An approved supplier list records which suppliers you've checked and allowed to supply each ingredient or packaging item, why you approved them, what documents you hold, how you check their deliveries, and when you'll review them again. Its rule is simple: buy only from suppliers on the list, and treat a new supplier as unapproved until it's been checked. For a small maker it's the start of controlling what comes in the door, and it answers a question buyers and auditors ask early: how do you know your ingredients are what they should be? In the example below, a kitchen's list has three approved suppliers, one conditional supplier buying with extra checks until its specification sheet arrives, and one that hasn't been approved yet, so its sugar can't be bought. Below is what to record, how to approve a supplier, the questions to ask, the rules for food facilities, and a free template.
The short version
- List each supplier with what it supplies and its status: approved, conditional or not approved.
- Record why it was approved: a questionnaire, a certificate, an audit, a tested first lot.
- Keep the documents: specification sheets, allergen statements, insurance, a recall contact.
- Decide how each supplier's deliveries are checked: a lot on every receipt, a certificate with every lot.
- Review each supplier on a schedule, and when something goes wrong.
- Buy only from approved suppliers; conditional ones come with extra checks.
- TaroStack keeps suppliers' details, a preferred supplier per item, and checks on every receipt. More below.
What to record for each supplier
| Column | Example |
|---|---|
| Supplier and what it supplies | Pacific Oils: frying oil |
| Status | Approved, conditional, or not approved |
| Approved on, and because | March 9: questionnaire, and a certificate of analysis with each lot |
| Documents on file | Specification sheet, allergen statement, insurance certificate |
| How deliveries are checked | Certificate of analysis checked against the spec, every lot |
| Next review | March 9 next year |
The example list
Windward Roots, the made-up taro business I use in these examples:
| Supplier | Supplies | Status | Approved because | How it's checked | Next review |
|---|---|---|---|---|---|
| Island Foods Supply | Coconut milk | Approved | Questionnaire; audit certificate | Lot on every receipt | Mar 2 |
| Pacific Oils | Frying oil | Approved | Questionnaire; COA each lot | COA every lot | Mar 9 |
| Kahuku Farm | Taro | Approved | Questionnaire; farm visit | Look at each delivery | Oct 20 |
| Sea Salt Co | Sea salt | Conditional | Questionnaire; first lot tested | COA every lot until the spec arrives | Dec 1 |
| Valley Sugar | Brown sugar | Not approved | Questionnaire sent | Don't buy until approved |
The farm's six-month review is due next week, and Valley Sugar's questionnaire is still out, so brown sugar stays with the current supplier until it's back and checked. How certificates of analysis are kept and checked is in certificate of analysis tracking, and how suppliers are scored once they're approved is in supplier scorecard.
How to approve a supplier
- Send the questionnaire and ask for the documents: specification sheets, an allergen statement, a certificate of insurance, a recall contact.
- Decide what evidence the risk calls for. Salt from a known packer needs less than a raw ingredient that could carry a hazard into your product.
- Check the first lot against the specification, by eye, by a test, or by its certificate of analysis.
- Record the decision: approved, conditional with the extra checks spelled out, or not approved.
- Set the review date, and review sooner after a problem, a recall or a change of site.
The questions to ask
| Ask | Why |
|---|---|
| Who do we call about quality or a recall? | A name and number before you need it |
| What certifications or audits do you hold? | Evidence someone independent has looked |
| Which major allergens are handled at your site? | Cross-contact risk for your labels |
| Is the lot code on every case? | Without it, your traceability stops at their door |
| Can you send a certificate of analysis with each lot? | Proof each lot meets the spec |
| Do you have a written recall plan? When was the last mock recall? | How fast they'd tell you |
| How will you tell us about a change to the product or site? | Changes are where problems start |
| What are your lead times and minimums? | So the approval fits how you buy |
The rules, for a registered food facility
If your food safety plan identifies a hazard in an ingredient that the supplier controls, FDA's preventive controls rule asks for a risk-based supply-chain program for that ingredient (21 CFR 117.405). The program includes using approved suppliers and verifying them, by onsite audits, sampling and testing, reviewing their food safety records or other activities that fit the risk (21 CFR 117.410). Suppliers are approved, and the approval documented, before you receive from them, and written receiving procedures make sure ingredients come only from approved suppliers (21 CFR 117.420). A qualified facility is exempt from that part of the rule (21 CFR 117.5); whether you are one is in FSMA requirements for small food businesses. An approved supplier list is good practice either way, and buyers often ask for it. This is general information, not legal advice.
Get the template
Download the approved supplier list and questionnaire. The list sheet records each supplier's status, approval, documents, checks and next review, and flags reviews that are due; the questionnaire sheet has the questions to send a new supplier. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
The list is a spreadsheet; the buying is a phone call. When the usual oil runs out on a Friday, someone buys a case from the store down the road, and nobody checks the list. The certificate of analysis that should come with every lot of salt arrives with some lots and not others, and nobody notices which, because the delivery was put away before anyone looked.
How TaroStack does it
TaroStack keeps each supplier's details with the buying and receiving, so the approved supplier is the easy one to use.
Suppliers and who supplies what. Each supplier carries its lead times, payment terms, minimum orders and contacts, with its price list, and each item has a preferred supplier, so a purchase order goes to the right one by default.
Checks on every receipt. Receipts can carry your own checks, like "certificate of analysis received and within spec" or a delivery temperature, and receiving records the supplier's lot and dates; scanning a supplier's GS1-128 case label fills them in. A setting can put every delivery into quarantine on receipt until it's checked, so nothing gets used before its paperwork is right.
And the trace back to the supplier. Recording a batch notes which supplier lots were used automatically, so if a supplier recalls a lot, or a review finds a problem, one report shows every batch and customer it reached. TaroStack also compares what each supplier promises with how long deliveries really take, and a price-creep report shows who's raising prices.
| The job | Spreadsheet | In TaroStack |
|---|---|---|
| Who supplies this item? | The list, if anyone checks | The item's preferred supplier, on the PO |
| COA with this lot? | Noticed, or not | A check on the receipt |
| Use before it's checked? | Easy | Quarantine on receipt until released |
| A supplier's recall | Which batches? Unknown | One report, supplier lot to customer |
Suppliers, purchase orders, receiving with checks, quarantine and lots are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.