What this is
What is a supplier approval record?
What is a supplier approval record?
The record establishing that a supplier can consistently meet requirements for a specific material from a specific site: the evidence gathered, the technical requirements agreed, any trial or validation performed, and the approval decision with its scope and conditions.
Why does the approval scope matter?
Because the scope defines what the approval covers. A supplier approved for one material from one site is not thereby approved for another material, or for the same material from a different site, and unscoped approvals are how unassessed manufacturing locations enter a supply chain without anyone making a decision.
Scope
When is a supplier approval record required?
This approves a supplier for a scope. Ongoing performance and audit sit separately.
Use this template when
- Approving a new supplier for a specific material from a specific site
- Extending approval to an additional material or an additional manufacturing site
- Reassessing after ownership, site, process or certification change
- Approving distributors and brokers, where the manufacturer must also be identified
- Recording conditions or limitations attached to an approval
Do not use it for
- Supplier audits, which are an input to approval and to ongoing verification
- Supplier performance monitoring, which tracks delivered quality over time
- Incoming material inspection and certificates of analysis
- The supply agreement and commercial terms
- Supplier risk assessment, which addresses dependency as well as hazard
Compliance mapping
Which ISO 9001 cl.8.4.1 requirements does this satisfy?
Supplier control requirements appear across quality and food safety standards with a consistent risk-based structure.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.4.1 | Criteria for evaluation, selection, monitoring and re-evaluation of external providers, with records retained | Header |
| ISO 9001 cl.8.4.2 | Type and extent of control based on the effect on conformity of products and services | Evidence gathered |
| ISO 9001 cl.8.4.3 | Requirements communicated to the external provider before communication | Technical requirements |
| SQF Edition 9 cl.2.3 | Approved supplier programme with risk assessment, approval criteria and monitoring | Header |
| BRCGS Issue 9 cl.3.5 | Supplier and raw material approval based on risk assessment with defined approval procedures | Evidence gathered |
| 21 CFR 117 Subpart G | Supply chain programme where a hazard requires a supply chain applied control | Technical requirements |
| ISO 22000 cl.7.1.6 | Control of externally provided processes, products and services affecting food safety | Trial and decision |
| IATF 16949 cl.8.4.2.4 | Supplier monitoring with defined performance indicators and escalation | Trial and decision |
What it does not cover
- Supplier audits, an input to approval and to ongoing verification.
- Supplier performance monitoring, tracking delivered quality over time.
- Incoming inspection and certificates of analysis.
- Supply agreements and commercial terms.
- Supplier risk assessment, which addresses dependency as well as hazard.
How to complete it
How to complete a supplier approval record, step by step
Define the scope precisely, scale the evidence to the risk, and agree the specification first.
Manufacturing site address, the specific materials covered, and any conditions: volumes, grades, packaging formats or seasonal restrictions. Then make the purchasing system enforce it, because an approval scope that exists in a quality file and not in the ordering process constrains nothing.
A new supplier of an allergen-containing ingredient for a ready-to-eat product needs more than a long-standing supplier of packaging outer cases. Risk-based approval is explicit in the standards and it is what makes the programme sustainable, because uniform requirements produce either an unmanageable workload or a token exercise.
Attributes, limits, methods, sampling, certification and what happens on a deviation. A specification agreed after product arrives is a negotiation with material already on site and money already committed, and it is settled on very different terms from one agreed while the supplier is still being selected.
Where the supplier is a distributor, broker or agent, identify the actual manufacturing site and apply the approval there. Otherwise the approval covers a commercial relationship, and the distributor can change source without breaching anything you have agreed.
What auditors find
Most common supplier approval record findings
Supplier approval findings concentrate on scope and on what the evidence establishes.
| Finding | Clause | What fixes it |
|---|---|---|
| Approval granted at company level rather than site and material. | BRCGS 3.5 | Name the site; company approval permits supply from unassessed locations. |
| Certification treated as the assessment. | ISO 9001 cl.8.4.1 | It confirms a scheme audit at a point in time, not your requirements. |
| Specification agreed after first delivery. | ISO 9001 cl.8.4.3 | Requirements communicated before supply; afterwards it is a negotiation. |
| Uniform evidence requirements regardless of risk. | ISO 9001 cl.8.4.2 | Scale to consequence; uniform requirements produce a token exercise. |
| Distributor approved without identifying the manufacturer. | 21 CFR 117 Subpart G | Reach through; otherwise the source can change without notice. |
| Approval not reviewed after ownership, site or process change. | SQF 2.3 | Capability changes with all three and none announce themselves. |
| Approval scope not enforced in the purchasing system. | ISO 9001 cl.8.4.1 | A scope in a quality file constrains nothing at the point of ordering. |
| No trial or validation for a critical new material. | ISO 22000 cl.7.1.6 | Establish performance before commitment where consequence warrants it. |
| Allergen and regulatory status not confirmed at material level. | 21 CFR 117.135 | These attach to the material and the site, not to the supplier. |
| Emergency or temporary suppliers used outside the approval process. | BRCGS 3.5 | Define an expedited route with defined minimum evidence rather than an exception. |
Case in point
Case in point: the same company, a different plant
An ingredient supplier was approved on the strength of a site audit, current certification, specifications and satisfactory trial results. The approval was recorded against the company name.
Eighteen months later a quality investigation into an out-of-specification delivery established that the material had been manufactured at a second plant belonging to the same company, in a different country. The move had happened some months earlier for capacity reasons and had not been notified, because nothing in the agreement required it.
The second plant was not certified to the same scheme, used a different process for one step, and had never been assessed. No rule had been broken: the approval named a company, and the company had supplied the material.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- QUA-038
- Archetype
- Record
- Record ID
- SUPA-2026-000
- Scoring
- Approval score
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 9001 cl.8.4.1, SQF 2.3
- Links
- Links Vendor
- Tags
- Supplier, Quality
- Sections
- 4
- Fields
- 40
- Follow up fields
- 2
- Repeating sections
- 0
- Links out
- 5
Header
9 fieldsApproval ID*
Auto sequence. Format SUPA-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date*
Completed By*
Supplier*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Materials Supplied*
Material Risk Category*
High risk raw material, low risk ingredient, packaging or service.
- High risk raw material0 pts
- Medium risk ingredient1 pt
- Low risk ingredient2 pts
- Packaging2 pts
- Service3 pts
No Approval, No Delivery
Material from an unapproved supplier cannot be accepted. Goods in checks against this list before anything is booked in.
Evidence gathered
12 fieldsQuestionnaire Completed*
- Yes3 pts
- No0 pts
Questionnaire ID
Links to QUA-039 Questionnaire ID
Questionnaire Score
Certification Held*
GFSI recognised schemes reduce the audit burden considerably.
Certificate Attached
Certificate Expiry
Audit Required*
Audit ID
Links to QUA-040 Audit ID
Audit Outcome
- Passed3 pts
- Passed with actions2 pts
- Conditional1 pt
- Failed0 pts
Risk Assessment Completed*
- Yes3 pts
- No0 pts
Risk Assessment ID
Links to QUA-045 Assessment ID
Risk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Technical requirements
8 fieldsSpecification Agreed*
- Yes3 pts
- Draft1 pt
- No0 pts
Specification ID
Links to QUA-043 Spec ID
COA Requirements Agreed*
- Yes3 pts
- No0 pts
Allergen Status Declared*
- Yes3 pts
- Partial1 pt
- No0 pts
Country Of Origin Declared*
- Yes3 pts
- No0 pts
Traceability Capability Confirmed*
- Yes, tested3 pts
- Claimed only1 pt
- No0 pts
Food Fraud Vulnerability Assessed*
Required by GFSI schemes. High value ingredients and long supply chains carry most risk.
- Yes3 pts
- No0 pts
Subcontracting Declared*
- No subcontracting3 pts
- Declared2 pts
- Not disclosed0 pts
Trial and decision
11 fieldsTrial Deliveries Required*
Trial Deliveries Completed
Trial Result
- Passed3 pts
- Passed with issues1 pt
- Failed0 pts
Approval Decision*
- Approved3 pts
- Approved with conditions2 pts
- Conditional pending evidence1 pt
- Declined0 pts
Conditions Of Approval
Approval Valid Until*
Inspection Level Set*
- Reduced3 pts
- Normal2 pts
- Tightened1 pt
- 100 percent0 pts
Quality Manager*
Signature*
Procurement*
Second Signature*
QUA-038 · record IDs look like SUPA-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The record approves a source. What fails is a scope naming a company and a source that moved without notice.
Holds approval scoped to site and material with conditions, and scales evidence requirements to the risk of the material.
Enforces the approval scope at the point of ordering, so an unapproved site cannot supply against an approved code.
Flags ownership, certification and site changes as approval review triggers rather than waiting for a periodic cycle.
Tracks certification expiry and scheme scope, distinguishing what certification establishes from what it does not.
This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.
Meet KnowQuality→Glossary
Supplier Approval Record definitions and key terms
- Approval scope
- The specific site, materials and conditions an approval covers, which defines what may be supplied.
- Risk-based approval
- Scaling the evidence required to the consequence of failure for that material.
- Supply chain applied control
- A preventive control applied by the supplier where the hazard is controlled before receipt.
- Second-party audit
- An audit conducted by the customer, scoped to the customer's requirements rather than to a scheme.
- Certificate of analysis
- Supplier confirmation of results for a delivered batch, which verifies rather than approves.
- Reach-through
- Identifying and approving the actual manufacturer where the supplier is a distributor or broker.
- Approval decay
- Loss of validity through ownership, site, process or personnel change occurring without notification.
- Expedited approval
- A defined shorter route with minimum evidence, used instead of bypassing the process under pressure.
FAQ
Frequently asked questions about supplier approval record
What should an approval cover?+
A specific site and specific materials, with any conditions attached. Company-level approval permits supply from any manufacturing location the company operates, including ones with different equipment, controls and certification status that nobody has assessed. The scope also needs enforcing in the purchasing system, because a scope recorded only in a quality file constrains nothing at the point of ordering.
Is certification enough?+
No. Certification confirms that a management system was audited against a scheme at a point in time, by someone assessing conformity to that scheme rather than to your requirements. It is a useful starting point and it establishes a baseline, and it does not address whether the supplier can meet your specification for your application consistently.
How much evidence is enough?+
It scales with consequence. A new supplier of an allergen-containing ingredient for ready-to-eat product warrants far more than a long-standing supplier of outer packaging. Risk-based approval is explicit in the standards, and applying uniform requirements produces either an unmanageable workload or a process everyone completes without reading.
What about distributors and brokers?+
The approval has to reach the actual manufacturing site. Otherwise you have approved a commercial relationship, and the distributor can change source at any time without breaching anything, which is a common route by which unassessed manufacturers enter a supply chain invisibly.
When does an approval need revisiting?+
On ownership change, manufacturing site change, significant process change, loss or change of certification, and a pattern of performance issues. None of these announce themselves, which is why the agreement should require notification and why periodic reassessment exists as a backstop for the changes that were never notified.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Supplier Quality Assurance
Approved suppliers with evidence, and rejections that actually change behaviour.
Contracts and Purchasing
Nothing renewing by default, and no supplier trading before onboarding completes.
Supplier Onboarding and Lifecycle
No supplier trading before onboarding completes, and none left active after it ends.
Used together in Supplier Quality Assurance
Modern Slavery and Labour Standards Assessment
Assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions
Transport Provider Assessment
Assesses a haulier for licensing, driver management, vehicle standards, temperature capability and load security
Supplier Environmental Assessment
Assesses a supplier's environmental performance and certifications
Vendor and Contractor Register
Holds every supplier, contractor and service provider you work with, including their status and approval level
Material Rejection Report
Rejects incoming material that fails inspection
Supplier Questionnaire
Collects information about a supplier's systems, certifications and controls
More in Suppliers
Supplier Questionnaire
Collects information about a supplier's systems, certifications and controls
Supplier Audit
Audits a supplier's site against your requirements
Supplier Scorecard
Scores a supplier on quality, delivery, responsiveness and cost over a period
Supplier Corrective Request
Asks a supplier to investigate and fix a problem with their material or service
Material Specification Record
Holds the agreed specification for each material you buy, including tolerances and test methods
Certificate of Analysis Review
Checks the certificate supplied with a material against the agreed specification
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 9001:2015 clause 8.4, control of externally provided processes, products and services
- SQF Edition 9 clause 2.3, approved supplier programme
- BRCGS Food Safety Issue 9 clause 3.5, supplier and raw material management
- 21 CFR 117 Subpart G, supply chain programme, FDA
- ISO 22000:2018 clause 7.1.6, control of externally provided processes, products and services
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.