Supplier audit checklist for food and supplement brands

A supplier audit checklist is useful only if it helps a quality team make a decision. Can this supplier provide this material, from this site, under these controls, with evidence that will hold up during a customer review, audit, recall investigation, or release decision?

For food, supplement, and baby-food brands, that evidence usually goes beyond a generic quality questionnaire. The audit should connect supplier approval, material risk, certificates of analysis (COAs), third-party testing, receiving controls, traceability records, and corrective actions in one repeatable workflow.

Use this checklist as a practical starting point. It is written for quality, regulatory, procurement, and operations teams that need to evaluate ingredient suppliers, packaging suppliers, co-manufacturers, brokers, distributors, and service providers that can affect product quality or compliance.

Supplier audit checklist: the core questions and evidence

A good supplier audit checklist should ask two things for every area: what requirement applies, and what evidence proves the supplier meets it. The exact questions should change by material risk, product category, and supplier history, but the core checklist usually looks like this.

This table can be copied into a supplier audit template, vendor audit checklist, or digital quality system. The important point is not the format. The important point is that every answer leads to a decision: approve, approve with conditions, request more evidence, test, re-audit, suspend, or disqualify.

Start with supplier-material risk, not the audit form

The same supplier can be low risk for one item and high risk for another. A corrugate vendor, a food-contact pouch supplier, an imported spice supplier, a botanical extract supplier, and an infant-food ingredient supplier should not all receive the same audit.

Start by assigning a risk tier to the supplier-material relationship. Then choose the audit depth, evidence, and follow-up cadence that match that risk.

This is where the checklist connects to an approved supplier program. The audit gathers evidence. The approved supplier program turns that evidence into operating controls: who can buy what, what receiving must check, what testing is required, and when the supplier must be reviewed again.

Food supplier audit checklist additions

Food supplier audits should include ordinary quality-system questions, but they also need food safety and supply-chain control questions.

For FDA-regulated human food, supply-chain program requirements can apply when a receiving facility identifies a hazard that requires a supply-chain-applied control. In practice, that means the supplier audit should answer three questions:

1. Which hazard is being controlled before the material reaches you?
2. Who controls it: the supplier, a sub-tier supplier, a broker, a grower, a co-manufacturer, or another entity?
3. Which verification activity gives adequate assurance: onsite audit, sampling and testing, review of supplier food-safety records, third-party audit review, or another activity?

Add these food-specific prompts to the checklist:

For serious supplier-controlled hazards, the evidence bar should be higher. An onsite audit before use and at least annually after may be the right default unless the team documents why other verification activities provide adequate assurance.

Supplement supplier audit checklist additions

Supplement supplier audits should be built around specifications and COA reliability. A supplement component COA is useful only when the brand or manufacturer knows what the specification requires and why the supplier's results can be trusted.

For each supplement component, ask:

• Is there a current identity specification?
• Are purity, strength, composition, and contaminant limits defined?
• Is the supplier approved for this exact component and site?
• Does the COA show methods, limits, actual results, units, and the correct lot?
• Has the supplier been qualified for COA reliance?
• When was the supplier's COA reliability last confirmed by independent testing or another appropriate check?
• Did quality control personnel review and approve the supplier qualification or requalification basis?
• What happens when a result misses specification or a deviation could affect identity, purity, strength, or composition?

For dietary ingredient components, identity deserves special attention. A supplier audit should not rely only on a supplier statement that the ingredient is what the label says it is. The file should show the identity test or examination strategy, method suitability, supplier qualification, and quality review.

Baby-food and high-risk ingredient additions

Baby-food and young-child products need an added contaminant lens. The supplier audit should ask how the supplier prevents, detects, trends, and responds to environmental contaminants such as lead, arsenic, cadmium, and mercury.

That matters because contaminant risk is often ingredient-specific. Spices, botanicals, mineral ingredients, grains, root vegetables, and agricultural inputs can carry very different risk profiles depending on source region, processing, blending, and lot controls.

Add these baby-food or high-risk ingredient questions:

• Which ingredients carry known toxic-element or contaminant risk?
• Are lead, arsenic, cadmium, mercury, pesticide, mycotoxin, or other limits defined in the specification?
• Do supplier COAs show actual results and methods, or only pass/fail statements?
• Is independent testing required for every lot, first lots, skip lots, or periodic confirmation?
• Are near-limit results trended, not just accepted as passes?
• Does the supplier investigate elevated results by source, region, lot, process, or sub-supplier?
• Are changes in source, grower, mine, region, blender, or processor reported before shipment?
• Can the supplier connect ingredient source lots to finished product lots quickly during a complaint, failed test, or recall?

FDA's January 2025 lead guidance for processed foods intended for babies and young children uses category-specific action levels, including 10 ppb and 20 ppb levels depending on the food category. Those numbers should not be copied blindly into every specification, but they show why baby-food supplier audits need tighter material-specific limits and records than a generic vendor checklist.

How to review a COA during a supplier audit

A COA is evidence, not proof by itself. The audit should test whether the COA can support the decision the team is making.

Review each COA against this checklist:

If a COA is incomplete, do not simply file it and move on. Ask the supplier for corrected records, add independent testing, place the material on hold, or limit approval until the evidence is usable.

How to score findings and close corrective actions

A supplier audit is not complete when the checklist is filled out. It is complete when the team understands the findings, decides what they mean for supplier status, and verifies that corrective actions are effective.

A simple severity model is enough for most teams:

For each finding, capture:

• finding ID and source: audit, COA, test result, receiving inspection, complaint, regulatory alert, or supplier change
• affected material, lot, product, site, or process
• immediate containment or hold decision
• root cause
• corrective action and preventive action
• owner and due date
• required evidence: updated SOP, training record, test result, calibration record, sanitation record, mock trace, new COA, or photo evidence
• retesting, reinspection, or re-audit requirement
• closure approver and closure date
• supplier status after closure

The supplier status matters. A weak CAPA for a low-risk document issue may only require follow-up. A failed high-risk ingredient lot may require hold, independent retesting, temporary suspension, and requalification before the supplier returns to normal status.

How often to audit suppliers

There is no single audit frequency that works for every supplier. Set a baseline cadence by risk tier, then use events to trigger earlier review.

Useful triggers include:

• failed incoming test or out-of-spec result
• repeated COA errors or late documents
• complaint, recall, withdrawal, or customer issue linked to the supplier
• new site, source, country of origin, process, formula, or specification
• new allergen, claim, certification, or labeling impact
• audit finding or certification lapse
• FDA warning letter, import alert, or other regulatory concern
• supplier corrective action that is late, incomplete, or ineffective
• emergency use of a temporary supplier
• change in product population, such as a general product moving into a baby-food or young-child use case

A practical cadence might look like this:

How Light Labs helps supplier audits become easier to defend

Supplier audits are easier to run when lab data and quality records are connected to the supplier, material, lot, and decision.

Light Labs combines an ISO 17025-accredited lab, testing, compliance workflows, and software that help food, supplement, and baby-food teams keep supplier evidence organized. That can include COA confirmation, identity and potency testing, contaminant panels, microbiology, retesting after supplier issues, action-limit tracking, and records tied to supplier qualification.

For supplement brands, manufacturers, and baby-food teams, the practical benefit is a clearer supplier file:

• Which supplier and site provided the lot?
• Which COA, specification, method, and test result supported the release decision?
• Which lots failed, passed, or needed retesting?
• Which supplier findings are still open?
• Which suppliers need more frequent review, testing, or requalification?

The goal is not more paperwork. The goal is evidence that quality, procurement, and operations teams can use quickly when they approve a supplier, release a lot, investigate a problem, or answer a customer or auditor.

Final takeaway

A supplier audit checklist should make supplier decisions clearer before materials enter production.

Start with the supplier-material risk. Define the specification and evidence needed. Review COAs as data, not paperwork. Use independent testing where supplier evidence needs confirmation. Connect findings to corrective actions, supplier status, receiving controls, and requalification.

For food, supplement, and baby-food brands, the strongest checklist is the one that links supplier, site, material, lot, COA, test result, traceability record, and decision in a way the team can actually defend.