SQF supplier approval requirements: what the auditor samples

SQF asks you to prove three things about every supplier on your approved list: that you approved them against written criteria before you bought anything, that you have monitored them since, and that the evidence of both is current on the day of the audit. In Edition 9 this sits in clause 2.3.4, the approved supplier program. It requires a documented and implemented procedure for selecting, evaluating, approving and monitoring suppliers, a current record of approved suppliers, receiving inspections and supplier audits, and a program built on the supplier's past performance and the risk level of what they supply. The program itself has to name the agreed specifications, the risk level applied to each material or service, a summary of the supplier's food safety controls, how approved status is granted, the methods and frequency of monitoring, the certificates of conformance you require, and how often you review supplier performance and status.

What an auditor does with that is narrower than the clause sounds. Nobody reads 50 supplier files in a day. The auditor takes your approved supplier list, picks a handful of names weighted by risk, and traces each one back through those three records: the approval decision, the monitoring since, and the certificate on file with its date and its scope. A gap in any one of the three, on a sampled supplier, is a finding. Under Edition 10 the approved supplier program is one of nine Core Clauses, where a minor non-conformance costs 2 points instead of 1 and a major costs 7 instead of 5, so the same gap you could absorb before now costs more. Edition 10 was published in March 2026 and audits against it begin on 2 January 2027, with no mixing of editions in a single audit.

The three records, and what current means in each

The approval record

This is a dated decision made before the first delivery. In practice it is a completed supplier questionnaire, a signed specification, a risk rating with the reasoning attached, and a name against the approval. Where risk is high, it also includes a third party audit result or a GFSI recognised certificate, or your own supplier audit conducted by someone trained to do it.

The failure mode here is not a missing file, it is a file that was clearly built last week. If 50 approval records carry dates inside the same month and the plant has been running for six years, the auditor reads that as a document exercise rather than a program. There is no fixing that in the final fortnight. What you can do is stop adding to the problem: approve the next supplier properly, on the date you actually approve them.

The monitoring evidence

Monitoring is the half that plants lose. Your program states a method and a frequency. The auditor's question is simply whether you did it at the frequency you wrote down. If you said you review low-risk suppliers annually, they will ask for the last two reviews. If you said CoA on every lot for the allergen-bearing ingredients, they will take three delivery dates off a receiving record and ask for the three CoAs.

Evidence of the chase counts as monitoring evidence, which QA managers consistently undervalue. A dated record that you asked a supplier for a renewal on a particular day, who you asked, and whether the request was delivered, is proof the program was operating between audits. A certificate that simply appeared in a folder proves only that a document exists. If your record of chasing lives in a sent-items folder that nobody can search in front of an auditor, you have the activity and not the evidence.

The certificate currency check

Four things get checked on a certificate, and only the first is the one people worry about. The expiry date, the scope, the certification body, and whether the scope actually covers the product you buy. A current GFSI certificate for a supplier's cold-filled line does not cover the ambient product you take from them. An auditor who notices that has found something more interesting than a lapsed date.

The subtler problem is the certificate that expired three weeks ago while the supplier's recertification audit is booked for next month. An SQF certificate runs 12 months, so there is a renewal event in every supplier relationship every year, and renewal audits slip. The plant's position is not that the gap never happens, it is that the gap is visible, dated, chased and risk-assessed in writing. A documented decision to keep receiving from a supplier whose certificate lapsed by 11 days, with the evidence of the chase attached, is defensible. Silence is not.

Then there is the category of document with no printed expiry at all. Allergen declarations and vendor questionnaires often carry only the date they were signed. Auditors still ask for an updated allergen statement, and "it has no expiry" is not an answer. Pick a review period per document type, three years from the date on the form is a common house rule, write it into your approved supplier procedure, and apply it the same way to all 50 suppliers.

How an auditor samples a 50-supplier plant

There is no sample size written into the code. What there is, instead, is a time budget. Supplier approval gets a slice of the document review, perhaps 45 minutes to an hour on a single-site audit, and that slice buys a handful of names, somewhere in the region of five to ten on a 50-supplier plant. The pattern of which names is far more predictable than the count.

• The highest-risk materials. Allergen-bearing ingredients, anything going into a ready-to-eat product, anything carrying a label claim you cannot verify yourself.
• The newest supplier. Anyone added since the last audit, because that is where the approval process gets tested rather than inherited.
• Any non-approved receipt. If the records show an emergency receipt from an unapproved supplier, the auditor will want the receiving inspection or analysis that was conducted and recorded before use, plus the reason it was an emergency.
• Service providers. Pest control, laundry, sanitation chemicals, calibration, transport, external storage, co-packers. Services belong in the approved supplier program and they are the most common omission.
• One name picked off the floor. An ingredient label in a storage bay, a pallet note, a line on a receiving log, back-traced into your approved supplier list. This is the unbiased pick and it is the one that finds incomplete lists.

Two of those five are selected from outside your list rather than from it, which is the thing to take away. A tidy list of 50 does not help if the sixth name the auditor reads off a drum is not on it. Add the previous audit's finding to the sample as well, because a repeat of a closed non-conformance is read as a corrective action that did not hold.

Where 50-supplier plants actually lose points

The low-risk tail. Ten high-risk suppliers get attention all year. The other 40 get whatever your written review frequency says, and that frequency applies to them too. If the procedure says every supplier is reviewed annually and 38 of them have not been touched since the last recertification, the procedure is the non-conformance.

Broker and trader mismatches. The certificate names a manufacturing site; your purchase order names an agent. Unless the approval record connects the two, the auditor cannot tell whether the document you hold describes the business you buy from.

Expiry clustering. Certificates collected in a single pre-audit push tend to expire in a single month roughly a year later, usually the month you are busy with something else. Four lapses at once looks systemic rather than unlucky.

Superseded documents. When a renewal arrives and replaces the old file in place, you cannot answer "show me the declaration that was valid in March". Keep the previous version, dated, somewhere you can retrieve it.

The four weeks before

1. Reconcile the approved supplier list against the last quarter of goods-in records and the service contracts the plant pays. Add what is missing before someone else finds it.
2. Sort every certificate by expiry date and work the next 90 days first. Anything already lapsed needs a dated chase today and a written risk decision if receipts continue.
3. Pick your own sample, five names across the risk bands, and run the auditor's trace on each: approval record, monitoring evidence, certificate with scope checked. Whatever breaks on your five will break on theirs.
4. Check the review frequencies you committed to in writing, and either produce the evidence or amend the procedure to a frequency you will actually meet. Amending it is honest; failing it is a finding.

If you are planning backwards from a recertification date rather than forwards from today, our post on how many months out to start on supplier certificates sets the timeline out in order.

What a tracking system does, and what it does not

Certly is a certificate tracking and reminder system, and it is worth being exact about the boundary. When it launches, it holds a supplier database with the required certificate types per supplier, allergen declaration, CoA and audit certificate, stores the documents against the supplier and type, and shows one screen with every certificate as current, expiring soon, expired or missing, which exports to PDF in the same four status badges an auditor sees on screen. Expiry tracking runs against configurable thresholds at 90, 60 and 30 days, and the thresholds are editable per certificate type or as a plant-wide default, because an allergen declaration and a GFSI certificate do not deserve the same warning window. For documents with no printed expiry, it is built to let you record the issue date and derive the due date from a renewal period you set for that document type.

The monitoring evidence side is the part that matters for clause 2.3.4. Chase emails to supplier contacts are logged per send with their delivery status, sent, failed or opened, and carry a single-use expiring upload link so the supplier can return the document without an account. There is a chase-now action on each row when you want to put a dated request on the record immediately rather than wait for a threshold. That log is the thing you show when an auditor asks what you did between audits.

What it does not do is verify that a certificate is genuine, confirm that its scope covers your product, or guarantee that you comply with anything. A disclaimer saying exactly that sits on the dashboard and on the PDF export, and it is there because the judgement calls stay with you. The system tracks dates and reminds people; reading the scope line on a certificate is still QA work. Data stays scoped to a single plant on every query, and supplier contact names and emails can be erased on request, which is the GDPR hygiene you want when the documents you store carry other people's names on them.