A lot of warehouse operators treat supplier approval as purchasing's problem. It's not.
Two decades in U.S. warehousing has taught me a pattern: when a food warehouse gets burned by a recall, the failure usually isn't a dirty dock or a broken thermometer. It's the product that walked in the door already compromised. In 2023, I watched a 120,000-square-foot 3PL cold storage facility in Ontario, California go through a customer audit. The auditor skipped the temperature logs and opened with one question: "Who supplies your frozen poultry, and where are their qualification files?" The warehouse manager froze. The files lived with procurement. The only copy on site was an expired certificate. One major nonconformance, logged before the walkthrough even started.
If your food warehouse holds SQF or BRCGS certification — SQF run by the SQFI arm of FMI, BRCGS the renamed British Retail Consortium standard, both benchmarked by GFSI — supplier approval is not optional paperwork. It's a scored, audited part of your system. Here's how to do it from someone who's sat on both sides of the audit table.
A Valid Certificate Is Not a Qualified Supplier
The desk review is where most programs go soft. The typical flow: the supplier emails a stack of PDFs, purchasing forwards them to quality, someone confirms nothing is expired, and everything gets filed. That's collecting certificates. It is not auditing.
I check four things, every time.
First, verify the certificate itself. SQF certificates are searchable in the SQFI database; BRCGS certificates in the BRCGS Directory. Both are public. The era of trusting a photocopy is over — I've seen doctored certificates where even the numbering format was wrong. And read the scope: a supplier certified only for ambient dry-goods storage has no business holding your frozen product.
Second, licenses and test reports. Look at the dates and the line items. A third-party lab report older than a year tells you the product was fine last year. Micro, pesticide residue, whatever applies to your commodity — check what's covered and how often it's run. If a category looks thin, ask for the most recent round.
Third, the traceability system and the recall procedure. This is where both schemes dig in hardest. The paperwork has to show an unbroken chain: raw-material lot to finished lot to who received it and how much. And the recall procedure cannot be a template. I once reviewed one whose emergency contacts were three years out of date, including a recall coordinator who had left the company two years earlier. A procedure like that is the same as no procedure. Both schemes expect periodic mock-recall exercises — the common practice is at least one a year — and auditors will flip through those records.
Fourth, ask how the supplier approves its own suppliers. It sounds recursive, but both SQF and BRCGS expect it. "How do you qualify your packaging vendor?" If they can't answer, their system stops at their own front door.
One hard rule for the desk review: every document needs a version and a date. An undated, unversioned quality manual is scrap paper to an auditor.
The Half-Day Site Visit Tells You Everything the Paperwork Won't
No matter how good the files look, you walk the floor. I head straight for four things.
Sanitation first. You don't need a magnifying glass — just follow the flow of people and product. Standing water, debris, mold in the corners, drain covers you can't lift to inspect. In cold storage, check the evaporator coils and the dock doors. Heavy frost buildup means the defrost cycle is off, and a torn strip curtain isn't just an energy problem. It's how pests get in.
Then pest control. Ask for three things: the pest control operator's contract, the bait-station and insect-light trap map, and the last few inspection reports. Walk the map against the floor, station by station. Blocked bait stations and three-month-old records are classic findings. Weekly checks are the common practice for food sites. And if the log shows "no activity" week after week with suspicious regularity, ask harder questions. Records that are too clean sometimes mean nobody looked.
Then temperature records. Pull three consecutive months for every chilled and frozen zone, plus the calibration certificates for the probes. A suspiciously flat trend line earns a request for the raw data export. An expired calibration certificate voids the records it produced. Automated monitoring beats handwritten logs here, but the system itself gets audited too: are there alarm records, and what happened after each alarm?
Finally, the people. Hairnets, gloves, uniforms, handwashing. Are they actually happening or just written down? A plant where workers skip the hairnets is a plant whose temperature logs I trust a little less. Talk to a line worker or two. Ask what they do when they find foreign material in product. A confident answer usually means the training was real.
One tactic: don't send your checklist in advance. If you do, you'll audit a staged performance. BRCGS itself runs unannounced audits — at least one in every three-year cycle — so there's precedent. Your supplier program should include the occasional surprise visit too.
Don't Lump Every Finding Together: Grade It, Track It, Revisit It
You will always find nonconformances. What matters is grading them and driving closure.
Both schemes use three grades: critical, major, minor. A critical is a red line — a direct threat to product safety. That usually ends the relationship or triggers immediate suspension. A major is a substantive system gap; the common expectation is closure within 30 days with root-cause analysis and evidence. Minors go on record and get checked at the next review.
The biggest trap in grading is softening findings to spare the relationship. I learned this the expensive way. Years ago, a dry-goods supplier had essentially decorative rodent proofing. I wrote it up as a minor to keep things friendly. Six months later, rodent damage turned up in their product: full lot isolation, a customer claim, and a bill far larger than switching suppliers would have cost. Since then my rule is simple. Grade the fact, not the friendship.
Track every finding on a CAPA record: description, root cause, corrective action, due date, verifier. "We fixed it" over the phone doesn't count. I need photos, records, revised procedures. No evidence, no closure. And a supplier with open CAPAs doesn't get new volume. That's the floor, not the ceiling.
Finally, re-approval. Supplier qualification isn't a lifetime appointment. The common practice: re-audit annually, starting two months before the certificate expires. Add a mid-year unannounced visit for high-risk categories — frozen meat, seafood, ready-to-eat — or for suppliers with a rough history. Keep it all in one register: who was audited, when, what grade, how many CAPAs opened and closed.
Build a supplier qualification register with every food supplier's certificate expiry, latest test report date, and last audit date, and set a 60-day advance warning. Most warehouses don't fail because they never audited. They fail because a certificate lapsed three months ago and nobody noticed. That register can be built tomorrow.
And one caution: the enemy of a good supplier audit is the courtesy audit. Agree the rules with purchasing before anyone visits — grading criteria, closure deadlines, suspension triggers, in writing. Rules apply to the situation, not the person. When it matters, that's what lets you say no.
