Supplier Qualification Audits for Food Manufacturers: What to Verify Beyond the COA

Most food manufacturers have lived through it. A supplier's lot ships with a clean Certificate of Analysis (COA), production runs, and a recall lands weeks later from another customer using the same batch. A supplier qualification audit catches what the COA can't: the system, the controls, and the paper trail back to the grower. The guide below walks through tiering, on-floor checks, mock recall testing, and re-qualification.

How to Tier Your Approved Supplier List

Most food manufacturers split their approved supplier list (ASL) into two or three tiers. The tier sets audit frequency, paperwork depth, and the volume share each supplier can fulfill. Most QA teams operate under one GFSI (Global Food Safety Initiative) aligned framework. The table below shows the typical qualification floor for each tier.

Tier 1 Suppliers Carry Full Volume

A Tier 1 supplier is the anchor of your category demand. Holds a current GFSI-recognized certification, passes an on-site audit within 12 months, and clears a mock recall in four hours with full reconciliation. Carries no open critical findings. Such suppliers can typically fulfill the full category demand without volume caps.

Tier 2 Suppliers Work with Volume Limits

A Tier 2 supplier passes baseline checks but with conditions attached. Holds a baseline food safety certification or has cleared a remote audit only. Open critical findings are tolerated when an active CAPA (Corrective Action and Preventive Action) plan and closure date are on file. Volume share is typically capped at 25 to 40 percent of category demand.

Tier 3 Stays on Trial or Recovery

A Tier 3 supplier is on probation. Covers new suppliers, smaller suppliers without certification, or recovery suppliers under remediation. Limited volume. Frequent QA review. Short-term contracts only, with movement to Tier 2 contingent on twelve months of clean audits.

What an Audit Actually Checks on the Floor

A solid supplier audit covers three layers. The floor where the work happens. The inputs that go into every lot. The paperwork that proves the first two work as designed. Each layer needs to be sampled in person and against records, not just reviewed at a desk.

Walking the Floor for Sanitation and Process Control

Auditors look at how the facility runs day to day. The focus areas include:

• Building condition and pest-control logs from the last 12 months

• Sanitation schedule with verification swabs

• Water and air quality records

• HACCP (Hazard Analysis and Critical Control Points) plan with deviation logs

Critical control point monitoring should be visible during the walk, with corrective action logs for any deviation found.

Tracking Allergens and Raw Material Inputs

Allergen and input control sit at the center of audit risk. Ask for the ingredient flow map, equipment shared across allergens, validated cleaning protocols between allergen and non-allergen runs, and segregation in receiving and storage. For internationally sourced ingredients, FSVP (Foreign Supplier Verification Program) documentation is required under FSMA (Food Safety Modernization Act). For high-allergen categories like nuts or seeds, expect closer scrutiny on changeover validation.

Reading the Paper Trail and Training Logs

Documentation closes the gap between policy and practice. A supplier's SOP (Standard Operating Procedure) versioning, internal audit reports, third-party audit findings, and GMP (Good Manufacturing Practice) training records all sit in this layer. A PCQI (Preventive Controls Qualified Individual) should be on staff and named in the food safety plan. A supplier passing on paper and failing the on-site walk is a common audit finding in food manufacturing.

The Mock Recall Test That Tells You Everything

Mock recall is where audit performance gets stress-tested. The exercise checks whether a supplier can identify a contaminated lot, trace its inputs back to the grower, and contact every downstream customer that received it. A four-hour mock recall with full reconciliation is a widely cited GFSI benchmark for Tier 1 status.

The Four-Hour Benchmark

Four hours, 100 percent of product accounted for. A supplier missing either side of that benchmark may drop out of Tier 1, regardless of certification. Worth asking for the most recent live drill, not just a paper exercise. Some QA teams require an unannounced mock recall as part of annual re-qualification.

What a Solid Recall Report Should Show

A mock recall report tells you what the supplier can actually do under pressure. The report should include:

• The lot number selected and the rationale for the selection

• Time elapsed from start to identification of all inputs and outputs

• Percentage of finished product reconciled, with a target of 100 percent

• Corrective actions for any gaps

The supporting chain should connect the grower lot, inbound transport, warehouse receipt, production batch, finished good lot, bill of lading, and customer purchase order.

When to Re-Qualify Your Suppliers

Suppliers don't qualify once and forever. Annual re-qualification is the standard baseline under GFSI-aligned programs and FSMA preventive controls rules. The depth of each re-qualification scales with ingredient risk.

The Annual Baseline

Annual re-qualification refreshes the standard documents. Covers the GFSI certification, third-party audit findings, insurance, and the supplier's recent QA history. High-risk categories like raw animal proteins, fresh produce, and allergen-bearing materials often warrant a 6-month review instead of the annual cycle.

Trigger Events That Reset the Clock

Some events override the calendar and force a fresh on-site audit. The most common ones include:

• Change in supplier ownership or facility

• Loss or downgrade of a food safety certification

• Two or more out-of-spec lots in a rolling 12 months

• Customer complaint or recall involving a shared supplier

• Major change in the supplier's process, ingredient source, or co-packer

Re-qualification scope ranges from a documentation refresh to a full on-site audit, depending on the trigger.

Wrapping Up

A supplier audit covers what the COA can't. The system, the controls, the recall capability, and the document chain from grower to delivery. A clean COA confirms one lot. A clean audit confirms the supplier behind it.

Need bulk ingredients with audit-ready documentation? Contact Global Resources Direct for same-day quotes, competitive pricing, and flexible minimums across 500+ food ingredients.

Frequently Asked Questions

What audit elements separate a Tier 1 from a Tier 2 supplier?

A Tier 1 supplier carries a current GFSI certification, a recent on-site audit, a four-hour mock recall, and no open critical findings. Tier 2 has a baseline cert or remote audit only, with volume typically capped at 25 to 40 percent.

How do you verify an allergen control program during an audit?

Ask for the allergen flow map, validated cleaning protocols, swab and ATP (adenosine triphosphate) test results from changeovers, and operator training logs. On-site, watch a real changeover or review the records of one.

What proves a supplier can run a real mock recall?

A recent mock recall report showing lot selected, time elapsed, percentage reconciled (target 100 percent), and corrective actions. The chain behind it should include transport records, warehouse receipts, batch sheets, and bills of lading.

How often should manufacturers re-qualify suppliers?

Annual re-qualification is the standard baseline. High-risk categories may justify a 6-month review. Trigger events like ownership change or two out-of-spec lots in 12 months reset the cycle.

What baseline documents should a new supplier provide?

A current GFSI or equivalent food safety certificate, recent third-party audit report, spec sheet, and COA template, allergen statement, relevant kosher or halal certs, and a certificate of insurance. International sourcing also calls for FSVP records.

How is auditing a broker different from auditing a direct manufacturer?

For a broker or distributor, check what they directly control (warehouse handling, allergen segregation, lot tracking), then audit upstream into how they qualify the manufacturers behind them. A distributor without an upstream audit trail typically caps at Tier 2.