A supplier list isn't a programme. We build the risk-based tiering, verification activities, and documented workflow that turns your supplier relationships into a defensible, auditable system, aligned with GFSI, FSMA, and FSVP requirements.
A supplier approval programme is the documented system for evaluating, approving, and continuously monitoring the suppliers a food business sources from, covering raw materials, ingredients, packaging, and processing aids.
The distinction between a supplier list and a supplier approval programme is the one auditors care about most. A list tells you who you buy from. A programme tells you why each supplier is approved, what level of verification applies to them, who decided that, and what evidence shows the verification happens on the schedule the programme describes. A list without that structure behind it is one of the more common findings in GFSI audits, even when the list itself looks complete and well organised.
The regulatory foundation goes back to the Codex Alimentarius General Principles of Food Hygiene, which establish supplier controls as a core prerequisite programme requirement. FSMA's preventive controls rules require food manufacturers to control supplier-sourced hazards as part of their hazard analysis, and every GFSI-benchmarked scheme, SQF, BRCGS, FSSC 22000, and others, has specific clauses an auditor will check the programme against directly.
What makes supplier approval distinct from a one-time vetting exercise is that it has to keep working after a supplier is first approved. Certifications expire, ownership changes, non-conformances happen, and ingredient risk profiles shift. A programme that only operates at the point of first approval, and never again, isn't a programme an auditor will accept, regardless of how thorough that first approval was.
Each component connects to the next. Tiering determines verification, verification produces evidence, and evidence supports the approval decision and its review.
Grouping suppliers and materials into tiers based on inherent material risk, certification status, country of origin, and history, so verification effort scales with risk.
Defined criteria for what a supplier needs to demonstrate, certification, documentation, audit results, before being approved at a given tier.
The specific activities, certificate review, questionnaires, audits, testing, assigned to each tier, with defined frequency and responsibility.
Tracking certification expiry, non-conformances, and incident reports for approved suppliers between formal reviews.
A defined cycle and trigger events for revisiting a supplier's tier and approval status, not a one-time decision.
Records showing the programme operates as designed: who approved what, when, against which criteria, and what verification evidence supports it.
These six components are deliberately presented as a cycle and not a checklist, because the most common audit findings happen at the seams between them, a tier that exists on paper but doesn't drive any actual verification difference, or verification activities that are defined but not evidenced, or an approval that's never revisited regardless of what happens afterward. A programme that an auditor can follow end to end, from supplier, to tier, to required activity, to evidence, to review, is what distinguishes a defensible programme from a list with extra paperwork attached.
The federal compliance date moved, but the practical pressure on supplier programmes hasn't gone away, and in some cases has already arrived ahead of the federal timeline.
FDA's Food Traceability Rule (FSMA 204) originally required compliance by January 20, 2026. Following a 30-month extension confirmed through the Continuing Appropriations Act of 2026, enforcement now begins July 20, 2028. That extension addresses the federal enforcement date only. It does not remove the underlying requirements, and it has not paused retailer-driven supplier traceability programmes, several major US retailers and foodservice distributors built their own supplier traceability requirements toward the original 2026 timeline and have not reversed course.
FSMA 204 federal enforcement date, extended by 30 months following industry feedback on readiness.
Major retailer supplier-traceability and data requirements are already operational, independent of the federal date.
Foreign Supplier Verification Programme requirements for importers continue to apply regardless of FSMA 204 timing.
For a business supplying into retail or foodservice, the practical framing is that the federal date is the floor and retailer requirements are increasingly the ceiling. Where a retailer's vendor portal already requires specific supplier data, advance shipping notices with key data elements, standardised case and pallet labelling, that requirement is live now, with commercial consequences, regardless of what the federal enforcement calendar says. A supplier approval programme that treats 2028 as the relevant date risks being out of step with the requirements your customers are already applying.
Separately, 2026 has also seen increased regulatory attention to ingredient sourcing more broadly, including GRAS reform proposals and new scrutiny of food additives, which tends to increase the documentation buyers expect from suppliers around ingredient sourcing and substantiation. None of this changes the core structure of a supplier approval programme, but it does mean the bar for what "verification" needs to capture is moving upward, and a programme designed only to satisfy the minimum GFSI clause wording may need to capture more than it currently does.
Supplier approval is relevant to any business sourcing raw materials, ingredients, or packaging, whether building a programme for the first time or fixing one that isn't holding up at audit.
Operations with an approved supplier list that lacks documented tiering criteria, defined verification activities, or evidence those activities occur.
Operations pursuing SQF, BRCGS, FSSC 22000, or other GFSI-recognised certification that need a documented supplier approval programme in place before audit.
Operations importing food into the US that need their internal supplier programme coordinated with FSVP requirements without duplicating effort.
Operations whose food fraud vulnerability assessment or food defence assessment identified supplier-level risks not yet reflected in supplier tiers.
Operations adding new suppliers, regions, or material categories whose existing programme wasn't designed to scale to the new sourcing footprint.
Operations that have received the same supplier-related non-conformance more than once and need the underlying programme fixed, beyond the immediate finding.
The process follows a defined sequence. Our part of the process typically takes 1 to 2 weeks.
| Stage | What happens | Our role | Duration |
|---|---|---|---|
| 1. Supplier and material inventory | Every supplier and material in scope is listed, covering raw materials, ingredients, packaging, and processing aids. | We compile the full inventory with your team. | 1 to 2 days |
| 2. Risk-based tiering design | Suppliers and materials are grouped into tiers based on inherent risk, certification status, origin, and history. | We design the tiering model and apply it to your supplier base. | 3 to 5 days |
| 3. Verification activity matrix | Verification activities, certificate review, questionnaires, audits, testing, are defined for each tier with frequency and responsibility. | We design the verification activity matrix. | 2 to 3 days |
| 4. Approval workflow design | The decision process for approving a new supplier, including who reviews what and what's recorded, is documented. | We design the approval workflow and templates. | 1 to 2 days |
| 5. Monitoring and re-approval cycle | A schedule and trigger events for ongoing monitoring, certification expiry tracking, and re-approval are defined. | We design the monitoring and review cycle. | 1 to 2 days |
| 6. FFVA/TACCP alignment | Where food fraud or food defence assessments exist, their findings are reflected in relevant supplier tiers. | We align supplier tiers with existing FFVA/TACCP findings. | 1 to 2 days |
| 7. FSVP coordination | For importers, the internal programme is coordinated with FSVP requirements to avoid gaps or duplication. | We map internal verification against FSVP requirements. | 2 to 3 days |
| 8. Documentation and rollout | The programme is documented as a maintained component of the food safety management system, and the team is onboarded. | We produce the documentation and support rollout. | 2 to 4 weeks, run alongside operations |
We cover the full scope of supplier approval programme development, from first design through to ongoing alignment with other risk assessments.
A review of existing supplier approval documentation against GFSI scheme requirements, FSMA supply chain programme requirements, and FSVP where relevant.
Design of a tiering model that groups suppliers and materials by risk and scales verification activity accordingly.
Design of the specific verification activities, certificate review, questionnaires, audits, testing, assigned to each tier with defined frequency.
Documentation of the approval decision process, including templates for supplier evaluation and approval records.
Design of the ongoing monitoring process and re-approval schedule, including trigger events for out-of-cycle review.
Alignment of supplier tiers and verification activities with findings from food fraud vulnerability assessments and food defence assessments.
Coordination of internal supplier verification with Foreign Supplier Verification Programme requirements for importers.
Review of supplier approval practices across multiple sites to identify and address inconsistent tiering or verification.
Documentation of the supplier approval programme as a maintained, auditable component of the food safety management system.
A supplier approval programme is only as reliable as the people running it day to day, deciding which tier a new supplier sits in, recognising when a certificate has lapsed, and knowing when an incident should trigger an out-of-cycle review. Training that builds genuine understanding of risk-based tiering and verification requirements, beyond a written procedure nobody has read, is one of the most direct ways to keep a programme operating as designed between audits. We recommend pairing this consulting programme with our supplier approval training course, and can advise on the right approach during the initial consultation.
Our gap assessment checks whether your programme would survive being followed end to end by an auditor, beyond whether the list looks complete.
The assessment reviews existing supplier approval documentation against GFSI scheme requirements, FSMA supply chain programme requirements, and FSVP where relevant, checking whether every supplier and material in scope is captured, whether tiering criteria are documented and consistently applied, whether the verification activities assigned to each tier are being completed and recorded as described, and whether approval and re-approval decisions are documented with a clear rationale.
Where you also have an FFVA or TACCP assessment, we check whether their findings about specific suppliers or materials are reflected in that supplier's tier and verification requirements, since this is one of the most common disconnects we see.
We confirm every supplier and material in scope is captured in the programme.
We check whether tiering criteria are documented and consistently applied across the supplier base.
We confirm whether defined verification activities are being completed and recorded as described.
We produce a written gap assessment with a prioritised action plan.
If you also need a full tiering model or verification matrix built from scratch, we can scope both together so the gap assessment findings feed directly into the new design.
The same gaps appear across supplier approval reviews regardless of sector. Knowing where these gaps cluster is the most effective preparation.
An approved supplier list exists, but no documented criteria explain why each supplier sits where it does, or what verification applies to them and why.
Verification activities are written into the programme, but records don't show they're completed on the schedule the programme describes.
A supplier's certification status is verified at initial approval and never checked again, so an expired or downgraded certificate goes unnoticed.
New suppliers are added by procurement outside the formal approval process, bypassing the tiering and verification steps entirely.
Re-approval or periodic review has no defined frequency or trigger events, so reviews happen inconsistently or not at all.
A food fraud or food defence assessment identifies supplier-level risk, but that finding never changes the supplier's tier or verification requirements.
An illustration of how verification activity scales with risk tier. Exact criteria and activities are defined for your specific supplier base and materials.
| Tier | Typical materials | Approval basis | Ongoing verification |
|---|---|---|---|
| Low risk | Non-food-contact packaging, low-risk processing aids | Certificate of conformance, basic questionnaire | Periodic certificate refresh |
| Medium risk | Food-contact packaging, stable commodity ingredients | GFSI certification or equivalent, supplier questionnaire | Annual certification check, periodic COA review |
| High risk | High-risk ingredients, FFVA-flagged commodities | GFSI certification, on-site or remote audit, FFVA review | Annual audit, COA on every lot, periodic testing |
| Our consulting | Supplier Approval Programme Consulting: tiering, verification matrix, and documentation for every level | ||
What drives the timeline and cost of a supplier approval programme project. We provide a written proposal with a fixed fee after the initial consultation.
Timeline
How long our consulting work takes
Cost factors
What drives the consulting fee
No existing documented programme. Our consulting work, from scoping to documented programme, typically takes 1 to 2 weeks.
Review of an existing programme against current requirements. Typically 2 to 3 days.
Onboarding the team to a new or revised programme, run alongside operations, typically 2 to 4 weeks.
A larger or more diverse supplier base requires more tiering and verification matrix design time.
Additional scope for importers needing internal verification mapped against FSVP requirements.
Additional scope where existing food fraud or food defence assessments need to be reflected in supplier tiers.
For businesses with multiple sites, consistency review across sites is scoped as part of the same engagement.
A gap assessment only, a full programme build, or ongoing review support each carry different fees. All scopes are defined in writing before work begins.
Answers to the questions we hear most often from businesses building or reviewing supplier approval programmes.
A supplier approval programme is the documented system a food business uses to evaluate, approve, and continuously monitor the suppliers it sources raw materials, ingredients, and packaging from. It sets out which suppliers are in scope, what evaluation and verification activities apply to each, who is responsible for approving and reviewing suppliers, and what records demonstrate the programme operates as designed. The Codex Alimentarius General Principles of Food Hygiene establish supplier controls as a core prerequisite programme requirement, and FSMA and GFSI-benchmarked schemes including SQF, BRCGS, and FSSC 22000 each have specific clauses auditors verify against.
A supplier list is simply a record of who you buy from. A supplier approval programme is the system behind that list: documented risk-based tiering, defined verification activities for each tier, an approval decision process, ongoing monitoring, and a re-approval or review cycle. Auditors evaluate the programme behind the list, not the list alone. A list without a documented programme behind it, criteria for approval, evidence of risk-based verification, and records of ongoing monitoring, is a common audit finding, even where the list itself looks complete.
Risk-based supplier tiering groups suppliers and materials into categories, typically three to four tiers, based on the food safety risk they present, considering factors such as the inherent risk of the material, the supplier's certification status, country of origin, history of non-conformances, and whether the material appears in your hazard analysis or food fraud vulnerability assessment as a significant risk. Each tier carries a defined set of verification activities. A low-risk packaging supplier with a strong certification history might require only certificate of conformance review at intervals, while a high-risk ingredient supplier might require an annual on-site audit, certificate of analysis review on every lot, and periodic independent testing. Tiering is the mechanism that lets verification effort scale with risk instead of being applied uniformly.
Common verification activities include reviewing a supplier's food safety certification, GFSI-recognised certification such as SQF, BRCGS, FSSC 22000, or equivalent, reviewing certificates of analysis or conformance for incoming materials, conducting supplier questionnaires or self-assessment forms, performing on-site or remote audits at a frequency matched to risk tier, reviewing the supplier's own non-conformance and corrective action history, and for higher-risk materials, periodic independent or third-party testing. Which combination applies to a given supplier depends on the tier it sits in, and the programme documentation needs to show that link explicitly.
Under FSMA's preventive controls requirements (21 CFR Part 117 Subpart G), US food manufacturers must implement a supply chain programme for any hazard that is controlled by a supplier and not at the manufacturer's own facility. If you import food into the United States, the Foreign Supplier Verification Programme (FSVP), under 21 CFR Part 1 Subpart L, creates a separate, legally binding layer of requirements: importers must conduct a hazard analysis for each imported food, evaluate the foreign supplier's performance and food safety practices, and conduct verification activities appropriate to the hazards identified. FSVP and an internal supplier approval programme are related but distinct, and both need to be coordinated so verification activity isn't duplicated or, more importantly, isn't missing for either purpose.
A food fraud vulnerability assessment (FFVA) identifies which ingredients and suppliers present food fraud vulnerability and at what level, and the supplier approval programme is where that vulnerability translates into actual controls: which suppliers need fraud-specific risk assessment, authenticity testing, or batch-level verification, and at what frequency. Similarly, where a TACCP assessment identifies supply chain access points relevant to food defence, supplier approval criteria can include security-related requirements for higher-risk suppliers. Supplier approval is, in effect, the operational layer where FFVA and food defence findings, alongside standard food safety risk, all come together into one coordinated set of supplier requirements.
A supplier approval gap assessment reviews your existing programme against GFSI scheme requirements, FSMA supply chain programme requirements, and FSVP where relevant, checking whether every supplier in scope is captured, whether your tiering criteria are documented and consistently applied, whether the verification activities assigned to each tier are being completed and recorded as described, whether approval and re-approval decisions are documented with a clear rationale, and whether the programme reflects current information, certification status, audit history, recent non-conformances, not information from when a supplier was first approved.
The most common gaps are: a supplier list exists but no documented tiering criteria explain why each supplier sits where it does. Verification activities are defined on paper but records don't show they're completed on the schedule the programme describes. Certification status for approved suppliers is checked once at approval and never revisited, so an expired certificate goes unnoticed. New suppliers are added informally by procurement without going through the approval process. Re-approval or periodic review has no defined trigger or frequency. FFVA or TACCP findings about specific suppliers aren't reflected in that supplier's tier or verification requirements.
Review frequency should be tied to risk tier and not a single fixed schedule. High-risk suppliers are typically reviewed annually at minimum, including certification status, audit history, and any non-conformances, while lower-risk suppliers might be reviewed every one to three years. Beyond the scheduled cycle, specific events should trigger an out-of-cycle review: a certification lapse or downgrade, a recall or significant non-conformance traced to that supplier, a change in the material's risk profile flagged by horizon scanning or an FFVA update, or a change in the supplier's ownership, site, or country of origin.
Our consulting work moves fast. For a business without an existing documented programme, designing the tiering model, approval workflow, and verification activity matrix typically takes 1 to 2 weeks, depending on the size and diversity of the supplier base. For businesses with an existing programme needing review, a gap assessment typically takes 2 to 3 days. Implementing the resulting documentation and onboarding the team to the new workflow typically takes a further 2 to 4 weeks, run in parallel with day-to-day operations.
Yes. Tiering model design, approval workflow design, verification activity programme design, and documentation are all available remotely, since they primarily involve reviewing supplier and material information against risk criteria and scheme requirements. Where on-site supplier audits are part of your verification activity for high-risk tiers, those are coordinated separately and are not part of this consulting engagement. We work with clients worldwide.
You can commission any of these on their own, with an agreed scope and a written quote, without taking on ongoing consulting. See all food safety services.
Where approval keeps failing at audit.
Read about A supplier approval system review →To check what your supplier files evidence in practice.
Read about A supplier document review →To put monitoring effort where the hazard is.
Read about Supplier risk classification →Where a material carries enough risk to justify seeing the site.
Read about A supplier audit →Tell us about your supplier base, your current documentation, and which certification you're working toward. We will tell you exactly where your programme stands today.