Approved supplier program for food and supplement brands
An approved supplier program is the system a quality team uses to decide which suppliers can provide ingredients, packaging, processing aids, services, or finished goods before those materials are used. A strong program does more than keep an approved supplier list. It defines risk criteria, collects evidence, verifies that suppliers can meet food safety and quality requirements, controls receiving, and keeps records that explain every approval decision.
For food, supplement, and baby-food brands, the point is not paperwork for its own sake. Supplier approval is where testing data, certificates of analysis (COAs), specifications, audits, traceability records, and corrective actions meet the purchasing process. If that evidence is scattered across PDFs, email, spreadsheets, and lab portals, the approved supplier list can become a false sense of control.
The goal is a supplier program that is practical to run and easy to defend: the team can show who was approved, for which material, based on what evidence, under which receiving checks, and how the supplier is monitored over time.
What an approved supplier program is
An approved supplier program is a risk-based control system for supplier qualification and monitoring. It usually includes:
- written approval criteria by supplier, material, and risk level
- a supplier questionnaire or onboarding form
- product and material specifications
- required records such as COAs, audit reports, certifications, allergen statements, contaminant results, and traceability details
- an approved supplier list used by purchasing and receiving teams
- receiving procedures that prevent off-list or unverified materials from being used
- verification activities such as audits, sampling, testing, and food safety record reviews
- monitoring, requalification, and corrective action steps when performance changes
That is why the program is different from an approved supplier list. The list is an operating tool. The program is the decision system behind it.
SQF guidance defines an approved supplier as one that has been assessed and approved by the site based on risk assessment and capability to meet food safety and quality requirements. That is the right way to think about the program: approval is earned by evidence, not by being a familiar vendor.
When an approved supplier program is required
Not every vendor list is a regulatory supply-chain program. A brand can have a broad purchasing list for office supplies, packaging vendors, freight providers, and ingredient suppliers. The food safety obligations depend on the material, hazard, market, and role of the company.
For FDA-regulated human food facilities, the key trigger is the hazard analysis. Under 21 CFR Part 117 Subpart G, a receiving facility must have a written, risk-based supply-chain program when it identifies a hazard that requires a supply-chain-applied control. The program has to use approved suppliers, determine supplier verification activities and frequency, conduct those activities, and document them.
In plain terms, if the supplier is controlling a food safety hazard before the ingredient reaches you, your supplier program has to show how you know that control is working.
A few common cases need extra attention:
| Situation | Why supplier approval matters |
|---|---|
| Domestic food ingredients with supplier-controlled hazards | The receiving facility may need a written supply-chain program tied to its food safety plan. |
| Imported ingredients or foods | The importer may also need a Foreign Supplier Verification Program (FSVP) under 21 CFR Part 1 Subpart L. |
| Dietary supplement components | Under 21 CFR Part 111, a supplement manufacturer can rely on a supplier COA only after qualifying the supplier and confirming the reliability of the supplier's test or examination results. |
| Baby food or infant nutrition materials | Ingredient specifications and verification tend to carry more scrutiny because contaminants, nutrition, and vulnerable-consumer risk are higher. FDA's 2025 lead action levels for processed foods intended for babies and young children are a useful example of why material-specific limits matter. FDA |
| SQF, BRCGS, GFSI, retailer, or customer audit programs | Certification and customer requirements often expect supplier selection, evaluation, approval, monitoring, records, and exception handling beyond the minimum FDA rule. |
The safest framing is simple: use regulatory requirements as the floor, then build the program around the actual risk of the material and supplier.
Qualification, approval, and the approved supplier list are not the same thing
Supplier programs often get messy because teams use three terms interchangeably.
Supplier qualification is the evidence review. It answers: does this supplier, at this site, for this material, have enough controls to meet our requirements?
Supplier approval is the decision. It answers: can we buy this material from this supplier under defined conditions?
The approved supplier list is the operating record. It answers: what can purchasing and receiving teams use today, and what checks apply before the material is accepted?
A strong program separates those jobs. That lets the team approve a supplier for one material but not another, approve a supplier conditionally, or require more verification for high-risk materials while keeping low-risk materials moving.
Common status labels include:
- Approved: evidence is complete and the supplier can be used under normal receiving checks.
- Conditionally approved: the supplier can be used under added controls, such as first-lot testing, missing-document follow-up, or a short review window.
- Temporary or emergency approved: the supplier can be used for a defined need only after verification before use.
- Rejected or blocked: the supplier cannot be used because evidence is missing, results failed, or risk is not acceptable.
Build the program around risk
The best approved supplier programs do not treat every supplier the same. A label printer, a low-risk corrugate supplier, a botanical extract supplier, a co-manufacturer, and an imported infant-food ingredient supplier should not all go through the same checklist.
Start by assigning risk at the supplier-material level. The same supplier might provide one low-risk packaging component and one high-risk ingredient.
| Risk tier | Typical examples | Baseline approval evidence | Verification approach |
|---|---|---|---|
| Low | Secondary packaging, non-food-contact materials, low-impact services | Supplier information, spec or service agreement, quality contact, basic change-control terms | Periodic document review and performance monitoring. |
| Medium | Food-contact packaging, low-risk ingredients, established suppliers with stable performance | Supplier questionnaire, material specs, COA or certificate of conformance when relevant, certification or audit evidence, traceability details | Receiving checks, periodic COA review, periodic sampling/testing or record review. |
| High | Ingredients with known food safety hazards, allergens, ready-to-eat inputs, imported materials, botanicals, high-variability suppliers | Full supplier file, food safety plan or certification, recent audit, material specs, contaminant/allergen evidence, COA reliability review, FSVP evidence if imported | Stronger verification such as onsite or third-party audit, targeted testing, first-lot verification, frequent performance review. |
| Critical | Infant formula or baby-food ingredients, high-risk imported ingredients, supplier-controlled hazards with severe health consequences | All high-risk evidence plus tighter specifications, regulatory review, validated supplier controls, clear escalation plan | Pre-use verification, more frequent testing or audits, senior quality approval, rapid corrective-action triggers. |
Risk criteria should include:
- hazard severity and likelihood
- whether the supplier controls a hazard that your facility does not control later
- product population, such as infants, young children, or medically sensitive consumers
- material variability and history of failures
- country of origin and import status
- supplying site, including broker or distributor relationships
- audit or certification status
- COA reliability and method fit
- previous complaints, deviations, failed tests, or corrective actions
- availability of alternate suppliers
For serious supplier-controlled hazards, FDA rules can require stronger verification. Part 117 generally requires an onsite audit before use and at least annually after that when the hazard controlled by the supplier could cause serious adverse health consequences or death, unless the facility documents why another verification activity is adequate.
What to collect before approving a supplier
A supplier file should be complete enough for someone outside the daily process to understand the decision. That person might be an auditor, a customer, a regulator, a new quality manager, or your own team during a recall investigation.
| Evidence | Why it matters |
|---|---|
| Supplier questionnaire | Captures site information, contacts, product scope, certifications, allergen controls, traceability, recall contacts, and change-control expectations. |
| Material or product specification | Defines what the supplier is approved to provide, including acceptance criteria and test limits. |
| COA or lab report | Shows lot-level or material-level results, but should be checked for method, units, limits, and actual results. |
| Audit report or certification | Provides evidence that the supplier's food safety or quality system has been evaluated. |
| Food safety plan or relevant control records | Helps confirm how supplier-controlled hazards are managed. |
| Allergen, GMO, organic, vegan, halal, kosher, or claim support | Needed when supplier inputs support label or market claims. |
| Contaminant, microbiology, pesticide, mycotoxin, residual solvent, or heavy-metal evidence | Important for ingredients or materials with category-specific risk. |
| FSVP or import records | Needed when the foreign supplier, importer, and hazard controls must be documented. |
| Change-control agreement | Requires notification before formula, process, site, source, spec, or certification changes. |
| Traceability and lot-coding details | Allows finished products, ingredients, and supplier records to be connected later. |
| Insurance, contracts, and commercial terms | Often owned by procurement, but should not replace food safety and quality evidence. |
For supplement brands, the COA deserves extra caution. Part 111 allows reliance on a supplier COA only when the supplier has been qualified and the manufacturer has confirmed the reliability of the supplier's results. The COA should include a method description, limits, and actual results. A PDF that says "passes" without usable method, limit, and result detail is weak evidence.
How to verify an approved supplier
Verification should match the risk. The goal is not to create the biggest possible paperwork file. The goal is to choose evidence that actually proves the supplier can control the relevant risk.
Common verification activities include:
| Verification activity | Best fit | What to watch |
|---|---|---|
| Onsite supplier audit | Serious supplier-controlled hazards, new high-risk suppliers, certification gaps, repeated failures | The audit should cover the actual supplying site and the material or process in scope. |
| Third-party certification or audit report | Suppliers with credible food safety certification, lower internal audit bandwidth | Confirm the standard, scope, site, date, findings, and whether the material is covered. |
| Sampling and testing | Contaminants, potency, identity, microbiology, allergens, pesticides, mycotoxins, heavy metals, residual solvents | The method, matrix, limit, and sample plan need to fit the decision. |
| COA review | Routine lot release, qualified supplement suppliers, stable lower-risk materials | Confirm supplier qualification, method, units, limits, actual results, and lot match. |
| Food safety record review | Supplier-controlled preventive controls, sanitation, kill step, allergen program, environmental monitoring | Review records tied to the relevant hazard, not generic quality documents. |
| Receiving inspection | Packaging condition, temperature, seal integrity, lot code, quantity, identity, correct supplier/site | Receiving checks should block off-list or conditional materials from being used without review. |
| Performance monitoring | Late documents, failed lots, complaints, deviations, rejected shipments, corrective actions | Trends should affect approval status and requalification frequency. |
Testing is not a substitute for supplier qualification, but it can make the program much stronger. It is especially useful when the risk is measurable, the result affects a release decision, or the team needs to confirm that supplier COAs are reliable.
Examples:
- A supplement brand confirms identity and potency for a new botanical extract supplier before relying on routine supplier COAs.
- A baby-food brand adds heavy-metal verification for high-risk ingredient categories and keeps results connected to the supplier and lot.
- A food manufacturer tests first shipments from a conditional supplier before moving the supplier to normal approval status.
- A brand trends microbial, pesticide, or mycotoxin results by supplier to decide whether the review cadence should change.
What belongs on the approved supplier list
The approved supplier list should be short enough for purchasing and receiving teams to use, but detailed enough to prevent avoidable mistakes.
At minimum, include:
- supplier legal name
- supplying facility or site, including broker or distributor relationships
- approved material, ingredient, packaging component, service, or finished product
- internal material code or specification reference
- risk tier
- approval status
- approval date and approver
- allowed use or restrictions
- required receiving checks
- required verification activity and frequency
- last review date and next review date
- key documents on file
- emergency or temporary approval conditions
- supplier owner inside your company
One of the most common supplier-program failures is approving a company name when the actual manufacturing site is different. If a broker, distributor, or sales office is involved, the program still needs clarity on the supplier site and material source that controls the risk.
Monitoring, requalification, and corrective action
Supplier approval should not last forever by default. The supplier's risk profile can change even when the vendor name stays the same.
Set a review cadence by risk tier, then define event-based triggers that force a review sooner. Useful triggers include:
- failed incoming test or out-of-spec result
- repeated COA or document errors
- complaint, recall, withdrawal, or customer issue linked to the supplier
- new ingredient source, facility, country, process, or formulation
- new allergen, claim, or labeling impact
- audit finding or certification lapse
- new FDA warning letter, import alert, or regulatory concern
- supplier corrective action that is late, incomplete, or ineffective
- unusually high rejection rate, late shipments, or quality incidents
- emergency use of a temporary supplier
Corrective action should be tied to approval status. A minor paperwork issue might lead to document follow-up. A failed high-risk lot might require quarantine, retesting, supplier investigation, root cause analysis, tighter receiving controls, temporary suspension, or full removal from the approved supplier list.
Records matter here. If the team cannot show what changed, who reviewed it, and why the supplier remained approved, the program becomes difficult to defend.
Common mistakes to avoid
- Treating the approved supplier list as the whole program. The list is useful only when it reflects current risk, evidence, and verification decisions.
- Relying on COAs without qualifying the supplier. A COA is stronger when the supplier's method, limits, results, and reliability have been checked.
- Approving the broker but not the actual site. Brokers and distributors can help with documentation, but the program still needs clarity on who makes, grows, processes, or controls the material.
- Using one checklist for every supplier. Low-risk packaging and high-risk imported botanicals do not need the same approval path.
- Skipping receiving controls. If purchasing or receiving can use off-list suppliers without quality review, the program has a practical gap.
- No temporary supplier process. Emergencies happen. The SOP should explain what has to be verified before an unapproved supplier is used.
- No requalification triggers. A supplier can drift out of control through site changes, spec changes, failed lots, or missing documents long before the annual review.
FAQ
What is an approved supplier program?
An approved supplier program is a documented system for evaluating, approving, verifying, and monitoring suppliers before their materials or services are used. It includes approval criteria, risk tiers, supplier evidence, receiving controls, verification activities, and records. The approved supplier list is one output of the program, not the whole program.
Is an approved supplier program required by FDA?
It depends on the product and hazard analysis. For FDA-regulated human food, 21 CFR Part 117 requires a written, risk-based supply-chain program when a receiving facility identifies a hazard that requires a supply-chain-applied control. Imported foods may also require FSVP controls. Even when a formal FDA supply-chain program is not triggered, supplier approval is often needed for audits, customers, and internal quality control.
What is the difference between an approved supplier program and an approved supplier list?
The program is the process for qualifying, approving, verifying, and monitoring suppliers. The approved supplier list is the controlled record that purchasing and receiving teams use to know which suppliers, sites, and materials are approved today and what checks apply.
What documents should be in a supplier approval file?
A practical file often includes a supplier questionnaire, material specifications, COAs or lab reports, audit or certification evidence, food safety records, allergen or claim support, traceability details, FSVP records when relevant, change-control terms, and approval or requalification records. The exact file should match the supplier and material risk.
How often should approved suppliers be reviewed?
Review frequency should be risk-based. Low-risk suppliers may need periodic document and performance review, while high-risk suppliers may need annual or more frequent verification. Review sooner when there is a failed lot, specification change, site change, audit finding, complaint, recall, regulatory concern, or repeated documentation problem.
Where do testing and COAs fit in supplier approval?
Testing and COAs help verify that a supplier can meet specifications, but they do not replace supplier qualification. Quality teams should confirm that methods, units, limits, actual results, lots, and supplier reliability are usable for the decision. Testing is especially helpful for high-risk ingredients, new suppliers, first shipments, COA confirmation, and trend monitoring.
How Light Labs helps quality teams manage supplier approval evidence
Approved supplier programs are easier to run when lab data and quality records are connected to the supplier, material, lot, and decision.
Light Labs combines an ISO 17025-accredited lab with testing, compliance workflows, and software that help brands and manufacturers keep supplier evidence organized. For supplier qualification, that can mean testing incoming or finished materials, confirming COA reliability, setting action limits, tracking retests, and keeping results tied to the supplier file.
That matters for food, supplement, and baby-food teams because supplier approval decisions often have to answer several questions at once:
- Did the supplier meet the material specification?
- Did the COA match the actual lot and method?
- Did testing confirm identity, potency, contaminants, microbiology, or another critical requirement?
- Is the supplier still approved after a failed result, new source, or corrective action?
- Can the team show the record quickly during a customer review, audit, or release decision?
For supplement brands and manufacturers, the strongest supplier program is the one where the right evidence is easy to find, compare, and act on.
Final takeaway
An approved supplier program should make supplier decisions clear before materials enter production.
Build it around a simple sequence:
- define the materials and suppliers in scope
- classify supplier-material risk
- set approval criteria and required evidence
- verify the supplier before use
- control receiving with an accurate approved supplier list
- monitor performance and requalify when risk changes
- keep records that connect the supplier, material, lot, result, and decision
That structure keeps supplier approval practical for day-to-day teams and defensible when a regulator, retailer, customer, or auditor asks why a supplier was approved.
Sources13 sources
- 21 CFR Part 117 Subpart G - Supply-Chain Program - eCFR / U.S. Government
- FSMA Final Rule for Preventive Controls for Human Food - U.S. Food and Drug Administration
- 21 CFR Part 1 Subpart L - Foreign Supplier Verification Programs - eCFR / U.S. Government
- FSMA Final Rule on Foreign Supplier Verification Programs - U.S. Food and Drug Administration
- Supply-Chain Program Requirements and Co-Manufacturer Supplier Approval and Verification - U.S. Food and Drug Administration
- 21 CFR Part 111 - Dietary Supplement Current Good Manufacturing Practice - eCFR / U.S. Government
- Dietary Supplement CGMP Small Entity Compliance Guide - U.S. Food and Drug Administration
- Action Levels for Lead in Processed Food Intended for Babies and Young Children - U.S. Food and Drug Administration
- SQF Approved Supplier Program Guidance Document - Safe Quality Food Institute
- SQF Food Safety Code: Food Manufacturing, Edition 9 - Safe Quality Food Institute
- BRCGS Food Safety Standard - BRCGS
- FSMA Supplier Verification Requirements - UC Davis / UC Food Safety
- Prerequisite Program: Approved Suppliers - Safe Food Victoria
Whether you’re a brand or a co-manufacturer, Light Labs helps you move faster, stay compliant, and eliminate testing bottlenecks — all from a modern, shared platform.