Knowella

Supplier Onboarding Checklist

A supplier onboarding checklist takes a supplier from selected to able to trade: banking verified, terms signed, technical approval done, system record created. Its recurring failure is sequence, not content. Somebody needs the material this week, the purchase order goes out before the technical steps finish, and an unapproved supplier becomes an approved one by the act of being paid. The checklist exists so that decision has to be made in the open.

KnowLogisticsChecklistLOG-030Pinned in navigation50 fields across 5 sectionsFull researchSee the form

Reviewed by Siddarth SinghCSPLast reviewed 16 August 2026

Basis
ISO 9001 cl.8.4
Workspace
KnowLogistics
Form type
Checklist
Raised
Once per new supplier, before the first purchase order
Feeds
Vendor Register (FDN-005) and Supplier Approval (QUA-038)

The short version

  • ISO 9001 clause 8.4.1 requires criteria for evaluating and selecting external providers, applied and evidenced per supplier. A procedure describing the criteria without a record showing they were applied to this supplier fails the audit.
  • The type and extent of control must be proportionate to the supplier's impact on conforming product. The Risk Tier field is that judgement, and it decides how much of the checklist can legitimately be marked N/A rather than being a label.
  • Banking details verified independently means through a channel the supplier did not supply. Payment fraud enters through onboarding far more often than through hacking, because the onboarding email chain is the attacker's easiest impersonation surface.
  • An audit can be waived; it cannot be skipped. 'Audit Completed Or Waived Deliberately' exists because the defensible position after a supplier failure is a recorded decision with a name on it, not an empty field nobody remembers.
  • In food and packaging supply chains, BRCGS 3.5.1 and the FSMA supply-chain programme both require risk-based supplier approval before material is accepted, which makes the technical section of this checklist a regulatory record, not an internal courtesy.
  • Days To Complete is the honest metric. If onboarding routinely takes longer than the business can wait for material, the process will be bypassed under pressure, and the fix is to shorten the process rather than to police the bypass.

What this is

What is a supplier onboarding checklist?

What is a supplier onboarding checklist?

A single record per new supplier that proves every gate was passed before trading began: company registration and banking verified, terms and pricing agreed in writing, insurance held, technical approval and certification checked, ethical assessment done, and the supplier set up in the vendor register and purchasing system. It is the evidence that selection criteria under ISO 9001 clause 8.4 were applied to this supplier, not just written into a procedure.

Who owns supplier onboarding?

Procurement owns the record; technical owns the approval decision inside it. That split is deliberate and both sign. When one function owns the whole thing, the commercial steps get done because they block payment and the technical steps get skipped because they only block risk. The two-signature close forces the functions to disagree in writing rather than by omission.

When is onboarding complete?

When every applicable item is answered, any waived step carries a waiver reference, the vendor register and supplier approval records exist and are linked, and both procurement and technical have signed. Not when the system record is created. A supplier who can be ordered from is not the same as a supplier who should be, and the gap between those two states is exactly what this checklist measures.

Scope

When is a supplier onboarding checklist required?

Onboarding is the assembly point, not the analysis. Each specialist judgement it collects has its own template, and doing that work inside the checklist produces a record that satisfies neither purpose.

Use this template when

  • A supplier has been selected and needs to move from chosen to able to trade
  • A supplier is being reactivated after a lapse and the original onboarding evidence is stale or missing
  • A supplier is extending into a new category, site or material that changes their risk tier
  • A purchase order is being requested for a supplier not yet on the vendor register
  • An audit or customer requires evidence that the approval sequence was followed for a named supplier

Do not use it for

  • Deciding whether to look for a supplier at all, which is the Supplier Sourcing Request (LOG-041) stating what is needed and why existing suppliers cannot provide it
  • Screening for sanctions, ownership, financial standing and adverse media, which is Supplier Due Diligence and Screening (LOG-042) and happens before commercial discussions go far
  • The bank verification callback itself, which is Supplier Bank Detail Verification (LOG-043); this checklist records that it happened, not the evidence of how
  • The technical approval decision and its basis, which is the Supplier Approval Record (QUA-038) backed by the Supplier Questionnaire (QUA-039) and Supplier Audit (QUA-040)
  • Ongoing performance after trading begins, which belongs to the Supplier Scorecard (QUA-041) and Supplier First Delivery Review (LOG-045)

Compliance mapping

Which ISO 9001 cl.8.4 requirements does this satisfy?

Regulation treats supplier approval as a controls question: prove you selected, evaluated and continue to control your external providers in proportion to the risk they carry. The onboarding checklist is where 'in proportion' gets decided and evidenced for each supplier.

ClauseRequirementWhere it lands
ISO 9001 cl.8.4.1Criteria for the evaluation, selection, monitoring and re-evaluation of external providers, with documented information of evaluations retainedCommercial
ISO 9001 cl.8.4.2Type and extent of control over the provider proportionate to the potential impact on conforming products and servicesHeader
ISO 9001 cl.8.4.3Requirements communicated to the provider: processes, product specifications, competence, and the controls the organisation will applySet up
BRCGS Food Safety Issue 9 cl.3.5.1Documented, risk-based approval of raw material and packaging suppliers before acceptance, with ongoing performance monitoringTechnical and compliance
FSMA 21 CFR 117 subpart GSupply-chain programme with supplier verification activities where a hazard is controlled by the supplier, before receiving the materialTechnical and compliance
ISO 22000 cl.7.1.6Control of externally provided processes, products and services, with criteria and evaluation results kept as documented informationTechnical and compliance
Modern Slavery Act 2015 s.54Annual transparency statement on steps taken against slavery and trafficking in supply chains, which the ethical assessment evidencesTechnical and compliance
ISO 9001 cl.7.5.3Documented information available where needed and protected against loss, including the evaluation and waiver recordsOutcome

What it does not cover

  • Due diligence and screening, which lives in Supplier Due Diligence and Screening (LOG-042): sanctions, ownership, litigation and adverse media are investigated there, before commercial discussions commit anything.
  • The bank verification evidence, which lives in Supplier Bank Detail Verification (LOG-043): the independently obtained number, who was called, and what was confirmed. This checklist records only that the verification exists.
  • The technical approval decision, which lives in the Supplier Approval Record (QUA-038) with its questionnaire and audit evidence. 'Technical Approval Completed: Yes' is a pointer to that record, not a substitute for it.
  • Ongoing supplier control, which lives in the Supplier Scorecard (QUA-041), Supplier Corrective Request (QUA-042) and Supplier Change Notification (LOG-046) once trading begins. Onboarding proves the starting state, not the continuing one.
  • Supplier exit, which lives in Supplier Offboarding and Exit (LOG-048). The programme's outcome is symmetric: no supplier trading before onboarding completes, and none left active after it ends.

Global

Supplier Onboarding Checklist requirements by country

No jurisdiction regulates supplier onboarding as such. What they regulate is the consequence of not doing it: unverified suppliers of food, unmanaged supply-chain hazards, and supply chains nobody examined for forced labour.

United States

FSMA, 21 CFR Part 117 subpart G and the FSVP rule (21 CFR Part 1 subpart L)

Supplier verification is mandatory where a hazard is controlled by the supplier, and importers must verify foreign suppliers before import.

For food, supplier approval is a federal requirement with the receiving facility liable, so 'the supplier is certified' is a verification input, not a conclusion.

United Kingdom

Food Safety Act 1990 due diligence defence; Modern Slavery Act 2015 s.54

Due diligence turns on whether all reasonable precautions were taken, and larger businesses must publish a supply-chain slavery statement.

The onboarding record is the first exhibit in a due diligence defence, and an ethical assessment marked N/A undermines the published statement.

European Union

Regulation (EC) 178/2002, art.18 traceability; Corporate Sustainability Due Diligence Directive

Operators must identify their immediate suppliers one step back, and large companies face supply-chain due diligence duties as the CSDDD phases in.

The vendor register entry this checklist feeds is the one-step-back traceability record a food authority asks for first.

Canada

Safe Food for Canadians Regulations, preventive control plan and traceability provisions

Licence holders must control hazards including those arising from incoming materials, with traceability one step back.

CFIA inspection of a preventive control plan reaches supplier approval evidence, so the checklist is inspectable, not internal.

Australia

Food Standards Code, Standard 3.2.2 receipt of food provisions; Modern Slavery Act 2018 (Cth)

Food businesses must take reasonable steps to ensure food received is safe and traceable, and large entities report on modern slavery risk.

Both duties are discharged supplier by supplier, which is the grain this checklist records at.

International

ISO 9001 cl.8.4; ISO 22000 cl.7.1.6; GFSI schemes (BRCGS, SQF, FSSC 22000)

Management system and certification requirements for documented, risk-based supplier approval before acceptance of materials.

Certification auditors sample the register and walk back to the onboarding evidence, so the weakest recent onboarding sets the audit outcome.

How to complete it

How to complete a supplier onboarding checklist, step by step

Every item on this checklist can be answered Yes and the record can still be worthless, because the value is in what the Yes stands on. Four judgements decide whether the record would survive an investigation.

Set the risk tier before answering anything else

The Risk Tier field is the control decision ISO 9001 clause 8.4.2 asks for, and it governs what N/A legitimately means further down. An agency labour supplier does not need allergen information; a raw material supplier does not get to skip the audit question. Tier set last, or set to match the answers already given, converts a control into a rationalisation.

Treat 'verified independently' as a channel question

Banking details verified against the supplier's own letterhead, invoice or email chain are not verified at all, because every one of those artefacts is controlled by whoever sent the email. Independent means a phone number obtained from a source the counterparty did not provide. If the answer to how the number was obtained is 'from the email', the field is No regardless of what was ticked.

Waive in writing or not at all

'Audit Completed Or Waived Deliberately' and 'Any Step Waived' exist because real onboarding happens under commercial pressure and steps do get skipped. The defensible version is a waiver record with an owner, a reason and a revisit date, referenced in the Waiver ID field. The indefensible version is the same skip with nothing written down, discovered eighteen months later by an incident investigator.

Close the loop into the register before signing

The Vendor ID and Supplier Approval ID fields are what make this record navigable later: from the register entry back to the evidence, and from the evidence forward to the approval. An onboarding record that does not name the register entry it created is an orphan, and orphaned evidence is functionally missing when a customer auditor asks how this supplier was approved.

What auditors find

Most common supplier onboarding checklist findings

Onboarding findings cluster around sequence and evidence: the trading that started early, the Yes with nothing behind it, and the waiver nobody wrote down.

FindingClauseWhat fixes it
Purchase orders issued to the supplier before onboarding closed.ISO 9001 cl.8.4.1Make vendor master creation the final setup step and block PO release on onboarding status.
Technical approval marked Yes with no Supplier Approval Record linked.ISO 9001 cl.8.4.1Require the QUA-038 Approval ID before the technical answer can be Yes.
Banking verification evidenced only by supplier-supplied documents.Internal financial controlRecord the independently sourced contact route in LOG-043 and reference it here.
Risk tier identical across all suppliers, so extent of control is not proportionate.ISO 9001 cl.8.4.2Define tier criteria by category and impact, and calibrate against worked examples.
Audit neither completed nor deliberately waived; the field is simply N/A.BRCGS Food Safety Issue 9 cl.3.5.1Restrict N/A to categories the approval procedure exempts; everything else is Yes or a waiver.
Allergen and origin information not obtained for a raw material supplier.FSMA 21 CFR 117 subpart GGate first receipt on specification and allergen information for material suppliers.
Waiver granted verbally; Waiver ID field empty on a record marked 'Any Step Waived: Yes'.ISO 9001 cl.7.5.3Raise the FDN-030 waiver with owner, reason and revisit date before closing the checklist.
Certification 'verified' by holding an expired or wrong-scope certificate.ISO 22000 cl.7.1.6Check scope, site and expiry against the issuing body's directory, not the PDF.
Ethical and labour assessment marked N/A for agency labour and service providers.Modern Slavery Act 2015 s.54Invert the exemption: labour-intensive categories are where the assessment is least optional.
Onboarding closed by procurement alone; second signature missing or same person.ISO 9001 cl.8.4.1Enforce distinct procurement and technical signatories at close.

Case in point

Case in point: the substitute supplier who was approved by invoice

A food manufacturer lost its seasoning supplier to a fire and had four days of stock. The buyer found a substitute, and onboarding started properly: company details verified, pricing agreed, checklist raised. Then planning needed a delivery date, so the vendor record was created early to let the purchase order through. Technical approval, specification and the allergen question were left In Progress, to be finished once the material was flowing.

The first three deliveries ran fine, and the checklist quietly aged out of everyone's queue. Five months later a routine customer audit sampled the seasoning and asked for the supplier approval. There was none. Worse, the specification had never been agreed, and the substitute's blend carried mustard, which the original's had not. The allergen was not on the finished product label. The customer required a withdrawal, and the manufacturer bore the cost, because the due diligence position was an onboarding checklist stuck at In Progress with a purchase order dated before it.

Nobody had decided to trade with an unapproved supplier. The decision was made by the ERP, which only checked that a vendor record existed. The corrective action was not more training; it was resequencing the checklist so system setup is the last gate, and adding a deliberate waiver route so that a four-day emergency produces a signed, time-boxed waiver instead of a permanently unfinished record.

The template

The template, field by field

The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.

50fields
5 sections
Reference
LOG-030
Archetype
Checklist
Record ID
SONB-2026-000
Scoring
Onboarding complete
Direction
High is good
Singleton
Yes
Basis
ISO 9001 cl.8.4
Links
Feeds Vendor Register and Supplier Approval
Tags
Supplier, Onboarding, Commercial
Sections
5
Fields
50
Follow up fields
4
Repeating sections
0
Links out
5
Field typesOwn ID, generated on saveCase thread and parentPick list from a registryLinked to another templateFollow up, dashed outlineScored

Header

13 fields
Text

Onboarding ID*

Generated on save

Auto sequence. Format SONB-2026-000.

The record's own ID. Other templates point at this value.

Single Choice

Status*

Scored

Drives who this goes to next.

  • Planned2 pts
  • In progress2 pts
  • Complete3 pts
  • Deferred0 pts
  • Open0 pts
  • Closed3 pts
  • Overdue0 pts
Date & Time

Date and Time*

Users

Completed By*

Pick List

Site*

From FDN-001 Site NameFilter: Status is Active
Text

Site ID*

Linked

Format SITE-000.

Links to FDN-001 Site ID

Text

Supplier Name*

Single Choice

Supplier Category*

Scored

Raw material, packaging, ingredient, service, equipment, laboratory, haulier, or agency.

  • Raw materialnot scored
  • Packagingnot scored
  • Ingredientnot scored
  • Servicenot scored
  • Equipmentnot scored
  • Laboratorynot scored
  • Hauliernot scored
  • Agencynot scored
Single Choice

Risk Tier*

Scored
  • Low3 pts
  • Medium2 pts
  • High1 pt
  • Very high0 pts
Users

Requested By*

Users

Procurement Owner*

Text

First Order Required By

Optional
Info

Where An Unapproved Supplier Becomes Approved

Somebody needs the material this week, so the technical approval is skipped and the purchase order goes out anyway. This checklist exists so that decision has to be made in the open.

Commercial

6 fields
Single Choice

Company Details And Registration Verified*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Banking Details Verified Independently*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Terms Agreed In Writing*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Pricing Agreed*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Insurance Certificates Held*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Contract Or Purchase Terms Signed*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator

Technical and compliance

6 fields
Single Choice

Technical Approval Completed*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Certification Verified Where Required*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Specification Agreed*

Scored
  • Yes3 pts
  • Draft1 pt
  • No0 pts
Single Choice

Audit Completed Or Waived Deliberately*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Allergen And Origin Information Obtained*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Ethical And Labour Assessment Completed*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator

Set up

6 fields
Single Choice

Added To The Vendor Register*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

System Record Created*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Delivery Instructions Issued*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Booking Process Explained*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Site Rules Issued*

Scored
  • Yes3 pts
  • No0 pts
Single Choice

First Delivery Monitored*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator

Outcome

19 fields
Single Choice

Onboarding Complete*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Numeric Answer

Days To Complete

OptionalScored
Single Choice

Any Step Waived*

Scored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Text

Waiver ID

OptionalLinkedShows if Any Step Waived equals Yes

Links to FDN-030 Waiver ID

Text

Vendor ID

OptionalLinked

Links to FDN-005 Vendor ID

Text

Supplier Approval ID

OptionalLinked

Links to QUA-038 Approval ID

Numeric Answer

Items Assessed*

Excludes anything marked N/A.

Numeric Answer

Items Failed*

Numeric Answer

Score Percent*

Scored

Calculated on submission. High is good. N/A items leave the denominator.

Single Choice

Result Band*

Scored
  • Pass3 pts
  • Caution1 pt
  • Fail0 pts
Numeric Answer

Completeness Percent*

How much of the template was actually answered. A high score on a half completed form is not a high score.

Single Choice

Action Required*

Scored

Raise the action record, then enter its reference here.

  • No2 pts
  • Yes0 pts
Single Choice

Priority

OptionalScoredShows if Action Required equals Yes
  • High0 pts
  • Medium1 pt
  • Low3 pts
Text

CAPA ID

OptionalLinkedShows if Action Required equals Yes

Format CAPA-2026-00000.

Links to FDN-014 CAPA ID

Users

Action Owner

OptionalShows if Action Required equals Yes
Users

Procurement*

Signature

Signature*

Users

Technical*

Signature

Second Signature*

LOG-030 · record IDs look like SONB-2026-000 · Feeds Vendor Register and Supplier Approval

Open in Knowella

Run it with agents

From a document you fill in to a programme that runs itself

The checklist is a list; the failure is coordination. Six functions each own two fields, nobody owns the sequence, and the record stalls at eighty percent while the purchase orders flow.

KnowLogistics

Runs the onboarding queue against the vendor register, routes each open step to the function that owns it, and keeps the waiver, approval and register references linked on the record.

KnowQuality

Holds the technical side: questionnaire, audit, certification and specification records that the checklist's technical answers point to.

KnowComply

Tracks the ethical, insurance and certificate expiries that onboarding captured, so approval does not silently lapse while trading continues.

Ella
Ella

Flags suppliers with purchase activity but no closed onboarding, chases the stalled step with its owner, and surfaces waivers approaching their revisit date.

This template lives in KnowLogistics — supply chain execution. Inbound, outbound, inventory, yard, claims, supplier lifecycle and customs.

Glossary

Supplier Onboarding Checklist definitions and key terms

Approved supplier
A supplier whose evaluation against defined criteria is complete and evidenced, and who appears on the vendor register with that status. Approval is a recorded state, not a relationship.
Technical approval
The quality function's decision that a supplier can meet specification, based on questionnaire, certification and audit evidence, recorded in the Supplier Approval Record.
Risk tier
The classification of a supplier's potential impact on product conformity and continuity, which sets how much verification onboarding requires and how often re-evaluation recurs.
Independent bank verification
Confirming payment details through a contact channel obtained from a source other than the supplier's own correspondence, defeating invoice-redirection fraud.
Waiver
A recorded, owned, time-boxed decision to proceed without a completed onboarding step, carrying a reason and a revisit date. The alternative to a skip.
Vendor register
The controlled list of suppliers and their approval status, which purchasing systems should read as the source of truth for who can receive an order.
Certificate verification
Checking a supplier's certification for scope, site and validity against the certification body's directory rather than accepting the document itself.
Supply-chain programme
Under FSMA, the documented system of supplier approval and verification a receiving facility must run where a hazard is controlled by its supplier.

FAQ

Frequently asked questions about supplier onboarding checklist

Can we start buying while onboarding is still in progress?+

Only through the waiver route, and only for the steps actually waived. A time-boxed waiver signed by someone with authority to accept the risk is a defensible position; an In Progress checklist with purchase orders behind it is the single most common supplier finding and has no defence at all. If the business needs a faster path, shorten the checklist for low-tier suppliers rather than tolerating the bypass.

Does a certified supplier still need technical approval?+

Yes. Certification is evidence within the approval, not a replacement for it. The certificate must be checked for scope, site and expiry, and it says nothing about your specification, your allergen requirements or your delivery constraints. Under FSMA, reliance on certification is one verification activity among several, and the receiving facility stays responsible either way.

Who verifies banking details, procurement or finance?+

Finance, or someone outside the buying relationship. The buyer has the motive to move fast and owns the email chain an impersonator would have compromised, which makes them the wrong person to perform the callback. The checklist should record that verification happened and reference the LOG-043 record; it should not be the place the verification is performed.

How long should onboarding take?+

Track Days To Complete and answer with your own data, but the useful comparison is against how long the business can actually wait for a new supplier. When onboarding routinely exceeds that, the process gets bypassed under pressure. Most of the elapsed time is usually waiting on supplier documents, which argues for starting the technical requests at selection rather than after commercial agreement.

What does N/A legitimately mean on this checklist?+

That the step does not apply to this supplier's category and tier under your approval procedure, and the procedure says so. Allergen information is genuinely N/A for a haulier. It is not N/A for an ingredient supplier who has not sent it yet, and using N/A to mean 'not yet' is how incomplete onboarding disguises itself as complete, because N/A items leave the scoring denominator.

Is one onboarding record enough if the supplier serves several sites?+

One commercial onboarding, usually, but the technical position is per material and sometimes per supplying site, and delivery instructions and site rules differ by receiving site. The practical pattern is one checklist per supplier anchored to the lead site, with the approval record carrying the material and site scope, and a new checklist when the supplier extends into a category or site the original never covered.

Keep going

Related templates and programmes

Siddarth Singh

Written and reviewed by

Siddarth Singh

Founder & Chief Executive Officer, Knowella

Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.

  • Certified Safety Professional (CSP), Board of Certified Safety Professionals
  • MBA, University of Chicago Booth School of Business
  • MS and BS, The Ohio State University, Industrial and Systems Engineering
  • Six Sigma Black Belt
Verify with BCSP →

Sources and last review. Reviewed 16 August 2026 against:

  • ISO 9001:2015 clause 8.4, control of externally provided processes, products and services
  • ISO 22000:2018 clause 7.1.6, control of externally provided processes, products and services
  • BRCGS Global Standard Food Safety Issue 9, section 3.5, supplier and raw material approval and performance monitoring
  • FSMA Preventive Controls for Human Food, 21 CFR Part 117 subpart G, supply-chain program
  • FSMA Foreign Supplier Verification Programs, 21 CFR Part 1 subpart L
  • Modern Slavery Act 2015, section 54, transparency in supply chains (UK)
  • Safe Food for Canadians Regulations, preventive controls and traceability provisions

This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.

Start in Minutes, Not Weeks

Launch a Ready-Made Template and Customize It Your Way

Every template is fully editable. Adjust fields, workflows, and branding to match your processes, then deploy to your team instantly.