# Supplier Qualification Form

A blank, fillable form for qualifying one supplier. You record who they are, what
they supply, the certifications they hold and when those expire, the basis you
approved them on, and the schedule you verify them against. Reach for it when you
bring on a new supplier, when your hazard analysis says a supplier controls one of
your hazards, or when you are building the approved-supplier records an audit will
ask to see.

When your hazard analysis identifies a hazard that a supplier controls rather than
your own process, FDA's preventive-controls rule asks you to run a supply-chain
program: use only approved suppliers, verify them, and keep the records that prove
it. The approval decision is yours as the receiving facility, not the supplier's.
The rule lists four verification activities you can build an approval on: reviewing
the supplier's relevant food safety records, sampling and testing the material, an
onsite audit of the supplier, or another activity you justify by the supplier's
performance and the material's risk. You conduct them before the first receipt and
periodically after; where the hazard could cause serious health consequences or
death, the appropriate activity is an onsite audit before first use and at least
annually, unless you document why an alternative gives the same assurance.

- General requirements for the supply-chain program, 21 CFR 117.410: https://www.law.cornell.edu/cfr/text/21/117.410
- Conducting supplier verification activities, 21 CFR 117.430: https://www.law.cornell.edu/cfr/text/21/117.430
- A supply-chain-applied control is a preventive control your hazard analysis assigns to your supplier instead of your own line, which is what obligates you to approve and verify that supplier.
- A COA (certificate of analysis) is the supplier's own test results for a specific lot, which you review as one form of verification — not a substitute for deciding the activity fits the risk.
- Use one copy per supplier. Fill every blank and replace the example rows with your own. Keep the finished form — the record of the approval decision is itself what an auditor checks.

---

## Supplier and contact

Who the supplier is and how you reach them.

| Field | Entry |
| --- | --- |
| Your facility (the one approving this supplier) | |
| Supplier legal name | |
| Trading name or brand | |
| Ship-from address | |
| Supplier type (grower, manufacturer, broker, distributor) | |
| If a broker or distributor, the actual manufacturer | |
| Primary contact (name, role) | |
| Phone | |
| Email | |

## Materials supplied

Every raw material or ingredient this supplier provides. Flag the ones your hazard
analysis says the supplier controls — those are the reason this form exists.

| Material or ingredient | Your spec or item code | Supplier controls a hazard here? (Y / N) | If yes, the hazard |
| --- | --- | --- | --- |
| (example) Roasted peanuts | RM-PEA-01 | Y | Allergen and pathogen control at roast |
| | | | |
| | | | |
| | | | |

## Certifications held

Every certification, registration, or document the supplier carries, and the date
each lapses. Track the expiry so a certificate never goes stale on file without you
noticing — an FDA food facility registration, for instance, renews on a two-year
cycle.

| Certification or document | Issuing body | Reference or number | Issued | Expires | Copy on file? (Y / N) |
| --- | --- | --- | --- | --- | --- |
| (example) SQF Food Safety Code, Edition 9 | SQFI (via certification body) | ____ | 2026-03-01 | 2027-03-01 | Y |
| (example) FDA food facility registration | FDA | ____ | ____ | Biennial renewal | Y |
| | | | | | |
| | | | | | |
| | | | | | |

## Approval basis and verification activities

The activities you ran to approve this supplier. These are the four the rule
recognizes — record which you used, the evidence, and the date. A COA is one way to
satisfy the records review; it is not a substitute for deciding the activity fits
the risk.

| Verification activity | Used for this supplier? (Y / N) | Evidence or record reference | Date completed |
| --- | --- | --- | --- |
| Review of the supplier's food safety records (e.g., current GFSI certificate, third-party audit report, COA per lot) | | | |
| Sampling and testing of the material | | | |
| Onsite audit of the supplier | | | |
| Other activity justified by supplier performance and material risk | | | |

(example) Review of records — Y — GFSI certificate + COA reviewed per lot — 2026-04-10

## Verification schedule

How often you re-run the verification, and when it is next due. The rule sets no
single interval for every supplier; you set the frequency from the hazard and the
supplier's track record, and an onsite audit runs at least annually where the
hazard could cause serious health consequences or death.

| Field | Entry |
| --- | --- |
| Verification activities conducted before first receipt? (Y / N) | |
| Ongoing frequency (e.g., COA every lot, audit annually) | |
| Last verification completed (date) | |
| Next verification due (date) | |

## Approval and re-approval

The approval decision, who made it, and when it gets revisited. Re-approve on your
set schedule and again after any change to the material, the supplier, or a
verification that comes back short.

| Field | Entry |
| --- | --- |
| Approved by (name, role) | |
| Approval basis (one-line summary) | |
| Approval date | |
| Re-approval due (date) | |
| Status (approved / conditional / on hold / removed) | |