be transmitted electronically to U.S. Customs and Border Protection for each line entry of food, identifying you as the FSVP importer of that food.

One structural point is worth naming early, because it is what makes FSVP hard to schedule rather than merely hard to do. Steps two, three and four are performed per supplier and per food. Two foods from the same supplier can carry different hazards, warrant different verification activities and sit on different frequencies. The same food from two suppliers is two separate evaluations. The obligation therefore multiplies along a grid rather than a list, and each cell of that grid keeps its own dates.

2. How often is FSVP reevaluation required?

Read section 1.505(c) closely and it says something different from what almost every summary of FSVP says. The common phrasing is “reevaluate every three years, or sooner if new information arises” — which describes two obligations running side by side: a schedule, and a trigger that occasionally interrupts it. The regulation is not built that way. Paragraph (c)(1) is the obligation; it is event-driven and it has no interval at all. Paragraph (c)(2) is conditional on its absence: if at the end of any three-year period you have not reevaluated in accordance with paragraph (c)(1), then you must.

So there is one clock, and its start date moves. A recall notice about your supplier's region, a failed test result, a change in who is actually controlling the hazard upstream — each of those, handled properly, produces a documented reevaluation, and the backstop restarts from that day. The three years are the longest you may go without one, not the rhythm at which they occur.

There is one more route through section 1.505 that changes what you are tracking. Paragraph (d) lets you satisfy the evaluation or the reevaluation by reviewing and assessing one performed by another entity, provided a qualified individual performed it — and provided you document your review and assessment, including documenting that the person who did it was qualified. Section 1.506(a)(2) makes the same allowance for the approved-supplier procedures. That is a real and useful outsourcing route, and it is worth being precise about what it moves: the work travels, the record does not. What lands in your file is not the other entity's evaluation. It is your dated assessment of it, and that assessment is the thing with a date on it.

3. Why tracking FSVP dates matters

3.1 You are named as the FSVP importer, line by line, by somebody else

Most compliance obligations begin with an application. You decide to enter a market, you file for something, a number comes back, and a renewal date arrives with it. FSVP does not work like that. There is nothing to apply for and nothing is issued. The obligation attaches because of a commercial position you occupy at the moment goods are offered for entry — and then section 1.509 requires that position to be declared: for each line entry of food, your name, your email address and your unique facility identifier acceptable to FDA are transmitted electronically to Customs and Border Protection, identifying you as the importer of that food.

In practice, the keystroke belongs to your customs broker. Which produces a peculiar situation that catches a great many first-time importers: the declaration that you are the FSVP importer of a particular food is filed, correctly, on your behalf, per line, potentially long before anyone in your business has asked whether an FSVP for that food exists. The usual advice — that using a broker does not transfer the responsibility — understates it. The broker's filing is not a missed opportunity to shift the duty elsewhere. It is the act that puts your name against it.

This is a genuinely different shape from the third-party documents on the vendor and subcontractor compliance page, and the difference is worth holding onto if you carry both. There, the documents belong to a third party and your job is to collect and chase them — you selected the vendor and you are pursuing evidence they already hold. Here, no document is being requested from anyone. You are performing an assessment of a company that may not know it is being assessed, under a designation entered into a customs filing before the question came up.

3.2 The due date moves, and the thing that moves it looks like an incident, not a review

Because the three years restart from each reevaluation, the real due date for any supplier-and-food pair is three years from the last time you reacted to something — and reacting to something rarely feels like performing a scheduled compliance task. A supplier reports a failed environmental swab. A customer complaint pattern emerges. The supplier's own upstream ingredient source changes. Somebody senior looks at it, decides the arrangement is still acceptable, and the business carries on. Under paragraph (c)(1), that is precisely the moment a reevaluation was required, promptly, and required to be documented.

Two failures come out of that, and they pull in opposite directions. In the first, the reaction happens but is never written down as a reevaluation, so the record shows a three-year gap that the business genuinely did not have — work performed, credit not taken, and an inspector reading a file that understates what was done. In the second, the reaction never happens at all because the calendar says the review is not due for another year, and the fixed date has done what fixed dates do: reassured everyone that nothing is outstanding. The tracking response to both is the same. Record the reevaluation on the day it actually occurs, and let the next due date be computed from it.

3.3 You write your own verification interval, and then it binds you

Section 1.506(e)(1) requires verification before importing the food and periodically thereafter, and does not say how periodically. Section 1.506(d)(1) explains why: you must determine and document which activity and what frequency give adequate assurance, based on the evaluation you performed. The interval is therefore not looked up. It is authored — and once authored and documented it becomes the standard your file is read against. An annual records review that you specified as quarterly is a deviation from your own program even where an annual one would have been perfectly defensible had you written it that way.

Against that self-set rhythm sits one interval the rule does fix. Where a hazard will be controlled by the foreign supplier and there is a reasonable probability that exposure to it would cause serious adverse health consequences or death, section 1.506(d)(2) requires an onsite audit of that supplier before you first import the food and at least annually thereafter — unless you make an adequate written determination that other activities, or less frequent auditing, are appropriate. Note the shape of that escape hatch: it is not a lighter obligation, it is a second document, and one whose reasoning is anchored to an evaluation that itself has a moving date. There is also a substitution worth calendaring: under 1.506(e)(1)(i)(E), written results of an appropriate inspection by FDA, another federal agency, a state or tribal agency, or the food safety authority of a country whose system FDA has recognized as comparable, may be used instead of the onsite audit — but only if the inspection was conducted within one year of the date by which the audit would have been required.

So a single supplier-and-food pair can be carrying a reevaluation backstop measured from a moving point, a verification frequency you chose, an annual audit obligation with a written exception attached to it, and a one-year eligibility window on a substitute inspection you did not commission. Multiply by the grid.

3.4 The twenty-four hours is about where the evidence lives, not how fast you can print it

This is the most frequently garbled requirement in the whole subpart, and getting it right changes what you plan for. Section 1.510(b) contains three distinct duties. Records must be made available promptly to an authorized FDA representative for inspection and copying. Where records are kept in another language, FDA may request an English translation, and that is owed within a reasonable time — not twenty-four hours. And the twenty-four hours itself belongs to paragraph (b)(2), which permits offsite storage, expressly including records maintained by other entities under sections 1.504, 1.505 and 1.506, provided those records can be retrieved and provided onsite within twenty-four hours for official review. Electronic records accessible from an onsite location are treated as onsite.

Read that way, the rule stops being a stopwatch and starts being a statement about your supply chain. It exists precisely because the evidence in an FSVP file is so often held by somebody else: the audit report sits with the auditing firm, the test results sit with a laboratory, the supplier's food safety plan sits with the supplier, and the evaluation may have been performed by a consultant under 1.505(d). Every one of those arrangements is permitted. Each of them also creates a dependency on a third party answering a request inside a day — a third party in another time zone, sometimes operating in another language, who has no visibility of the inspection that prompted the call.

The related detail people miss is that the language question reaches further back than the translation duty. Section 1.500 defines a qualified individual as somebody who, among other things, can read and understand the language of any records that the person must review in performing the activity. That constraint applies at the moment the record is reviewed, not at the moment FDA asks for it. And section 1.510(a)(2) adds a small requirement that quietly generates dates of its own: FSVP records must be signed and dated on initial completion and on any modification.

4. Who needs to track FSVP dates

The obligation does not follow an industry or a company size. It follows a position in a transaction — whoever is the U.S. owner or consignee when food is offered for entry — which means it lands on some businesses that do not think of themselves as importers at all.

5. What happens when FSVP isn't kept current

The distinctive thing about FSVP enforcement is that it is a records exercise rather than a facility one. There is nothing at your premises for an inspector to look at — the food was produced abroad, the hazards were controlled abroad, and the only thing in your possession is documentation of the assessment you performed. An FSVP inspection is therefore an examination of a file, and a file is unusually unforgiving: it either contains a dated evaluation for this supplier and this food, or it does not.

That matters because most compliance failures have a substantive defence available. You can argue that the risk was in fact controlled, that the practice was sound, that the outcome was safe. Here, the requirement is the record. Section 1.505(a)(2) requires you to document the evaluation. Section 1.505(c)(1) requires the reevaluation to be documented. Section 1.506(d)(1) requires the determination of activity and frequency to be documented. Section 1.505(d) requires your review of somebody else's evaluation to be documented, including documentation that a qualified individual performed it. An importer who genuinely knows its suppliers well, visits them, tests their product and has never had a safety incident can still fail an inspection comprehensively, because the thing being inspected was never the supplier relationship. It was the paper trail of having assessed it.

The reevaluation backstop is the usual point of failure, and its length is the reason. Three years is long enough that the person who performed the original evaluation has often changed roles, the ingredient has been reformulated, and the arrangement has been renewed once or twice commercially without anyone revisiting the safety assessment underneath it. Nothing prompts a review in that interval, because nothing about the relationship changes on the day the backstop expires. Shipments keep clearing, invoices keep matching, and the pair goes quietly overdue inside a program everyone believes is current.

The retention rule deepens the same problem. Under section 1.510(c)(1) records are kept for at least two years after they were created or obtained; under (c)(2), records relating to processes and procedures — including the results of evaluations and determinations — are kept for at least two years after their use is discontinued, and the rule offers examples of what discontinuation means: you no longer import a food, you no longer use a supplier, you have reevaluated the risks, or you have changed the verification activities. So a reevaluation is not only an obligation. It is also the event that starts a two-year disposal clock on the evaluation it replaced, which is exactly the record somebody may later want in order to show the chain was unbroken.

Then there is the consequence importers actually feel, which arrives at the border. FSVP is enforced through the import process, and the tools available on that side — refusal of entry, detention without physical examination so that subsequent entries are held on arrival, or an import alert flagging a company's products for scrutiny — do not distinguish between a food safety problem and a documentation one. This is worth distinguishing from the entry problems covered on the customs bond page, which are financial: a bond secures the duties and can be found insufficient as your volumes grow. Fixing that is a transaction with a surety. An FSVP finding cannot be cured by putting more money behind the entry, because what is missing is an assessment that had to have been performed at a point in the past. You can produce a bond today. You cannot produce a reevaluation dated eighteen months ago.

6. How Remindax keeps every supplier's verification current

The second of those does most of the work, and it is worth saying plainly why a general calendar struggles with it. A calendar entry is a fixed point: you set it, it fires, you set the next one. What section 1.505(c) describes is a deadline defined relative to an event that has not happened yet and may never happen — three years from your most recent reevaluation, whenever that turns out to be. Represented as a fixed annual reminder it is wrong in both directions, firing when nothing is due and staying silent when the pair has actually gone overdue because the last documented reevaluation was earlier than anyone remembered.

One point about where these dates should live, given how much of the underlying work is outsourced. Sections 1.505(d) and 1.506(a)(2) let another entity perform the evaluation and the approved-supplier procedures, and 1.506(e) contemplates obtaining documentation of activities performed by others. All of that is permitted and much of it is sensible. None of it moves the obligation, and none of it moves the twenty-four-hour retrieval duty that offsite arrangements create. Keeping the dates somewhere you control — separate from the consultant, the auditor and the supplier who hold the underlying documents — is what lets you see the dependency before an inspector does.

7. Why spreadsheets fail for FSVP tracking

A spreadsheet can hold a date. What it cannot hold is a date that recalculates — and the central date in FSVP recalculates every time you do the work.

The typical FSVP tracker is a grid: suppliers down the side, foods across the top, and a column headed “next reevaluation” that somebody populated three years out from the day the program was built. It looks orderly and it is quietly wrong, because that column was calculated once. When a supplier issue prompts a genuine reevaluation in month fourteen, nothing in the sheet notices; the date stays where it was, describing a review that has already effectively happened. When no reevaluation occurs at all, the sheet is equally happy: the date is still in the future, so nothing is flagged, right up until it passes on a day nobody was looking at that row.

It handles the other intervals no better. The verification frequency you authored is a different number for every pair, so a single formula cannot express it. The annual onsite audit applies only to some pairs, and only where you have not written the determination that lifts it — a conditional that lives in a document, not in a cell. The one-year eligibility window on a substitute inspection depends on a date you did not generate. And the December 31 very-small-importer re-documentation is an annual date belonging to the businesses least likely to have built a tracker in the first place.

There is also a specific hazard in using a spreadsheet for this topic. An FSVP tracker tempts a team into pasting the substance in to make the review easier — audit findings, test results, extracts of a supplier's food safety plan — which puts commercially sensitive material belonging to your suppliers into an untracked file that gets emailed around. That is the material section 1.510 expects to be held properly and retrieved on request, not duplicated into a working document nobody controls.

A system built for this holds each supplier-and-food pair as its own item with its own cadences, recomputes the backstop from the last reevaluation actually recorded, reminds a named owner and a backup ahead of each activity, and stores dates and status rather than food safety records. It is the difference between an importer who believes its FSVP is current and one who can name the date each pair was last reevaluated without opening a single file.

8. Key takeaways

• ✓FSVP — 21 CFR Part 1, Subpart L — makes the U.S. importer responsible for assuring that each foreign supplier produces food under processes giving at least the same level of public health protection U.S. law requires domestically.
• ✓The importer is the U.S. owner or consignee at the time of entry — or, where there is none, a U.S. agent who has signed a statement of consent to serve as importer. A customs broker never occupies the role.
• ✓Under section 1.509 your name, email and unique facility identifier are transmitted to CBP for each line entry, identifying you as the FSVP importer — usually filed by your broker.
• ✓The work is per supplier and per food: a hazard analysis, an evaluation and approval, and verification activities chosen and documented for each pair.
• ✓The three years is a backstop, not a schedule. Section 1.505(c)(2) applies only where you have not reevaluated under (c)(1), so each event-driven reevaluation restarts the interval from that day.
• ✓You determine and document your own verification frequency — and are then measured against it. The one fixed interval is the annual onsite audit for a serious hazard controlled by the supplier, unless you write an adequate determination that something else is appropriate.
• ✓Records go to FDA promptly; an English translation is owed within a reasonable time. The twenty-four hours applies to records stored offsite — including records held for you by a supplier, auditor or consultant — which must be retrievable onsite in that window.
• ✓Retention is two years, and for evaluations and determinations two years after use is discontinued — a category the rule says includes having reevaluated the risks. Every reevaluation starts a disposal clock on the one it replaced.
• ✓Enforcement is records-based and lands at the border: refusal of entry, detention without physical examination, or an import alert. A missing dated assessment cannot be created after the fact.
• ✓Tracking each pair's reevaluation and verification dates — as dates and status, never as FSVP records — is what keeps a three-year interval from outlasting the people who set it.