Food Supplier Audit Checklist: 11 Sections for Buyers

A food supplier audit checklist tells you what to see, what to read and what to ask for when you check a factory before you buy from it. A sound one covers eleven areas: documents and licences, site hygiene, raw material intake, process controls, testing, traceability and recall, pest control, water, storage and dispatch, people and training, and corrective actions. Each line should ask for evidence you can see or hold, not a promise.

This guide gives you that checklist in printable sections, built on the rules an Indian food factory already has to follow, with the official source for each. It is written by Poorti Mandalam LLP, a food house in Ahmedabad that works through a circle of farmers, processors, manufacturers, testing laboratories and logistics partners across India, for buyers about to order from a supplier they have not yet visited.

What should a food supplier audit checklist cover?

Most free templates are generic yes-and-no forms. They rarely say which rule each line comes from, so you cannot tell a legal requirement from a nice-to-have. This checklist is built on three public references:

• Schedule 4 of India's food licensing regulations. Every food business applying for a licence must follow the hygienic and sanitary practices in Schedule 4 of the Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations, 2011. Part II applies to licensed manufacturers, processors, packers and stores.
• The Codex General Principles of Food Hygiene. The FAO and WHO text CXC 1-1969 sets out good hygiene practices for every stage of the food chain, with a HACCP annex.
• HACCP as described by the US FDA. The FDA's HACCP Principles and Application Guidelines set out seven principles and list supplier control, specifications, traceability and recall among the prerequisite programmes a plant should have.

What should you do before the audit starts?

• Write your specification. The supplier is audited against what you buy: product, cut or mesh size, moisture, microbiological limits, foreign matter, pack, labelling and shelf life. The Codex text says incoming materials should be procured according to specifications, and the same logic applies to you.
• Set the depth by risk. A ready-to-eat powder that will not be cooked again deserves a deeper audit than a sack supplier.
• Ask for documents in advance. Request the licence, food safety plan, water report, recall plan and recent test reports before the visit, so the visit is spent checking that the paper matches the floor.
• Agree the grading. Decide how findings will be graded before you see any. A simple scale is set out further down.

If you are having a product made under your own label, read the house's guide to private-label food manufacturing in India first. It shows where the audit sits among the other steps of a private-label order.

1. Are the documents and licences real and current?

Start with paper. A supplier that cannot show a valid licence for your product is not a supplier for that product. FSSAI's licensing portal, FoSCoS, has a public search where you can look up a licence number and read the registered name, address and status.

• Licence seen in original, and its number checked on the official portal.
• Name and address match the company that will invoice you and the site you are in.
• Your product falls within the categories on the licence, and the licence is current.
• A documented food safety plan exists. Schedule 4 says licence holders must identify the steps critical to food safety and keep procedures for them.
• Any food safety certificate shown is checked for scope, site address and expiry with the body that issued it.
• The supplier buys only from licensed or registered vendors and keeps a record, one of the conditions of an FSSAI licence.
• Recent export shipments, destinations and the documents they travelled on.

2. Is the site built and kept to hygiene rules?

Schedule 4 Part II sets the baseline for location, layout, equipment, cleaning and sanitation. The Codex text adds that cleaning should remove food residue and dirt, including allergens. Look for hygiene built into the layout, not added for the visit.

• Site protected from nearby smoke, dust and waste.
• Floors, walls and ceilings smooth, sound and easy to clean, with no flaking paint or plaster.
• Raw and finished areas separated so air and people do not flow from dirty to clean.
• Equipment placed so it can be cleaned and inspected.
• A written cleaning programme naming area, frequency, method and chemicals, with signed records.
• Cleaning chemicals labelled and stored away from food.
• Allergen controls where the site runs more than one product: separation, cleaning between runs and sequencing.

3. How does the supplier check what comes in?

A finished product cannot be better than its raw material. Schedule 4 says no raw material should be accepted if it is known to contain parasites, undesirable micro-organisms, pesticides or extraneous matter that normal sorting or processing will not reduce to an acceptable level, and that the source of each raw material is recorded in a register.

Walk one recent delivery from the gate to the store.

• Approved supplier list for raw materials and packaging, with how each was approved.
• Written intake checks: appearance, smell, foreign matter, moisture, pack condition and dates.
• Intake register entries for a recent lot: supplier, date, quantity, checks and result.
• A marked hold area for material awaiting a decision, and a rejection record.
• Food-contact packaging is food grade, as Schedule 4 requires for primary packaging.

4. Are the process controls written down and followed?

The FDA guidelines list seven HACCP principles: hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification, and record-keeping. For a dried ingredient the critical steps are often drying, sorting, size reduction, sieving and metal detection. For a pulp they are usually heat treatment and filling.

• A process flow chart that matches the floor.
• A hazard analysis covering biological, chemical and physical hazards for your product.
• Critical control points named, each with a measurable limit such as a temperature, time, moisture value or sieve size.
• Monitoring sheets filled in at the stated frequency, by named people, on the day.
• Written action for an out-of-limit reading, posted at the station.
• Instruments for critical readings calibrated, with records.
• Magnets, sieves or metal detectors tested at set intervals, with records.

Check one limit in person. If the plan sets a dryer outlet temperature, read the gauge, then read the log for the same hour.

5. What is tested, where and how often?

FSSAI's conditions of licence require testing of relevant chemical and microbiological contaminants through an own lab or an NABL accredited or FSSAI notified lab at least once in six months, and more often where risk calls for it. You can check a laboratory's accreditation with the National Accreditation Board for Testing and Calibration Laboratories.

See the in-house lab, then ask how its results compare with the outside laboratory's on the same lot.

• In-house checks on every lot for your specification parameters, such as moisture, particle size, colour and foreign matter.
• Outside reports for microbiology, pesticide residues, heavy metals or other contaminants relevant to your market.
• Each report names the laboratory, its accreditation, sample date, lot number and method.
• Results compared against your specification, not only India's standard.
• Retained samples kept for each lot for the shelf life.
• A certificate of analysis for every lot, carrying the same lot number as the bags.

As an example, Poorti's published potato flake and flour specification states 100% through 1.7 mm and moisture 10.0% maximum, which tells you which two results the certificate of analysis must show.

6. Can the supplier trace a lot and recall it?

FSSAI's recall guidelines say covered food businesses must keep an up-to-date recall plan, with records of suppliers and distributors, raw material purchase dates, batch codes and lot numbers, traceable from raw material to finished good. The Codex text adds that each container should be permanently marked to identify the producer and the lot.

The most useful test is one you set on the day. Pick a finished lot number and ask the supplier to show, from records, every raw material lot in it and every customer who received it. Note how long it takes.

• A readable, permanent lot code on every bag or carton.
• Trace backwards to raw material lots and their suppliers.
• Trace forwards to every buyer and the quantity shipped.
• Quantities reconcile, with losses explained.
• A written recall plan with named people, contacts and steps.

7. Is pest control working, not just contracted?

A contract is not evidence. The Codex text says that even where monitoring is outsourced, the business should review monitoring reports and make sure corrective action is taken. Schedule 4 asks for records of pesticides used, with dates and frequency.

Walk the building edge, inside and out, before you read the file.

• A pest map with every bait station and trap numbered.
• Stations in place and matching the map; open three or four at random.
• Doors, windows and drains fitted with mesh, grills or seals; no gaps under shutters.
• Bait placed where it cannot reach product.
• Recent treatment records, with chemicals named.
• Sightings and actions reviewed and signed off by the site, not only the contractor.

8. Is the water safe for food?

Schedule 4 says only potable water should be used as an ingredient in processing, that storage tanks should be cleaned periodically with records, and that non-potable pipes should be clearly marked. A licence application also asks for a chemical and bacteriological analysis of ingredient water from a recognised or public health laboratory.

• Water source named, and the treatment applied.
• Latest chemical and bacteriological report, with sampling date and point.
• Tank cleaning register up to date.
• Non-potable lines marked and kept apart from food water.
• Ice and steam in contact with food made from potable water.

9. How are goods stored, packed and loaded?

Many quality problems begin in the store or the container. Schedule 4 asks for food to be stored on racks or pallets well above the floor and away from the wall, for raw, processed, rejected and returned goods to be kept apart and marked, and for first in, first out or first expired, first out rotation.

• Stacks on pallets, off the floor and clear of walls.
• Separate marked areas for raw, finished, rejected and returned stock.
• Packaging stored apart from chemicals and hardware.
• Temperature and humidity controlled where the product needs it.
• Lot codes applied at packing, in a clean, controlled packing area.
• Containers inspected before loading for cleanliness, smell, damage and moisture, with a record.
• Loading records tying lot numbers to container numbers.

If the supplier prints your retail packs, read the house's guide to food label requirements before you approve artwork.

10. Are the people fit, trained and supervised?

Schedule 4 asks for food handlers to be medically examined once a year, with signed records, and for training to be assessed and reviewed. The Codex text says records of training should be kept and asks management to build a positive food safety culture.

• Clean protective clothing, head covering and footwear in food areas, for staff and visitors.
• Handwashing at entry to production.
• No eating, smoking or chewing in food areas.
• Annual medical examination records.
• Training records by person and topic, including hygiene, allergens and critical controls.
• A named, qualified person responsible for food safety, present on the day.
• Ask two operators what they do if a reading is out of limit. Their answers tell you more than the file.

11. What happens when something goes wrong?

Every site has deviations; what matters is what happens next. The Codex text defines a corrective action as one taken to re-establish control, decide what happens to the affected product and prevent it happening again. Schedule 4 asks for a periodic audit of the whole system, with records kept for one year or the shelf life of the product, whichever is more.

• Complaint log, with cause and action for each.
• Deviation records from the process controls.
• Two closed corrective actions you can follow from problem to fix to proof.
• Internal audit reports and the action taken on them.
• Records kept for the required period and easy to find.

Should you audit remotely or on site?

A remote audit uses live video and shared documents in place of a visit. It suits paperwork review and a first screen of several suppliers. It is weak at what needs your own senses: smell, dust, damp, pests, the real state of a store, and whether the line you are shown actually runs.

If you audit remotely, make the evidence harder to stage:

• Ask for one continuous live walk, not recorded clips, with you directing the camera.
• Start at the gate and end at the loading bay.
• Pick records at random during the call.
• Ask for a sample to be drawn on camera, sealed, marked and couriered to you.

A usable pattern: screen three or four suppliers remotely, visit the strongest one or two in person, and approve a sealed sample before you sign.

How do you score the audit and decide?

• Critical. A direct food safety risk or legal failure, such as no valid licence for the product, no control at a critical step, unsafe water or live infestation in a food area. One critical finding stops approval.
• Major. A system on paper that fails in practice, such as logs filled in after the event or a trace exercise that cannot be completed. Approval waits until it is closed with evidence.
• Minor. A single lapse in a working system. Approval can proceed, with a date to close it.

Record one outcome: approved, approved with conditions, re-audit required, or not approved. Send the supplier the findings in writing, with a date for each action, and set the next audit date by product risk.

Which findings should stop the order?

• The name on the licence is not the company that will invoice you.
• Your product is not covered by the licence.
• The line is idle and the supplier cannot show it running.
• Samples come from an office cupboard, not current stock.
• Logs are blank, in one handwriting, or completed ahead of time.
• Test reports carry no laboratory name, date or lot number.
• A finished lot cannot be traced back to its raw materials.
• You are refused access to the store, the lab or the packing area.

How Poorti handles supplier checks for buyers

If you buy from India but cannot travel, the house can do this work for you. Poorti's Verify inspection builds a shortlist of makers matched to your written specification, visits each in person on a stated date against the same eight checks, and gives you a written report with dated photographs and a plain verdict on each maker. Samples are drawn from current production. The report records what was observed on that date against your specification. It is not a laboratory analysis or a certification, and where something could not be seen or checked, it says so.

When you buy through the house, the Poorti Standard sets out the holds every order goes through: your sample is sealed and sent for approval before anything is contracted, and each lot carries its certificate of analysis. For brand founders, the Make door runs in six steps: brief, sealed sample, brand and pack, produce, certificate of analysis for every lot, and dispatch.

Questions people ask

What is a supplier audit checklist in the food industry?

It is a structured list of checks a buyer uses to decide whether a food supplier can make a product safely and to specification. It covers licences, hygiene, raw materials, process controls, testing, traceability, pest control, water, storage, people and corrective actions, and asks for evidence on each.

How often should a food supplier be audited?

Set the frequency by risk. A ready-to-eat ingredient, or a supplier with major findings, needs a closer interval than a low-risk supplier with a clean record. A sensible pattern is to audit before the first order, then at a fixed interval, and again after any serious complaint or change of site.

Is a food safety certificate a substitute for an audit?

No. A certificate shows a site met a scheme's requirements on its audit date, within a stated scope. Your audit checks your product against your specification. Use the certificate as evidence, after checking its scope and expiry with the issuing body.

What documents should I ask an Indian food supplier for before an audit?

Ask for the food licence and its product categories, the food safety plan, the latest water analysis, the recall plan, recent laboratory reports for your product, the cleaning and pest control programmes, and training records. Check the licence number on FoSCoS yourself.

Can a supplier audit be done entirely online?

A document review and a live video walk can screen out weak suppliers, but they cannot show you smell, pests, real capacity or a line running on the day. Use a remote audit as a first screen and visit in person, or have someone visit for you, before a large order.

What should happen after the audit?

Send the supplier your graded findings in writing, with dates for each correction. Approve a sealed sample against your specification, put a certificate of analysis for every lot into the contract, and set the date of the next audit.

If you are checking a supplier in India for dehydrated onion, dehydrated garlic, dried ginger, potato flakes and flour, fire-roasted pulps or vegetable and fruit powders, send Poorti the product, the specification you buy to and your destination port at poorti.net/contact. If you are a brand founder who wants a product made under your own label, start at poorti.net/make.