Glossary

Supplier Audit

Back to Glossary

Definition

A supplier audit is a documented examination of a supplier's facility, processes, and records to verify they meet food safety regulations, quality standards, and your organization's requirements. The FDA defines it in 21 CFR § 117.3 as "the systematic, independent, and documented examination (through observation, investigation, records review, discussions with employees of the audited entity, and, as appropriate, sampling and laboratory analysis) to assess an audited entity's food safety processes and procedures."
The practical version: a supplier audit answers the question every quality manager should be able to answer before an auditor asks it first. Can you prove your suppliers are controlling the hazards that could reach your finished product?

Where It Fits

Supplier are a required component of multiple overlapping frameworks, each with specific obligations:
  • FSMA Preventive Controls (21 CFR Part 117, Subpart G): Receiving facilities must approve suppliers and verify they're controlling hazards before raw materials enter your process. This is not optional. It's a documented program requirement.
  • FSMA Foreign Supplier Verification (21 CFR Part 1, Subpart L): If you source ingredients internationally, § 1.506(e)(1)(i) requires a separate verification program covering those suppliers. Domestic approval programs don't extend to imported ingredients by default.
  • GFSI-benchmarked standards (FSSC 22000, BRCGS, SQF): Certification against any of these standards requires verified supplier oversight. For many retailer and foodservice relationships, that certification is a market access requirement, not just a best practice. See our comparison of GFSI schemes for how audit requirements differ across programs.
  • Animal food facilities (21 CFR Part 507, Subpart E): Parallel supplier verification requirements apply under § 507.135.
If your facility operates as a contract manufacturer, you carry two distinct audit obligations simultaneously. You're a receiving facility under FSMA, responsible for verifying your own suppliers, and you're also a supplier subject to your customers' second-party audits. Both require documented programs, and auditors for each will look for evidence of the other.

Real-World Use Cases

A quality manager at a mid-size ingredient processor builds a risk-based supplier verification schedule after FSMA implementation. She assigns on-site audit frequency based on each supplier's hazard classification and GFSI certification status, keeping lower-risk, certified suppliers on annual documentation reviews and scheduling on-site audits for uncertified suppliers handling allergenic or high-risk materials.
A food safety director at a contract manufacturer manages dual obligations: maintaining an approved supplier list and verification program for incoming raw materials while also preparing documentation packages for customer second-party audits of his own facility. Both programs run concurrently with separate documentation trails.
A procurement team at a national bakery uses third-party audit reports from a qualified auditor to satisfy § 117.430 requirements for a high-volume wheat supplier. Rather than conducting on-site audits themselves, they review and assess the third-party documentation as required under § 117.415, and keep that review in their supplier records.
A compliance manager at an importer runs a parallel FSVP program alongside her domestic supplier verification program. Foreign suppliers require verification activities under § 1.506(e)(1)(i) that her domestic program doesn't cover, including supplier verification documentation formatted to FSVP requirements. Our guide on FSMA traceability and food safety obligations covers how these programs interact.

FAQs

A second-party audit is one your organization conducts directly on your supplier. A third-party audit is conducted by an independent, qualified auditor, often against a recognized standard. Under 21 CFR § 117.430, receiving facilities may rely on qualifying third-party audits, but the receiving facility is still responsible for reviewing and assessing that documentation.
Not entirely. GFSI certification is a recognized verification activity and can reduce audit frequency for certified suppliers, but it doesn't eliminate your obligation to approve the supplier, document that approval, and assess their verification documentation under § 117.410 and § 117.415. Certification is an input to your program, not a substitute for it.
There's no single answer. Under § 117.425, frequency is risk-based. Factors include the hazard severity of the ingredient, whether your process applies a lethal step, the supplier's history, and their current certification status. A high-risk, uncertified supplier with prior nonconformances warrants more frequent on-site verification than a GFSI-certified supplier of a low-risk ingredient.
No. FSMA's supplier verification rules require a "qualified auditor" under § 117.435, defined by training and experience relevant to the audited product and process. Accreditation under 21 CFR Part 1, Subpart M is a separate program and is not required to satisfy PCHF, PCAF, or FSVP supplier verification obligations.
The finding triggers more than a corrective action request to the supplier. You need to evaluate whether materials already accepted may be affected, whether your traceability records can isolate impacted lots, and whether your own preventive controls account for the hazard. That chain of response is where audit programs either hold or break down.
Start with your ingredient risk ranking. Classify each supplier's materials by hazard type, then assign verification activities and frequencies based on that ranking and the factors in § 117.425. Document your rationale. An approved supplier list with documented approval criteria and verification records is the minimum defensible baseline for an FDA inspection.

Compliance Requirements

FDA 21 CFR § 117.410: Receiving facilities must approve suppliers and document that approval before accepting raw materials. A certificate of conformance alone doesn't satisfy this requirement. You need a risk-based supplier compliance program with documented activity.
FDA 21 CFR § 117.425: Audit frequency isn't fixed. It must be determined based on the hazard associated with the ingredient, the supplier's history, their certification status, and whether your process applies a lethal step downstream. That determination must be documented.
FDA 21 CFR § 117.430 and § 117.435: Receiving facilities may rely on third-party audit documentation, provided the audit was conducted by a qualified auditor. One clarification that trips up practitioners: FSMA supplier verification audits do not require accreditation under 21 CFR Part 1, Subpart M. The requirement is a "qualified auditor," which is defined by training and experience, not accreditation status.
FSSC 22000 Version 7: Requires documented supplier verification activities. Suppliers of raw materials and primary packaging must be audited by a third party against a standard that verifies GMP, HACCP, traceability, and recall management implementation. For current effective dates and transition requirements, refer to the official FSSC 22000 transition timeline directly, dates in evergreen content age poorly.
BRCGS Food Safety Issue 9: Requires periodic unannounced audits. Frequency varies by grade and audit history under Issue 9 requirements. Review the standard's specific clauses for requirements that apply to your certification grade. Our BRC certification guide covers Issue 9 in more detail.
SQF Edition 10: Uses a points-based scoring system where audit scores directly determine verification frequency and oversight intensity. Under Edition 9, frequency is tied to supplier audit scores: 0 points for a met requirement, 1 point per minor nonconformance, 5 per major, 50 per critical (deducted from a maximum of 100). A supplier with a poor score gets more frequent oversight.
Non-compliance consequences range from audit findings and certification loss to FDA warning letters, import alerts for FSVP violations, and recall liability when a supplier-linked hazard reaches finished product.

See how SafetyChain approaches supplier compliance

Learn More