Glossary

Supplier Risk Management

Back to Glossary

Definition

Supplier risk management is the systematic process a food or beverage manufacturer uses to verify that external suppliers, covering ingredients, raw materials, and food-contact packaging, consistently meet food safety, quality, and regulatory requirements before materials enter production.
The scope is broader than most teams assume: hazard analysis by raw material, formal supplier approval before first use, ongoing verification activities, corrective action workflows, and records you can produce in the first hour of an FDA inspection. A working program includes hazard analysis by raw material, formal supplier approval before first use, ongoing verification activities (audits, COA review, sampling, or written attestations), corrective action workflows when a supplier fails, and records you can produce in the first hour of an FDA inspection.
Your quality manager is accountable for the entire chain: what your suppliers do upstream affects what you can defend downstream.

Where It Fits

Supplier risk management sits at the intersection of FSMA preventive controls, GFSI certification requirements, and customer/retailer compliance programs. It's a requirement across several standards.
  • FSMA (21 CFR Part 117, Subpart G): When your facility identifies a hazard that requires a supply-chain-applied control, you must establish a formal supply-chain program, including documented supplier verification activities. This isn't a blanket requirement for every Part 117 facility; it triggers when your hazard analysis identifies supplier-controlled risk.
  • FSMA FSVP (21 CFR Part 1, Subpart L): If you import food, you must verify that foreign suppliers produce food consistent with U.S. safety standards. Annual on-site audits are required for hazards that could cause serious adverse health consequences. You also need a DUNS number as a unique facility identifier when filing entry with CBP.
  • SQF Edition 10, Clause 2.4.4: Risk-based approved supplier program with documented criteria, supplier questionnaires, third-party audit results, COAs, and product specifications. Re-evaluation frequency is tiered: high-risk suppliers annually, medium-risk annually or every 18 months, low-risk every two years.
  • BRCGS Issue 9, Clause 3.5: High-risk ingredient suppliers require annual audits regardless of third-party certification status. See our BRCGS certification guide for clause-level detail.
  • FSSC 22000 Version 6 / ISO 22000:2018, Clause 8.8.3: Supplier controls embedded in the broader food safety management system. FSSC 22000 v6 gained GFSI recognition in September 2024.
For facilities pursuing or maintaining GFSI certification, FDA has previously run a voluntary pilot program evaluating alignment between GFSI third-party audit standards and FSVP requirements. Verify current program status at fda.gov before relying on GFSI certification as a FSVP substitute.

Real-World Use Cases

Your quality manager gets a call at 5:45pm. A supplier shipment arrived without a COA for a high-risk ingredient scheduled for Monday production. She's now texting the supplier rep, digging through email threads from six weeks ago to find the last valid COA, and deciding whether to hold the ingredient over the weekend. This is what happens when supplier documentation lives in inboxes.
An SQF auditor opens your approved supplier list and spots a GFSI certificate that expired 47 days ago. You didn't catch it because there's no alert system, just a spreadsheet you manually update when you remember to check. That's a nonconformance. It also means the verification activity you relied on for your FSVP or Part 117 program is now undocumented for the gap period.
A packaging supplier changes the adhesive on a label without notifying you. The new formulation contains a derivative of a tree nut. Your specification hasn't been updated. The product goes out. A customer complaint triggers the investigation. Without a documented supplier change notification requirement and a re-verification workflow, you can't demonstrate your program caught anything.
Before implementing a structured system, Blue Bell Creameries collected safety and quality data across multiple enterprise facilities using binders, filing cabinets, and Excel. Audits were inconsistent, data wasn't accessible in real time, and decisions across departments were slower than they needed to be. After moving to digital records, food safety and quality data became instantly accessible and consistent across facilities.

FAQs

Supplier quality management focuses on whether materials meet your specification: dimensions, composition, sensory attributes. Supplier risk management is broader. It includes quality, but also food safety hazards, regulatory compliance, allergen controls, and the documentation your program depends on to survive an audit or a recall investigation. Most supplier quality management programs are a component of a supplier risk program, not a substitute for one.
If your FSMA preventive controls analysis identifies any hazard that must be controlled by a supplier, yes. The supply-chain program requirement under 21 CFR 117, Subpart G is triggered by your hazard analysis, not your facility size. Qualified Facility exemptions under Part 117 may apply in limited cases, but exempt facilities still face label disclosure requirements and other obligations.
Not usually. A COA confirms that one specific lot met specifications at the time of testing. It doesn't tell you whether the supplier's facility controls are sound, whether their food safety plan is current, or whether they've changed an ingredient, process, or co-manufacturer since you approved them. FSMA and GFSI both require ongoing verification across a range of activities, with COA review as one input, not the whole program.
It depends on risk tier and your applicable standard. SQF Edition 10 recommends annual re-evaluation for high-risk suppliers, annually or every 18 months for medium-risk, and every two years for low-risk. BRCGS Issue 9 requires annual audits for high-risk ingredient suppliers. Beyond scheduled re-evaluation, a supplier change notification requirement should trigger re-verification any time a supplier changes facilities, formulations, or co-manufacturers.
Expired certifications and incomplete qualification files. Auditors look for documentation that proves your verification activities actually happened: audit records, COA reviews, corrective actions, and written assurances. If those records are missing, incomplete, or out of date, the program fails regardless of what your SOP says.
Start with your hazard analysis. Identify which raw materials and ingredients have hazards that require a supplier-controlled mitigation. Tier your suppliers by risk. Define the verification activities appropriate to each tier. Then build out the documentation: approval criteria, verification records, corrective action workflows, and an expiration tracking system for certifications and attestations. The supplier onboarding software guide covers the process in more detail.

Compliance Requirements

  • FDA 21 CFR Part 117, Subpart G: When a hazard requiring a supply-chain-applied control is identified under 21 CFR 117.405(a)(1), your facility must establish and implement a written supply-chain program. Records of all supplier verification activities are required under 21 CFR 117.475.
  • FDA 21 CFR Part 1, Subpart L (FSVP): Importers must conduct and document risk-based supplier verification activities before importing food. FDA has published guidance on FSVP implementation; check fda.gov for the current version. 
  • Food-contact packaging (21 CFR Parts 174–186): Packaging materials that contact food must meet FDA authorization requirements for indirect food additives. New food-contact substances are handled through FDA's food additive petition process, a GRAS (Generally Recognized as Safe) notification, or the Threshold of Regulation exemption. Request current authorization documentation from packaging suppliers before approving materials.
  • PFAS in packaging: Multiple states have enacted or are in active phases of restricting intentionally added PFAS in food-contact packaging, including California (AB 347, which restricts intentionally added PFAS with thresholds; verify current enforcement dates), Washington, Massachusetts, Vermont, Connecticut, New Hampshire, and Maine as of 2026. Supplier verification now includes requesting Total Organic Fluorine (TOF) screening or targeted PFAS analysis and written declarations of compliance with applicable state thresholds.
  • Extended Producer Responsibility (EPR): California (SB 54, with fees as currently scheduled under CalRecycle rulemaking), Oregon (SB 582), Colorado (HB 22-1355), Minnesota, Maryland, Washington, and Maine have enacted or are in active implementation phases of EPR programs. Enforcement timelines vary by state. Verify current status before assuming obligations are active; these programs require accurate supplier documentation of packaging material types, weights, and recycled content. Check your state's current requirements through NCSL or your packaging compliance counsel.
  • Polystyrene restrictions: Washington state restricts certain EPS foam food-service packaging. These restrictions apply primarily to food-service operators in Washington; if your facility supplies food-service markets in restricted states, verify which materials and packaging formats are covered with your legal or regulatory affairs team. Additional states are advancing similar measures.
Non-compliance can trigger FDA warning letters, import detention, loss of GFSI certification, or retail customer disqualification. When a recall investigation starts, supplier records determine how fast you can answer the question: which lot, from which supplier, verified how?

SafetyChain's Supplier Compliance capabilities give quality managers a structured, auditable system for supplier documentation, expiration tracking, and corrective action workflows.

See How