What this is
What is a supplier questionnaire?
What is a supplier questionnaire?
It is a scored, self-reported assessment of a supplier's systems, certifications and controls — quality management, food safety, allergen and foreign body controls, traceability and supply chain ethics. It is built against ISO 9001 cl.8.4.2 and sits inside the Supplier Quality Assurance programme.
How is it different from a supplier audit?
The questionnaire is self-reported: the supplier answers, quality reviews. An audit is verified on site against the same subject matter. A questionnaire that scores well is evidence a follow-up audit is unnecessary yet, not evidence the controls actually exist as described.
Why does it need to be refreshed yearly rather than filed once?
Certifications expire, teams turn over, and controls that were dedicated can quietly become shared. A questionnaire answered once at onboarding and never repeated stops being an evaluation and becomes an artefact of the day approval was granted.
Scope
When is a supplier questionnaire required?
This assessment establishes and refreshes a supplier's declared control baseline. It is not where you decide to approve them, and it is not where you verify what they've declared.
Use this template when
- A new supplier is going through approval and needs a documented baseline before commercial discussions go further
- An existing supplier's annual refresh is due, on the schedule set at last approval
- A supplier has notified a material change — new site, new certification body, ownership change — that warrants re-collecting the full picture
- A linked record needs this one to exist: it links to the Vendor register
- Quality needs a scored, comparable basis to rank or shortlist suppliers offering the same material
Do not use it for
- Supplier Approval Record, which records the approval decision itself and the evidence behind it — the questionnaire is an input to that decision, not the decision.
- Supplier Audit, which verifies a supplier's site against your requirements in person rather than relying on their own account of it.
- Supplier Scorecard, which scores ongoing delivery, responsiveness and cost performance over a trading period, not systems and certifications at a point in time.
- Supplier Risk Assessment, which weighs the risk a supplier poses independent of what they self-report about their controls.
- Anything outside KnowQuality, which belongs in the workspace that owns that process
Compliance mapping
Which ISO 9001 cl.8.4.2 requirements does this satisfy?
The clauses below map what the questionnaire is actually discharging: proportionate, risk-based evaluation of an external provider, refreshed rather than assumed to still hold true.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.4.1 | The type and extent of control applied to an external provider must be determined by the risk their process or product poses to conforming output. | Company and systems |
| ISO 9001 cl.8.4.2 | Criteria for evaluation, selection, monitoring of performance and re-evaluation of external providers must be established and applied. | Company and systems |
| ISO 9001 cl.8.4.2 | Re-evaluation must use current monitoring evidence — certification status, audit grade — not the evidence gathered at initial selection. | Controls |
| ISO 9001 cl.8.4.3 | Information communicated to the external provider must include the controls the organisation intends to apply and how often re-evaluation occurs. | Controls |
| ISO 9001 cl.8.4.2 | Where a supplier subcontracts part of the provision, that sub-tier must be evaluated with the same rigour as the direct relationship. | Supply chain and ethics |
| ISO 9001 cl.8.4.1 | Records of evaluation results and any resulting actions arising from the evaluation must be retained. | Result |
| ISO 9001 cl.10.2 | A gap identified through evaluation must generate a corrective action or a follow-up trigger, not just a lower percentage. | Result |
What it does not cover
- Food Safety Certification marked GFSI recognised, which is only true if the certificate is current — a lapsed certificate scores the same field as if it never existed.
- HACCP Team Trained marked yes on the strength of training delivered at initial approval, with no record of it surviving staff turnover since.
- Segregation Method answered as dedicated lines from the original questionnaire, when a facility change since then has moved the supplier to time separation without anyone re-asking.
- Subcontracting Used answered 'No' because the supplier didn't think to mention a sub-tier processor that has been part of their supply chain since before this questionnaire was ever sent.
- Recall Procedure Tested marked as tested in the last 12 months without a date or reference to which exercise that refers to, leaving the claim unverifiable at review.
Global
Supplier Questionnaire requirements by country
A self-reported questionnaire sits differently depending on who is expected to have verified the underlying claims and under what regulatory pressure.
FDA Foreign Supplier Verification Program (FSMA)
Importers of food are required to verify that foreign suppliers meet US safety standards using methods proportionate to hazard and supplier performance — a questionnaire alone is rarely sufficient verification on its own.
A questionnaire answered 'GFSI recognised' or 'HACCP in place' does not discharge the verification obligation by itself; it should trigger, not replace, audit or certificate-checking activity where the hazard profile warrants it.
Regulation (EC) 178/2002, General Food Law
Food business operators must be able to identify who supplied them and demonstrate that suppliers are managed to keep unsafe food out of the supply chain — the obligation sits with the buyer, not just the declaring supplier.
The questionnaire supports traceability and due diligence, but the responsibility for acting on a weak answer — segregation, allergen controls — stays with the business that received it, not the supplier who submitted it.
GFSI benchmarking requirements
GFSI recognition is a benchmark against a specific certification scheme (BRCGS, IFS, SQF and similar), not a single universal standard, and certificates carry defined validity windows and scopes.
'GFSI recognised' on the questionnaire is only meaningful if the specific scheme, scope and expiry date are checked against the certificate — the tick box alone tells you a scheme was claimed, not that it currently applies.
How to complete it
How to complete a supplier questionnaire, step by step
The scoring is mechanical, but four judgement calls decide whether the resulting record actually means what the score implies.
Every answer on this template is the supplier's own account. A high weighted percent tells you what they claim, not what an auditor found. Treat a strong score as reason to prioritise other suppliers for audit attention, not as a reason to skip auditing this one indefinitely.
A certificate that expired since the last refresh should score as if the certification does not currently exist, not as if the historical achievement still counts. The field asks about current state, even though the supplier may answer from memory of what was once true.
Declared, evaluated subcontracting scores differently from undeclared subcontracting discovered after the fact — the second is a trust issue independent of whatever the sub-tier's actual standards turn out to be. Score the disclosure, then separately assess the sub-tier.
Gaps Identified and Audit Triggered are two different decisions. A gap in a low-risk control can be noted and monitored at the next refresh; a gap in foreign body detection, allergen segregation or recall testing should trigger verification now, not at the next annual cycle.
What auditors find
Most common supplier questionnaire findings
These are the gaps that surface when a questionnaire is reviewed against what has actually changed since it was last sent, rather than taken at face value.
| Finding | Clause | What fixes it |
|---|---|---|
| GFSI recognised certification claimed with no certificate number or expiry recorded against it | ISO 9001 cl.8.4.2 | Require the certificate reference and expiry date as supporting evidence before the field can be marked GFSI recognised, not just the claim. |
| Questionnaire on file is more than a year old with no refresh scheduled | ISO 9001 cl.8.4.2 | Trigger the annual refresh automatically from the last Sent Date rather than relying on someone remembering the cycle. |
| Segregation Method answered inconsistently with the site's own recall or complaint history | ISO 9001 cl.8.4.1 | Cross-check the declared control against any recorded incident before accepting the score, and query the supplier where the two disagree. |
| Subcontracting declared as 'Yes, declared' with no detail on which processes are subcontracted | ISO 9001 cl.8.4.2 | Capture which specific processes are subcontracted and request evidence that the sub-tier is itself evaluated, not just disclosed. |
| Follow Up Required marked 'No' on a record with multiple controls scoring zero | ISO 9001 cl.10.2 | Set a minimum score floor per control area below which follow-up is mandatory regardless of the weighted total. |
| Gaps Identified field left blank despite a Result Band of Caution or Fail | ISO 9001 cl.8.4.1 | Make the gaps field mandatory whenever the result band is anything other than Pass, so the record explains its own score. |
Case in point
Case in point: the certificate that expired quietly
A packaging-adjacent ingredient supplier was approved two years ago on a questionnaire showing GFSI-recognised certification and a risk-based environmental monitoring programme. The supplier remained on the approved list, and the original questionnaire sat in the file as the only evidence anyone had ever asked.
When a customer audit asked for current certification evidence, the buyer discovered the supplier's certification body relationship had lapsed eight months earlier after a change of scheme, and nobody had refreshed the questionnaire to catch it. The approval had been valid on the day it was granted and stale for most of the time it was relied on — the fix was making the annual refresh a system trigger rather than a manual reminder.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- QUA-039
- Archetype
- Assessment
- Record ID
- SQ-2026-000
- Scoring
- Weighted percent
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 9001 cl.8.4.2
- Links
- Links Vendor
- Tags
- Supplier, Quality
- Sections
- 5
- Fields
- 48
- Follow up fields
- 0
- Repeating sections
- 0
- Links out
- 1
Header
9 fieldsQuestionnaire ID*
Auto sequence. Format SQ-2026-0000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date*
Completed By*
Supplier*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Sent Date*
Returned Date
Completed By At Supplier
Company and systems
9 fieldsYears Trading
Number Of Sites
Site Supplying Us Named*
- Yes3 pts
- No0 pts
Quality Management System*
- ISO 9001 certified3 pts
- Documented, not certified2 pts
- None0 pts
Food Safety Certification*
- GFSI recognised4 pts
- Non GFSI scheme2 pts
- None0 pts
Last Certification Grade
- AA or A4 pts
- B3 pts
- C1 pt
- D or lower0 pts
HACCP Plan In Place*
- Yes3 pts
- Partial1 pt
- No0 pts
HACCP Team Trained*
- Yes3 pts
- Partly1 pt
- No0 pts
Prerequisite Programmes Documented*
- Yes3 pts
- Partly1 pt
- No0 pts
Controls
12 fieldsAllergen Management Programme*
- Documented and verified3 pts
- Documented only1 pt
- None0 pts
Allergens Handled On Site
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Segregation Method
- Dedicated lines4 pts
- Time separation with validated clean3 pts
- Time separation only1 pt
- None0 pts
Foreign Body Detection In Place*
- Multiple methods4 pts
- Single method2 pts
- None0 pts
Detection Types
Detection Verification Frequency
- Every hour or better4 pts
- Every shift3 pts
- Daily2 pts
- Less often0 pts
Environmental Monitoring Programme*
- Yes, risk based3 pts
- Yes, basic2 pts
- None0 pts
Pest Control Contract*
- Professional contract3 pts
- In house1 pt
- None0 pts
Glass And Brittle Plastic Policy*
- Documented with register3 pts
- Policy only1 pt
- None0 pts
Traceability Exercise Frequency*
- Quarterly or better4 pts
- Twice yearly3 pts
- Annually2 pts
- None0 pts
Trace Time Achieved
- Under 2 hours4 pts
- 2 to 4 hours3 pts
- 4 to 8 hours1 pt
- Over 8 hours0 pts
Recall Procedure Tested*
- Yes, last 12 months3 pts
- Yes, over 12 months ago1 pt
- Never0 pts
Supply chain and ethics
6 fieldsOwn Suppliers Approved And Audited*
- Yes3 pts
- Approved only1 pt
- No0 pts
Subcontracting Used*
- No3 pts
- Yes, declared2 pts
- Yes, undeclared0 pts
Food Fraud Programme*
- Documented and reviewed3 pts
- Basic1 pt
- None0 pts
Ethical Audit Held
- Yes3 pts
- No1 pt
Environmental Certification
- Yes3 pts
- No1 pt
Business Continuity Plan*
- Documented and tested3 pts
- Documented2 pts
- None0 pts
Result
12 fieldsItems Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Gaps Identified
Follow Up Required*
- No3 pts
- Yes0 pts
Audit Triggered*
Reviewed By*
Signature*
Quality Manager*
Second Signature*
QUA-039 · record IDs look like SQ-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The questionnaire is the easy part to send. Noticing when a certificate has quietly lapsed since the last refresh is the work that actually slips.
Schedules the annual refresh from the last Sent Date, and flags a supplier whose approval is resting on a questionnaire older than its own review cycle.
Tracks certification expiry dates declared on the questionnaire against the certifying body's own records where available, and surfaces a lapse before the next scheduled refresh would have caught it.
Watches the food safety and foreign body detection answers for a downgrade between refreshes — a control that weakens quietly is a bigger signal than one that was always weak.

Coordinates the crew across the vendor register and the questionnaire cycle, rolling overdue refreshes and score changes into one view, and holds every write for your approval.
This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.
Meet KnowQuality→Glossary
Supplier Questionnaire definitions and key terms
- GFSI
- The Global Food Safety Initiative, a benchmarking programme that recognises specific certification schemes (such as BRCGS, IFS, SQF) as meeting a common baseline. GFSI itself does not certify suppliers directly — it recognises the schemes that do.
- HACCP
- Hazard Analysis and Critical Control Points — a systematic method for identifying and controlling food safety hazards at specific points in a process. A HACCP plan existing is different from the team responsible for it being currently trained.
- Prerequisite programme
- The foundational hygiene and operational controls (cleaning, pest control, maintenance) that a HACCP plan assumes are already in place. A HACCP plan without documented prerequisites is built on an unverified base.
- Foreign body detection
- Physical controls — metal detection, X-ray, magnets, sieves, optical sorting, visual checks — used to catch unintended physical contaminants before product leaves the supplier's site.
- Food fraud programme
- A documented assessment of vulnerability to intentional adulteration or substitution for economic gain, distinct from unintentional food safety hazards covered elsewhere in the questionnaire.
FAQ
Frequently asked questions about supplier questionnaire
What is the supplier questionnaire template based on?+
It is built against ISO 9001 cl.8.4.2, which requires evaluation, selection, monitoring and re-evaluation criteria for external providers, proportionate to the risk they pose.
What sections does the template contain?+
There are 5 sections: header, company and systems, controls, supply chain and ethics, result. Together they hold 48 fields, 35 of which are required.
How often should a supplier questionnaire be sent?+
Before initial approval, and then refreshed yearly. A material change at the supplier — new site, new certification body, ownership change — should trigger an out-of-cycle refresh rather than waiting for the annual date.
Which programme does this template belong to?+
It sits in Supplier Quality Assurance and also links into Supplier Onboarding and Lifecycle. Its outcome is approved suppliers backed by evidence, and rejections that actually change behaviour.
How is a supplier questionnaire scored?+
Scoring is weighted percent, where high is good, calculated across the required fields with N/A items excluded from the denominator. The score exists to let suppliers offering the same material be compared on the same basis.
Does a strong questionnaire score mean an audit isn't needed?+
No. The questionnaire is self-reported. A strong score is grounds to deprioritise audit urgency, not to remove the supplier from the audit programme altogether — verification and self-report are different controls.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Supplier Quality Assurance
Modern Slavery and Labour Standards Assessment
Assesses the site and its labour supply chain for forced labour, debt bondage, withheld documents and unlawful deductions
Transport Provider Assessment
Assesses a haulier for licensing, driver management, vehicle standards, temperature capability and load security
Supplier Environmental Assessment
Assesses a supplier's environmental performance and certifications
Vendor and Contractor Register
Holds every supplier, contractor and service provider you work with, including their status and approval level
Material Rejection Report
Rejects incoming material that fails inspection
Supplier Approval Record
Records the decision to approve a new supplier, with the evidence behind it
More in Suppliers
Supplier Approval Record
Records the decision to approve a new supplier, with the evidence behind it
Supplier Audit
Audits a supplier's site against your requirements
Supplier Scorecard
Scores a supplier on quality, delivery, responsiveness and cost over a period
Supplier Corrective Request
Asks a supplier to investigate and fix a problem with their material or service
Material Specification Record
Holds the agreed specification for each material you buy, including tolerances and test methods
Certificate of Analysis Review
Checks the certificate supplied with a material against the agreed specification

Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 9001:2015 cl.8.4.2 — Type and extent of control of external provision
- ISO 9001:2015 cl.8.4.1 — General requirements for externally provided processes
- Regulation (EC) 178/2002 — General Food Law
- FDA Foreign Supplier Verification Program, FSMA
- GFSI Benchmarking Requirements
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.