Key points
- An audit approves a supplier for one ingredient, one intended use and one destination market — not a factory in general.
- A GFSI-recognised certificate narrows the work; it does not replace it. Read the scope statement and the last two audit reports, not the logo.
- Screen documents before you travel. Most disqualifying findings are visible in the specification, process flow and allergen statement.
- Convert every finding into a verification action with an owner and a date. An audit that ends in a score changes nothing.
- Four findings should stop approval outright: undeclared subcontracting, no traceability exercise, no allergen control where allergens exist, and unverifiable treatment claims.
Most supplier audit reports we are asked to fill in run to forty pages and answer the wrong question. They describe a factory. They do not tell the buyer whether that factory can supply this ingredient, at this specification, into this market, batch after batch after batch.
That narrower question is the only one an audit has to settle. Everything below is organised around it — what to screen before you travel, what to look at once you are inside, and which findings should end the conversation rather than generate a corrective action.
Start with the ingredient, not the certificate
Before requesting audit documents, write a one-page risk brief. It should identify:
- the exact ingredient, botanical or chemical identity, physical form and processing method;
- whether it will be eaten without a later validated kill step;
- biological, chemical, allergen and physical hazards that are known or reasonably foreseeable;
- vulnerable attributes such as water activity, pesticide residues, sulphites, heavy metals, foreign matter or viscosity;
- the destination market, consumer group and finished-food application;
- who in the chain controls each material hazard.
This matters for low-moisture foods. Low water activity stops many pathogens from multiplying, but it does not necessarily kill them. Codex notes that Salmonella can remain viable for extended periods in low-moisture products and can be more heat resistant in dry matrices. (Codex CXC 75-2015) An audit of a ready-to-eat freeze-dried fruit therefore asks different questions from an audit of a material that the buyer will fully cook.
The pre-audit document screen
A practical note from the other side of the table: the document pack a supplier can produce in 48 hours tells you almost as much as the visit will. If a specification arrives without methods, or the process flow has no CCP marked, or the allergen statement is a sentence rather than a site profile, you have learned something real before booking a flight. Ask for documents early enough to review them before a visit or video audit. A useful pack includes the following.
| Evidence | What to verify | Frequent weak point |
|---|---|---|
| Legal entity and site address | The contracting, manufacturing and invoicing entities are identified | Trader presented as manufacturer |
| Product specification | Revision, test methods, limits, ingredients and intended grade | “Typical” values with no acceptance limits |
| Process flow | Every processing, treatment, rework and packing step | Outsourced kill step omitted |
| Hazard analysis | Hazards are product- and process-specific | Generic HACCP copied across categories |
| Food-safety certificate and audit report | Site, scope, products, exclusions, expiry and open findings | Certificate covers a different site or activity |
| Allergen programme | Site allergens, segregation, changeover and label control | “Allergen free” declared without site map |
| Traceability and recall test | Lot linkage and measured retrieval time | One-up/one-down records cannot isolate rework |
| Laboratory controls | Methods, sampling, competence and out-of-specification workflow | COA shows “pass” but no result or method |
| Complaint and CAPA trend | Repeat failures, root cause and effectiveness checks | Closure based only on retraining |
| Regulatory history | Warning letters, import alerts, recalls or enforcement relevant to the site | Company-name variants not searched |
For U.S.-bound food, FDA provides public supplier-evaluation resources and expects importers to consider compliance history as part of supplier performance. (FDA supplier resources) A clean database search is not proof of compliance; it is one input.
What to examine at the facility
Follow one lot from receiving through release rather than walking the site in departmental order. Select the lot yourself if possible.
Identity and material control
Compare receiving records, internal labels, storage location, production record, COA and final pallet marks. Look for undocumented relabelling, mixed origins, partial bags without traceability, expired status labels and rework that can cross lot boundaries.
Hygienic design and zoning
Observe traffic from raw to finished areas, tools, forklifts, footwear, dust extraction and maintenance access. In low-moisture facilities, uncontrolled water can spread contamination and create niches. Ask when wet cleaning is allowed, how the area is released afterward, and how condensate or roof leaks are handled.
Process control
Choose the controls that matter to the ingredient: drying endpoint, water activity, metal detection, sieve integrity, steam-treatment parameters, fermentation conditions, filtration, residual solvent or final viscosity. Verify the monitoring record against the written limit and the calibration record. A plausible number is not enough if the method, instrument or correction rule is undefined.
Post-treatment protection
Where a microbial-reduction step exists, inspect the point at which treated material can meet raw dust, personnel, air, tools or packaging. Codex gives special attention to products exposed to the environment after a pathogen-reduction step. That is often the decisive part of the audit, not the treatment certificate itself.
People and records
Interview the operator who performs the check, not only the manager who wrote the procedure. Ask the operator what happens when a result is close to the limit, the instrument fails, or a bag loses its lot label. The answer shows whether the control works under pressure.
Convert findings into a verification plan
An audit produces observations; approval requires a decision. FDA lists onsite auditing, sampling and testing, and review of relevant records as possible verification activities. The mix should follow risk. (FDA third-party audit resources)
Use four approval states:
- Approved: defined products may be purchased under the agreed controls.
- Conditionally approved: limited orders are allowed while named evidence or corrective action is completed.
- Trial only: samples or a controlled pilot may proceed; commercial release may not.
- Not approved: a stop condition exists or critical evidence is missing.
The decision should state product/site scope, effective date, required testing frequency, COA requirements, change-notification period, audit or record-review frequency, and triggers for suspension.
Example risk matrix
This is a decision aid, not a regulatory formula.
| Risk signal | Lower-intensity response | Higher-intensity response |
|---|---|---|
| Fully cooked later by buyer | Document review plus periodic confirmation | Validate that the later step truly controls the hazard |
| Ready-to-eat low-moisture ingredient | Lot COA plus periodic independent testing | Onsite audit and risk-based lot verification |
| Stable process and transparent CAPA history | Longer review interval may be justified | — |
| New site, unexplained OOS or origin change | — | Hold approval; investigate and increase verification |
| Supplier-controlled serious hazard | — | Qualified onsite audit normally receives greater weight |
Document why the selected activity is adequate. “The supplier has a certificate” is not a rationale.
Non-negotiable stop conditions
Pause approval when any of the following occurs:
- the actual manufacturing site or subcontractor is concealed;
- the lot on the COA cannot be linked to the offered or shipped lot;
- a critical treatment is claimed but no validated process and record are available;
- results have been overwritten, selectively omitted or issued before the sample date;
- a certification scope does not cover the site, process or product being sold;
- a serious complaint or regulatory event has no credible root-cause investigation;
- the supplier refuses reasonable change notification or traceability evidence.
Commercial urgency does not lower the hazard. If a temporary purchase is permitted by the buyer’s programme and applicable law, define enhanced verification before the material enters production.
Remote audits: useful, but bounded
We host remote audits regularly and they work well for document control, traceability exercises and specification alignment. What they cannot do is smell a drying line, follow a forklift route, or show you what the floor looks like at the end of a shift rather than the start of one. Treat a remote audit as a screen that decides whether an onsite visit is worth it — not as a substitute for one. A remote review can efficiently test document control, interview personnel and inspect selected records. It is weaker for odour, dust movement, pest evidence, hidden storage, drainage, building condition and unscripted operator behaviour. Record what could not be observed and decide whether an onsite visit, independent sampling or a shorter approval period is needed.
The final supplier-audit record
Keep the risk brief, evidence reviewed, auditor competence, findings, supplier responses, decision, approver, verification plan and next review date together. The record should let a new reviewer reconstruct why the supplier was approved without relying on memory.
For an ingredient-specific review, provide the application, destination market, required specification and expected volume when contacting a supplier. Ask for a representative sample and a batch-specific COA before a commercial order—not only a brochure or certificate.
Frequently asked questions
Is a GFSI-recognised certificate enough to approve a supplier?
No certificate answers every product-specific question. Review its site and product scope, audit findings and validity, then connect it to your own hazard analysis and verification plan.
Must every supplier receive an onsite audit every year?
Not universally. Frequency and method depend on the applicable law, the hazard, who controls it and supplier performance. Under certain U.S. FSMA situations involving a serious supplier-controlled hazard, an annual onsite audit is generally required unless a documented alternative provides adequate assurance. Obtain qualified legal or food-safety advice for your case.
Can a trader be approved when it does not manufacture the ingredient?
Yes, if roles are transparent and the buyer can evaluate the actual manufacturer and controls. Approval should state whether it covers the trader, manufacturing site, product and any outsourced treatment or laboratory.
Where to go next
If you are building an approval file, these are the next three documents you will need.
- read a certificate of analysis line by line — the audit tells you whether the process is controlled; the COA tells you whether this particular lot was.
- the RFQ fields that make quotes comparable — an approved supplier still needs a specification precise enough to quote against.
- our goji, freeze-dried and dehydrated ranges — if you want to run this checklist against us, start with the products and send the intended use.
- send a specification for review — include destination market, application and the certifications your customer actually requires.
Published 9 September 2025. Last reviewed 15 August 2026 by the Union Sure technical team. Regulatory limits, standards and market requirements change — verify every legal limit against the current official source before it is used to approve a shipment.
