To qualify a new coconut supplier, classify the hazard before you book the plant visit. Under US rules, that classification decides whether you must fly an auditor to the factory every year or can verify on records and test results alone. Get the order wrong and you either overspend on audits you did not owe, or miss the one you did.
The cost gap is real. An onsite third-party audit in Sri Lanka, Indonesia or the Philippines runs into travel, auditor days and a corrective-action cycle; a records review costs an analyst an afternoon. Both are legal verification activities. This is the checklist the desk runs before a first container moves.
What does FSVP actually require you to verify?
The Foreign Supplier Verification Program sets four things an importer must evaluate before approval: the hazard analysis for the food, which entity controls each hazard, the supplier’s performance, and its storage and transport practices. Performance explicitly includes whether the firm is the subject of an FDA warning letter, import alert or other compliance action (21 CFR 1.505(a)).
Two numbers in that rule get misquoted constantly.
First, reevaluation. The rule requires reapproval at least every three years, plus prompt reevaluation whenever new information surfaces. Annual re-approval is not required.
Second, the audit trigger. An onsite audit before first import and at least annually thereafter is mandatory only where a hazard carries a reasonable probability of serious adverse health consequences or death, and the foreign supplier controls it (21 CFR 1.506(d)(1)(ii)). Even then it is rebuttable: an importer may substitute other activities or a lower frequency if it documents the justification in writing. An FDA inspection within the past year can stand in for the audit.
For desiccated coconut, the hazard driving this test is Salmonella. Codex names it the primary pathogen of concern in low-moisture foods, and its Code of Hygienic Practice for Low-Moisture Foods (CXC 75-2015) covers desiccated coconut by name.
| Hazard situation | Who controls it | Verification the rule points to |
|---|---|---|
| Salmonella, kill step at the plant | Supplier | Onsite audit pre-import, then annually, unless justified in writing |
| Salmonella, kill step applied after import | You | Your preventive control; supplier verification can be records-based |
| Aflatoxin, heavy metals, chlorate, sulphites | Supplier | Sampling and testing, or records review, chosen on risk |
Sampling records must carry lot numbers, methods, dates and results. A results-only certificate is not a verification record.
How do you check a food-safety certificate is genuine?
Check the scheme’s public register, not the PDF the supplier emailed.
Start with a category error that costs buyers time. GFSI recognises certification schemes, not factories. No plant is “GFSI certified”. The GFSI register of recognised programme owners lists BRCGS, FSSC 22000 v6, IFS Food v8 and SQF Edition 9 Level 2. A scheme version absent from that list fails at the first check.
Validity also differs by scheme, and buyers who ask only for “an in-date certificate” get caught here.
| Scheme | Certificate validity | Public verification | Watch for |
|---|---|---|---|
| FSSC 22000 v6 | 3 years, annual surveillance | FSSC public register | v5.1 certificates removed 31 May 2025 |
| IFS Food v8 | 12 months | IFS Database | Withdrawn certificates stay listed 3 months |
| BRCGS Issue 9 | Per BRCGS protocol | BRCGS Directory | Issue 9 audits began 1 February 2023 |
| SQF | Per SQF Code | SQF assessment database | Edition 9 Level 2 is the GFSI-recognised version |
IFS publishes its scoring gates. A score of 95% or above is Higher Level; 75% up to 95% is Foundation Level; both yield a twelve-month certificate. More than one Major, a total below 75%, or any knock-out clause scored D means no certificate (IFS Food v8, §4.2.1).
Then read the scope line. A certificate covering coconut oil refining does not cover a desiccated coconut line.
Unannounced audits: ask which year, not whether
Since the 2020 GFSI benchmark, every recognised scheme must deliver at least one unannounced audit within each three-year certification cycle. BRCGS sets this out in its unannounced audit protocol, version 6 dated 24 July 2024. IFS requires that at least every third IFS Food audit is unannounced, in force since 1 January 2021. FSSC 22000 requires one unannounced surveillance audit in each three-year period.
The IFS mechanics show what a supplier can and cannot control. The audit window runs from sixteen weeks before the due date to two weeks after. A site may nominate a blackout of at most ten working days. Refusing the auditor access, absent force majeure, withdraws the certificate within two working days.
So the question is not whether unannounced audits happen. It is: show me the last unannounced report, and which year the next is scheduled.
Which spec goes into the contract?
Name the method, not just the number. Two parties can both measure moisture honestly and land three-tenths of a point apart on different methods. That gap is enough to reject a container.
The most repeated error in coconut sourcing is that Codex sets desiccated coconut moisture at 3%. It does not. Codex CXS 177-1991, revised 2011 sets a maximum of 4% m/m. The 3% figure is a commercial norm European buyers write into their own specs, reported by CBI. Both are legitimate. Only one is a standard.
| Parameter | Codex CXS 177 (rev. 2011) | Typical EU buyer spec | Reference method |
|---|---|---|---|
| Moisture | max 4% m/m | max 3% | AOAC 925.40 |
| Oil content, full fat | min 60% m/m | min 60% | AOAC 948.22 |
| Ash | max 2.5% m/m | max 2.5% | AOAC 950.49 |
| Acidity of extracted oil | max 0.3% as lauric acid | as Codex | ISO 660:2009 |
| Extraneous vegetable matter | max 15 fragments / 100 g | as Codex | Codex CXS 177 §3.2.4 |
| Foreign matter | absent in 100 g | absent | Codex CXS 177 §3.2.4 |
Write the method code into the contract alongside the limit. For how those numbers read on an incoming lot, see reading a desiccated coconut COA and the desiccated coconut page.
Two organic paperwork failures that strand a container
US organic imports require an NOP Import Certificate for every consignment. It can only be generated through the USDA Organic INTEGRITY Database, and the importer must file the certificate data into CBP’s ACE system (7 CFR 205.273). This came in with the Strengthening Organic Enforcement rule, published 19 January 2023, compliance date 19 March 2024, which also removed the certification exemption brokers, traders and importers relied on.
The EU mirror is an electronic Certificate of Inspection in TRACES under Regulation (EU) 2018/848, with the consignee completing box 13 on receipt.
SOE also changed what a certifier owes you. Agents must conduct unannounced inspections of at least 5% of the operations they certify, run mass-balance audits at annual inspections, and verify traceability back to the previous certified operation. That gives buyers a concrete test: pick one real lot and walk the mass balance from nut intake to shipped weight.
The pre-first-container checks
Four verifications run alongside the food-safety work.
Company registry. Confirm the trading entity exists and matches the proforma: Sri Lanka eROC, Philippines SEC eSPARC, the Vietnam National Business Registration Portal, or India’s MCA portal.
Sanctions screening. Screen the entity and its beneficial owners against the EU consolidated financial sanctions files and the OFAC SDN list before payment terms are agreed.
Border-control exposure. No coconut product appears in Annex I or Annex II of the EU’s increased-official-controls regulation through the June 2026 update, per the AGRINFO monitoring platform. Those annexes are reviewed roughly every six months, so recheck rather than assume. On the US side, FDA Import Alert 23-12 covers detention without physical examination of coconut for microbiological contamination. It is firm-specific, so read the live list.
Trial volume. One container, full document set, full test panel, before any program commitment.
What this means for buyers
- Procurement (CPG): classify the hazard first. If the kill step sits with the supplier, budget the annual onsite audit or document why you are not doing one.
- Procurement (CPG): put the AOAC and ISO method codes in the spec sheet. A limit without a method is an arbitration waiting to happen.
- Importers and distributors: verify certificates on the scheme register, not the emailed PDF, and read the scope line against the product you buy.
- Anyone buying organic: confirm the NOP Import Certificate route and the certifier’s scope before the container books, not at the port.
FAQ
Does FSVP require an annual audit of every coconut supplier? No. The annual onsite audit applies where a hazard could cause serious adverse health consequences or death and the supplier controls it. Even then an importer may use other verification activities, or audit less often, if it documents the justification in writing.
Is Codex moisture for desiccated coconut 3% or 4%? Codex CXS 177 sets a maximum of 4% m/m. The 3% figure is a commercial specification common among European buyers, not a Codex limit. Both can appear in a contract, so state which one applies.
Can a supplier refuse an unannounced audit? Under IFS, refusing access without force majeure withdraws the certificate within two working days. Sites may nominate blackout periods, capped at ten working days across at most three periods.
Qualifying a supplier is cheaper before the contract than after the claim. To lock a spec, a method set and a verification plan across more than one origin, send the desk an RFQ.