Diagnose critical compliance gaps in your Approved Supplier List (ASL) spreadsheet in 30 seconds. Identify expired GFSI certificates, missing physical manufacturing sites, broker blindspots, and unapproved ERP vendors before your next third-party audit.
Instant automated gap detection against GFSI / SQF Edition 9 and BRCGS requirements. Analyzed 100% locally in your browser—no files uploaded to any third party.
Drag and drop your spreadsheet exported as .csv, or browse your local drive.
In over 68% of food processing facilities, the Approved Supplier List (ASL) resides in a Microsoft Excel or Google Sheets workbook. While spreadsheets are convenient for initial data entry, they represent the single largest vulnerability during third-party GFSI audits and FDA inspections.
| Standard / Audit Body | Governing Clause | Mandatory ASL Record Requirement | Spreadsheet Failure Mode |
|---|---|---|---|
| SQF Edition 9 | Clause 2.3.4.2 | Register of approved suppliers detailing material specifications, approval criteria, and verification methods. | Uncontrolled multiple versions; missing physical manufacturer locations. |
| BRCGS Issue 9 | Clause 3.5.1.2 | Documented procedure for ongoing supplier performance monitoring and annual review of approval status. | Expired GFSI audit certificates remaining marked as "Approved". |
| FDA FSMA PCHF | 21 CFR 117.410 | Supply-chain applied control documentation, including verification audit reports prior to receiving ingredients. | No audit trail proving receiving dock checked active approval status. |
| FDA FSMA 204 | 21 CFR 121 (FTL) | Traceability Lot Code (TLC) source and location identifier for all Food Traceability List items. | Broker listed without farm / manufacturing facility location. |
| FDA 21 CFR Part 11 | Subpart B & C | Electronic records and signatures must be secure, computer-generated, timestamped, and unalterable. | Excel files lack tamper-proof change history and authenticated signatures. |
When an auditor enters your facility, their opening request is almost universally: "Please provide your current Approved Supplier List and show me the last 5 receiving records." If your receiving clerk is using a printed sheet from last month while QA updated an Excel file yesterday, you immediately receive a Non-Conformance for document control under SQF Clause 2.2.2.
Our audit tool screens for the exact 8 systemic failure modes that trigger major non-conformances and FDA 483 inspection citations:
Spreadsheets cannot send automated push notifications. On average, 14% of suppliers on an Excel ASL have expired third-party food safety audit certificates (SQF, BRCGS, FSSC 22000), leaving the plant legally unprotected.
Listing an ingredient distributor or trading company as the "supplier" without documenting the true manufacturing facility name and physical location. This violates BRCGS 3.5.1.3 and FSMA Supply-Chain mandates.
Vendors who were temporarily approved for a one-off run 3 years ago remain permanently marked as "Approved" in the spreadsheet, allowing procurement to re-order without QA re-qualification.
`ASL_2025_Final.xlsx`, `ASL_2025_Final_v2_QA.xlsx`, and `ASL_Approved_Procurement.xlsx` circulating concurrently. Conflicting spreadsheets lead to receiving dock personnel releasing unapproved materials.
SQF Clause 2.6.3 requires documented 24-hour emergency recall contacts for all approved raw material vendors. Spreadsheets typically record generic sales emails that go unmonitored over weekends.
Anyone with file access can change a status from "Conditional" to "Approved" or modify expiration dates without leaving an authenticated timestamp, electronic signature, or justification note.
Treating a critical RTE allergen supplier identically to a cardboard carton vendor. SQF 2.3.4.1 mandates hazard-based risk classification directly linked to verification testing intensity.
When the spreadsheet is not dynamically integrated with ERP or WMS receiving screens, warehouse workers have no automated block to prevent unloading lots from non-compliant suppliers.
Compare how traditional manual spreadsheet governance stacks up against continuous, automated supplier quality management:
| Capability / Audit Requirement | Manual Excel / Google Sheets | Evidlane Automated Platform |
|---|---|---|
| Certificate Expiration Tracking | Manual calendar checks; 15-20% missed expirations | Automated 60/30/14-day vendor reminder sequences |
| Audit Preparation Speed | 12 to 24 hours spent gathering PDFs and binder tabs | 1-Click instantaneous auditor binder generation |
| 21 CFR Part 11 Audit Trail | Non-compliant (No tamper-proof logs) | 100% Compliant (Immutable audit logs & timestamps) |
| Broker & Manufacturer Linkage | Flat text cells; broker blindspots common | Multi-tier parent-child vendor hierarchy tracking |
| ERP / Receiving Dock Integration | None; dock workers must cross-reference paper prints | Real-time REST API & webhook hold/release sync |
| Emergency Recall Readiness | Hours spent locating outdated emergency cell numbers | Instantaneous 24/7 verified contact directory |
| Annual Administration Time | 200+ QA hours per year chasing missing documents | Under 15 QA hours per year (90% reduction) |
Follow this 5-stage protocol to transform a degraded, unverified spreadsheet into an airtight, audit-ready supplier register:
Pull 12-month trailing purchase orders from your ERP accounting software. Cross-reference active purchasing accounts against the QA Approved Supplier List. Identify "Ghost Vendors" (active in ERP but omitted from QA approval) and "Zombie Approvals" (approved 5 years ago but no purchase in >24 months). Archive inactive vendors and place unvetted purchasing accounts on immediate hold.
For every ingredient purchased through a broker, distributor, or trading group, demand the legal entity name, FDA Facility Registration Number (FEI), and physical manufacturing site address. Under BRCGS 3.5.1.3, an approval issued solely to an office broker is deficient unless the manufacturing plant itself has been audited and approved.
Examine each active GFSI certificate (SQF, BRCGS, FSSC 22000, PrimusGFS). Verify the expiration date against official scheme databases (SQFI directory, BRCGS Directory). Inspect the certified "Scope of Assessment" to ensure the specific ingredient SKU you buy is covered—auditors routinely cite plants whose supplier certificates cover dairy powders but not the specialty cheese inclusions purchased.
Conduct an active communication test. Send an automated or test contact confirmation to the recorded 24-hour recall phone number and emergency QA email for every Tier 1 and Tier 2 supplier. Log response times. Any contact taking >4 hours to confirm during working hours must be issued a non-conformance flag and updated within 10 business days.
Eliminate offline spreadsheet files. Import the cleansed dataset into Evidlane SQMS. Enable self-service vendor document uploading, automated 60-day expiry warning triggers, and webhook synchronization with your warehouse ERP to enforce automated receiving holds whenever a certificate lapses.
An auditor will immediately reject an ASL that only lists company names and phone numbers. Under SQF Edition 9, BRCGS Issue 9, and FDA FSMA 204, every entry in your Approved Supplier List must contain these 12 standardized data attributes:
| Data Field | Technical Specification | Regulatory Reference | Deficiency Consequence |
|---|---|---|---|
| 1. Supplier Legal Entity Name | Full corporate legal name matching tax ID / W-9. | SQF 2.3.4.2 | Mismatched commercial invoices and QA certificates. |
| 2. Physical Manufacturing Facility | Actual plant address where material was processed (not broker office). | BRCGS 3.5.1.3 | Major non-conformance for broker blindspot. |
| 3. FDA Facility Registration (FEI) | 10-digit FDA Establishment Identifier or DUNS number. | FSMA 21 CFR 1.225 | Customs hold or import refusal on foreign ingredients. |
| 4. Approved Raw Material SKU(s) | Explicit item codes and product names approved for purchase. | SQF 2.3.4.1 | Supplier ships unvetted high-risk SKU under existing master contract. |
| 5. Inherent Risk Tier Rating | Assigned category: Critical, High, Medium, or Low. | BRCGS 3.5.1.1 | Failure to justify reduced audit or testing frequencies. |
| 6. GFSI Benchmark Scheme & Rating | Certification scheme (SQF, BRCGS, FSSC) + audit score (e.g., SQF 96% Excellent). | GFSI Benchmarking | Mandatory on-site audit required if certificate is missing or invalid. |
| 7. Certificate Expiration Date | Explicit expiration calendar date with proactive reminder alert. | SQF 2.3.4.2 | Immediate audit deduction for lapsed documentation. |
| 8. PCQI Approval Date & Sign-off | Electronic signature and credentials of approving PCQI. | 21 CFR 117.410 | FDA 483 citation for unapproved supply-chain controls. |
| 9. 24/7 Emergency Recall Contact | Direct cell phone and dedicated QA crisis inbox verified quarterly. | SQF 2.6.3 / FSMA 204 | Critical failure during mock recall or FDA traceability query. |
| 10. Big 9 Allergen Declaration Status | Declaration of allergen presence and cross-contact risk matrix. | FALCPA & FASTER Act | Catastrophic undeclared allergen recall risk (Class I). |
| 11. Downstream Kill Step Dependency | Flag indicating whether material relies on supplier lethality or in-house lethality. | 21 CFR 117.135 | Misapplication of HACCP CCP verification rules. |
| 12. TLC Source Identifier (FSMA 204) | Traceability Lot Code generator identifier for all FTL items. | 21 CFR 1.1310 | Inability to generate 24-hour electronic spreadsheet sort. |
Supply chain shortages frequently force procurement teams to source emergency spot-market ingredients. Managing conditional approvals in an uncontrolled spreadsheet often results in emergency suppliers becoming permanently approved without required documentation:
Conditional approvals must carry a strict system-enforced 30-day time limit. After 30 days or completion of the single approved purchase order, the vendor status must automatically revert to "Quarantined" in the ERP.
Because third-party facility audits have not been verified, 100% of incoming lots from conditional suppliers must be placed on physical and electronic quality hold pending ISO 17025 accredited micro and chemical release testing.
Procurement cannot unilaterally approve a spot-market vendor. Emergency onboarding requires written, signed risk assessment sign-off from both the site PCQI and the Operations Director before PO release.
No. The Evidlane Supplier Spreadsheet Auditor processes your file 100% locally within your web browser using client-side JavaScript. Your file, vendor identities, pricing, and contact details are never transmitted to our servers or stored in any database.
Under SQF Clause 2.3.4.2, an Approved Supplier List (ASL) must maintain: the supplier and manufacturer name, exact physical manufacturing site address, specific approved raw materials or packaging items, approval date, risk tier category, certification standard/expiry date, and emergency recall contact details.
Excel lacks revision control, electronic signatures (21 CFR Part 11 compliance), and automated audit trails. Auditors commonly find expired certifications listed as valid, unapproved suppliers receiving orders, and multiple conflicting spreadsheet versions across procurement and QA.
The Broker Blindspot occurs when a facility lists an ingredient broker or distributor as the supplier without documenting the actual manufacturing plant where the ingredient was processed. BRCGS 3.5.1.3 explicitly requires identification and approval of the manufacturing site.
Under FSMA 204, receiving facilities must record Key Data Elements (KDEs) including the Traceability Lot Code (TLC) source and location identifier. If an ASL spreadsheet lacks the actual physical facility registration, generating the required 24-hour electronic spreadsheet sort becomes virtually impossible.
Food manufacturers should conduct a thorough reconciliation of their ASL at least monthly, cross-referencing active ERP receiving vendor IDs against QA-approved vendor records, or replace spreadsheets entirely with automated continuous verification software.
Conditional approvals are granted for temporary supply disruptions, typically restricted to a single purchase order or a 30-day window, requiring 100% lot testing and PCQI sign-off. Leaving conditionally approved suppliers on a static spreadsheet indefinitely is a major audit non-conformance.
Yes. The algorithm uses fuzzy semantic matching across column headers to identify vendor names, certificate expiration dates, audit schemes, and material descriptions regardless of column ordering or exact phrasing.
Download our auditor-approved Approved Supplier List template formatted for SQF Edition 9 and BRCGS Issue 9.
Generate automated 60-30-14 day renewal schedules across all vendor GFSI and organic certifications.
Score raw material hazards, vendor certifications, and process lethality to calculate tier assignments.
Evidlane automates supplier document requests, validates GFSI audit scopes, alerts on expiring certificates, and gives your team a real-time, audit-ready supplier register.
