Supplier audits in a food warehouse are not the legal department's job. They're the warehouse's job.

Last year we took on a frozen-food client — 40-plus SKUs, 17 suppliers. The client said: "You audit the suppliers. If something goes wrong, I come to you." On paper every one of them was perfect: licenses, insurance, HACCP plans, all beautiful. On site, half fell apart. After enough years in this business you learn one thing: you can never judge a food supplier by paperwork. You judge them by people and by the floor.

What pushed us to build a real system

August 2023. Our Southern California frozen warehouse took on a new egg supplier — credentials in order, first three deliveries clean.

The fourth delivery arrived at 11 PM. The driver said his reefer unit was acting up and asked us to unload fast and release the goods. Our receiving lead, Lao Zhao — nine years on receiving, stubborn as they come — said nothing. He grabbed his core-temperature probe, cracked open two cases, and stuck the probe right into the product. Core temp came back at 46°F against our 38°F receiving limit. Lao Zhao: "This truck doesn't get received."

1,200 cases. The driver argued with him for half an hour that night. The client called me at midnight too, hinting we should "just receive it, don't hold up the line." I didn't budge. If we'd taken that load, the thawed-and-refrozen eggs would have been our bacterial risk to carry.

After that incident I made two rules, still enforced today: every inbound truck gets a core-temperature check on the product itself — not the trailer thermometer, the goods; and any receiver can reject a temperature-violating load on the spot, no need to ask me. Authority to reject turned out to be more powerful than any audit form.

The second wake-up call came in early 2024. The client designated a seasoning-powder contract manufacturer, saying "only their flavor passes, nobody else can make it." We went to audit. The system documents were immaculate. But our auditor, Xiao Wang, had a habit — he took a walk through their warehouse at night. Their pest-control log claimed glue boards were replaced weekly, with photos on file. He looked at the photos: three shots, the glue board in the exact same spot, the exact same angle, dated three different days. The board hadn't moved once. The photos were re-dated, not re-taken.

That's falsification, and no pretty documentation fixes it. We failed them. The client blew up — who supplies my goods then? Three paths: switch factories and tune the recipe to recover the missing flavor; station our person on site for three months of supervised correction, then re-audit; or we buy the raw materials and find a contract blender ourselves. The client picked option two. Three months later they passed the re-audit, and the partnership has been solid ever since.

What we audit: the three-layer checklist we actually use

After a few years of getting burned, we now run a fixed audit checklist with three layers. Each layer has clear "instant-fail" items — hit one and the audit stops, no point continuing.

Layer one: credentials. Business license, FDA facility registration (the registration number must be verifiable), product liability insurance, third-party food safety certification (GFSI-benchmarked, like SQF or BRC). This layer is simple, but check two things: expiry dates and certification scope. We've twice seen certificates that were genuine but whose scope didn't cover the product the supplier was making for us. The certificate didn't match the goods.

Layer two: systems. HACCP or food safety plan, pest-control records, temperature-control logs, mock recall records, training records. One rule when reading records: ask for three consecutive months of raw records — never summaries, never aggregated versions. Falsification always shows in the continuity of raw records: the glue-board photos I just described, or temperature logs that show the exact same pretty number every single day, zero fluctuation. That's not good. That's fake.

Layer three: the floor. Look at people, traffic flow, the corners nobody cleans. Four must-see spots: a visible temperature/humidity display at the cold-room door; whether clean and dirty traffic flows cross; locker room and restroom cleanliness (this tells you the real management standard); whether physical pest barriers — strip curtains, air curtains, door sweeps — are actually in use. Twenty minutes on the floor beats two hundred pages of documents.

Our instant-fail list is four items: expired or mismatched certificates; live pests found on site; falsified temperature records; refusal to show raw records. Hit any one of them and we walk. No wasted time.

How often: tiered by risk, not one-size-fits-all

At first we audited all 17 suppliers once a year, all on site. It wore out three people. Then we switched to risk tiers and only chase what matters.

We now run three tiers:

High risk (twice a year: one scheduled, one unannounced): fresh and frozen meat, egg, and dairy suppliers; ready-to-eat suppliers; any supplier with a quality incident in the past 12 months; any new partner under one year. No advance warning — we show up and see normal operations.

Medium risk (on-site every two years plus an annual self-assessment questionnaire): dry goods, seasonings, packaging-material suppliers; partners with two-plus clean years. The questionnaire renews credential files yearly, and they must declare any changes.

Low risk (on-site every three years plus annual credential check): office consumables, pallets, non-food-contact packaging. Once a year we just check that certificates are still valid.

Tiers aren't permanent. Downgrades are easy; upgrades are fast. A high-risk supplier with two clean years can move down to medium. But one temperature excursion or one foreign-object complaint sends them straight back to high risk, and the clock restarts. This rule is written into our supplier agreements, and suppliers sign it. Nobody argues.

Counterintuitive takeaway: the suppliers we audit hardest are usually the ones we have the best relationships with. Close auditing means you know their real capability and weak spots. The "good relationship, never audited" ones are the dangerous ones — when something goes wrong, you won't even know when they changed raw materials. An audit isn't about finding excuses to kill a supplier. It's about giving yourself the confidence to release their goods.

What we do when they fail: the corrective loop and the backup plan

When an audit fails, we run a three-step process, all documented in writing.

Step one: send the corrective-action notice within 48 hours — nonconformity, evidence photos, deadline. Deadlines scale with severity: 30 days for critical items like pests or temperature control, 60 for documentation.

Step two: during the correction period, our people follow up. Minor issues get a corrective report plus photos; major issues require an on-site re-audit. Pass the re-audit and supply resumes — but the supplier automatically moves to high risk for a one-year observation period.

Step three: when a supplier truly can't make it, we give them an exit ramp, not a dead end. Three backup plays: switch suppliers (keep one or two alternates warm, never scramble last-minute); stationed supervision during a correction window (like the seasoning factory — three months with our person on site); or restructure the product (if no alternative exists, negotiate a recipe or spec change with the client). The one thing we never do: keep using a supplier we know is noncompliant just because "they're the only ones who can make it." That's not business. That's gambling.

One more thing: keep audit records at least two years. When FDA inspectors show up, the first thing they ask for is your supplier audit and receiving records. We've had an inspector flip through three years of our audit files, see the closed-loop corrective records, and stop digging. Complete records are your own armor.

One reminder for fellow operators

Food warehouse supplier audits come down to one sentence: every shortcut you take on audits today becomes a phone call tomorrow night. The 11 PM delivery, the client's midnight pressure, the inspector's surprise visit — you can't dodge those. What you can do is keep your checklist, your risk tiers, and your corrective loop solid during normal days.

And don't make auditing one person's job. Lao Zhao dared to reject 1,200 cases because I gave him the authority. Xiao Wang dared to walk that warehouse at night because I'd told him "the floor matters more than the files." Hand real authority and real judgment criteria to your frontline people — that's when auditing stops being paperwork.

Do you audit suppliers by paper or by the floor? Come talk to me.

By Chen Feng, Warehouse Operations Manager