What documents to collect from every food supplier

Every supplier file has two halves, and they behave differently.

The first half describes the supplier as a business. It is collected once at approval, it carries an expiry date, and it has to be replaced on a schedule: the third party food safety audit certificate, the product liability and recall insurance certificate, the completed approval questionnaire, confirmation of a HACCP study, and any scheme certificate sitting behind a claim you print on pack.

The second half describes the material. It arrives with the goods or with each change to the product: the agreed specification, the allergen declaration, the certificate of analysis for the lot, and any provenance or species declaration you rely on.

The set most mid-market plants end up with looks like this.

• Third party food safety audit certificate against BRCGS, SQF, FSSC 22000, IFS or an equivalent scheme, ideally with the audit report and evidence that findings were closed out
• Product liability and recall insurance certificate, showing the level of cover and the period it covers
• Completed supplier approval questionnaire or self assessment, dated and signed by a named person
• HACCP or food safety plan confirmation, including how allergens are controlled on the line your material runs on
• Signed product specification for every material code you buy from that supplier, not one specification for the supplier
• Allergen declaration covering the material and the line, including cross contact statements
• Certificate of analysis for each delivered lot, reporting against the limits your specification sets
• Claim specific certification: organic, halal, kosher, non GMO, gluten free, RSPO, MSC, whatever your label or your customer's label depends on
• Provenance documents: country of origin, species declaration, authenticity testing where the commodity is known to be adulteration prone
• Declaration of compliance for food contact materials, for packaging and anything that touches product
• Establishment registration or approval number where your category works that way
• A named technical contact and a written commitment to notify you of change, covering formulation, process, site, ownership and certification status

That last item does more work than any certificate. A supplier who tells you they have moved production to a second site has saved you a recall conversation. A supplier who does not tell you has left you holding a certificate that is technically current and factually wrong.

Collect the first half once, then track the dates. Collect the second half continuously, and file it against the batch or the specification version it belongs to. Most of what QA managers describe as chasing suppliers for their certs comes from treating both halves as one pile.

A single checklist applied to every supplier produces two failures at once. You chase a stationery supplier for an allergen declaration, and you accept a thin file from the raw material supplier who feeds your highest risk line.

Tier instead. The material and its role in your process set the document list.

High attention

Raw materials that carry allergens, anything going into a ready to eat product with no further kill step, commodities with a known adulteration history, and sole source materials you could not replace inside a month. These need the full set: audit certificate, report and close out, questionnaire, HACCP confirmation, signed specification, allergen declaration, CoA per lot, and provenance where relevant.

Standard attention

Materials with a downstream control step, secondary ingredients in small inclusion rates, primary packaging. Audit certificate or a completed questionnaire where no certification exists, insurance, specification, allergen position, declaration of compliance for packaging, CoA on a reduced frequency you can justify.

Light attention

Services and non-contact goods: pest control, calibration, laundry, maintenance contractors, hauliers. These still belong on the approved supplier list, and an auditor will ask how you approve them, but the document set is smaller: proof of competence or accreditation, insurance, and for transport, hygiene and temperature control evidence.

Write the tier and the reason next to the supplier. When an auditor asks why the seasoning blender has a thicker file than the box supplier, the answer should already be written down rather than reconstructed on the day. Your scheme's published requirements are the authority on what approval and monitoring must include, and they differ by version, so read yours rather than a checklist from a blog, including this one.

Documents fail in different ways because they run on different clocks, and conflating them is the most common cause of a gap.

Per supplier documents renew on a date printed on the document. The audit certificate and the insurance certificate are the obvious ones. They do not care how much you bought this month. They need a calendar and a chase, and they are the easiest documents to lose track of precisely because nothing in the daily flow of work reminds you they exist.

Per material documents change on an event rather than a date. A specification and an allergen declaration are valid until the supplier changes the formulation, the process, the packaging or the line. That makes the change notification commitment part of the document control system, not a courtesy. Many plants also re-request both annually, so that an event nobody told you about surfaces at least once a year.

Per delivery documents arrive with the goods. A certificate of analysis belongs to a lot number, and it is only useful if it is filed against that lot. A CoA in a shared inbox is not traceability. Decide at goods in who checks the CoA against the specification limits, what happens when it is missing, and where it is stored so that a mock recall can find it in minutes rather than hours.

When you set up your filing, keep those three clocks visible. A supplier row that says "allergen declaration: current, expires 14 March" is answering a different question from "lot 4471: CoA received and checked", and an auditor will ask both.

An in-date certificate is not the same as a correct file, and this is where a tidy spreadsheet gives false comfort.

The scope moved

A certification covers named sites, processes and product categories. A supplier can hold a valid organic certificate that does not cover the specific product you buy, or a valid audit certificate for a site that no longer makes your material. Read the scope, not just the date, and note on the file which product codes the scope covers.

The site or the owner changed

Acquisitions, site consolidations and contract manufacturing arrangements all break the link between the company you approved and the plant that ships to you. The certificate in your folder may still be genuine and no longer relevant. This is the case for asking in writing, at approval, to be notified of any change of site, ownership or subcontractor.

The grade changed mid-certificate

A supplier can be audited, downgraded, or have a certificate suspended between the dates you are tracking. Nothing in your file changes on the day that happens. Periodic verification against the certification body's own records, at a frequency proportionate to the supplier's tier, is the only way to catch it.

Tracking expiry dates removes the largest and dullest category of failure, the out of date certificate on file that nobody chased. It does not remove the judgement calls above. Any tool that tells you a document is current is telling you about a date, not about authenticity, scope or the supplier's performance since.

Patterns worth checking your own system against, because they are the ones that surface under time pressure.

• The certificate is in someone's inbox. It was received, it was never filed, and the person who received it is on leave during the unannounced audit.
• The expiry date lives only inside the PDF. Nothing in your tracking says when it lapses, so the chase depends on somebody remembering.
• The reminder went to a person who left. Supplier contacts churn. A chase sequence aimed at a dead mailbox looks like diligence in your records and achieves nothing.
• The specification is older than the product. The supplier reformulated, told a buyer rather than QA, and the allergen declaration you hold describes a product that no longer exists.
• The CoA arrives but nobody compares it to the limits. Received is not checked. If no one signs off the comparison, the document is filing, not control.
• Service suppliers are missing entirely. Pest control, calibration, hauliers and laundry are suppliers. Many approved supplier lists start at ingredients and stop there.
• Two versions of the truth. A spreadsheet, a shared drive and an inbox, each partly right. When the three disagree, the auditor's question becomes which one you actually run on.

Each of these has the same root cause: the document, its expiry date, its owner and its chase are recorded in different places, or in nobody's place. Fixing the root cause is more valuable than another round of tidying.

Collection is half the job. Retrieval under pressure is the other half, and it is decided by the conventions you set in week one.

Name files so a stranger can find them. Supplier, document type, expiry date, in that order, with an ISO style date. Your successor, or your deputy during an unannounced audit, should be able to find the current allergen declaration for a supplier without asking you.

Keep one current version, and keep the superseded ones. Auditors look for both: the document in force now, and evidence that you held a valid document at the time a given batch was made. Overwriting last year's certificate destroys the second answer.

Name an owner per document type. Insurance certificates and audit certificates often sit naturally with different people from specifications and CoAs. Unowned document types are the ones that lapse.

Agree a retention period and write it down. Your scheme requirements and your customer contracts set the period, and they vary, so take the number from those documents rather than from habit.

Remember that these documents contain people. Audit certificates, specifications and CoAs carry named signatories, auditors and technical managers, and your supplier contact list is personal data in its own right. That means thinking about who can see the files, how long you keep contact records, and how you respond if a supplier contact asks you to remove their details. It is an ordinary business data question rather than an exotic one, but it is easier to set up at the start than to retrofit across four years of PDFs.

Work down this list before you mark a supplier approved.

• The material's role in the process is written down, with the tier and the reason
• Every on-pack claim that depends on this supplier is listed, with the certificate that supports it and the scope that certificate covers
• Audit certificate held, with the expiry date recorded outside the PDF, plus report and close out evidence for high attention suppliers
• Insurance certificate held, with the policy period recorded
• Approval questionnaire completed, signed and dated by a named person
• HACCP or food safety plan confirmation held, covering the line making your material
• Specification signed by both sides for every material code
• Allergen declaration held, dated, and consistent with the specification
• CoA arrangement agreed: frequency, who checks it against limits at goods in, where it is filed, what happens when it is missing
• Provenance or species declaration where the commodity carries substitution risk
• Declaration of compliance held for packaging and contact materials
• Named technical contact recorded, plus a written commitment to notify you of change to formulation, process, site, ownership or certification
• Renewal chase dates set, with an owner, before the approval is closed
• Escalation written down for the case where a document lapses anyway

If the last two lines are blank, you have collected documents rather than built a programme. The difference shows up about eleven months later, when the certificate expires and the only thing standing between you and a non-conformance is whether somebody happened to look.