SQF supplier approval requirements
SQF supplier approval requirements are the parts of the SQF Food Safety Code that ask a certified site to approve its raw material, ingredient and packaging suppliers against written criteria, and to keep the evidence of that approval on file and current. This page defines the term, shows what the evidence usually looks like at audit, and names where the paperwork behind it tends to go out of date
What SQF supplier approval requirements are
SQF supplier approval requirements are the obligations a site certified to an SQF Food Safety Code carries to approve each supplier of raw materials, ingredients, packaging and outsourced processes against documented criteria, to record that approval, and to monitor the supplier's continued performance against it. The requirement is procedural rather than prescriptive: the code asks you to have a written approved supplier programme and to follow it, and your own procedure is then the standard you are audited against.
The code itself is published by the SQF Institute, and the clause numbering and wording change between editions, so the exact text that applies to you is the edition your certificate names. Read that edition for the clause. What follows is the practical shape the requirement takes on the plant floor.
In practice three things have to exist and agree with each other. First, written approval criteria: what you require of a supplier before you buy from them, and what you require of them on an ongoing basis. Second, an approved supplier list, the register of who has passed those criteria. Third, the evidence file behind each entry, which is where the documents live: the supplier's own third-party audit or certification certificate, certificates of analysis, allergen declarations, specifications, and the questionnaire or risk assessment you used to approve them.
The example that gets written up
A plant lists a dairy ingredient supplier as approved. The approval criteria say the supplier holds a current GFSI-recognised certificate and supplies an allergen declaration annually. The supplier's certificate on file expired four months ago, and nobody noticed because the file was last opened at the previous audit. The supplier is almost certainly still certified; the renewed certificate simply never arrived. The auditor is not assessing the supplier, they are assessing whether your own programme did what it says it does, and on that question the file answers for you.
The three parts of an approved supplier programme
| Part | What it holds | How it fails at audit |
|---|---|---|
| Written approval criteria | The documents and checks a supplier must satisfy before and during supply | Criteria are vague, so the auditor cannot test whether you met them, or they are specific and you did not |
| Approved supplier list | The register of approved suppliers and the certificate types required of each | Suppliers you stopped buying from are still listed, or current suppliers are missing from it |
| Supplier evidence file | Audit or certification certificates, CoAs, allergen declarations, questionnaires, specifications | A document is out of date, superseded without a trace, or sitting in an inbox rather than on file |
Why expiry dates, not approvals, are the usual finding
Approving a supplier is a one-off decision that most QA teams do carefully. Keeping the approval evidenced is a recurring administrative task spread across dozens or hundreds of suppliers, each with two or three documents, each on its own renewal clock. Nothing about the first task warns you when the second has lapsed.
That is why the commonest supplier-related finding at audit is not an unapproved supplier, it is an approved supplier whose document on file ran out. The sequence is familiar: a certificate expires, the supplier is mid-renewal with their own certification body, the renewed copy is never requested, and the gap only surfaces when an auditor opens the folder. The cost is a non-conformance to close out, a corrective action to write, and in the worst case a re-audit fee and a disrupted production week.
The practical defence is a status view rather than a folder: a list that tells you which documents are current, which are inside their renewal window, which have expired and which were never received at all, before anyone from a certification body asks.
Related terms
- Approved supplier list. The register of suppliers that have met your approval criteria, with the certificate types each one owes you. It is the index to the evidence, not the evidence itself.
- Certificate of analysis, or CoA. A supplier's batch or consignment test result, often the shortest-lived document in the file and the one most often requested per delivery rather than per year.
- Allergen declaration. The supplier's written statement of allergens present on their site and in the material supplied, usually refreshed annually or on any recipe or site change.
- Document control. The discipline of knowing which version of a document is the current one and who holds it. Our document control page covers how that applies to supplier records.
- Non-conformance. The finding an auditor raises when the programme and the evidence disagree, graded minor or major. Our page on non-conformances explains the grading and what closing one out involves.
- Corrective action, or CAPA. The fix and the root cause work you record to close a finding.
- Unannounced audit. An audit with no notice, which removes the week of catch-up most sites rely on before a scheduled visit.
- BRCGS supplier approval and performance monitoring. The equivalent requirement under the BRCGS Global Standard, covered on its own page in this pillar rather than repeated here.
Questions
Does SQF specify which documents I must collect from a supplier?
The code asks for documented approval criteria and the records that show you applied them, rather than handing you a fixed document list. Most plants land on the same core set in practice: the supplier's third-party audit or certification certificate, certificates of analysis, allergen declarations and an agreed specification. Because your own criteria become the standard you are audited against, write the list you can actually keep current.
Where do I read the exact clause wording?
From the SQF Institute, for the edition of the code your certificate names. Clause numbers and wording move between editions, so quoting an older edition back to an auditor does not help you.
Is an expired certificate on file automatically a non-conformance?
It depends on the auditor, the risk of the material and what your own procedure promised. If your criteria say you hold a current certificate for every approved supplier and one has expired, the evidence contradicts the procedure, which is the condition a finding is written against. Grading is the auditor's judgement, and our non-conformance page covers how minor and major differ.
How often does supplier approval need reviewing?
At the interval your own approved supplier programme states, which is the interval you will be held to. Annual review is common, with an earlier trigger on a complaint, a failed CoA, a site change or a lapsed certification.
Can software make my site compliant with SQF supplier approval requirements?
No, and Certly says so on the dashboard and its export: it tracks certificate status and reminds you and your suppliers, and it does not verify that a document is authentic or guarantee regulatory compliance. Approval remains a decision your QA team makes and signs.
What does Certly actually hold against a supplier?
Contact details and the certificate types you require of that supplier, such as an allergen declaration, a CoA or an audit certificate, with each document's status shown as current, expiring soon, expired or missing on one screen. Certly is pre-launch, so the waitlist is the way in for now.