How to Build an SQF Supplier Approval Program for Food Safety Compliance

An SQF supplier approval program is a documented risk-based program that is implemented by a food facility to confirm that all raw materials, ingredients, and services received from vendors are sourced from a vendor that is approved for the SQF for that raw material, ingredient, or service. This program is part of the Safe Quality Food (SQF) Code and is a tool for businesses to assess, monitor, and verify hazards in their supply chain to prevent hazards from reaching the production floor.

Document Compliance Network (DCN) offers food manufacturers in the U.S. comprehensive supply chain management and document control services to keep their SQF supplier approval programs audit-ready. DCN streamlines the process of gathering GFSI certificates, letters of guarantee and third-party audits, ensuring your facility meets the latest SQF Edition 9 requirements. 

Why is an SQF supplier approval program necessary for food safety?

An SQF supplier approval program is required for this reason: it’s the first line of defense within a facility’s Food Safety Plan and helps to keep contaminated or substandard materials out of the facility.

If no process is established for vendor qualification, there is a potential for the introduction of biological, chemical and physical hazards by a vendor that the manufacturer’s Preventive Controls or HACCP plan may not address. Document Compliance Network (DCN) can assist food and beverage companies with this verification process, allowing them to make sure that ingredients are not used during production if the supplier has not passed strict safety requirements.

In addition to safety, the program is required to earn and keep SQF certification. Auditors check for evidence that a thorough risk assessment has been carried out on each supplier. This refers to the raw material’s main producer as well as other entities involved such as brokers, distributors, and service companies (e.g., pest control, lab services). A systematic approval procedure will decrease the chances of expensive recalls and the harm that could result on a company’s brand.A structured approval procedure will decrease the likelihood of expensive recalls and harm that could result on a company’s brand due to supply chain failures. 

What are the core requirements of an SQF-compliant supplier program?

The key elements of a supplier programme that meets SQF standards are: a documented procedure for approval, a supplier register, and a documented risk assessment for every material or service supplied. The SQF Code requires records to be kept for each vendor, including third-party audit reports, certificates of analysis (COAs), and product specifications. Document Compliance Network (DCN) makes these requirements easy with an electronic repository that alerts you to the upcoming expiration of documents, and gives you an approved supplier list that never lapses.

In addition, the program shall specify how to source in an emergency. When a primary supplier fails or a shortage happens, the facility should have a procedure in place to evaluate a “spot-buy” or emergency supplier, so as not to jeopardize the food safety of the product because of speed of production. In addition, SQF requires annual testing of the performance of approved suppliers. This review should cover a summary of the non-conformances, quality concerns, and whether or not the supplier can deliver what is required and whether or not the documents are available on time. 

How do you perform a risk assessment for SQF suppliers?

A risk assessment for SQF suppliers requires a consideration of the risks arising from the particular raw material and the supplier’s past. Suppliers must be categorized by risk into high, medium and low risk groups, according to the susceptibility of the material to pathogens, the supplier’s country of origin and the score obtained from their last audit. Document Compliance Network (DCN) simplifies this process by consolidating all supplier information in a single location, and the quality manager can easily apply the risk level to the supplier using the standardized compliance metrics.

SQF Code may impose additional verification for high-risk items (raw proteins or produce) including auditing at the point of sale or more regular testing of incoming lots. For low-risk products, such as packaging for food products or salt, a continuing letter of guarantee may be all that is necessary, and food safety program may be reviewed on an annual basis. The purpose of the risk assessment is to decide upon the frequency and depth of monitoring needed to ensure that the material is not a risk to the finished product or consumer. 

What documents must be collected for SQF supplier approval?

Documentation required for SQF supplier approval includes GFSI-recognized audit certificates, product specifications, letters of guarantee and allergen statements. In addition, depending on the risk of the ingredient, it’s possible to also require a supplier’s HACCP plan summary, environmental monitoring results, or evidence of food defense and food fraud mitigation programs. Document Compliance Network (DCN) oversees the lifecycle of these documents, and gives suppliers the ability to upload their documents and then verifies it against your facility’s specific SQF requirements.

SQF Edition 9 places special focus on the importance of making sure that product specifications are kept up to date, in addition to safety documents. It is essential that these specifications be negotiated between the supplier and manufacturer and contain physical, chemical and microbiological limits. A key pain point during audits is organization of the documentation – with the right documentation service such as Document Compliance Network (DCN) all documents in your warehouse will be supported by a valid, non-expired documentation package that corresponds to the latest SQF Code version. 

How does Document Compliance Network (DCN) manage supplier monitoring?

Document Compliance Network (DCN) manages supplier monitoring by utilizing automated workflows that track the expiration dates of critical safety documents and notify both the manufacturer and the vendor when updates are required. Instead of manually emailing hundreds of suppliers for updated organic certificates or audit reports, the DCN platform acts as a proactive assistant that maintains the integrity of the approved supplier list. This continuous monitoring ensures that a supplier’s status is never “approved” simply by default, but rather through active, documented compliance.

Monitoring also involves the tracking of incoming shipments against the agreed-upon specifications. If a supplier sends a shipment without a required Certificate of Analysis (COA), or if the COA shows results outside of the acceptable range, the DCN system can help document the non-conformance. This data is then aggregated into an annual performance report, which is a required element of the SQF management review process. By using DCN, food safety managers can shift their focus from administrative paperwork to actual risk mitigation and process improvement.

What is the difference between a broker and a manufacturer in SQF?

The difference between a broker and a manufacturer in SQF lies in the level of transparency and documentation required to prove the safety of the supply chain. A manufacturer is the entity that actually produces or processes the ingredient, while a broker is an intermediary who facilitates the sale without necessarily handling the product. SQF mandates that even if you buy through a broker, you must still have information regarding the original manufacturer and their food safety credentials. Document Compliance Network (DCN) helps bridge this gap by allowing manufacturers to link brokers to their respective production sites in a single compliance dashboard.

Purchasing from a broker does not exempt a facility from knowing the “site of manufacture.” If a broker refuses to disclose their source, it becomes significantly more difficult to perform an accurate SQF risk assessment. DCN’s platform encourages transparency by providing a standardized portal where brokers can upload the necessary manufacturer-level audits and certifications while maintaining their commercial relationships, ensuring the end-user remains compliant with SQF transparency requirements.

How should a facility handle unapproved or emergency suppliers?

A facility should handle unapproved or emergency suppliers by following a strictly documented “Emergency Supplier Procedure” that includes a temporary risk assessment and a heightened inspection process for incoming goods. SQF recognizes that supply chain disruptions occur, but it does not allow for a total bypass of safety protocols. Document Compliance Network (DCN) provides the framework for these temporary approvals, ensuring that even one-time purchases are recorded and vetted to the highest possible extent before the materials are introduced to the production line.

In an emergency sourcing scenario, the facility might require the temporary vendor to provide a recent third-party audit and a signed statement of compliance with the facility’s specifications. Once the emergency has passed, the facility must decide whether to move the vendor through the full approval process or terminate the relationship. DCN ensures that these “spot-buy” records are archived separately from the permanent approved supplier register, providing a clear trail for SQF auditors to follow during the annual inspection.

Frequently Asked Questions (FAQ)

Q1. Do all suppliers need to be audited on-site for SQF?

Ans: NO, an on-site audit from each supplier is not a requirement for SQF; it’s based on the risk assessment. Depending on the risk level, suppliers who are not certified by a GFSI organisation may need to be audited onsite, while those with lower risk can sometimes be approved by means of documented evidence from the supplier with letters of guarantee and/or specifications.

Q2. At what intervals do the approved supplier registers have to be updated?

Ans: The approved supplier register should be revised on a regular basis as there are changes and reviewed every 12 months at a minimum. Document Compliance Network (DCN) updates the register in real-time, so that it is always up to date for daily use and audits.

Q3. What is the impact on the certification of a supplier if it is no longer certified by GFSI?

Ans:  When a supplier loses their GFSI certification, the facility should re-evaluate the supplier’s risk level as soon as possible. The facility may have to test further the materials received from the supplier, or may have to carry out an audit on the supplier to ensure that it is still meeting the safety requirements in the SQF.

Q4. Is there a supplier program that includes service providers such as pest control?

Ans:  Absolutely, service providers that can affect food safety, such as pest control, laundry services and contract laboratories, must be part of the SQF supplier approval program. The vendors must be vetted to make sure that they do not bring hazards into the food production environment.

Q5. Is it possible to use a supplier that is not SQF certified at a facility?

Ans:  Yes, a facility may use a supplier that is not SQF certified, but the facility has done its own risk assessment and confirmed the food safety program of the supplier by another recognized GFSI audit (BRCGS, FSSC 22000) or through a complete self-assessment questionnaire and supporting documents.

Q6. What is the new value for the Supplier Approval Level in SQF Edition 9?

Ans: In SQF Edition 9, the focus was shifted to food fraud and food defense in the food supply chain. Now, facilities must implement measures to reduce the risk of intentional adulteration and fraudulent substitution of ingredients in their suppliers’ programs.

Q7. For how long should the records of supplier approval be retained?

Ans: Records are normally required to be maintained for at least 12 months or until the product is out of date (shelf-life of finished product as determined by the manufacturer), whichever is longer, for SQF. Document Compliance Network (DCN) offers unlimited digital storage for documents so they can be accessed for multi-year historical review.

Q8. Do supplier approvals require a Letter of Guarantee (LOG)?

Ans: Generally, a Letter of Guarantee is not enough for high-risk ingredients. It’s required, but SQF auditors would like to see documentation, such as a third-party audit report and certain product testing results, to prove the claim of the supplier.

Ensure Your Supply Chain is Audit-Ready with DCN – Get your supply chain ready for audits with DCN today!

The manual SQF supplier approval programme is a risky approach that can result in the failure to supply documents and non-conformances during supplier audits. Document Compliance Network (DCN) provides a specialized solution for food manufacturers in the United States, giving them the technology and expertise they need to manage all of their vendor relationships and document needs. Partnering with DCN will allow you to automate certificate collection, make even quicker risk assessments, and keep your facility ready for the next SQF audit. Reach out to Document Compliance Network (DCN) now to find out how our paperless compliance solution helps to safeguard your production and streamline your supplier workflow.