Set supplier verification frequency for each supplier-site, tea family, hazard and destination—not for the supplier name alone. Start with legal minima and the risk posed by the tea, then select the activity that can answer each control question. Give every activity a numeric cadence, a maximum evidence age and event triggers. Increase checks when history is absent or performance deteriorates; reduce them only through a written, evidence-based decision.
Do not confuse four different clocks
Supplier approval, routine verification, lot release and programme reevaluation are different decisions. A factory audit can assess systems but cannot release a particular lot. A passing pesticide test can support one lot but cannot prove that an approved site remains unchanged. A three-year programme review does not mean testing or auditing only every three years.
For covered U.S. importers, 21 CFR 1.505 requires prompt reevaluation when new information changes the food or supplier concerns and, absent an earlier reevaluation, at least every three years. Section 1.506 separately requires the importer to determine the activities and their frequency from the food-and-supplier evaluation and perform them before import and periodically thereafter. These are legal FSVP rules for businesses in scope, not a universal global timetable.
Build one verification-frequency control sheet
| Control field | What to record | Why it changes frequency |
|---|---|---|
| Approval unit | Legal supplier, manufacturing site, tea family, process, destination and intended use | One supplier may have several sites or risk profiles |
| Hazard and control | Residue, contaminant, microbiological, allergen or physical hazard; controlling entity | Verify the party and measure that actually control the hazard |
| Requirement layer | Applicable law, official guidance, buyer specification and contract clause | A legal minimum cannot be relaxed by a scorecard |
| Verification activity | Audit, independent test, record review, regulatory screen or incoming-lot check | Different activities answer different questions |
| Routine cadence | Every lot, one in n lots, monthly, annually or another defined interval | “Periodic” is not an executable instruction |
| Maximum evidence age | Last acceptable audit, certificate, test trend or regulatory search date | Old evidence can remain formally complete but operationally stale |
| Escalation triggers | Failure, complaint, alert, change, missed notice, trend or overdue action | Events must override the calendar immediately |
| De-escalation rule | Required consecutive conforming lots, closed causes and approval authority | Prevents an automatic return to light checking after one pass |
Use an eight-step scheduling method
1. Define the unit you are approving
Write the supplier's legal name, exact manufacturing site, product family, process, destination market and intended use. Treat a new site as a new approval unit even if the corporate parent is familiar. Link the record to the factory-verification evidence, approved samples and specifications.
2. Map hazards and the controlling entity
Use the destination hazard analysis and product specification. Identify who prevents or verifies each significant hazard: grower, processor, packing site, laboratory, importer or downstream customer. For example, pesticide residues may depend on agricultural controls plus representative lot testing, while package identity and seal condition are checked at dispatch and receipt. Verification aimed at the wrong entity creates paperwork, not assurance.
3. Match each question to an activity
Use an onsite audit for facility practices and system implementation; independent sampling and testing for defined analytes in an identified lot; record review for control evidence; regulatory database screening for compliance signals; and incoming inspection for identity, damage and status. Do not use a certificate, audit or supplier COA to answer a question it cannot prove.
4. Set the initial intensity from risk and knowledge
New or poorly documented sources need enough inspection and testing to establish a history. Known poor performance needs intensified controls. Codex CXG 47-2003 gives this principle to government import-control systems: inspection frequency should reflect risk and conformity history, using transparent criteria; unknown or poor-history sources may be sampled more intensively. A buyer may adopt the logic as a trade reference, but it is not itself a private-company legal schedule.
For each activity, document the reason for the starting tier. Avoid labels such as “high risk” without showing the hazard, evidence gap or performance signal.
5. Convert the tier into an executable cadence
Write a number and a boundary. “Every lot before release,” “one independently selected lot in every n received lots, with no gap longer than x months,” and “audit completed by the anniversary date” can be scheduled. “Regular testing” cannot. Set n and x from the hazard, legal framework, volume, seasonal variability, lot size, control reliability and consequence of failure—not from budget alone.
Keep shipment controls and system controls on separate rows. Lot identity, documents and incoming condition will often be checked for every consignment; analytical testing, record reviews and audits may follow different risk-based intervals.
6. Add event triggers that override the calendar
Require immediate review after an out-of-specification result, regulatory alert, serious complaint, recall signal, unapproved site or source change, new process, material specification change, missed certificate, repeated document error, overdue corrective action or adverse trend. Use the supplier change-control plan to decide what must be reapproved. An event-driven review may increase tests, audit scope, shipment holds or approval status before the next routine date.
7. Define escalation and de-escalation before a failure
State which failure moves testing to every lot, which finding requires an audit or suspension, and who can approve the change. To step down, require a defined evidence set: root cause accepted, action implemented, corrective-action effectiveness verified and a specified sequence of conforming lots or records. One passing retest should not erase a systemic finding.
8. Review the whole schedule, not just completion
At the planned programme review, ask whether each activity still addresses the current hazard and controlling entity, whether dates were met, whether findings were assessed promptly and whether the cadence detected deterioration early enough. Cross-check the supplier scorecard, complaints, lot dispositions, changes and regulatory information. Record the next due date, owner and approval decision.
Use a decision matrix instead of one universal interval
| Situation | Frequency decision | Release safeguard |
|---|---|---|
| New site or no reliable history | Intensify relevant document, sampling, testing and facility verification until defined evidence is built | Do not reduce on elapsed time alone |
| Stable approved site with conforming trend | Maintain lot controls; consider a documented risk-based interval for tests, records and audits | Keep a maximum time gap and event triggers |
| One isolated noncritical document error | Increase the affected record check and verify correction; do not automatically expand unrelated tests | Escalate if the error repeats or breaks traceability |
| Failed safety result or serious system finding | Hold affected product, intensify relevant verification and reassess approval immediately | Require disposition, cause, action and effectiveness evidence |
| Supplier, site, process or source change | Reperform the affected approval and verification decisions before routine cadence resumes | Treat an undisclosed material change as a separate performance failure |
Know which requirement controls the schedule
- Legal requirement: destination law controls businesses and products in its scope. For example, U.S. FSVP rules include food-and-supplier evaluation, activity-frequency determination and event/three-year reevaluation duties.
- Official guidance: FDA's FSVP guidance explains the agency's current nonbinding recommendations and examples; it does not replace the regulation.
- Voluntary standard: Codex CXC 1-1969 says verification frequency should be sufficient to confirm that controls work and systems should be reviewed periodically and when changes occur.
- Trade reference: Codex import-control guidance supports risk- and history-based inspection intensity, but a buyer must adapt it to its role.
- Buyer specification: states the approval unit, activities, cadence, maximum gaps, triggers, evidence and release rules.
- Contract requirement: makes notification, access, records, testing, audit cooperation, costs, holds and remedies enforceable between the parties.
Common buyer mistakes
- Using one annual audit date for every supplier, product and hazard.
- Treating the U.S. three-year reevaluation rule as a testing interval.
- Scoring a supplier without defining the manufacturing site.
- Relying on supplier-selected samples when independence is needed.
- Writing “periodic” without a number, maximum gap or owner.
- Reducing checks after one pass instead of a defined conforming sequence.
- Letting an expired certificate wait for the next calendar review.
- Increasing every check after a narrow error instead of targeting the failed control.
- Ignoring low-volume suppliers until years pass between evidence points.
- Failing to connect changes, complaints and corrective actions to the schedule.
Practical conclusion
A defensible schedule is specific approval unit - current hazard analysis - correct controlling entity - suitable activity - numeric cadence and maximum gap - event triggers - written escalation and de-escalation - documented review. It uses the calendar as a backstop, not a substitute for new information. To align the schedule with a real purchase, review Yunjing Tea's sample-to-shipment quality controls, laboratory selection guide, and send the tea, destination, annual volume and required verification evidence.
Sources checked 16 September 2026: 21 CFR 1.505, eCFR Title 21 current through 14 September 2026; 21 CFR 1.506, current through 11 September 2026; FDA's January 2023 final FSVP guidance for industry; Codex CXC 1-1969, 2022 revision / 2023 edition; and Codex CXG 47-2003, Guidelines for Food Import Control Systems. Confirm the current destination law, product scope, hazard analysis and contract before setting a real schedule.
