Introduction to Supplier Audits in Food Supply Chains
Picture receiving a pallet of seasoning that looks perfect: clean bags, correct labels, paperwork in order. Two weeks later, a customer finds an allergen that should never have been in that blend. Nothing at receiving could have shown you the supplier’s changeover cleaning failed that day. Supplier audits exist to look where receiving inspection cannot.
Put simply, a supplier audit is a structured examination of a supplier’s site, system, records, and practice against agreed criteria, carried out to decide whether that supplier can safely and consistently provide what you buy. It is both a control and a learning visit: you verify, and you come to understand a process you depend on.
Purpose and scope of a supplier audit
Main purposes cluster into four decisions. Should you approve a new supplier? Should you continue with an existing one? Did corrective action after a problem actually work? Has a change in process, site, or ownership altered the risk?
Scope must be stated before anyone travels. An audit might cover a whole site and all products, or one line, one ingredient, storage only, or a specific problem such as allergen control. Scope creep during a visit wastes time and annoys hosts; an overly narrow scope can miss a shared sanitation or maintenance system that affects your product too.
- Products and processes included, and any excluded lines or buildings
- Criteria used: law, a certification standard, your specification, or a blend
- Time period for records to be sampled
- Sites, warehouses, and sub-suppliers included
Types of audit by relationship
First, second, and third party
A first-party audit is an organisation auditing itself, commonly called an internal audit. Results support self-improvement but lack independence. A second-party audit is performed by a customer on its supplier, or by an agent acting for that customer. Most supplier audits in a buyer’s programme are second-party audits. A third-party audit is performed by an independent organisation, for example a certification body granting a certificate, or a regulator inspecting under law, though regulatory inspection has its own authority and purpose.
Each type has value. Internal audits can be frequent and detailed. Third-party certification gives a standardised, independent verdict accepted by many buyers. Second-party audits let you focus on your ingredient, your hazards, and your specification in a way a generic audit cannot. Mature programmes use all three without duplicating effort blindly.
What an audit examines
Auditors follow material and information flow. Expect review of management commitment, hazard analysis and HACCP or preventive controls, prerequisite programmes such as sanitation and pest control, allergen management, traceability and recall, training, maintenance, laboratory practices where relevant, and handling of nonconforming product.
Evidence comes from three sources. Documents show intent: policies, procedures, specifications. Records show history: monitoring logs, test results, training files, deviation reports. Observation and interviews show reality: how a line runs, how staff behave, whether explanations match records. Strong conclusions rest on more than one source; a single tidy binder should never settle a major question.
Sampling is central. No audit reviews every record or watches every task. Auditors choose samples based on risk, time period, product, and shift, then expand sampling when a sample reveals a problem. A good report states what was sampled, so readers know the limits of the conclusion.
Outcomes and follow-up
Audit outcomes range from approval, through conditional approval with actions, to rejection or suspension. Findings are usually graded by severity, with critical or major issues requiring faster, deeper correction than minor points. Grading language varies by programme, so define your terms clearly if you run your own audits.
An audit without follow-up is tourism. Agree corrective actions, owners, and dates, then verify closure with evidence proportionate to the risk. A photo may close a minor housekeeping point; a failed kill step needs records, revalidation evidence, or a revisit.
Frequency follows risk and performance. New, high-risk, or troubled suppliers get audited more often. Stable, low-risk suppliers get lighter cycles, supplemented by certificate review, performance data, and questionnaires where suitable. In the US, if you rely on an audit as a verification activity under 21 CFR 117 Subpart G or under the FSVP rule in 21 CFR Part 1 Subpart L, specific documentation and auditor qualification expectations apply, so build those into your procedure.
Attitude that gets results
Professional, curious, and firm works better than either friendly vagueness or aggression. Explain purpose, respect site safety and confidentiality, ask open questions, and stay unmoved when evidence contradicts a claim. Suppliers cooperate more when they trust your fairness, and they fix more when your findings are specific and undeniable.
Remote audits deserve a clear place in this picture. Document review, video walk-throughs, and interviews by video call can cover much ground when travel is impossible or risk is lower, and they suit focused follow-ups well. Limits remain: camera angles are chosen by the host, smells and small details disappear, and spontaneous observation is harder. Record in your procedure when remote work is acceptable and when only an on-site visit gives enough confidence for approval.
Key points
- A supplier audit examines site, system, records, and practice against agreed criteria to support an approval decision.
- Define scope, products, criteria, and record period before the visit begins.
- First-party is internal, second-party is customer-led, and third-party is independent.
- Base conclusions on documents, records, observation, and interviews combined, not one source alone.
- Grade findings, agree corrective actions with dates, and verify closure proportionate to risk.
- Set audit frequency by risk, history, and performance, not by habit alone.
