How to Set Up a Supplier Approval System for Your Food Business
Practical guide to establishing supplier approval and monitoring procedures for UK food businesses. Covers due diligence, traceability, certification checks, and ongoing supplier management.
Under the Food Safety Act 1990, it is an offence to sell food that is unsafe or not of the quality demanded by the purchaser. The due diligence defence (Section 21) requires you to prove that you took all reasonable precautions and exercised all due diligence to avoid committing the offence. In practice, this means having a documented system for approving and monitoring your suppliers.
EC Regulation 852/2004 also requires food businesses to establish traceability systems capable of identifying the immediate supplier of all food ingredients. You must be able to demonstrate where every ingredient came from and provide this information to enforcement officers on request. Failure to maintain adequate traceability can result in unlimited fines.
This guide takes you through setting up a supplier approval system that protects your business legally, ensures the quality and safety of your ingredients, and gives you the documentation you need to demonstrate due diligence if anything goes wrong.
5 steps to complete
Define your supplier approval criteria
Establish the standards every supplier must meet before you purchase from them. At minimum, criteria should include: valid food business registration with their local authority, current food hygiene rating (decide your minimum acceptable score, typically 3 or above), evidence of their own HACCP or food safety management system, product liability insurance, ability to provide allergen information for all products, and a delivery specification covering temperature control and packaging requirements. For high-risk suppliers (raw meat, dairy, fish), consider requiring third-party audit certifications such as BRCGS, SALSA, or SQF.
Create a supplier approval questionnaire
Design a standard questionnaire or form that captures all the information you need from each supplier. Include: business name, address, and registration number; food hygiene rating and date of last inspection; details of their food safety management system; allergen management procedures; traceability systems; insurance details and expiry dates; delivery arrangements (temperature-controlled vehicles, delivery windows, packaging standards); and references from other food business customers. Send this to every existing and new supplier and file the completed forms.
Verify certifications and documentation
Do not take supplier claims at face value. Independently verify key information: check their food hygiene rating on the FSA website (ratings.food.gov.uk), request copies of insurance certificates and check validity dates, ask for copies of audit certificates (BRCGS, SALSA) and verify with the issuing body if possible, and request product specifications and allergen data sheets for every product you purchase. Record the date you verified each document and set calendar reminders for when certificates need renewing.
Establish traceability records for all deliveries
Set up a system to record the supplier, product description, batch or lot number, quantity, and date for every delivery received. Check delivery temperatures for chilled (below 8 degrees C) and frozen (at or below -18 degrees C) products using a calibrated probe thermometer, and record the results. Retain all delivery notes, invoices, and temperature records for at least the shelf life of the product plus one year (or a minimum of two years for most products). This traceability record must allow you to identify, within a reasonable time, which supplier provided any given ingredient on any given date.
Set up ongoing supplier monitoring
Supplier approval is not a one-off exercise. Implement ongoing monitoring that includes: checking delivery temperatures and product quality on every delivery; conducting periodic supplier reviews (at least annually) to reassess their food hygiene rating, insurance, and certifications; recording and investigating any non-conformances (wrong temperature, damaged packaging, incorrect products, short shelf life); and maintaining a supplier scorecard or log that tracks performance over time. If a supplier repeatedly fails to meet your standards, have a clear process for escalation and, ultimately, removal from your approved list.
Tips for success
Common mistakes to avoid
Frequently asked questions
What is the due diligence defence under the Food Safety Act 1990?
Section 21 of the Food Safety Act 1990 provides a defence if you can prove that you took all reasonable precautions and exercised all due diligence to avoid committing an offence. In the context of supplier management, this means having a documented system for checking that your suppliers meet food safety standards, verifying their credentials, monitoring delivery quality, and maintaining traceability records. Without this documentation, you cannot rely on the defence.
Do I need to approve every supplier, including one-off purchases?
Yes. Every supplier of food or food-contact materials should be subject to your approval process. For one-off or emergency purchases (such as buying from a supermarket when your regular supplier fails to deliver), record the purchase with a receipt and note the circumstances. Having a process for handling emergency purchases shows inspectors that your system is practical and realistic.
How long should I keep supplier records?
Keep supplier approval documentation (questionnaires, certificates, insurance) for the duration of the relationship plus at least two years after you stop using them. Keep delivery records, temperature logs, and traceability information for at least the shelf life of the longest-life product purchased plus one additional year, or a minimum of two years. These records are essential for product recall and food safety investigations.
What should I do if a delivery arrives at the wrong temperature?
Reject the delivery and record the details: date, time, supplier, products, expected temperature, actual temperature measured, and the name of the staff member who checked it. Notify the supplier in writing and request an explanation and corrective action. Keep the rejection record in your supplier file. Repeated temperature failures should trigger a supplier review and potentially removal from your approved list.
What certifications should I look for in a food supplier?
At minimum, check their food hygiene rating (available on the FSA website) and verify they are registered with their local authority. For higher-risk suppliers, look for third-party audit certifications such as BRCGS (British Retail Consortium Global Standards), SALSA (Safe and Local Supplier Approval), SQF (Safe Quality Food), or Red Tractor. These certifications indicate the supplier has been independently audited against recognised food safety standards.
Ready to simplify compliance?
Paddl automates the processes described in this guide. Digital records, automatic alerts, and complete audit trails for your hospitality business.
Full access to all features · Dedicated onboarding support · Cancel anytime