FDA 483 Citations for FSVP Supplier Evaluation and Verification Under 21 CFR 1.505 and 1.506

22 hours ago

6 min read

After the hazard analysis, an importer must evaluate each foreign supplier, approve it, and verify on an ongoing basis that it controls the hazards. These steps drew the largest group of FSVP observations on system-generated Form FDA 483s in fiscal year 2025:

Did not document the evaluation of [foreign supplier performance] [the risk posed by a food], 1.505(a)(2), 106 times
Did not conduct and document supplier verification activities [before importing the food] [periodically thereafter], 1.506(e)(1), 97 times
Did not establish [adequate] written procedures for supplier verification activities, 1.506(b), 87 times, and did not follow them, 32 times
Did not establish written procedures to ensure you import food only from approved foreign suppliers, 1.506(a)(1), 76 times
Did not determine and document which verification activities are appropriate, or their frequency, 1.506(d)(1)(i), 85 times combined
Did not document approval of a foreign supplier based on the evaluation, 1.505(b), 37 times

That is more than 500 citations. Together they describe importers who buy from suppliers they have never evaluated, with no plan for checking them and no records showing that anyone did.

What the citations mean

Examples written after "Specifically" usually describe:

No written evaluation of the supplier's food safety performance or compliance history
Suppliers used without documented approval
No written procedure listing approved suppliers or how unapproved suppliers are blocked
A supplier questionnaire or certificate as the only evidence, with no verification activity
Verification chosen without considering the hazard or the supplier's history
No annual onsite audit for a hazard that could cause serious illness or death, and no documented reason for another approach
Verification done once at approval and never repeated
Audit reports or test results on file but never reviewed

What 21 CFR 1.505 and 1.506 require

Evaluation (1.505(a)). Before importing a food from a foreign supplier, you must evaluate the risk posed by the food, based on your hazard analysis, and the foreign supplier's performance. The evaluation must consider:

The hazard analysis and who controls each hazard
The supplier's procedures, processes and practices related to the safety of the food
Applicable FDA food safety regulations and information on the supplier's compliance, including whether the supplier is the subject of an FDA warning letter, import alert or other compliance action
The supplier's food safety history, including test results, audit results and responsiveness in correcting problems
Any other factors appropriate and necessary, such as storage and transportation practices

You must document the evaluation (1.505(a)(2)), approve suppliers on the basis of it and document the approval (1.505(b)), and reevaluate when you become aware of new information and at least every 3 years (1.505(c)).

Written procedures (1.506(a) and (b)). You must establish and follow written procedures to ensure that you import foods only from foreign suppliers you have approved, or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose foods you subject to adequate verification before importing. You must also establish and follow adequate written procedures for conducting appropriate foreign supplier verification activities.

Choosing verification activities (1.506(c) and (d)). Based on the evaluation, you must determine and document which activities are appropriate and how often to conduct them. Appropriate activities include:

Onsite audits by a qualified auditor
Sampling and testing of the food
Review of the supplier's relevant food safety records
Other appropriate activities based on the food and supplier

When a hazard in a food will be controlled by the foreign supplier and is one for which there is a reasonable probability that exposure will result in serious adverse health consequences or death (SAHCODHA), the default is an onsite audit before initially importing the food and at least annually thereafter, unless you make an adequate written determination that other activities and frequencies provide adequate assurance.

Conducting verification (1.506(e)). You must conduct and document the verification activities before importing the food and periodically thereafter, and review the results. An onsite audit must consider applicable FDA regulations and include a review of the supplier's written food safety plan, if any, and its implementation. Verification must be conducted by someone free of conflicts of interest.

Corrective actions (1.508). If you determine that a supplier is not meeting requirements, you must take appropriate corrective action, which may include stopping imports from that supplier.

How to respond to the 483

FDA does not set a single deadline for responding to a food 483, but most firms respond in writing within 15 business days, so FDA has the response before it decides on further action.

Evaluate and approve every current supplier

For each food and supplier, document the evaluation against the 1.505(a) factors. Check the FDA warning letter and import alert databases. Approve or reject each supplier in writing.

Write the procedures

How suppliers are evaluated, approved, reevaluated and removed
How purchasing and receiving block unapproved suppliers
How verification activities and frequencies are chosen for each hazard and supplier
How results are reviewed and what triggers corrective action

Choose and document verification

For each food and supplier, record which activities you will use, how often and why. For SAHCODHA hazards controlled by the supplier, plan an annual onsite audit or document why another approach gives adequate assurance.

Conduct the first verification

Complete and review at least one verification activity for each supplier before the next shipment, or explain how upcoming shipments will be covered, such as lot testing.

What compliant FSVP supplier controls contain

Supplier evaluation for each food and supplier
Documented approval and approved supplier list
Written procedures for approved suppliers and verification
Verification activities and frequencies with a rationale
Audit, testing and record review results, with documented review
Corrective actions and supplier removal
Reevaluation at least every 3 years
Records

Common mistakes in supplier verification responses

Treating a questionnaire or third-party certificate as verification without reviewing it
Choosing record review for a SAHCODHA hazard without a written determination
Verifying once at approval and never again
Evaluating the broker instead of the actual foreign manufacturer
Leaving purchasing free to buy from unapproved suppliers

Example: how one response section might read

This illustrates structure only; your response must describe your own foods and facts.

Observation 3: You did not conduct and document supplier verification activities before importing the food. Specifically, frozen raspberries were imported from a new supplier with no verification activity.

Response:

Evaluation and approval: The supplier's food safety plan, third-party audit report, test history and FDA compliance status were evaluated, and the supplier was approved on a stated date.
Verification: Because hepatitis A and norovirus are SAHCODHA hazards controlled by the supplier, an annual onsite audit by a qualified auditor was scheduled. The first audit report was reviewed on a stated date.
Interim control: Each shipment before the audit was held and released only after review of lot records and test results.
Procedures: Written procedures for supplier approval and verification were issued, and the purchasing system now blocks orders from unapproved suppliers.

Frequently asked questions

Is an annual onsite audit always required?

It is the default for SAHCODHA hazards controlled by the foreign supplier. You may use other activities or frequencies if you document an adequate determination that they provide adequate assurance.

Can the foreign supplier's third-party audit count?

An audit conducted by a qualified auditor for another purpose can be used if it meets FSVP requirements. You must review the results and document the review.

How often must we reevaluate suppliers?

When you become aware of new information about the food or supplier, and at least every 3 years.

How A.P. Lyon documents help

A.P. Lyon's Supplier Approval and Control Procedure covers evaluation, approval, verification and removal of suppliers. The Receiving and Inspection of Incoming Materials Procedure blocks unapproved material, and the Corrective Action Procedure covers supplier problems. A.P. Lyon does not sell a stand-alone FSVP program.

Documents are editable Word and Excel files and must be adapted to your foods and suppliers. Audits must be conducted by qualified auditors. A.P. Lyon does not provide food safety consulting or supplier audits.

Next steps

Evaluate, approve and document every current supplier
Write procedures for approved suppliers and verification
Choose verification activities and frequencies with a rationale
Respond in writing within 15 business days with dates for each action

To build a complete set of procedures at a volume discount, use Build Your QMS.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.