Supplier Verification: How to Audit Your Food Suppliers in 2026

By GIFSQ Food Safety Team | October 2026

Most food safety failures begin before ingredients reach the receiving dock. The Peanut Corporation of America shipped Salmonella-contaminated product its own lab had flagged; its customers trusted the paperwork. Time and again, investigations trace an outbreak or recall to a supplier whose controls existed on paper and nowhere else. Supplier verification is the discipline that keeps that from happening to your brand — and since FSMA made it law, it is no longer optional.

This guide covers what supplier verification requires in 2026: the regulatory backbone, how to build an approved supplier program, how to run an onsite audit that actually finds things, and how to cut off a supplier without stopping your own production.

The Law Changed: Supplier Verification Is a Regulatory Requirement

FSMA’s Preventive Controls rule for human food (21 CFR Part 117, Subpart G) requires receiving facilities to implement a supply-chain program when a hazard in a raw material or ingredient requires a supply-chain-applied control. Section 117.410 spells out the verification activities: onsite audits, sampling and testing, and review of the supplier’s food safety records — selected according to the risk the ingredient presents. Importers face parallel duties under the Foreign Supplier Verification Programs rule (21 CFR Part 1, Subpart L).

Certification schemes sharpen the point. SQF, BRCGS, and FSSC 22000 all require documented supplier approval and monitoring programs, and auditors routinely cite facilities whose “approved supplier list” is a spreadsheet of names with no approval basis behind them. The expectation is straightforward: every supplier on the list earned its place through evidence, and the evidence is current.

Approved Suppliers Versus Conditional Ones

An approved supplier program has two gates. Nothing is purchased until the supplier passes the first: a completed questionnaire, product specifications on file, a current third-party audit report or certification, a HACCP or food safety plan summary, and allergen and recall procedures. High-risk ingredients — ready-to-eat components, allergens, anything with a history of contamination — warrant an onsite audit before first purchase, not after the first delivery.

Reality sometimes forces a conditional approval: a sole-source ingredient, a supply disruption, a new launch on a deadline. Conditional status is legitimate only when it is time-bound, documented, and paired with compensating controls — every-lot testing, certificates of analysis (COAs) verified against your own lab results, restricted use until full approval. A conditional supplier still on the list a year later is not conditional; it is unapproved.

The Paper Trail That Survives an Audit or a Recall

For each supplier, maintain a single approval record: approval date, the basis for approval, the risk rating assigned, the re-verification frequency, and the next review date. Attach the evidence — audit reports, COAs, corrective action closures — rather than filing it somewhere nobody can find during a recall. Under FSMA’s traceability rule (21 CFR Part 1, Subpart S), key data elements for foods on the Food Traceability List must be retrievable in a sortable electronic spreadsheet within 24 hours of an FDA request. Your supplier records should meet the same standard of retrievability, because the day you need them is the day you have no time to reorganize them.

The Onsite Audit: What Auditors Actually Find

Second-party audits — you auditing your supplier — remain the most revealing verification tool available. Third-party certifications are valuable, but your auditor works for you, follows your risk concerns, and asks the questions a certificate can’t. Scope the audit around your hazards: the supplier’s HACCP or food safety plan, sanitation programs, allergen controls, pest management, foreign material controls, traceability, calibration, training records, and management commitment. Walk the floor against the paperwork; the gap between the two is where findings live.

Insist on seeing a traceability exercise run live. Ask the plant to trace one lot of finished product forward to customers and one raw material lot backward to its source, on the clock. GFSI schemes expect a full mock recall completed within about two to four hours; if the supplier can’t produce complete records inside that window, their traceability system is a binder nobody opens. Check corrective actions from their last audit too — repeat findings signal a management system that files paperwork instead of fixing problems.

Scoring Suppliers and Setting Re-verification Frequencies

Score findings by severity and tie the score to action. Critical findings — systemic HACCP failures, pest infestation in production areas, falsified records — suspend purchasing until verified correction. Major findings require corrective action plans with deadlines, typically 30 days. Minor findings get tracked and closed at the next review. The score also sets how often you go back: high-risk suppliers audited annually, medium-risk every two years, low-risk suppliers monitored through records review and COA trending.

Risk ratings should combine the ingredient’s inherent hazard with the supplier’s performance history. A supplier of pasteurized liquid egg with three clean audits is lower risk than a new spice supplier from a region with known adulteration problems, even though both sit on the same list. Re-rate annually — a supplier’s risk is not fixed, and neither is your verification effort.

Testing as a Verification Tool: When to Sample Incoming Lots

Testing incoming materials verifies the supplier; it does not replace them. Use it where the hazard justifies the cost: aflatoxin in peanuts and tree nuts (the EU enforces 2 parts per billion for aflatoxin B1 and 4 ppb total in many foods), pesticide residues in produce, heavy metals in ingredients sourced from high-risk regions, pathogens in ready-to-eat components. Verify COAs with your own testing on a defined frequency — every lot for new suppliers, skip-lot for proven ones — because a COA is only as honest as the lab behind it.

Trend the results. A supplier whose micro counts creep upward quarter after quarter is telling you something months before a lot fails specification. Share the trend data with the supplier; competent ones treat it as free consulting, and the ones who argue with their own data are telling you something too.

Cutting Off a Supplier Without Stopping Production

Suspension criteria belong in the procedure before anyone is suspended: critical audit findings, repeated major findings, confirmed adulteration, falsified COAs, or a regulatory action against the supplier. When suspension hits, the contingency plan activates — qualified alternates, safety stock, adjusted production scheduling. That plan only works if alternates were qualified before the crisis, which is why best-in-class programs maintain at least two approved sources for every critical ingredient.

Communicate the decision in writing, state the conditions for reinstatement, and require a root-cause corrective action with verification — usually a re-audit, not a promise. Suppliers that survive a suspension and return stronger often become the most reliable partners on the list. The ones that can’t explain what went wrong were never really suppliers; they were risks with invoices.