A supplier approval pack is the file you assemble before the first purchase order, and its purpose is narrow: to establish that the supplier can produce, to the specification, repeatably, and that if something goes wrong you will be able to find out what and from whom. Everything in the pack should be traceable to one of those three objectives. Anything that is not is paperwork for its own sake, and it dilutes the file.
This guide sets out what belongs in the pack, what each document is evidence of, and the checks that catch the failures. The failures are rarely dramatic. A certificate whose scope excludes your product, an insurance policy that expired last quarter, a specification agreed by email and never signed – these are what actually go wrong, and every one of them is visible in ten minutes if someone looks.
Section one: identity and legal standing
Before anything technical, establish who you are dealing with.
- Company registration extract. Legal name, registered address, registration number and the persons authorised to bind the company. Match this against the name on the quotation and, later, the invoice. A mismatch between the entity that quoted, the entity that signs and the entity that invoices is a common structure in trading chains and it needs to be understood before it becomes a dispute.
- VAT or tax registration and, for exports into the EU, the exporter’s own identifiers.
- Bank details on company letterhead, verified by callback. Payment redirection fraud in food trading is routine. Verify a change of bank details by telephone to a number you already had, never to a number in the email requesting the change.
- Ownership and site list. Which sites will actually produce your goods. A supplier with three plants may certify one of them.
- Insurance certificates. Product liability and, where relevant, cargo cover, with the sums insured and the expiry date visible.
Section two: food safety certification
This is the section buyers read first and check least carefully.
- The certificate itself, for a GFSI-recognised scheme where your customer requires one: BRCGS Food Safety, IFS Food or FSSC 22000. Which one is a commercial question rather than a technical one, and the BRCGS against IFS comparison explains why.
- The scope statement, which is the part that fails. A certificate covers named products, processes and sites. Frozen fruit certified for packing but not for freezing, or a certificate covering the plant but not the adjoining cold store, is a real and frequent gap.
- The audit report, not only the certificate. The report shows the non-conformities raised and how they were closed, which tells you more about the operation than the grade does.
- Validity and audit type. Current dates, and whether the audit was announced or unannounced.
- The certification body and its accreditation. A certificate is only as good as the body that issued it and the accreditation behind it. Understanding food safety standards sets out the verification route.
Where the supplier holds ISO 22000 without a recognised scheme, that is not disqualifying, but it changes the workload: your own audit and a fuller document review have to do the work the certificate would otherwise do.
Section three: the HACCP and quality system
- HACCP plan summary for the product you are buying: the flow diagram, the hazard analysis, the critical control points with their limits, the monitoring and the corrective actions. You do not need the whole system; you need to see that the plan matches the product and the process you are buying.
- Validation evidence for the critical steps. For frozen vegetables that means blanching and its validation; for a freezing step it means evidence that the freezer achieves the intended core temperature at the intended throughput.
- Traceability and recall procedure, plus the date and result of the last mock recall. Ask what the trace exercise covered and how long it took.
- Internal audit schedule and management review records. These show whether the system is alive or documented.
- Complaint handling and corrective action procedure, with a sample of recent complaints and their closure. A supplier with no complaints is not a supplier with no problems.
Section four: the product
- Signed product specification. Not a datasheet – an agreed document with tolerances, methods and a version number. This is the single most valuable page in the pack, because it is the document against which a claim is judged.
- Certificates of analysis from recent production, covering the parameters in the specification with the analytical methods named and the laboratory identified.
- Laboratory accreditation. Whether testing is in house or contracted, and whether the laboratory is accredited for the methods that matter.
- Pesticide residue evidence, covering the substances relevant to the crop and origin under the EU MRL framework. Note the difference between a legal limit and a customer’s own tighter internal requirement.
- Contaminant and microbiological results, referenced to the criteria that apply to the product category rather than to a generic list.
- Allergen statement covering the site as well as the product, including what else is handled on the same lines.
- Foreign body controls: metal detection or X-ray, sieving, optical sorting, with the check frequency and the reject verification.
- Packaging declarations, including food contact compliance for the primary packaging and the labelling artwork if the product is packed for retail. Packaging requirements for frozen product covers what those declarations should say.
- Shelf life justification, with the basis stated. A shelf life asserted without a study is a marketing number.
Section five: origin, sustainability and social
- Organic certificate where the product is sold as organic, under the EU organic regulation, plus the certificate of inspection route for imports.
- Primary production certification where the customer requires it – GLOBALG.A.P. and, for the labour module, GRASP.
- Social audit, commonly SMETA, where the customer’s own supply chain policy requires it.
- Due diligence responses. Human rights and environmental questionnaires now arrive early in the approval process for European retail chains, and the answers become part of the file.
- Origin evidence, including the grower or collection base and how the supplier demonstrates it. For a processor buying from many small growers, the mass balance is the mechanism.
Section six: logistics and commercial
- Cold chain capability: cold store temperature records, freezer capacity, loading procedure and pre-cooling practice. The cold chain guide sets out what good looks like.
- Temperature monitoring policy: what is logged, at what interval, who holds the data and how quickly it is released. The cold chain management guide explains why the release policy matters more than the logger.
- Capacity and lead time, stated honestly for your volume rather than for the plant’s total.
- Incoterm and the transport arrangement, which decides who carries the temperature risk in transit – see the FCA, CPT and DAP comparison.
- Payment terms, currency and the contract form, including the analysis clause: who samples, which method, and whether the result is final at loading or at discharge.
How to read the pack
Read it for coherence, not for completeness. A complete pack of documents that contradict each other is worse than a short pack that hangs together.
Three questions catch most problems. Does the certificate scope cover the product, the process and the site you are buying from? Do the certificates of analysis use the methods named in the specification? Does the entity on the certificate match the entity on the quotation?
Check dates on everything, and diarise the expiries. Certificates lapse mid-programme and the supplier rarely volunteers it.
Check that the specification and the certificate of analysis speak the same language. A specification calling for a parameter that never appears on any certificate of analysis is a parameter nobody is measuring.
Check the gap between what the pack claims and what the first delivery shows. The approval pack is a hypothesis; the first three loads test it. Plan the intake checks on those loads to verify the specification parameters that matter most, and treat a discrepancy as an approval issue rather than as a one-off.
Running the approval as a process
The pack is a set of documents; the approval is a sequence, and treating it as a sequence is what stops it stalling.
- Screening. Registration, certificate, scope, capacity and a first indication of price. This takes an hour and eliminates most candidates.
- Document request. Send the full list at once rather than in instalments, with a deadline and a named contact on both sides. Approvals that drift usually drift because documents were requested three at a time.
- Specification agreement. Do this before the sample, not after. A sample assessed against an unagreed specification produces an argument about what “acceptable” meant.
- Sample assessment, against the agreed specification, from real production rather than from a hand-picked box, with the lot number recorded so it can be traced back.
- Site visit or remote audit, proportionate to the risk and the volume. For a high-volume programme it is not optional.
- Conditional approval and first loads, with a heightened intake plan for an agreed number of deliveries.
- Full approval and review date. Put the review in the calendar with the certificate expiries attached to it.
Risk-proportionate depth. Not every supplier needs the same file. A low-volume supplier of a low-risk ambient ingredient does not warrant the same scrutiny as a primary frozen fruit supplier feeding a retail programme. Define two or three tiers, write down what each tier requires, and apply them consistently – an approval policy that exists only in the technical manager’s head cannot be audited and will not survive that person’s departure.
Who else is in the chain. If you are buying through a trader or an agent, the pack has to cover the manufacturing site as well as the counterparty, because the certificate that matters is the one covering the plant where the goods are made. A trader who cannot or will not name the site is telling you something about the transparency of the chain.
What the pack cannot do
It cannot tell you what happens on a night shift in peak season, which is what a site visit is for. It cannot tell you whether the supplier will still be solvent in March. And it cannot substitute for a specification that says what you actually want – which is why the RFQ that starts the conversation matters as much as the file that ends it.
Vorezan is not a certification body and does not issue or verify certificates. The checks described here are the buyer’s own due diligence, and where a legal or certification question turns on a specific document, it should be verified with the issuing body or the competent authority.