Supplier Approval in Food Safety: What Records Should a Food Business Keep?

Supplier approval sounds administrative, but it sits close to several real food-safety risks: unsafe ingredients, incorrect allergen information, poor temperature control, weak traceability and products arriving from a source the business does not understand. A useful supplier-control record should show more than a company name. It should help the business explain why the supplier is acceptable, what products or assurances apply, what changed and what happened when a delivery or supplier failed to meet the agreed standard.

TapTick’s wider Food Safety Management System direction is built around connecting approved controls to what happens in the site. Supplier assurance should work the same way: the central rule, the delivery evidence, the exception and the follow-up should not live in four separate places.

What supplier approval means in practice

“Approved supplier” can mean different things in different businesses. For a small café it may mean buying from known, reputable wholesalers and keeping clear invoices and delivery records. For a manufacturer or large multi-site operator it may involve product specifications, questionnaires, certification, site approval details, audit reports, service-level requirements and formal periodic review.

The principle is the same: the business should have enough confidence in the source and the product to rely on it within its food safety management system.

The UK Food Standards Agency’s MyHACCP guidance treats supplier control as a prerequisite programme and advises that ingredients and supplies should, where possible, be bought to specification from reputable suppliers. Its worked guidance also gives examples such as pre-approved suppliers and agreed specifications as controls for hazards that may originate in raw materials.

That does not mean every shop needs a complex procurement portal. It means supplier control should be deliberate rather than accidental.

Legal traceability vs supplier approval

It is useful to separate two ideas that are often mixed together.

Traceability requirements set minimum information that food businesses must be able to retrieve about food moving through the supply chain. FSAI guidance explains the one-step-back and, where relevant, one-step-forward principle. For food received, core information includes the supplier’s name and address, the nature of the products and the transaction or delivery date. More detailed requirements apply to some foods, including foods of animal origin.

Supplier approval is the business’s control process for deciding whether a supplier and its products are suitable for the intended use. In many operations it is good practice and an important part of the FSMS, but the exact process depends on the product, sector, risk and any specific legal or customer requirements.

This distinction matters because an “approved supplier list” by itself does not satisfy traceability, and invoices by themselves do not prove that the business has assessed higher-risk suppliers appropriately.

What records should you keep?

A practical supplier file or digital supplier record may contain the following. Not every field is needed for every supplier.

1. Supplier identity and scope

• legal or trading name;
• address and contact details;
• supplier category;
• products or product groups covered;
• sites or business units allowed to buy from the supplier;
• registration or approval information where relevant.

2. The basis for approval

• why the supplier is considered acceptable;
• relevant certification or third-party assurance, if the business relies on it;
• completed supplier questionnaire, if used;
• audit or visit outcome, where proportionate;
• references to agreed product specifications;
• approval date, approver and review date.

The record should distinguish between information that was actually checked and a document that was merely uploaded. A certificate sitting in a folder after expiry is weak assurance.

3. Product and specification information

• agreed product description;
• temperature or transport requirements where relevant;
• packaging, shelf-life or date-code expectations;
• ingredient and allergen information;
• lot, batch or consignment information where needed;
• specific restrictions, for example an approved brand, factory or source.

4. Performance and exceptions

• rejected or quarantined deliveries;
• temperature failures;
• damaged packaging or date-code problems;
• allergen or specification discrepancies;
• recalls, withdrawals or safety alerts affecting supplied products;
• complaints and corrective actions;
• repeated non-conformances and escalation.

5. Review and status history

• current status: approved, conditionally approved, suspended or removed;
• last review date;
• who completed the review;
• what evidence was considered;
• why the status changed;
• what must happen before a suspended supplier can be used again.

For a digital system, preserving status history matters. If a supplier was approved when a delivery was received and later suspended, the historical record should still show what the position was at the time.

Make approval risk-based

Supplier control becomes unmanageable when every supplier is treated as equally risky. A business buying sealed stationery does not need the same assurance process as one buying ready-to-eat chilled food, raw meat, prepared salads or products carrying complex allergen information.

A simple risk-based approach can consider:

• the nature of the food;
• whether the product is ready to eat;
• whether a later process will control the relevant hazard;
• temperature-control requirements;
• allergen complexity;
• supplier history and previous failures;
• the consequences if the specification is wrong;
• whether the supplier or establishment requires regulatory approval;
• the volume and number of sites affected.

The approval evidence can then match that risk. Lower-risk purchases may be controlled through reputable sourcing and normal receiving checks. Higher-risk or strategically important suppliers may justify specifications, certificates, questionnaires, audits or more frequent review.

Connect supplier approval to delivery evidence

A supplier can be approved and still send an unacceptable delivery. Supplier approval is not a substitute for Goods In controls.

The site should still follow the receiving checks defined by its FSMS. Depending on the food, this may include condition, packaging, date coding, traceability information and temperature. If a delivery is rejected or held, the record should identify the supplier and preserve the reason.

This creates a useful feedback loop:

approved supplier → delivery → exception → corrective action → supplier review

Without that connection, head office may renew a supplier because its central documents look fine while sites have been rejecting deliveries for the same recurring problem for months.

For multi-site businesses, repeated delivery exceptions are especially valuable. One complaint may be local. The same issue appearing across ten sites can reveal a supplier-level problem.

Ingredients, allergens and specifications

Supplier control is particularly important where the business relies on supplier information to provide accurate allergen information to customers.

FSA guidance on allergen information recommends procedures to keep ingredient and allergen information accurate, including keeping ingredient records, checking for changes, using approved suppliers with supply-chain assurances and asking suppliers to notify the business of allergen changes.

That creates a practical requirement for change control. If a sauce, bakery item or prepared filling changes composition, the important question is not only whether the supplier emailed someone. It is whether the change reached the recipe, allergen information, labels, staff guidance and any affected sites before the changed product was sold.

A strong FSMS therefore links supplier information to the downstream controls that depend on it.

What happens when a supplier changes or fails?

Supplier approval should have a visible exception path. Examples include:

• a certification or approval document expires;
• a specification changes;
• a new production site starts supplying the product;
• a delivery repeatedly arrives outside agreed conditions;
• allergen information changes unexpectedly;
• a complaint identifies a product-safety issue;
• a withdrawal or recall affects supplied food;
• the supplier can no longer provide required assurance.

The business should decide what that event means. It might require updated documentation, temporary conditional approval, a site visit, a corrective-action response, tighter delivery checks, suspension or removal.

The important part is that the decision is recorded. “Supplier reviewed” is less useful than a record showing what changed, what evidence was checked, what decision was made, who made it and when the next review is due.

Supplier approval in a multi-site business

Multi-site retailers benefit from separating central supplier governance from site-level receiving.

Head office can control:

• which suppliers and products are approved;
• the standards and specifications that apply;
• document and review dates;
• supplier-level corrective actions;
• central suspension or withdrawal decisions.

Sites can then control:

• the actual delivery received;
• temperature and condition;
• accept, reject or quarantine decisions;
• photos and comments where something is wrong;
• immediate escalation.

The strongest system connects both views. Central teams should be able to see whether an approved supplier is generating repeated operational failures. Sites should not have to interpret central supplier documents during a busy delivery.

Supplier approval checklist

• Do we know exactly which suppliers are currently approved?
• Does the approval state which products or categories it covers?
• Do we have the legal traceability information for food received?
• Where relevant, have we checked registration or establishment approval?
• Are specifications and allergen/ingredient information current?
• Do we know when assurance documents expire?
• Are supplier reviews risk-based rather than purely calendar-based?
• Can delivery failures feed back into supplier review?
• Can we see why a supplier was suspended or removed?
• For multi-site operations, can head office identify recurring supplier problems across locations?

How TapTick fits

TapTick is evolving beyond standalone digital checks into a connected Food Safety Management System. Supplier control fits naturally into that model because the useful chain is wider than an uploaded certificate.

The goal is to connect the approved requirement to the operational evidence: the supplier, the specification, the delivery check, the failed condition, the corrective action, the review and the resulting status.

Supplier approval works best when it is treated as a living control rather than a static procurement file. The business should know who it trusts, why it trusts them, what each site received and what happened when the supply chain did not perform as expected.