Supplier approval in food safety is the documented, risk-based process of deciding which suppliers may provide your raw materials, packaging and services, and keeping that decision under review. It combines evidence such as questionnaires, certificates, audits and specifications with ongoing monitoring of performance.
Many hazards in a finished product arrive through the goods-in door. Salmonella in poultry, an undeclared allergen in a seasoning, aflatoxin in nuts or a substituted ingredient can all start with a supplier, and your own controls may not catch them.
Standards expect this control. ISO 22000:2018 requires control of externally provided processes, products and services, and GFSI-recognised schemes set detailed supplier requirements.
Start with a risk assessment
Not every supplier needs the same scrutiny. Put effort where failure would hurt most by considering:
- The material: microbiological, chemical, physical, allergen and fraud hazards, and whether your process controls them later. Raw chicken that you cook is different from a ready-to-eat garnish you do not.
- The supplier: certification status, history, location and how well you know them.
- The use: volume, whether the material goes into products for vulnerable consumers, and whether it carries a claim such as halal or organic.
Record the assessment and the resulting risk rating. Auditors want to see why a supplier received its level of control, not just that a form exists.
Approval methods
Supplier questionnaires
A self-assessment questionnaire covers registration, certification, HACCP, allergen management, traceability, pest control and recall procedures. It is useful for screening, but it is only the supplier's own statement.
Certificates and GFSI-recognised schemes
Certification to a GFSI-recognised scheme, such as FSSC 22000, BRCGS Food Safety, IFS Food or SQF, is independent evidence that the supplier runs a food safety system. ISO 22000 on its own is not GFSI-recognised, though FSSC 22000 builds on it; see FSSC 22000 vs ISO 22000 vs BRCGS.
Check every certificate for scope (does it cover the product and the site you buy from?), expiry date, certification body and accreditation. Verify it through the scheme owner's or certification body's public database where one exists, because forged and out-of-scope certificates do appear.
Supplier audits
An audit by your own team or a second-party auditor lets you see the site, the people and the records. It is the strongest approval method, usually reserved for high-risk materials, uncertified suppliers or poor performers.
Specifications and certificates of analysis
A signed specification defines what you are buying: composition, allergens, microbiological and chemical limits, packaging, labelling, shelf life, storage and delivery conditions. It turns expectations into an agreement you can test against.
A certificate of analysis (COA) reports test results for a lot. Check that it matches the delivered lot, covers the specified parameters and comes from a competent laboratory, ideally accredited to ISO/IEC 17025:2017. Verify COAs with your own testing periodically.
Supplier risk tiers and review frequency
| Risk tier | Typical materials | Approval method | Example review frequency |
|---|---|---|---|
| High | Raw meat and poultry, ready-to-eat ingredients, allergens, materials for vulnerable groups, fraud-prone materials | GFSI certificate plus audit or detailed document review, signed specification, COA per lot, verification testing | At least annually, with periodic audits |
| Medium | Ingredients you process further, such as frozen vegetables or pasteurised dairy | Certificate or questionnaire with document review, signed specification, periodic COAs | Every one to two years |
| Low | Ambient dry goods with a later kill step, secondary packaging | Questionnaire, certificate where available, specification | Every two to three years |
| Services | Pest control, laboratories, cleaning contractors, transport | Licences, competence, contract, service reports, laboratory accreditation | Annually |
These frequencies are examples only. Set your own based on risk, performance and the requirements of your certification scheme, customers and regulator.
The approved supplier list
The approved supplier list (ASL) is the controlled record of who you can buy from and for what. For each supplier, record the approved materials, risk tier, approval basis, certificate expiry dates, any conditions and the next review date.
It only works if people use it. Goods-in staff should check deliveries against it, and purchasing should not be able to order from an unapproved supplier without QA sign-off.
Emergency and temporary suppliers
Shortages happen. Document who can authorise an emergency purchase, the minimum checks (such as a valid certificate and COA), extra checks at receipt, and a time limit for full approval. Buying from a wholesaler still requires traceability to the original manufacturer.
Ongoing monitoring and performance review
Approval is not permanent. Monitor each supplier through:
- Receiving checks: temperature, packaging, labelling, vehicle hygiene and documents.
- Non-conformances, rejections and complaints linked to the supplier.
- Verification testing against the specification.
- Certificate renewals, audit outcomes and notified changes, such as a new site or recipe.
- Delivery performance and response to corrective actions.
Review this data at a set frequency and record the decision: continue, increase monitoring, re-audit, suspend or remove.
The food fraud angle
Supplier approval is also your first defence against food fraud. A vulnerability assessment looks at materials prone to substitution or dilution, such as spices, honey, olive oil and premium meat, and at supply chains that make fraud easier.
Controls include buying closer to the producer, authenticity testing, mass balance checks and scrutiny of prices that look too good to be true. See VACCP vs TACCP for how vulnerability assessment works.
Worked example: a Dubai restaurant group approves a poultry supplier
A Dubai restaurant group with a central kitchen and several outlets wants a second chilled poultry supplier after repeated short deliveries from its current one. The material is high risk: raw poultry is a known source of Salmonella and Campylobacter, and it must be halal.
- Questionnaire and documents: the processor returns a questionnaire with its trade licence, authority approvals for the slaughter and processing plant, an FSSC 22000 certificate and a halal certificate.
- Certificate checks: QA confirms that the FSSC 22000 scope covers poultry slaughter and processing at that site and is current, and that the halal certification body is recognised in the UAE.
- Specification: both parties sign a specification covering cuts, weight tolerance, delivery temperature, packaging, labelling, shelf life and microbiological criteria.
- Site audit: the group's QA manager audits chilling, cross-contamination controls, cleaning and the cold chain to Dubai, and raises one minor finding on vehicle temperature records.
- Trial deliveries: three deliveries are checked at receipt, and samples go to an ISO/IEC 17025 accredited laboratory.
- Decision: the supplier is approved as high risk, on condition that the audit finding is closed and monthly verification testing runs for the first six months.
The supplier joins the ASL with a review date. Six months later, consistent receiving checks and test results support reducing verification testing to quarterly.
Common mistakes
- Approving suppliers on a questionnaire alone, whatever the risk.
- Accepting a certificate without checking scope, site and expiry.
- Treating approval as a one-off event with no review.
- Letting purchasing bypass the ASL during shortages.
- Accepting COAs without checking they match the delivered lot.
- Forgetting service providers such as pest control and laboratories.
- Buying through brokers without traceability to the manufacturer.
Key takeaway: Supplier approval is a risk decision, not a filing exercise. Match the depth of approval to the hazard, verify certificates and COAs rather than just collecting them, and let performance data decide whether a supplier stays on the list.
Frequently Asked Questions
What is supplier approval in food safety?
Supplier approval is the documented process a food business uses to decide which suppliers may provide materials and services. It is based on risk and uses evidence such as questionnaires, certificates, audits, specifications and test results. Approved suppliers are recorded on an approved supplier list and their performance is reviewed regularly.
What documents should a food supplier provide?
Typical documents include a trade licence, food safety certificates and their scope, a completed questionnaire, a signed product specification, certificates of analysis, allergen and traceability information, and claim certificates such as halal. The exact set depends on the material's risk and on your scheme, customer and regulatory requirements.
Is a GFSI certificate enough to approve a supplier?
A valid GFSI-recognised certificate is strong evidence, but on its own it is not enough. Check that its scope covers the site and product, agree a specification, and verify incoming material through receiving checks and testing. For high-risk materials or poor performance, an audit may still be needed.
How often should suppliers be reviewed?
Review frequency should depend on risk and performance. Many businesses review high-risk suppliers at least annually and lower-risk suppliers less often, with extra reviews after complaints, failures or significant changes. Your certification scheme or customers may set specific expectations, so document your rationale in the procedure.
Next steps
Advanced Food Safety Management & Compliance covers supplier assurance in depth, and Food Fraud & Food Defence (VACCP and TACCP) shows how to assess supply chain vulnerability.
For related reading, see our guides to food traceability and recall readiness, internal auditor skills and audit planning and mycotoxins and aflatoxin in food. Not sure which course fits your role? Speak to a counsellor.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.