Many brand owners assume that once a contract manufacturer signs on, the regulatory risk moves with the product. It doesn't. Under the Food Safety Modernization Act (FSMA), the company that brings a product or ingredient into the United States from a foreign facility generally carries its own, separate legal duty to verify that supplier — a duty that exists independently of whatever quality systems the manufacturer runs on its own floor. For brands working with a manufacturer based in Mexico, or sourcing raw materials from outside the U.S., this is not a theoretical detail. It's the piece of the compliance puzzle that most often gets assumed away.
The relevant mechanism is FSMA's Foreign Supplier Verification Program, or FSVP. In broad terms, FSVP requires the U.S. importer of record — often the brand owner, sometimes a designated agent — to know enough about the hazards associated with a food or ingredient, and about the foreign supplier's ability to control those hazards, to make an informed decision about whether that supplier is safe to keep using. That means conducting a hazard evaluation, approving suppliers based on their demonstrated food-safety and quality performance, and choosing verification activities appropriate to the risk involved. For finished dietary supplements, this sits alongside the product-specific cGMP framework in 21 CFR Part 111, since verifying a supplement supplier means confirming they actually operate under the controls that framework requires, not just that they avoid contamination in a general food-safety sense.
What does 'verification' look like in practice, and what has to exist on paper to prove it happened? At minimum, an importer should be able to produce a written hazard analysis for the ingredient or finished product category, a documented rationale for approving that particular supplier, and records of the verification activity actually chosen — which could be an on-site audit, review of the supplier's own compliance audits, sampling and testing of incoming material, or a documented review of the supplier's relevant food or dietary supplement safety records. There also needs to be a mechanism for reassessing that approval periodically, and for responding to anything that changes the risk picture, such as a complaint, a recall, or a change in the supplier's process. None of this is a one-time file created at onboarding; it's meant to be a living record that shows ongoing oversight, not a checkbox exercise performed once and forgotten. This is where the duty genuinely splits between two parties, and where confusion tends to creep in. A capable contract manufacturer will generate and be willing to share the documentation that makes verification possible: certificates of analysis, batch and specification records, internal or third-party audit results, and evidence of how deviations and complaints are handled. But generating those records is not the same as performing verification. That responsibility, and the obligation to actually collect, review, and retain the resulting file, sits with the importer. FDA does not treat 'our manufacturer is certified' or 'our manufacturer passed an audit last year' as a substitute for the brand's own documented decision to rely on that supplier. If an inspector or an import review asks for the importer's FSVP file and it doesn't exist, the fact that the manufacturing plant itself was compliant does not resolve the finding — the gap is in the importer's own recordkeeping, not the plant's.
There are a few practical steps that make this manageable rather than burdensome. Verification expectations should be written into the manufacturing agreement itself: the right to request current audit reports, the right to review specification and testing records for the materials used in your product, and a requirement that the supplier notify you promptly of anything that would affect your risk assessment, such as a facility change, a recall, or a significant deviation. Keeping a simple, dated file of what was reviewed and when — rather than relying on informal email threads — turns routine due diligence into evidence that can be produced quickly if it's ever requested. It's also worth separating two things that get conflated. Dietary supplement cGMP under 21 CFR 111 governs what happens inside the manufacturing facility — how a formula is documented, produced, tested, and released. FSVP governs the separate question of how the U.S. company sourcing from that facility satisfies itself, and can prove it satisfied itself, that the facility and its inputs are being managed appropriately. A brand can work with an excellent, fully compliant manufacturer and still be out of compliance itself if it never built or maintained its own verification file. The two obligations run in parallel, and only one of them can be delegated to the manufacturer — the other has to be owned by the brand, full stop.
None of this is meant to make outsourcing sound riskier than it is. Contract manufacturing remains the standard, sensible way most supplement brands get to market, and a manufacturer with a transparent quality system makes verification considerably easier to perform and document. But 'easier to document' still means someone has to do the documenting, and under FSMA, that someone is the importer, not the plant.
