Critical Control Points

CCP: Supplier Verification - Approved Supplier Controls

Supplier Verification as a Critical Control Point

Supplier verification ensures that food entering your premises meets defined safety standards before you process or serve it. Under EC Regulation 852/2004, food business operators must ensure food is sourced from approved, reputable suppliers and that traceability records are maintained. For many businesses, supplier verification sits as a prerequisite programme. However, where incoming materials carry hazards that cannot be eliminated by later processing (e.g. allergen contamination in ready-to-eat ingredients, chemical residues, or unapproved additives), supplier controls may be elevated to CCP status.

Key takeaways

Maintain an approved supplier list with food safety certifications and review annually

Request written product specifications and allergen declarations from every supplier

Verify at every delivery that the supplier is approved and the product meets specification

Have a documented procedure for emergency sourcing from non-approved suppliers

Building an Approved Supplier List

An approved supplier list (ASL) is a documented register of all suppliers you have assessed and approved to supply your business. For each supplier, record: company name, products supplied, food safety certifications held (SALSA, BRC, STS, or equivalent), date of last assessment, and next review date. Approval should be based on evidence: a valid food safety certification from an accredited body, a satisfactory third-party audit report, your own supplier questionnaire completed and reviewed, or a site visit for high-risk suppliers. Review supplier approval annually at minimum, or whenever you receive a complaint, a delivery rejection, or news of a food safety incident involving the supplier. New suppliers should be assessed before the first delivery, not retrospectively. Your HACCP plan should state that food may only be sourced from suppliers on the approved list, and any deviation triggers corrective action.

Supplier Specifications and Certificates

Request written product specifications from every supplier covering: product description, ingredients list, allergen declarations, storage conditions, shelf life, and any relevant microbiological or chemical standards. For high-risk ingredients (raw meat, dairy, shellfish, ready-to-eat items), also request certificates of analysis (COA) or test results for relevant pathogens (Salmonella, Listeria, E. coli). Allergen declarations are especially important: your allergen CCP downstream depends on receiving accurate information from suppliers. A supplier who cannot confirm their allergen management process is a risk to your entire allergen control system. Store all specifications and certificates in a organised file (physical or digital) and review them when specifications change, when products are reformulated, or at your annual supplier review.

Monitoring and Verification

Monitoring supplier verification as a CCP involves checking that every delivery comes from an approved supplier and matches the agreed specification. At delivery, verify: the supplier is on your approved list, the product matches the description and specification, temperature requirements have been maintained (see the delivery temperature CCP), packaging is intact, use-by dates are adequate, and documentation (delivery notes, allergen information) is present. Record these checks for every delivery. Verification goes deeper: periodically audit your approved suppliers beyond just checking certificates. This might include supplier questionnaires, reviewing their latest inspection results, attending industry forums where food safety incidents are discussed, or conducting your own site visits. Any non-conformance discovered through monitoring or verification should trigger your corrective action procedure.

Critical Control Points

Automate your HACCP compliance

Paddl generates HACCP plans tailored to your business, creates monitoring routines from your CCPs, and keeps digital records that EHO inspectors can verify instantly. No more paper folders.

Start free trial See HACCP features

Try the free HACCP Hazard Identifier

Handling Non-Approved and Emergency Suppliers

Occasionally, your regular supplier may be unavailable and you need to source from an alternative at short notice. Your HACCP plan should include a procedure for this. Options include: maintaining a secondary approved supplier list for key products, requiring management sign-off for any purchase from a non-approved supplier, conducting an expedited assessment (phone questionnaire, check for certifications, require allergen documentation) before accepting delivery, and applying enhanced receiving checks (additional temperature checks, visual inspection, segregation until verified). Never accept food from a source you cannot verify. Purchasing from local markets, unapproved farms, or individuals without food safety credentials is a critical failure that could introduce unknown hazards into your supply chain. Document all emergency sourcing decisions.

What to do next

Create your approved supplier list

Document every supplier with their certifications, products supplied, and next review date. Store centrally and make accessible to all staff who receive deliveries.

Send a supplier questionnaire to all current suppliers

Request copies of food safety certificates (SALSA, BRC, STS), allergen management procedures, and product specifications. File the responses and set annual renewal reminders.

Add supplier checks to your delivery procedure

Ensure the delivery checklist includes a field to confirm the supplier is on the approved list, and that the delivery matches the agreed specification.

Common mistakes to avoid

Mistake

Approving suppliers based on price alone

Instead

Food safety certification and track record must be part of the approval criteria. A cheap supplier with poor food safety controls is an expensive risk.

Mistake

Never reviewing supplier approval once granted

Instead

Review annually at minimum, and immediately after any incident, complaint, or specification change. Suppliers can lose certifications or change processes.

Frequently asked questions

What certifications should I look for in a supplier?

SALSA (Safe and Local Supplier Approval) is common for smaller suppliers. BRC Global Standard for Food Safety and STS (formerly SQF) are higher-level certifications. Any GFSI-benchmarked certification demonstrates a robust food safety system. For very small or local suppliers, a completed questionnaire and satisfactory inspection report may suffice.

Is supplier verification always a CCP?

Not always. In many HACCP plans it sits as a prerequisite programme. It becomes a CCP when the incoming ingredient carries a hazard that no later step in your process will eliminate, such as allergen contamination in a ready-to-eat salad ingredient.

What if my supplier cannot provide allergen information?

Do not use them for any product that requires allergen declarations. Under UK food law, you must be able to provide accurate allergen information to your customers. If a supplier cannot confirm their allergen controls, they represent an uncontrolled hazard.

How do I audit a supplier remotely?

Request their latest third-party audit certificate, review their food safety policy, ask for completed questionnaire responses, and check their FSA/local authority rating (FHRS score). For high-risk suppliers, nothing replaces an on-site visit, but remote assessment is a valid starting point.

Critical Control Points