Approved supplier list: what belongs on it and how auditors sample it
An approved supplier list is the controlled record of every supplier your plant has assessed and cleared to supply, together with the evidence that justified each approval. This page defines the term, then sets out what belongs in each row, how an auditor samples the evidence behind it, and what keeps that evidence current between audits.
What an approved supplier list is
An approved supplier list is the controlled record of every supplier a food plant has assessed and formally cleared to supply raw materials, packaging or outsourced services, held alongside the evidence that supported each approval. It is a decision log, not a purchase log: a supplier appears on it because someone in QA assessed the risk, collected the documents the plant requires for that material, and signed the approval off.
The distinction matters because purchasing systems and accounts payable ledgers list whoever has been paid. An approved supplier list lists whoever is permitted to deliver, and it carries the reason. That is why it is usually a document-controlled record with an owner, a version and a review date, rather than a tab in a buyer's spreadsheet.
A worked example
A ready meals plant buys from around sixty suppliers. Its approved supplier list holds one row per supplier: legal name, manufacturing site, the materials that supplier is approved for, the approval date and approver, the completed supplier questionnaire on file, and the certificate types the plant requires from that supplier. For an ingredient supplier that is typically an allergen declaration, a certificate of analysis for delivered lots, and a current third-party audit certificate. For a haulier it might be a single service specification. A supplier whose audit certificate lapsed in March is still on the list, but flagged and restricted, with a corrective action open against it, because deleting the row destroys the history an auditor will ask about.
Why auditors open it first
Third-party certification schemes such as BRCGS, SQF and FSSC 22000 all expect a documented process for approving and monitoring suppliers, and the approved supplier list is the artefact that makes that process visible in a few minutes. An auditor will normally sample it: pick three or four suppliers, ask for the approval evidence behind each, and see whether the documents on file are the ones the list says should be there and whether they are still in date.
That sampling is where lists fail. The list itself is usually tidy. What tends to be out of date is the evidence behind it, because a certificate expires quietly, nobody is reminded, and the row keeps reading approved. A non-conformance raised on an expired document is not a judgement about the supplier's product; it is a judgement about the control of the record. Closing it out costs QA time, sometimes a re-audit fee, and always the hours spent chasing documents that should have arrived months earlier.
For the document types a plant should be holding behind each row, see the sibling guide on what documents to collect from every food supplier.
Keeping the list current between audits
An approved supplier list is only as good as its expiry dates, so most plants need two things running together: the register of who is approved and what is required from them, and a status view that answers the question an auditor asks, which is whether every required document is actually in date today.
Certly is being built as exactly that pairing. A supplier database holds each supplier with contact details and the certificate types required from them, including allergen declarations, certificates of analysis and audit certificates, and an audit-ready dashboard shows certificate status per supplier on a single screen as current, expiring soon, expired or missing, with a PDF export of that same screen for an auditor to read.
One detail matters for the record rather than for the week's work. A renewal never deletes the document it replaced: the superseded version is kept with its issue and expiry dates, so the auditor who asks for the declaration that was valid last March still has an answer.
The dashboard and the PDF both carry the same two-sentence line: Certly tracks and reminds on certificate expiry, it does not verify certificate authenticity or guarantee regulatory compliance. The approval decision, and the judgement about whether a document is genuine, stay with your QA team. Certly is not open yet, so the waitlist is the way in.
Related terms
- Approved supplier programme. The wider procedure the list sits inside: risk categorisation of materials, the approval criteria, questionnaires, ongoing performance monitoring and the rules for suspending or removing a supplier.
- Supplier approval questionnaire. The self-assessment a prospective supplier completes before approval, covering their site, controls and certifications. It is evidence behind a row, not a substitute for one.
- Certificate of analysis (CoA). A lot-specific document from the supplier reporting test results against agreed specifications. Usually required per delivery rather than annually, which is why CoAs and annual certificates are tracked differently.
- Allergen declaration. The supplier's statement of allergens present in a material and on their lines. Commonly reviewed annually or on any change of formulation or site.
- Document control. The practice of giving records an owner, a version, a review date and a retention rule. An approved supplier list is a controlled document.
- Non-conformance. A finding raised at audit where practice does not meet the standard, classified as minor or major. An out-of-date certificate on file is a frequent source of them.
- Audit-ready evidence pack. The set of records assembled for an auditor, typically including the approved supplier list and the current status of the documents behind it.
Questions
Is an approved supplier list the same as a vendor list?
No. A vendor or supplier list records who you buy from. An approved supplier list records who has been assessed and cleared to supply, along with the approval date, the approver and the evidence behind the decision.
What should be on an approved supplier list?
At minimum: supplier legal name and manufacturing site, the materials or services they are approved for, the approval date and approver, the certificate and document types you require from them, and the current status of those documents. Many plants also record risk category and the date of last review.
How often should the list be reviewed?
Most plants review the whole list on a fixed cycle, commonly annually, and review individual rows whenever something changes: a new material, a change of manufacturing site, a lapsed certificate or a complaint. The cycle should be written into the procedure so the review itself is evidenced.
Does a spreadsheet count as an approved supplier list?
Yes, if it is document controlled and its expiry dates are genuinely current. A spreadsheet works as a register; what it does not do on its own is tell you today which documents behind it have expired, which is usually where audit findings come from.
Should a supplier be deleted from the list when they lapse or are dropped?
Generally no. Removing the row removes the history. The usual practice is to mark the supplier as suspended or withdrawn with a date and a reason, so the record of who was approved when is still readable at audit.
Can Certly maintain the approval decisions themselves?
No. Certly holds suppliers with their required certificate types and shows whether each certificate is current, expiring soon, expired or missing, on screen and in the PDF export. The approval decision, the risk assessment and the judgement about whether a document is genuine stay with your QA team.
Does a renewal overwrite the certificate it replaces?
No. The version replaced by a renewal is kept, along with its issue and expiry dates, so an auditor asking which document was valid on a past date can be answered from the record rather than from memory.
What will Certly cost?
Three plans, all billed annually. Starter is $3,228 a year for a single plant tracking up to 50 suppliers, which works out at 269 dollars a month, 10 percent off the 299 dollar monthly rate for paying up front. Professional is $5,388 a year for one site with up to 200 suppliers, or 449 dollars a month on the same basis. Multi-site is $10,788 a year for groups and consultants covering up to 30 sites under one agreement, with no supplier cap. Starter and Professional each start with a 14-day free trial.