Food Safety Documents to Ask Your Ingredient Supplier For
This guide is for purchasing, QA and R&D teams at restaurant chains, distributors and food manufacturers. It lists the food safety documents to request from any ingredient supplier, what to check on each one, and how often to update your file. Copy the checklist and use it on your next supplier review.
Why the paperwork matters
An ingredient can look perfect on the dock and still carry a problem you can’t see. Documents are how you check what you can’t see. They show that the plant is audited, that each lot was tested, that allergens are controlled, and that the supplier can trace a lot fast if something goes wrong.
Your own customers and auditors will ask, too. A chain’s QA team, a retailer or your certification body may want proof that you approved each supplier. A clean supplier file makes those audits short.
The core document checklist
Ask for these before you approve a new supplier or a new item. Most good suppliers keep them ready to send.
| Document | What it shows | What to check | How often to update |
|---|---|---|---|
| GFSI-recognized certificate (for example BRCGS, SQF, FSSC 22000 or IFS) | The plant passed a third-party food safety audit under a benchmarked scheme | Plant name and address, scope (the products you buy), certification body, expiration date | Each time it renews, usually yearly |
| Audit report or summary | How the plant scored and what the auditor found | Grade or rating, major findings, proof that corrective actions were closed | Yearly, with the certificate |
| Product specification sheet | What the product should be: format, size, ingredients, limits, storage, shelf life | Matches your recipe and your label; includes micro and quality limits | When the product or process changes, and at least every 1–2 years |
| Certificate of analysis (COA) | Test results for a specific lot | Lot number matches the case; results fall inside the spec limits | Every lot, if your risk review calls for it |
| Allergen statement | Which major allergens are in the product or handled in the plant | All nine major allergens covered, including sesame; cross-contact controls | Yearly, or when the plant adds a product line |
| Process or kill-step statement | How hazards are controlled, for example pasteurization of purée | The step fits how you will use the product | When the process changes |
| Traceability and recall plan | How the supplier traces a lot one step back and one step forward | Date of the last mock recall and how long the trace took | Yearly |
| Continuing guarantee (letter of guarantee) | A written promise that shipments are not adulterated or misbranded | Signed, dated and on the supplier’s letterhead | Yearly, or per your policy |
| Certificate of insurance | Product liability coverage | Coverage amount and dates; your company named as required by your policy | Each policy term |
If you make claims on your own label, such as organic, kosher, gluten-free or non-GMO, add the matching certificate for each item. A claim needs a current certificate behind it.
What to look for on each document
The GFSI certificate
The Global Food Safety Initiative (GFSI) doesn’t certify plants itself. It benchmarks certification schemes, and BRCGS, SQF, FSSC 22000 and IFS are among the best-known schemes it recognizes. Check three things. First, the certificate names the plant that actually makes your product, not only a head office. Second, the scope covers your product type. Third, it hasn’t expired. Most of these certificates run on a yearly audit cycle, so put the expiration date on a calendar.
The spec sheet and the COA
These two get mixed up. The spec sheet is the promise: what every lot should look like. The COA is the proof for one lot: what that lot measured. A COA is only useful if you compare it to the spec. If the spec says a limit and the COA shows a result over it, don’t accept the lot without talking to the supplier.
What a COA lists depends on the product. Common examples:
- Frozen fruit and purée: micro results, Brix for purée, color and defect counts, and lot and production dates
- Dry spices and powders: micro results such as Salmonella, moisture, and mesh or particle size
- Oils: quality values such as free fatty acids and peroxide value
For example, if you buy garlic powder, granules or minced garlic, ask whether each lot comes with a micro result, and what the spec limits are.
The allergen statement
US law names nine major food allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame. Sesame was added as the ninth on January 1, 2023. Older allergen forms may only list eight, so ask for an updated one. The statement should cover two things: what is in the product, and what else runs in the same plant or on the same line.
The kill-step statement
This matters most for fruit purée. In the US, purée used in a drink is regulated as juice, so it needs a 5-log pathogen reduction step. For drinks or any no-cook use, buy pasteurized purée and keep the supplier’s pasteurization statement on file. Unpasteurized purée is only for manufacturers whose own process has a kill step, such as baking or mix pasteurization. IQF fruit pieces are not juice and are not pasteurized, so don’t expect that statement for them. Our passion fruit page shows how purée formats are listed.
Extra steps for manufacturers
If you are a food manufacturer covered by FDA’s preventive controls rule, your supplier file is part of a written supply-chain program. When a supplier controls a hazard in a raw material you receive, the rule asks you to verify that supplier. The listed verification activities are onsite audits, sampling and testing, and review of the supplier’s food safety records. For the most serious hazards, an onsite audit is the default, at least once a year. Your QA lead or food safety consultant should set the right activity and frequency for each ingredient.
Bakery and breakfast plants often use both pasteurized and unpasteurized ingredients. Our bakery and breakfast manufacturers page covers the formats those plants buy most.
Red flags in a supplier file
- The certificate names a different plant than the one on the case label
- The certificate or insurance has expired, and no renewal is on the way
- The COA lot number doesn’t match the lot you received
- COAs look identical lot after lot, with the same numbers every time
- The allergen statement lists only eight allergens
- The supplier can’t say when it last ran a mock recall
- Audit findings are listed with no proof they were fixed
One red flag doesn’t always mean you should drop a supplier. It means you ask questions and get the gap closed in writing.
How to keep the file current
- Build one folder per supplier. Keep a sub-folder per item for specs and COAs.
- Track expiration dates. A simple sheet with the document, the date it expires and the owner works well.
- Request renewals 30 days early. Certificates and insurance often renew at the same time each year.
- Check COAs at receiving. Match lot numbers before the product goes into storage.
- Review the whole file once a year. Update specs, allergen forms and the letter of guarantee.
How Concord Wholesale handles supplier documents
Every processing partner we source from goes through a qualification review before its products ship under our name, and partners are reviewed each year. Our food safety and quality assurance page explains the program and the certifications supported across our sourcing network. If you’re testing an item from our foodservice categories, ask for the spec sheet and documents along with your R&D samples.
Buying frozen fruit for a drink program? Our guide on how to choose a frozen fruit supplier adds a scorecard for comparing suppliers side by side.
FAQs
What is a COA in the food industry?
A certificate of analysis is a document from the supplier or a lab that shows test results for one specific lot. You compare it to the product spec to confirm the lot meets your limits.
What is the difference between HACCP and GFSI certification?
HACCP is a method for finding and controlling food safety hazards. A GFSI-recognized certification, such as SQF or BRCGS, is a full third-party audit of a plant’s food safety system. It includes HACCP-based controls plus many other requirements.
How often should supplier documents be updated?
Most buyers update certificates, audit reports, allergen statements and letters of guarantee every year. COAs come with each lot when your risk review calls for them. Spec sheets change when the product or process changes.