Supplier Approval That Holds Up: COAs, Qualifications, and the Paper Trail

Every ingredient that crosses your dock brings its supplier's program with it. The approval file is your evidence that you know what you are inheriting. Here is what a defensible program looks like at a facility that also has production to run.

Rank suppliers by what they can do to you

An allergen-bearing ingredient from a broker deserves a deeper file than shrink film from a national distributor. Rank by hazard of the material, history of the supplier, and your ability to detect a problem at receiving. The ranking decides the qualification depth, so you spend your effort where the exposure is.

The documents that actually matter

• A current GFSI certificate or your own audit, matched to the risk rank

• Ingredient specifications you have agreed to, not just received

• Allergen and country-of-origin statements that match the spec

• A COA arrangement that names the tests, methods, and limits

A COA you do not verify is a rumor

The certificate says what the supplier's lab found in their sample. Periodically test against it, at a frequency your risk rank sets, and record the comparison. The first time your result disagrees with their certificate is the day the whole program pays for itself.

Requalification is where programs go quiet

Approval is an event; the audit question is about the ongoing state. Certificates expire, specs drift, and suppliers change processes without telling you. Put expiry dates and review cadences on a calendar with an owner, and let receiving be the tripwire: a COA that stops matching the spec is a requalification trigger, not a filing task.