Knowella

Supplier Questionnaire

The recurring failure isn't a supplier lying on the form — it's the form being treated as a one-off intake instead of a refreshed control. A certification lapses, a HACCP team goes untrained after turnover, a segregation method degrades from dedicated lines to time separation, and none of it shows because nobody sent the questionnaire again. Approval decided on year-one answers quietly becomes approval based on nothing.

KnowQualityAssessmentQUA-039Pinned in navigation48 fields across 5 sectionsFull researchSee the form

Reviewed by Siddarth SinghCSPLast reviewed 16 August 2026

Basis
ISO 9001 cl.8.4.2
Workspace
KnowQuality
Form type
Assessment
Refresh cycle
Sent before approval, then annually
Completed by
The supplier, reviewed by quality

The short version

  • The questionnaire is a self-reported, scored baseline of a supplier's systems and controls, not a substitute for verification on site.
  • It is meant to be sent before approval and then refreshed yearly — a single completed copy has a shelf life, not a permanent validity.
  • The template holds 48 fields across 5 sections, and 35 of them are required, weighted toward food safety and traceability controls.
  • Scoring is weighted percent with high good, which lets suppliers be compared on the same basis, but a stale questionnaire compares nothing meaningful.

What this is

What is a supplier questionnaire?

What is a supplier questionnaire?

It is a scored, self-reported assessment of a supplier's systems, certifications and controls — quality management, food safety, allergen and foreign body controls, traceability and supply chain ethics. It is built against ISO 9001 cl.8.4.2 and sits inside the Supplier Quality Assurance programme.

How is it different from a supplier audit?

The questionnaire is self-reported: the supplier answers, quality reviews. An audit is verified on site against the same subject matter. A questionnaire that scores well is evidence a follow-up audit is unnecessary yet, not evidence the controls actually exist as described.

Why does it need to be refreshed yearly rather than filed once?

Certifications expire, teams turn over, and controls that were dedicated can quietly become shared. A questionnaire answered once at onboarding and never repeated stops being an evaluation and becomes an artefact of the day approval was granted.

Scope

When is a supplier questionnaire required?

This assessment establishes and refreshes a supplier's declared control baseline. It is not where you decide to approve them, and it is not where you verify what they've declared.

Use this template when

  • A new supplier is going through approval and needs a documented baseline before commercial discussions go further
  • An existing supplier's annual refresh is due, on the schedule set at last approval
  • A supplier has notified a material change — new site, new certification body, ownership change — that warrants re-collecting the full picture
  • A linked record needs this one to exist: it links to the Vendor register
  • Quality needs a scored, comparable basis to rank or shortlist suppliers offering the same material

Do not use it for

  • Supplier Approval Record, which records the approval decision itself and the evidence behind it — the questionnaire is an input to that decision, not the decision.
  • Supplier Audit, which verifies a supplier's site against your requirements in person rather than relying on their own account of it.
  • Supplier Scorecard, which scores ongoing delivery, responsiveness and cost performance over a trading period, not systems and certifications at a point in time.
  • Supplier Risk Assessment, which weighs the risk a supplier poses independent of what they self-report about their controls.
  • Anything outside KnowQuality, which belongs in the workspace that owns that process

Compliance mapping

Which ISO 9001 cl.8.4.2 requirements does this satisfy?

The clauses below map what the questionnaire is actually discharging: proportionate, risk-based evaluation of an external provider, refreshed rather than assumed to still hold true.

ClauseRequirementWhere it lands
ISO 9001 cl.8.4.1The type and extent of control applied to an external provider must be determined by the risk their process or product poses to conforming output.Company and systems
ISO 9001 cl.8.4.2Criteria for evaluation, selection, monitoring of performance and re-evaluation of external providers must be established and applied.Company and systems
ISO 9001 cl.8.4.2Re-evaluation must use current monitoring evidence — certification status, audit grade — not the evidence gathered at initial selection.Controls
ISO 9001 cl.8.4.3Information communicated to the external provider must include the controls the organisation intends to apply and how often re-evaluation occurs.Controls
ISO 9001 cl.8.4.2Where a supplier subcontracts part of the provision, that sub-tier must be evaluated with the same rigour as the direct relationship.Supply chain and ethics
ISO 9001 cl.8.4.1Records of evaluation results and any resulting actions arising from the evaluation must be retained.Result
ISO 9001 cl.10.2A gap identified through evaluation must generate a corrective action or a follow-up trigger, not just a lower percentage.Result

What it does not cover

  • Food Safety Certification marked GFSI recognised, which is only true if the certificate is current — a lapsed certificate scores the same field as if it never existed.
  • HACCP Team Trained marked yes on the strength of training delivered at initial approval, with no record of it surviving staff turnover since.
  • Segregation Method answered as dedicated lines from the original questionnaire, when a facility change since then has moved the supplier to time separation without anyone re-asking.
  • Subcontracting Used answered 'No' because the supplier didn't think to mention a sub-tier processor that has been part of their supply chain since before this questionnaire was ever sent.
  • Recall Procedure Tested marked as tested in the last 12 months without a date or reference to which exercise that refers to, leaving the claim unverifiable at review.

Global

Supplier Questionnaire requirements by country

A self-reported questionnaire sits differently depending on who is expected to have verified the underlying claims and under what regulatory pressure.

United States

FDA Foreign Supplier Verification Program (FSMA)

Importers of food are required to verify that foreign suppliers meet US safety standards using methods proportionate to hazard and supplier performance — a questionnaire alone is rarely sufficient verification on its own.

A questionnaire answered 'GFSI recognised' or 'HACCP in place' does not discharge the verification obligation by itself; it should trigger, not replace, audit or certificate-checking activity where the hazard profile warrants it.

European Union

Regulation (EC) 178/2002, General Food Law

Food business operators must be able to identify who supplied them and demonstrate that suppliers are managed to keep unsafe food out of the supply chain — the obligation sits with the buyer, not just the declaring supplier.

The questionnaire supports traceability and due diligence, but the responsibility for acting on a weak answer — segregation, allergen controls — stays with the business that received it, not the supplier who submitted it.

International (GFSI-benchmarked schemes)

GFSI benchmarking requirements

GFSI recognition is a benchmark against a specific certification scheme (BRCGS, IFS, SQF and similar), not a single universal standard, and certificates carry defined validity windows and scopes.

'GFSI recognised' on the questionnaire is only meaningful if the specific scheme, scope and expiry date are checked against the certificate — the tick box alone tells you a scheme was claimed, not that it currently applies.

How to complete it

How to complete a supplier questionnaire, step by step

The scoring is mechanical, but four judgement calls decide whether the resulting record actually means what the score implies.

Self-reported versus verified

Every answer on this template is the supplier's own account. A high weighted percent tells you what they claim, not what an auditor found. Treat a strong score as reason to prioritise other suppliers for audit attention, not as a reason to skip auditing this one indefinitely.

What a lapsed certification does to the score

A certificate that expired since the last refresh should score as if the certification does not currently exist, not as if the historical achievement still counts. The field asks about current state, even though the supplier may answer from memory of what was once true.

How much subcontracting is disqualifying

Declared, evaluated subcontracting scores differently from undeclared subcontracting discovered after the fact — the second is a trust issue independent of whatever the sub-tier's actual standards turn out to be. Score the disclosure, then separately assess the sub-tier.

When a gap triggers an audit versus a note

Gaps Identified and Audit Triggered are two different decisions. A gap in a low-risk control can be noted and monitored at the next refresh; a gap in foreign body detection, allergen segregation or recall testing should trigger verification now, not at the next annual cycle.

What auditors find

Most common supplier questionnaire findings

These are the gaps that surface when a questionnaire is reviewed against what has actually changed since it was last sent, rather than taken at face value.

FindingClauseWhat fixes it
GFSI recognised certification claimed with no certificate number or expiry recorded against itISO 9001 cl.8.4.2Require the certificate reference and expiry date as supporting evidence before the field can be marked GFSI recognised, not just the claim.
Questionnaire on file is more than a year old with no refresh scheduledISO 9001 cl.8.4.2Trigger the annual refresh automatically from the last Sent Date rather than relying on someone remembering the cycle.
Segregation Method answered inconsistently with the site's own recall or complaint historyISO 9001 cl.8.4.1Cross-check the declared control against any recorded incident before accepting the score, and query the supplier where the two disagree.
Subcontracting declared as 'Yes, declared' with no detail on which processes are subcontractedISO 9001 cl.8.4.2Capture which specific processes are subcontracted and request evidence that the sub-tier is itself evaluated, not just disclosed.
Follow Up Required marked 'No' on a record with multiple controls scoring zeroISO 9001 cl.10.2Set a minimum score floor per control area below which follow-up is mandatory regardless of the weighted total.
Gaps Identified field left blank despite a Result Band of Caution or FailISO 9001 cl.8.4.1Make the gaps field mandatory whenever the result band is anything other than Pass, so the record explains its own score.

Case in point

Case in point: the certificate that expired quietly

A packaging-adjacent ingredient supplier was approved two years ago on a questionnaire showing GFSI-recognised certification and a risk-based environmental monitoring programme. The supplier remained on the approved list, and the original questionnaire sat in the file as the only evidence anyone had ever asked.

When a customer audit asked for current certification evidence, the buyer discovered the supplier's certification body relationship had lapsed eight months earlier after a change of scheme, and nobody had refreshed the questionnaire to catch it. The approval had been valid on the day it was granted and stale for most of the time it was relied on — the fix was making the annual refresh a system trigger rather than a manual reminder.

The template

The template, field by field

The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.

48fields
5 sections
Reference
QUA-039
Archetype
Assessment
Record ID
SQ-2026-000
Scoring
Weighted percent
Direction
High is good
Singleton
No
Basis
ISO 9001 cl.8.4.2
Links
Links Vendor
Tags
Supplier, Quality
Sections
5
Fields
48
Follow up fields
0
Repeating sections
0
Links out
1
Field typesOwn ID, generated on saveCase thread and parentPick list from a registryLinked to another templateFollow up, dashed outlineScored

Header

9 fields
Text

Questionnaire ID*

Generated on save

Auto sequence. Format SQ-2026-0000.

The record's own ID. Other templates point at this value.

Single Choice

Status*

Scored

Drives who this goes to next.

  • Planned2 pts
  • In progress2 pts
  • Complete3 pts
  • Deferred0 pts
  • Open0 pts
  • Closed3 pts
  • Overdue0 pts
Date & Time

Date*

Users

Completed By*

Pick List

Supplier*

From FDN-005 Vendor Name
Text

Vendor ID*

Linked

Format VEN-0000.

Links to FDN-005 Vendor ID

Date & Time

Sent Date*

Date & Time

Returned Date

Optional
Text

Completed By At Supplier

Optional

Company and systems

9 fields
Numeric Answer

Years Trading

OptionalScored
Numeric Answer

Number Of Sites

Optional
Single Choice

Site Supplying Us Named*

Scored
  • Yes3 pts
  • No0 pts
Single Choice

Quality Management System*

Scored
  • ISO 9001 certified3 pts
  • Documented, not certified2 pts
  • None0 pts
Single Choice

Food Safety Certification*

Scored
  • GFSI recognised4 pts
  • Non GFSI scheme2 pts
  • None0 pts
Single Choice

Last Certification Grade

OptionalScored
  • AA or A4 pts
  • B3 pts
  • C1 pt
  • D or lower0 pts
Single Choice

HACCP Plan In Place*

Scored
  • Yes3 pts
  • Partial1 pt
  • No0 pts
Single Choice

HACCP Team Trained*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts
Single Choice

Prerequisite Programmes Documented*

Scored
  • Yes3 pts
  • Partly1 pt
  • No0 pts

Controls

12 fields
Single Choice

Allergen Management Programme*

Scored
  • Documented and verified3 pts
  • Documented only1 pt
  • None0 pts
Multi Choice

Allergens Handled On Site

OptionalScored
  • Yes2 pts
  • No0 pts
  • N/Aexcluded from denominator
Single Choice

Segregation Method

OptionalScored
  • Dedicated lines4 pts
  • Time separation with validated clean3 pts
  • Time separation only1 pt
  • None0 pts
Single Choice

Foreign Body Detection In Place*

Scored
  • Multiple methods4 pts
  • Single method2 pts
  • None0 pts
Multi Choice

Detection Types

Optional
Metal detectionX-rayMagnetsSievesOptical sortingVisual
Single Choice

Detection Verification Frequency

OptionalScored
  • Every hour or better4 pts
  • Every shift3 pts
  • Daily2 pts
  • Less often0 pts
Single Choice

Environmental Monitoring Programme*

Scored
  • Yes, risk based3 pts
  • Yes, basic2 pts
  • None0 pts
Single Choice

Pest Control Contract*

Scored
  • Professional contract3 pts
  • In house1 pt
  • None0 pts
Single Choice

Glass And Brittle Plastic Policy*

Scored
  • Documented with register3 pts
  • Policy only1 pt
  • None0 pts
Single Choice

Traceability Exercise Frequency*

Scored
  • Quarterly or better4 pts
  • Twice yearly3 pts
  • Annually2 pts
  • None0 pts
Single Choice

Trace Time Achieved

OptionalScored
  • Under 2 hours4 pts
  • 2 to 4 hours3 pts
  • 4 to 8 hours1 pt
  • Over 8 hours0 pts
Single Choice

Recall Procedure Tested*

Scored
  • Yes, last 12 months3 pts
  • Yes, over 12 months ago1 pt
  • Never0 pts

Supply chain and ethics

6 fields
Single Choice

Own Suppliers Approved And Audited*

Scored
  • Yes3 pts
  • Approved only1 pt
  • No0 pts
Single Choice

Subcontracting Used*

Scored
  • No3 pts
  • Yes, declared2 pts
  • Yes, undeclared0 pts
Single Choice

Food Fraud Programme*

Scored
  • Documented and reviewed3 pts
  • Basic1 pt
  • None0 pts
Single Choice

Ethical Audit Held

OptionalScored
  • Yes3 pts
  • No1 pt
Single Choice

Environmental Certification

OptionalScored
  • Yes3 pts
  • No1 pt
Single Choice

Business Continuity Plan*

Scored
  • Documented and tested3 pts
  • Documented2 pts
  • None0 pts

Result

12 fields
Numeric Answer

Items Assessed*

Excludes anything marked N/A.

Numeric Answer

Items Failed*

Numeric Answer

Score Percent*

Scored

Calculated on submission. High is good. N/A items leave the denominator.

Single Choice

Result Band*

Scored
  • Pass3 pts
  • Caution1 pt
  • Fail0 pts
Numeric Answer

Completeness Percent*

How much of the template was actually answered. A high score on a half completed form is not a high score.

Text

Gaps Identified

Optional
Single Choice

Follow Up Required*

Scored
  • No3 pts
  • Yes0 pts
Single Choice

Audit Triggered*

YesNo
Users

Reviewed By*

Signature

Signature*

Users

Quality Manager*

Signature

Second Signature*

QUA-039 · record IDs look like SQ-2026-000 · Links Vendor

Open in Knowella

Run it with agents

From a document you fill in to a programme that runs itself

The questionnaire is the easy part to send. Noticing when a certificate has quietly lapsed since the last refresh is the work that actually slips.

KnowQuality

Schedules the annual refresh from the last Sent Date, and flags a supplier whose approval is resting on a questionnaire older than its own review cycle.

KnowComply

Tracks certification expiry dates declared on the questionnaire against the certifying body's own records where available, and surfaces a lapse before the next scheduled refresh would have caught it.

KnowSafe

Watches the food safety and foreign body detection answers for a downgrade between refreshes — a control that weakens quietly is a bigger signal than one that was always weak.

Ella
Ella

Coordinates the crew across the vendor register and the questionnaire cycle, rolling overdue refreshes and score changes into one view, and holds every write for your approval.

This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.

Meet KnowQuality→

Glossary

Supplier Questionnaire definitions and key terms

GFSI
The Global Food Safety Initiative, a benchmarking programme that recognises specific certification schemes (such as BRCGS, IFS, SQF) as meeting a common baseline. GFSI itself does not certify suppliers directly — it recognises the schemes that do.
HACCP
Hazard Analysis and Critical Control Points — a systematic method for identifying and controlling food safety hazards at specific points in a process. A HACCP plan existing is different from the team responsible for it being currently trained.
Prerequisite programme
The foundational hygiene and operational controls (cleaning, pest control, maintenance) that a HACCP plan assumes are already in place. A HACCP plan without documented prerequisites is built on an unverified base.
Foreign body detection
Physical controls — metal detection, X-ray, magnets, sieves, optical sorting, visual checks — used to catch unintended physical contaminants before product leaves the supplier's site.
Food fraud programme
A documented assessment of vulnerability to intentional adulteration or substitution for economic gain, distinct from unintentional food safety hazards covered elsewhere in the questionnaire.

FAQ

Frequently asked questions about supplier questionnaire

What is the supplier questionnaire template based on?+

It is built against ISO 9001 cl.8.4.2, which requires evaluation, selection, monitoring and re-evaluation criteria for external providers, proportionate to the risk they pose.

What sections does the template contain?+

There are 5 sections: header, company and systems, controls, supply chain and ethics, result. Together they hold 48 fields, 35 of which are required.

How often should a supplier questionnaire be sent?+

Before initial approval, and then refreshed yearly. A material change at the supplier — new site, new certification body, ownership change — should trigger an out-of-cycle refresh rather than waiting for the annual date.

Which programme does this template belong to?+

It sits in Supplier Quality Assurance and also links into Supplier Onboarding and Lifecycle. Its outcome is approved suppliers backed by evidence, and rejections that actually change behaviour.

How is a supplier questionnaire scored?+

Scoring is weighted percent, where high is good, calculated across the required fields with N/A items excluded from the denominator. The score exists to let suppliers offering the same material be compared on the same basis.

Does a strong questionnaire score mean an audit isn't needed?+

No. The questionnaire is self-reported. A strong score is grounds to deprioritise audit urgency, not to remove the supplier from the audit programme altogether — verification and self-report are different controls.

Keep going

Related templates and programmes

Siddarth Singh

Written and reviewed by

Siddarth Singh

Founder & Chief Executive Officer, Knowella

Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.

  • Certified Safety Professional (CSP), Board of Certified Safety Professionals
  • MBA, University of Chicago Booth School of Business
  • MS and BS, The Ohio State University, Industrial and Systems Engineering
  • Six Sigma Black Belt
Verify with BCSP →

Sources and last review. Reviewed 16 August 2026 against:

  • ISO 9001:2015 cl.8.4.2 — Type and extent of control of external provision
  • ISO 9001:2015 cl.8.4.1 — General requirements for externally provided processes
  • Regulation (EC) 178/2002 — General Food Law
  • FDA Foreign Supplier Verification Program, FSMA
  • GFSI Benchmarking Requirements

This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.

Start in Minutes, Not Weeks

Launch a Ready-Made Template and Customize It Your Way

Every template is fully editable. Adjust fields, workflows, and branding to match your processes, then deploy to your team instantly.