What this is
What is a supplier onboarding checklist?
What is a supplier onboarding checklist?
A single record per new supplier that proves every gate was passed before trading began: company registration and banking verified, terms and pricing agreed in writing, insurance held, technical approval and certification checked, ethical assessment done, and the supplier set up in the vendor register and purchasing system. It is the evidence that selection criteria under ISO 9001 clause 8.4 were applied to this supplier, not just written into a procedure.
Who owns supplier onboarding?
Procurement owns the record; technical owns the approval decision inside it. That split is deliberate and both sign. When one function owns the whole thing, the commercial steps get done because they block payment and the technical steps get skipped because they only block risk. The two-signature close forces the functions to disagree in writing rather than by omission.
When is onboarding complete?
When every applicable item is answered, any waived step carries a waiver reference, the vendor register and supplier approval records exist and are linked, and both procurement and technical have signed. Not when the system record is created. A supplier who can be ordered from is not the same as a supplier who should be, and the gap between those two states is exactly what this checklist measures.
Scope
When is a supplier onboarding checklist required?
Onboarding is the assembly point, not the analysis. Each specialist judgement it collects has its own template, and doing that work inside the checklist produces a record that satisfies neither purpose.
Use this template when
- A supplier has been selected and needs to move from chosen to able to trade
- A supplier is being reactivated after a lapse and the original onboarding evidence is stale or missing
- A supplier is extending into a new category, site or material that changes their risk tier
- A purchase order is being requested for a supplier not yet on the vendor register
- An audit or customer requires evidence that the approval sequence was followed for a named supplier
Do not use it for
- Deciding whether to look for a supplier at all, which is the Supplier Sourcing Request (LOG-041) stating what is needed and why existing suppliers cannot provide it
- Screening for sanctions, ownership, financial standing and adverse media, which is Supplier Due Diligence and Screening (LOG-042) and happens before commercial discussions go far
- The bank verification callback itself, which is Supplier Bank Detail Verification (LOG-043); this checklist records that it happened, not the evidence of how
- The technical approval decision and its basis, which is the Supplier Approval Record (QUA-038) backed by the Supplier Questionnaire (QUA-039) and Supplier Audit (QUA-040)
- Ongoing performance after trading begins, which belongs to the Supplier Scorecard (QUA-041) and Supplier First Delivery Review (LOG-045)
Compliance mapping
Which ISO 9001 cl.8.4 requirements does this satisfy?
Regulation treats supplier approval as a controls question: prove you selected, evaluated and continue to control your external providers in proportion to the risk they carry. The onboarding checklist is where 'in proportion' gets decided and evidenced for each supplier.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.4.1 | Criteria for the evaluation, selection, monitoring and re-evaluation of external providers, with documented information of evaluations retained | Commercial |
| ISO 9001 cl.8.4.2 | Type and extent of control over the provider proportionate to the potential impact on conforming products and services | Header |
| ISO 9001 cl.8.4.3 | Requirements communicated to the provider: processes, product specifications, competence, and the controls the organisation will apply | Set up |
| BRCGS Food Safety Issue 9 cl.3.5.1 | Documented, risk-based approval of raw material and packaging suppliers before acceptance, with ongoing performance monitoring | Technical and compliance |
| FSMA 21 CFR 117 subpart G | Supply-chain programme with supplier verification activities where a hazard is controlled by the supplier, before receiving the material | Technical and compliance |
| ISO 22000 cl.7.1.6 | Control of externally provided processes, products and services, with criteria and evaluation results kept as documented information | Technical and compliance |
| Modern Slavery Act 2015 s.54 | Annual transparency statement on steps taken against slavery and trafficking in supply chains, which the ethical assessment evidences | Technical and compliance |
| ISO 9001 cl.7.5.3 | Documented information available where needed and protected against loss, including the evaluation and waiver records | Outcome |
What it does not cover
- Due diligence and screening, which lives in Supplier Due Diligence and Screening (LOG-042): sanctions, ownership, litigation and adverse media are investigated there, before commercial discussions commit anything.
- The bank verification evidence, which lives in Supplier Bank Detail Verification (LOG-043): the independently obtained number, who was called, and what was confirmed. This checklist records only that the verification exists.
- The technical approval decision, which lives in the Supplier Approval Record (QUA-038) with its questionnaire and audit evidence. 'Technical Approval Completed: Yes' is a pointer to that record, not a substitute for it.
- Ongoing supplier control, which lives in the Supplier Scorecard (QUA-041), Supplier Corrective Request (QUA-042) and Supplier Change Notification (LOG-046) once trading begins. Onboarding proves the starting state, not the continuing one.
- Supplier exit, which lives in Supplier Offboarding and Exit (LOG-048). The programme's outcome is symmetric: no supplier trading before onboarding completes, and none left active after it ends.
Global
Supplier Onboarding Checklist requirements by country
No jurisdiction regulates supplier onboarding as such. What they regulate is the consequence of not doing it: unverified suppliers of food, unmanaged supply-chain hazards, and supply chains nobody examined for forced labour.
FSMA, 21 CFR Part 117 subpart G and the FSVP rule (21 CFR Part 1 subpart L)
Supplier verification is mandatory where a hazard is controlled by the supplier, and importers must verify foreign suppliers before import.
For food, supplier approval is a federal requirement with the receiving facility liable, so 'the supplier is certified' is a verification input, not a conclusion.
Food Safety Act 1990 due diligence defence; Modern Slavery Act 2015 s.54
Due diligence turns on whether all reasonable precautions were taken, and larger businesses must publish a supply-chain slavery statement.
The onboarding record is the first exhibit in a due diligence defence, and an ethical assessment marked N/A undermines the published statement.
Regulation (EC) 178/2002, art.18 traceability; Corporate Sustainability Due Diligence Directive
Operators must identify their immediate suppliers one step back, and large companies face supply-chain due diligence duties as the CSDDD phases in.
The vendor register entry this checklist feeds is the one-step-back traceability record a food authority asks for first.
Safe Food for Canadians Regulations, preventive control plan and traceability provisions
Licence holders must control hazards including those arising from incoming materials, with traceability one step back.
CFIA inspection of a preventive control plan reaches supplier approval evidence, so the checklist is inspectable, not internal.
Food Standards Code, Standard 3.2.2 receipt of food provisions; Modern Slavery Act 2018 (Cth)
Food businesses must take reasonable steps to ensure food received is safe and traceable, and large entities report on modern slavery risk.
Both duties are discharged supplier by supplier, which is the grain this checklist records at.
ISO 9001 cl.8.4; ISO 22000 cl.7.1.6; GFSI schemes (BRCGS, SQF, FSSC 22000)
Management system and certification requirements for documented, risk-based supplier approval before acceptance of materials.
Certification auditors sample the register and walk back to the onboarding evidence, so the weakest recent onboarding sets the audit outcome.
How to complete it
How to complete a supplier onboarding checklist, step by step
Every item on this checklist can be answered Yes and the record can still be worthless, because the value is in what the Yes stands on. Four judgements decide whether the record would survive an investigation.
The Risk Tier field is the control decision ISO 9001 clause 8.4.2 asks for, and it governs what N/A legitimately means further down. An agency labour supplier does not need allergen information; a raw material supplier does not get to skip the audit question. Tier set last, or set to match the answers already given, converts a control into a rationalisation.
Banking details verified against the supplier's own letterhead, invoice or email chain are not verified at all, because every one of those artefacts is controlled by whoever sent the email. Independent means a phone number obtained from a source the counterparty did not provide. If the answer to how the number was obtained is 'from the email', the field is No regardless of what was ticked.
'Audit Completed Or Waived Deliberately' and 'Any Step Waived' exist because real onboarding happens under commercial pressure and steps do get skipped. The defensible version is a waiver record with an owner, a reason and a revisit date, referenced in the Waiver ID field. The indefensible version is the same skip with nothing written down, discovered eighteen months later by an incident investigator.
The Vendor ID and Supplier Approval ID fields are what make this record navigable later: from the register entry back to the evidence, and from the evidence forward to the approval. An onboarding record that does not name the register entry it created is an orphan, and orphaned evidence is functionally missing when a customer auditor asks how this supplier was approved.
What auditors find
Most common supplier onboarding checklist findings
Onboarding findings cluster around sequence and evidence: the trading that started early, the Yes with nothing behind it, and the waiver nobody wrote down.
| Finding | Clause | What fixes it |
|---|---|---|
| Purchase orders issued to the supplier before onboarding closed. | ISO 9001 cl.8.4.1 | Make vendor master creation the final setup step and block PO release on onboarding status. |
| Technical approval marked Yes with no Supplier Approval Record linked. | ISO 9001 cl.8.4.1 | Require the QUA-038 Approval ID before the technical answer can be Yes. |
| Banking verification evidenced only by supplier-supplied documents. | Internal financial control | Record the independently sourced contact route in LOG-043 and reference it here. |
| Risk tier identical across all suppliers, so extent of control is not proportionate. | ISO 9001 cl.8.4.2 | Define tier criteria by category and impact, and calibrate against worked examples. |
| Audit neither completed nor deliberately waived; the field is simply N/A. | BRCGS Food Safety Issue 9 cl.3.5.1 | Restrict N/A to categories the approval procedure exempts; everything else is Yes or a waiver. |
| Allergen and origin information not obtained for a raw material supplier. | FSMA 21 CFR 117 subpart G | Gate first receipt on specification and allergen information for material suppliers. |
| Waiver granted verbally; Waiver ID field empty on a record marked 'Any Step Waived: Yes'. | ISO 9001 cl.7.5.3 | Raise the FDN-030 waiver with owner, reason and revisit date before closing the checklist. |
| Certification 'verified' by holding an expired or wrong-scope certificate. | ISO 22000 cl.7.1.6 | Check scope, site and expiry against the issuing body's directory, not the PDF. |
| Ethical and labour assessment marked N/A for agency labour and service providers. | Modern Slavery Act 2015 s.54 | Invert the exemption: labour-intensive categories are where the assessment is least optional. |
| Onboarding closed by procurement alone; second signature missing or same person. | ISO 9001 cl.8.4.1 | Enforce distinct procurement and technical signatories at close. |
Case in point
Case in point: the substitute supplier who was approved by invoice
A food manufacturer lost its seasoning supplier to a fire and had four days of stock. The buyer found a substitute, and onboarding started properly: company details verified, pricing agreed, checklist raised. Then planning needed a delivery date, so the vendor record was created early to let the purchase order through. Technical approval, specification and the allergen question were left In Progress, to be finished once the material was flowing.
The first three deliveries ran fine, and the checklist quietly aged out of everyone's queue. Five months later a routine customer audit sampled the seasoning and asked for the supplier approval. There was none. Worse, the specification had never been agreed, and the substitute's blend carried mustard, which the original's had not. The allergen was not on the finished product label. The customer required a withdrawal, and the manufacturer bore the cost, because the due diligence position was an onboarding checklist stuck at In Progress with a purchase order dated before it.
Nobody had decided to trade with an unapproved supplier. The decision was made by the ERP, which only checked that a vendor record existed. The corrective action was not more training; it was resequencing the checklist so system setup is the last gate, and adding a deliberate waiver route so that a four-day emergency produces a signed, time-boxed waiver instead of a permanently unfinished record.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- LOG-030
- Archetype
- Checklist
- Record ID
- SONB-2026-000
- Scoring
- Onboarding complete
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 9001 cl.8.4
- Links
- Feeds Vendor Register and Supplier Approval
- Tags
- Supplier, Onboarding, Commercial
- Sections
- 5
- Fields
- 50
- Follow up fields
- 4
- Repeating sections
- 0
- Links out
- 5
Header
13 fieldsOnboarding ID*
Auto sequence. Format SONB-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Supplier Name*
Supplier Category*
Raw material, packaging, ingredient, service, equipment, laboratory, haulier, or agency.
- Raw materialnot scored
- Packagingnot scored
- Ingredientnot scored
- Servicenot scored
- Equipmentnot scored
- Laboratorynot scored
- Hauliernot scored
- Agencynot scored
Risk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Requested By*
Procurement Owner*
First Order Required By
Where An Unapproved Supplier Becomes Approved
Somebody needs the material this week, so the technical approval is skipped and the purchase order goes out anyway. This checklist exists so that decision has to be made in the open.
Commercial
6 fieldsCompany Details And Registration Verified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Banking Details Verified Independently*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Terms Agreed In Writing*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Pricing Agreed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Insurance Certificates Held*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Contract Or Purchase Terms Signed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Technical and compliance
6 fieldsTechnical Approval Completed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Certification Verified Where Required*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Specification Agreed*
- Yes3 pts
- Draft1 pt
- No0 pts
Audit Completed Or Waived Deliberately*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Allergen And Origin Information Obtained*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Ethical And Labour Assessment Completed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Set up
6 fieldsAdded To The Vendor Register*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
System Record Created*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Delivery Instructions Issued*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Booking Process Explained*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Site Rules Issued*
- Yes3 pts
- No0 pts
First Delivery Monitored*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Outcome
19 fieldsOnboarding Complete*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Days To Complete
Any Step Waived*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Waiver ID
Links to FDN-030 Waiver ID
Vendor ID
Links to FDN-005 Vendor ID
Supplier Approval ID
Links to QUA-038 Approval ID
Items Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Procurement*
Signature*
Technical*
Second Signature*
LOG-030 · record IDs look like SONB-2026-000 · Feeds Vendor Register and Supplier Approval
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The checklist is a list; the failure is coordination. Six functions each own two fields, nobody owns the sequence, and the record stalls at eighty percent while the purchase orders flow.
Runs the onboarding queue against the vendor register, routes each open step to the function that owns it, and keeps the waiver, approval and register references linked on the record.
Holds the technical side: questionnaire, audit, certification and specification records that the checklist's technical answers point to.
Tracks the ethical, insurance and certificate expiries that onboarding captured, so approval does not silently lapse while trading continues.

Flags suppliers with purchase activity but no closed onboarding, chases the stalled step with its owner, and surfaces waivers approaching their revisit date.
This template lives in KnowLogistics — supply chain execution. Inbound, outbound, inventory, yard, claims, supplier lifecycle and customs.
Glossary
Supplier Onboarding Checklist definitions and key terms
- Approved supplier
- A supplier whose evaluation against defined criteria is complete and evidenced, and who appears on the vendor register with that status. Approval is a recorded state, not a relationship.
- Technical approval
- The quality function's decision that a supplier can meet specification, based on questionnaire, certification and audit evidence, recorded in the Supplier Approval Record.
- Risk tier
- The classification of a supplier's potential impact on product conformity and continuity, which sets how much verification onboarding requires and how often re-evaluation recurs.
- Independent bank verification
- Confirming payment details through a contact channel obtained from a source other than the supplier's own correspondence, defeating invoice-redirection fraud.
- Waiver
- A recorded, owned, time-boxed decision to proceed without a completed onboarding step, carrying a reason and a revisit date. The alternative to a skip.
- Vendor register
- The controlled list of suppliers and their approval status, which purchasing systems should read as the source of truth for who can receive an order.
- Certificate verification
- Checking a supplier's certification for scope, site and validity against the certification body's directory rather than accepting the document itself.
- Supply-chain programme
- Under FSMA, the documented system of supplier approval and verification a receiving facility must run where a hazard is controlled by its supplier.
FAQ
Frequently asked questions about supplier onboarding checklist
Can we start buying while onboarding is still in progress?+
Only through the waiver route, and only for the steps actually waived. A time-boxed waiver signed by someone with authority to accept the risk is a defensible position; an In Progress checklist with purchase orders behind it is the single most common supplier finding and has no defence at all. If the business needs a faster path, shorten the checklist for low-tier suppliers rather than tolerating the bypass.
Does a certified supplier still need technical approval?+
Yes. Certification is evidence within the approval, not a replacement for it. The certificate must be checked for scope, site and expiry, and it says nothing about your specification, your allergen requirements or your delivery constraints. Under FSMA, reliance on certification is one verification activity among several, and the receiving facility stays responsible either way.
Who verifies banking details, procurement or finance?+
Finance, or someone outside the buying relationship. The buyer has the motive to move fast and owns the email chain an impersonator would have compromised, which makes them the wrong person to perform the callback. The checklist should record that verification happened and reference the LOG-043 record; it should not be the place the verification is performed.
How long should onboarding take?+
Track Days To Complete and answer with your own data, but the useful comparison is against how long the business can actually wait for a new supplier. When onboarding routinely exceeds that, the process gets bypassed under pressure. Most of the elapsed time is usually waiting on supplier documents, which argues for starting the technical requests at selection rather than after commercial agreement.
What does N/A legitimately mean on this checklist?+
That the step does not apply to this supplier's category and tier under your approval procedure, and the procedure says so. Allergen information is genuinely N/A for a haulier. It is not N/A for an ingredient supplier who has not sent it yet, and using N/A to mean 'not yet' is how incomplete onboarding disguises itself as complete, because N/A items leave the scoring denominator.
Is one onboarding record enough if the supplier serves several sites?+
One commercial onboarding, usually, but the technical position is per material and sometimes per supplying site, and delivery instructions and site rules differ by receiving site. The practical pattern is one checklist per supplier anchored to the lead site, with the approval record carrying the material and site scope, and a new checklist when the supplier extends into a category or site the original never covered.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Supplier Onboarding and Lifecycle
Conflict of Interest Declaration
Records a declared interest that could affect a business decision, and how it will be managed
Vendor and Contractor Register
Holds every supplier, contractor and service provider you work with, including their status and approval level
Supplier Sourcing Request
Starts the process of finding a new supplier, stating what is needed, why the existing suppliers cannot provide it and what the selection criteria will be
Supplier Due Diligence and Screening
Screens a prospective supplier for financial standing, ownership, sanctions exposure, litigation and adverse media before commercial discussions go far
Supplier Bank Detail Verification
Verifies a supplier's bank details through an independently obtained phone number before any payment is set up or changed
Supplier Master Data Setup
Creates the supplier record in the systems that will use it, covering codes, terms, tax status, addresses and approval scope
More in Supplier Lifecycle
Supplier Sourcing Request
Starts the process of finding a new supplier, stating what is needed, why the existing suppliers cannot provide it and what the selection criteria will be
Supplier Due Diligence and Screening
Screens a prospective supplier for financial standing, ownership, sanctions exposure, litigation and adverse media before commercial discussions go far
Supplier Bank Detail Verification
Verifies a supplier's bank details through an independently obtained phone number before any payment is set up or changed
Supplier Master Data Setup
Creates the supplier record in the systems that will use it, covering codes, terms, tax status, addresses and approval scope
Supplier First Delivery Review
Reviews the first delivery from a new supplier against everything that was promised during approval
Supplier Change Notification
Records a change a supplier has told you about, or one you have discovered, covering manufacturing site, formulation, ownership, subcontracting or certification

Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 9001:2015 clause 8.4, control of externally provided processes, products and services
- ISO 22000:2018 clause 7.1.6, control of externally provided processes, products and services
- BRCGS Global Standard Food Safety Issue 9, section 3.5, supplier and raw material approval and performance monitoring
- FSMA Preventive Controls for Human Food, 21 CFR Part 117 subpart G, supply-chain program
- FSMA Foreign Supplier Verification Programs, 21 CFR Part 1 subpart L
- Modern Slavery Act 2015, section 54, transparency in supply chains (UK)
- Safe Food for Canadians Regulations, preventive controls and traceability provisions
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.