Scoring Methodology

What this page is

The full rubric behind every SupplierCheckFDA risk score, published so you can verify how any score was produced - and check the underlying records yourself at the FDA sources below. A report supports the supplier evaluation and reevaluation your FSVP already requires under 21 CFR §1.505; it is not a compliance determination, and the scoring involves no discretionary judgment calls: the rules on this page are the whole model.

Data sources

Four data sets from FDA's public Data Dashboard, joined deterministically by FEI (FDA Establishment Identifier) - no fuzzy matching in the scored record:

• Inspection classifications - outcomes of FDA facility inspections (NAI / VAI / OAI)
• Inspection citations - the specific CFR sections cited during inspections
• Compliance actions - warning letters, injunctions, seizures
• Import refusals - shipments refused admission at the border

Coverage reaches back to fiscal year 2010 for inspections, citations, and compliance actions, plus FDA's full published import-refusal history. The local dataset is refreshed by incremental sync from FDA's API on a weekly cadence, and every report is stamped with its generation date - it reflects the data held at that moment, which is what makes it a dated record rather than a live page.

The rubric

Each of the four domains is scored independently by the rules below, and the overall score is the worst of the four - a clean inspection history does not offset a live warning letter. Risk levels are reported as:

1. Elevated Risk
2. Moderate Risk
3. No Adverse Findings
4. No FDA Records Found - a report status, not a risk tier: it means FDA has published nothing for that FEI, and your evaluation should rest on other verification methods.

An FEI with no records in any of the four sources returns the fourth status above.

Inspections

Compliance actions

The worst finding across all actions on record sets the domain score - a newer, milder action never shadows an older, more severe one.

Warning letters FDA publishes without an action date are not scored - the 2- and 5-year bands cannot be applied to an unknown date. Injunctions and seizures are date-independent, so a missing date never suppresses them.

Import refusals (trailing 12 months)

Citations

Any citation in a significant CFR family scores Moderate - citations alone never produce an Elevated score. The families counted: FSVP (21 CFR Part 1 Subpart L), Preventive Controls (117), Produce Safety (112), Seafood HACCP (123), Thermally Processed Foods (113), Dietary Supplement cGMP (111), Drug cGMP (211), Device QSR (820), and ISO 13485. Cross-category citations count deliberately: a food supplier cited under drug cGMP is still a risk signal.

Cross-domain flag

A supplier with 5 or more lifetime import refusals and zero FDA inspections gets an explicit note on the report, whatever its tier: refusals can accumulate at the border without the facility ever having been inspected, and recency-based rules alone would let a historically refused, currently dormant supplier show No Adverse Findings. The flag does not change the score; it tells you to look.

Design choices, stated plainly

• Hard recency cutoffs (2, 3, 5 years), not gradual decay - the thresholds are visible and checkable rather than buried in a curve.
• No trend prediction or trajectory scoring - the record shows what FDA published, not a forecast. A wrong algorithmic downgrade would be worse than none.
• Worst-of-four, not a weighted average - averaging would let good history dilute an active enforcement problem.
• Every report keeps the raw records in its appendix (most recent 25 per domain), so the score never has to be taken on faith.

Calibration

The rubric was calibrated on 2026-08-25 against every FEI in the synced dataset - 358,016 establishments across all four sources. The distribution it produces:

Two honest caveats on those numbers: the calibration universe covers all FDA-regulated entities (drugs and devices included), not food establishments alone, so the food-only distribution may differ; and the citation domain was broadened after that run from FSVP-only to the nine CFR families listed above, which can only move establishments toward Moderate - the published shares are a floor for that tier, not an exact current census.

Known limitations

• Recalls and import alerts are not in the scored record. FDA does not publish either with a machine-readable FEI join. The report's FDA firm-profile source link includes both - check them there as part of your evaluation.
• The score reflects FDA's published record only. No foreign-authority inspections, private or GFSI audits, state actions, or anything FDA has not published. A supplier FDA has never inspected can show No Adverse Findings on a thin record - the cross-domain flag covers the clearest version of that case, not every version.
• Most rules are recency-bounded by design. An OAI inspection or warning letter older than five years no longer moves the score (injunctions and seizures are the exception, counted at any age - even when FDA publishes them without a date). A warning letter published without a date is not scored at all: the age bands cannot be applied to an unknown date. The appendix still shows the records either way.
• FDA's API caps responses at 5,000 rows. The sync iterates by fiscal year to stay under the cap, but the highest-volume data slices can still truncate. Known limitation, monitored.
• Company names are ambiguous; FEIs are not. Roughly 2-3% of establishment names map to more than one FEI. Every report is keyed to a single FEI, printed at the top - confirm it matches your supplier's before filing.
• FDA records can lag or change. Records may be incomplete, delayed, or corrected after publication. Verify critical findings directly with FDA and with the supplier.

Who runs this

I do data-engineering work around food-import compliance - this is a solo build, not a company. Nothing in the report is my food-safety judgment: it's FDA's own record, organized and scored by a published rubric, and every data point traces back to the FDA sources linked in the report. That is also why this page exists: the rubric, not a resume, is what you should be able to audit. Questions about any rule here - or a score you think it got wrong - are welcome at [email protected].