Interactive 12-Point Food Supplier Approval Checklist
A step-by-step regulatory qualification protocol engineered for food manufacturing QA managers. Verify 12 mandatory gates, ensure zero audit non-conformances, and export an immutable signed audit record.
Food Supplier Approval Checklist
A verifiable 12-point protocol aligned with SQF 2.3.4, BRCGS 3.5.1, and FSMA 204. Mark items complete or document valid N/A justifications.
The 12 Mandatory Supplier Approval Gates & Statutory References
Every supplier onboarded into your facility must pass through these 12 statutory checkpoints before a purchase order is authorized.
| Gate | Approval Requirement | Statutory Reference | Auditor Verification Focus | Risk of Omission |
|---|---|---|---|---|
| Gate 01 | FDA Food Facility Registration & Legal Verification | 21 CFR § 1.230 & FSMA § 102 | Verify active 11-digit FDA registration number and physical manufacturing site DUNS number in FDA FURS database. | Automatic refusal of admission at port / Major 483 citation |
| Gate 02 | Continuing Letter of Guarantee (CLOG) | 21 U.S.C. § 331(h) / FD&C Act | Signed legal warranty from corporate officer certifying materials are not adulterated or misbranded under federal law. | Loss of legal statutory defense against adulteration charges |
| Gate 03 | Third-Party GFSI Audit Certificate & Full Report | SQF 2.3.4.3 / BRCGS 3.5.1.3 | Full 40+ page audit report from accredited CB (SQF, BRCGS, FSSC 22000) with documented corrective action closeouts. | Major non-conformance (-10 points on SQF audit) |
| Gate 04 | Raw Material Technical Specifications (Dual Signed) | SQF 2.3.2.1 / BRCGS 3.6.1 | Detailed specifications establishing physical, chemical, and microbiological limits, reviewed within past 3 years. | Minor or Major non-conformance for unapproved specs |
| Gate 05 | Big 9 Allergen Declaration & Cross-Contact Matrix | FALCPA & FASTER Act of 2021 | Signed declaration disclosing presence of sesame, peanuts, tree nuts, milk, eggs, wheat, soy, fish, and shellfish on shared lines. | Critical hazard risk / FDA Class I recall trigger |
| Gate 06 | Hazard Analysis & Preventive Controls Summary | 21 CFR § 117.130 (HARPC) | Documented evaluation of biological, chemical (mycotoxins, pesticides), and physical hazards requiring supply-chain control. | FDA 483 observation for missing supply-chain hazard control |
| Gate 07 | Certificate of Analysis (COA) Protocol Agreement | SQF 2.4.4.2 / BRCGS 3.5.2.1 | Documented agreement specifying required lot testing parameters (moisture, micro, Brix) and acceptable analytical limits. | Dock receiving disputes and acceptance of out-of-spec lots |
| Gate 08 | Certificate of Insurance (Commercial General Liability) | Corporate Legal Governance | $2M - $5M product liability coverage with your facility explicitly named as Additional Insured and 30-day cancellation notice. | Total financial exposure during third-party injury claims |
| Gate 09 | 24/7 Emergency Recall Contacts & Traceability Roster | SQF 2.6.3 / FSMA 204 § 1.1315 | Verified primary and secondary phone numbers, email addresses, and designated recall coordinator available 24/7. | Failure of 4-hour mock recall audit benchmark |
| Gate 10 | Foreign Supplier Verification Program (FSVP) Dossier | 21 CFR Part 1 Subpart L | For imported goods, qualified individual signed hazard evaluation, country of origin cert, and Customs UFI match. | Listing on FDA Import Alert 99-35 (Border detention) |
| Gate 11 | Agricultural Water Testing & GAP Proofs (Produce/Raw) | 21 CFR § 112 (Produce Safety) | Laboratory water testing records verifying zero generic E. coli in pre-harvest and post-harvest washing systems. | Immediate supplier disqualification for pathogenic STEC risk |
| Gate 12 | PCQI Written Approval & Live ASL Inclusion | SQF 2.3.4.1 / 21 CFR § 117.410 | Dated signature of Qualified Individual / PCQI officially approving the supplier and enrolling them on the live ASL register. | Major non-conformance for unapproved vendor receipt |
5-Stage Supplier Onboarding & Approval Lifecycle
Standard operating procedure connecting procurement, external vendor QA teams, and plant PCQIs into an efficient 13-day workflow.
Buyer initiates vendor onboarding request; vendor receives secure magic link to online intake portal with required document checklist.
Supplier uploads 12 compliance items; AI OCR instantly extracts expiration dates, scope descriptions, and accreditation seals.
QA evaluates raw material hazard profiles, reviews GFSI audit non-conformances, and verifies allergen cross-contact declarations.
QA Director executes cryptographic digital signature, assigning the supplier to High, Medium, or Low risk tier.
Evidlane pushes approved vendor code to ERP/WMS receiving dock, unlocking purchase order generation and freight truck receiving.
Top 8 Supplier Approval Deficiencies & Audit Pitfalls
Review real-world audit non-conformances identified during GFSI and FDA regulatory inspections.
| Audit Pitfall / Defect | Severity Level | Auditor Finding Text | Automated Remediation |
|---|---|---|---|
| 1. Allowing purchasing to issue POs before PCQI checklist completion | Major Non-Conformance | SQF Clause 2.3.4.1: Receiving facility received materials prior to completion of mandatory qualification activities. | Implement automated ERP purchase order holds until QA executes digital Gate 12 approval. |
| 2. Accepting supplier self-declarations for high-risk ingredients | Major Non-Conformance | BRCGS Section 3.5.1.3: High-risk raw material approved via questionnaire without independent audit verification. | Enforce mandatory accredited 3rd-party GFSI audit reports for all high-risk food raw materials. |
| 3. Approving a corporate sales office rather than physical manufacturing site | FDA 483 Warning Observation | FSMA 21 CFR 117.410: Importer verified corporate headquarters but failed to audit overseas manufacturing facility. | Capture exact physical facility address and FDA registration pin matching shipping bills of lading. |
| 4. Missing sesame declarations on legacy allergen statements | Critical Non-Conformance | FASTER Act of 2021: Undeclared allergen risk identified due to outdated 8-allergen declaration document. | Mandate signed Big 9 allergen declarations explicitly confirming presence or absence of sesame. |
| 5. Expired Certificate of Insurance (COI) during commercial dispute | Corporate Legal Breach | Risk Governance Audit: Plant held 100% financial liability for foreign contamination due to lapsed vendor insurance. | Automate 30-day policy renewal triggers and mandate Additional Insured endorsements. |
| 6. Lack of dual-signed technical ingredient specifications | Minor Non-Conformance | BRCGS Clause 3.6.1: Ingredient specification lacked formal signed acceptance from supplier technical director. | Deploy digital spec review workflows requiring electronic countersignatures from vendor QA. |
| 7. Receiving emergency ingredient shipments without QA authorization | Major Non-Conformance | SQF Clause 2.3.4.5: Emergency material unloaded and used in production without documented QA risk assessment. | Formalize 48-hour emergency release logs with mandatory PCQI sign-off and quarantine testing. |
| 8. Inability to produce completed checklist records within 2 hours | Audit Efficiency Non-Conformance | GFSI General Requirements: Facility failed to retrieve supplier verification records during audit window. | Store completed 12-point checklists in a centralized searchable cloud vault with 1-click PDF export. |
Manual Paper Checklists vs. Evidlane Automated Approval Platform
While a printed PDF or browser checklist helps standardize reviews, managing dozens of active ingredient vendors requires enterprise automation.
Manual PDF / Paper Checklists
- Avg 21 days to collect 12 vendor documents
- Manual calendar entry for certificate renewals
- No connection to ERP dock receiving software
- High risk of unapproved shipments entering plant
Evidlane Automated Platform
- Onboarding completed in 4.2 days via self-serve portal
- Automated 60-30-14 day renewal email chasing
- Instant ERP webhook locking unapproved lots at dock
- 1-Click sealed audit dossier with SHA-256 event log
Supplier Risk Tiering & Verification Activity Mandates
Under SQF Clause 2.3.4.2 and BRCGS 3.5.1.2, your supplier approval rigor must correlate directly with the inherent hazard level of the raw material.
| Risk Classification | Material Category Examples | Mandatory Approval Gates | Ongoing Verification Cadence |
|---|---|---|---|
| Tier 1: High Risk (SAHCODHA) | Raw poultry, unpasteurized dairy, tree nuts, fresh leafy greens, RTE allergen purees | All 12 Gates mandatory; accredited GFSI audit report required (no questionnaires accepted) | Lot-by-lot COA verification + annual unannounced audit review |
| Tier 2: Medium Risk | Refined vegetable oils, starches, granulated sugars, acidulants, food-grade preservatives | Gates 1 through 9 mandatory; comprehensive supplier technical questionnaire accepted | 24-month audit certificate renewal + quarterly composite testing |
| Tier 3: Low Risk / Primary Packaging | Salt, mineral water, corrugated outer cartons, plastic pallet wrap, glass containers | Gate 1, 2, 4, 8 mandatory; Letter of Guarantee certifying migration limits | 36-month document review + visual dock receiving inspection |
Emergency Temporary Supplier Approval Protocol (SQF 2.3.4.5)
Supply chain disruptions occasionally require purchasing from an unapproved vendor. Follow this strict protocol to maintain food safety and prevent audit non-conformances.
1. Documented QA Risk Assessment
Prior to PO release, the PCQI must complete a written risk assessment evaluating why the emergency vendor is necessary, what hazards exist, and what testing safeguards will be applied.
2. 100% Lot Quarantine at Receiving Dock
Upon arrival, warehouse receiving automatically tags the shipment with physical "QA HOLD" tape and applies an electronic lock in ERP, preventing production staging.
3. Analytical Testing & Director Sign-Off
Samples are drawn and tested for critical microbiological and chemical parameters. The QA Director issues written conditional release only after verified compliant test results are archived.
Frequently Asked Questions About Supplier Approval Checklists
Practical advice on implementing standardized supplier approval protocols and passing food safety audits.
What are the 12 mandatory gates in food supplier approval?
The 12 gates cover: 1) FDA facility registration verification, 2) Continuing Letter of Guarantee (CLOG), 3) Third-party GFSI audit report, 4) Signed technical specifications, 5) Big 9 allergen matrix, 6) Hazard analysis (HARPC), 7) COA parameters, 8) Certificate of Insurance, 9) 24/7 recall emergency contacts, 10) FSVP compliance (if imported), 11) Agricultural water tests (if produce), and 12) PCQI annual written approval.
Does SQF Edition 9 require a PCQI signature for every approved supplier?
Yes. SQF Edition 9 Clause 2.3.4 requires documented evidence that supplier approval records were evaluated and authorized by a designated food safety professional (such as a PCQI or SQF Practitioner) prior to receiving ingredients.
How long should completed supplier approval checklists be retained?
Under FDA 21 CFR 117 and GFSI benchmark schemes, supplier qualification records must be retained for at least 2 years, or the shelf-life of the product plus 1 year, whichever is longer.
Can a self-assessment questionnaire replace a 3rd-party GFSI audit report?
Only for low-risk commodities (such as inert food packaging). Both SQF 2.3.4.3 and BRCGS 3.5.1.3 explicitly forbid self-assessment questionnaires as the sole approval mechanism for high-risk raw materials.
How does Evidlane automate the 12-point checklist workflow?
Evidlane provides automated vendor onboarding portals with magic links, guides suppliers through uploading all 12 documents, runs AI OCR validation on certificate expiration dates, and produces an auditor-ready cryptographic approval packet in seconds.
What happens if an approved supplier changes their manufacturing facility?
If a supplier ships from a different physical facility, the approval for that specific shipment is invalid under SQF Clause 2.3.4. The supplier must undergo a new site-specific qualification audit for the alternative facility before shipping.
Why is a Continuing Letter of Guarantee (CLOG) necessary if we already have a GFSI certificate?
A GFSI certificate proves that a third party audited the supplier’s quality systems. A Continuing Letter of Guarantee is a legally binding warranty under Section 303(c)(2) of the FD&C Act protecting your facility from criminal prosecution if an ingredient is secretly adulterated.
How should packaging suppliers be qualified under the 12-point checklist?
Primary food-contact packaging suppliers (e.g. film pouches, bottles, cans) must provide Letters of Guarantee certifying migration limits under 21 CFR 174-178, a valid GFSI or ISO 22000 certificate, and heavy metal testing reports.
Can this checklist be exported to CSV or printed as a physical audit sign-off sheet?
Yes. The interactive checklist component at the top of this page allows QA managers to check off gates, enter supplier details, and immediately export a timestamped, signed CSV audit dossier directly from the browser.
How often must active approved suppliers be re-qualified through this checklist?
SQF Clause 2.3.4.2 mandates formal re-evaluation of approved suppliers at least every 12 months, or immediately upon critical non-conformances such as repeated COA deviations or regulatory warning letters.
Put Your 12-Point Supplier Approvals on Complete Autopilot
Evidlane provides automated vendor intake, AI OCR document parsing, 24/7 certificate expiration monitoring, and 1-click audit dossiers.