Key Components of a Supplier Audit Program

Approving a supplier on a handshake and a certificate creates a program that falls apart at the first serious deviation. Who decided the risk was acceptable? What verification was promised? When is the next review? A supplier audit program answers those questions in writing, before product moves.

Think of a program as an operating system, not a folder of audit reports. It defines which suppliers fall in scope, how risk is judged, who can approve, what evidence counts, and what happens when findings repeat. Without those rules, each buyer and each auditor invents a private system.

Governance, scope, and responsibilities

Start by naming an owner, usually in quality or food safety, with authority to block approval or suspend buying for safety reasons. Purchasing, operations, regulatory, and research teams contribute, but divided accountability often means no accountability when a deadline presses.

Define scope clearly. Include raw materials, ingredients, packaging that contacts food, co-manufacturers, contract packers, warehouses, and service providers whose work can affect safety, such as pest control or sanitation chemical suppliers, where risk justifies it. Note exclusions and reasons, so gaps are deliberate.

• Program owner and approvers, with named deputies
• Sites and material categories covered
• How brokers, distributors, and traders are handled when the actual manufacturer differs
• Escalation route for urgent safety concerns

Risk assessment and supplier categorisation

Not every supplier deserves the same scrutiny. Categorise by hazard severity, likelihood, vulnerability to fraud or substitution, country and site history, volume, and how you use the material. A ready-to-eat ingredient added after a kill step carries different risk from a raw agricultural commodity you will cook thoroughly.

Use inherent risk first, then adjust for controls and performance. A high-hazard material from a new supplier with no history should start in a high-attention category. Strong performance over time can reduce frequency of audits, but it should rarely reduce a supplier of high-risk material to no verification.

Approval criteria

Set minimum gates before first purchase. Typical gates include legal registration, a recognised food safety certification where appropriate, specification agreement, allergen and hazard information, traceability capability, and satisfactory audit or assessment results for higher-risk suppliers. Conditional approval, with limits on volume, products, or time, can work when gaps are minor and controlled.

Verification activities and audit frequency

Verification is broader than an on-site audit. Depending on risk, you might review third-party audit reports and certificates, conduct your own second-party audit, require certificates of analysis, sample and test lots, review complaint history, or monitor regulatory alerts for the supplier and region.

Write frequency into the program by category, with triggers that shorten the interval. Triggers include a serious finding, a recall, a change of ownership, a new process or site, repeated late corrective actions, or a long gap in supply followed by restart. Under the US preventive controls supply-chain program in 21 CFR 117 Subpart G, verification activities and their frequency must be documented, and audits used as verification have specific qualified-auditor and documentation expectations.

For foreign suppliers, US importers run a separate but related duty under the Foreign Supplier Verification Programs rule, 21 CFR Part 1 Subpart L. Keep importer records distinct where required, even if one audit supports both programs.

Standards, checklists, and auditor competence

Pick your audit criteria before you visit. Criteria may combine your own requirements, customer requirements, relevant regulation, and a recognised scheme such as a GFSI-benchmarked standard. A checklist should guide coverage and evidence recording, not turn auditing into ticking boxes without judgement.

Auditors need technical knowledge, auditing skill, and independence from the commercial relationship. Train them, shadow them, and calibrate them by comparing how different auditors grade the same evidence. Rotate auditors where familiarity could soften findings, and require conflict-of-interest declarations.

Corrective action, reassessment, and records

Findings need classification, timelines, and follow-up. Critical findings that create an immediate safety risk can pause approval or shipments. Major findings need root-cause analysis and verified closure. Minor findings still need agreed action, because small hygiene and record faults often signal weak supervision.

Reassess suppliers on a set cycle and after significant change or failure. Keep records that show approval decisions, risk rationale, verification performed, findings, corrective actions, and verification of closure. Records should be retrievable by supplier, site, and material, so a question from a regulator or customer does not become a week of searching inboxes.

Review program performance itself with simple measures: audits completed on schedule, overdue corrective actions, repeat findings, supplier-caused complaints or rejections, and time to close serious issues. Those measures tell you whether the program controls risk or merely produces paperwork.

Small companies sometimes worry that a formal programme needs a large team. Scale the paperwork, not the thinking. A one-page risk table, a shared supplier register, clear approval signatures, and a calendar for reviews can run a sound programme for a modest supply base. What cannot be scaled away is the discipline of deciding in advance, recording the decision, and checking that promised verification actually happened on time, every time, for every supplier in scope.

Key points

• A program sets ownership, scope, approval gates, and escalation rules in writing.
• Categorise suppliers by risk, then match verification type and frequency to that risk.
• Verification can include audits, certificate review, testing, and performance monitoring.
• Auditors must be competent, calibrated, and independent of buying pressure.
• Close findings with root-cause action and verified follow-up, and reassess after change or failure.
• Keep records organised by supplier, site, and material for fast retrieval.