A second party audit at your supplier's site, following your material through the operation, ending in a risk verdict and an approval recommendation.
A supplier audit is a second party audit, carried out on your behalf at a supplier's site, against your own requirements or a recognised standard. It is used where certification does not cover what you need, where a material carries enough risk to justify seeing the operation, or where a customer or a standard requires you to audit certain suppliers directly. The output is a findings report, a risk verdict and an approval recommendation you can put on file.
The audit follows your material. A supplier can run a capable system and still handle your ingredient differently from the rest of its production, so a general assessment of the site answers a question you did not ask. Tracing the batch that becomes your material is what makes the verdict mean something.
A second party audit at the supplier's site, scoped around the material you buy, ending in an approval decision you can put on file and defend at your own audit.
An audit is the most expensive form of supplier assurance. It earns that cost in some situations and not in others, and the last row here is the one most businesses are in.
| Situation | What it means | What fits |
|---|---|---|
| Certification does not cover the material | A supplier holds a valid certificate whose scope excludes what you buy. The certificate is real and it evidences nothing about your material. | Audit, or change what you buy. |
| The supplier holds no recognised certification | Common with smaller suppliers, agricultural producers and specialist ingredients. Your own approval procedure has to provide the assurance instead. | Audit, usually on a defined cycle. |
| The material is high risk | Ready to eat components, allergen containing ingredients, materials with a history of adulteration or contamination. | Audit, regardless of certification held. |
| A customer or standard requires it | Some customer codes and some scheme clauses require direct audit of certain supplier categories. | Audit, to the protocol specified. |
| Performance has deteriorated | Rejections, complaints, out of specification results or a failed delivery pattern. | Audit, focused on the cause. |
| Documents alone answer the question | A certified supplier, low risk material, sound documentation and no performance concerns. | Document review is cheaper and sufficient. |
Scoped around the material you buy, with each area assessed at the depth that material requires.
Policy, HACCP or food safety plan, hazard analysis quality and the control measures relied on for your material.
Hygienic design, cleaning, pest control, personal hygiene, maintenance and utilities, at the level your material requires.
How the supplier approves and monitors its own suppliers, since your risk extends one step further back.
The steps producing your material, the controls at each, and the records proving they operated.
Segregation, changeover, cleaning validation and labelling, where relevant to what you buy.
A live trace exercise on your material, in both directions, with mass balance reconciliation.
Whether the material produced matches the specification you hold, checked against actual records.
Previous findings, complaints and how the supplier closed them, which predicts future performance well.
These eight are what turns a supplier audit programme into an expense with no risk reduction attached to it.
A standard questionnaire applied to every supplier, which tests general capability and never tests the specific material you buy. The audit passes and your risk is untouched.
Auditing the site without following the batch that becomes your ingredient. A supplier can run a good system and still handle your material differently from the rest.
Being walked through the areas the supplier chose. Audits that follow the material go where the material goes.
Your risk extends one step further back at minimum. A supplier with weak approval controls transmits that weakness into your material.
A findings list handed over with no recommendation. Your approval procedure needs a decision, and an audit that stops short of one leaves the hardest part undone.
The audit is done and the report sits with the person who commissioned it. At your own audit, the supplier file is what gets examined.
Findings raised at a supplier and never closed. It is worse than not auditing, because you have documented a known problem and left it.
Audit effort concentrated where relationships are comfortable. Risk classification should decide the schedule, and it frequently does not.
Written to go straight into your supplier file and stand up when your own auditor examines it.
| Element | What it holds |
|---|---|
| Findings register | Each finding with the requirement it fails, the objective evidence and a severity. |
| Material specific verdict | An assessment of the controls applying to your material, separate from general site capability. |
| Traceability result | The outcome of the live trace on your material, with timings and mass balance. |
| Risk verdict | A clear risk position on the supplier for the material in question. |
| Approval recommendation | Approve, approve with conditions, or do not approve, with the reasoning stated. |
| Conditions and timescales | Where approval is conditional, what has to change and by when. |
| Monitoring recommendation | How often this supplier should be reaudited, based on risk and on what was found. |
| File ready format | Written to go straight into your supplier file and stand up at your own audit. |
Manufacturers, processors, packers, brand owners and importers who have to demonstrate supplier control. It suits businesses without capacity to travel and audit themselves, and any operation where a material carries enough risk to justify seeing the site.
A supplier's certified scope does not cover the material you buy.
A key supplier holds no recognised certification.
You are approving a new supplier of a high risk material.
A customer code requires you to audit certain supplier categories.
Supplier performance has deteriorated and you need the cause.
Your supplier approval process has been raised as a finding.
You are sourcing from a new country and want the operation seen.
You have no capacity to travel and audit suppliers yourself.
You confirm the requirement set, the materials in scope, the audit duration and the language.
Existing supplier documentation is reviewed first, so site time addresses what documents cannot answer.
System, prerequisites, process control and allergen management are audited, following your material through the operation.
A live trace on your material in both directions, with mass balance reconciliation.
Findings are presented to the supplier before the report is issued, so factual errors are corrected on the spot.
The findings register, risk verdict and approval recommendation are issued to you, in file ready format.
The approval decision is yours. The audit provides the findings, the risk verdict and a recommendation, and your approval procedure governs what happens next.
Closing findings at the supplier is between you and them. Where you want support managing that, it is quoted separately.
Arranging supplier access and any confidentiality agreement sits with you, since the commercial relationship is yours.
Every audit is quoted against its own scope, with travel included in the figure. A one day audit an hour away and a two day audit in another country are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
A supplier audit is a second party audit carried out at a supplier's site on your behalf, against your own requirements or a recognised standard. It differs from a certification audit, which is carried out by an independent body against a published standard, and from an internal audit, which a business carries out on itself.
Frequently not. A valid certificate whose scope covers your material, supported by sound documentation and good performance, satisfies most approval requirements. Auditing becomes necessary where the certified scope excludes your material, where the supplier holds no recognised certification, where the material carries high risk, or where a customer or standard requires direct audit.
It is where a supplier holds a valid certificate, and the certified scope does not cover the material you buy from them. A site certified for ambient packing that also supplies you a frozen ingredient is a common example. The certificate looks valid in the file, and an auditor who reads the scope line will raise it.
On a schedule driven by risk classification, not by convenience. High risk materials and suppliers without recognised certification are audited most frequently. Low risk certified suppliers may need no audit at all. Your approval procedure should state the rationale, and that rationale is itself commonly audited.
Partly, and with limits. Documentation, records and management systems can be reviewed remotely. The things a supplier audit exists to establish, hygienic condition, actual practice and how your material is genuinely handled, need someone on site. Remote supplier audits have a place for low risk reassessment and they are a weaker instrument.
Whichever fits. Your own supplier requirements where you have them documented, a recognised standard such as BRCGS or IFS where you want that benchmark, or a customer protocol where one has been specified. The protocol is agreed before the audit and the report is written against it.
The audit assesses how the supplier approves and monitors its own suppliers, because your risk extends at least one step further back. Auditing those suppliers directly is a separate exercise and is sometimes warranted for high risk materials.
You receive a risk verdict and a recommendation, which may be approve with conditions or do not approve. Conditions come with what has to change and by when. The decision is yours, and the report gives you the basis for it and the record supporting it.
Most do, and the right to audit is usually built into supply agreements. Where a supplier refuses, that is itself information, and your approval procedure should have a route for it, whether that is alternative assurance, escalation or de listing.
Yes. Audits are carried out worldwide and travel is quoted with the work. Language is agreed beforehand, and the report is delivered in whichever language you need.
A document review assesses the files you already hold, remotely and at lower cost, and finds expired certificates, missing specifications and scope mismatches. A supplier audit goes to the site and tests what happens in practice. Most businesses should do the document review first, because it frequently answers the question.
A findings register with evidence and severity, a verdict specific to your material, the traceability result, a risk position, an approval recommendation with conditions where relevant, a reaudit frequency recommendation, and a report written to go straight into your supplier file.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
A review of how you approve and monitor suppliers, which is one of the most commonly failed clauses in every major standard.
Read about Supplier Approval System Review →A review of the documentation you hold for each supplier, checking it is current, complete and covers the material you buy.
Read about Supplier Document Review →A defensible risk classification across your supplier base, so monitoring effort goes where the hazard really is.
Read about Supplier Risk Classification →Certificated course covering approval systems, risk classification and supplier auditing.
View Certified Supplier Approval Specialist →Expert supplier approval programme consulting worldwide. Risk-based supplier tiering, verification activities, and approval programmes aligned with GFSI, FSMA, and...
See Supplier Approval Programme Consulting →Expert consulting for meeting retailer food safety and supplier requirements worldwide.
See Retailer Food Safety Standards Consulting →Tell us the supplier, the material and the protocol, and receive a written quote covering the scope, the duration, the travel and the price.