Supplier Verification: A Checklist Beyond the Paper Trail

By Zynthio. Published 19 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

Supplier verification goes past collecting certificates. Work through approved lists, traceability, delivery checks and allergen data.

Supplier verification is the running process that proves every business feeding a kitchen is traceable, competent and delivering what was ordered - checked at each delivery, not once at sign-up. A folder of certificates shows only that a supplier passed somebody else's audit on one day.

Three sets of rules sit behind the work in England. Regulation (EC) 178/2002 sets the traceability duty, Regulation (EC) 852/2004 governs what may be accepted into a food business and how the cold chain is treated, and the Food Safety and Hygiene (England) Regulations 2013 carry the offences that enforce them. Each stage below ends in a record an environmental health officer can read.

What supplier verification covers

Four things, and most venues hold only the first two.

• Identity. Trading name, registered address, food business registration or approval number, and the carrier that turns up at the back door.
• Competence. The supplier's own food safety management system, any third-party certification, and the date of its last audit rather than the fact that one exists.
• Specification. What each product is, in writing: ingredients, allergens, storage temperature, shelf life and pack size.
• Performance. What the supplier has done across the last twenty deliveries - temperatures on arrival, short dates, substitutions, damage and shortages.

Performance is the part almost nobody records, and the only one that shows whether the other three are still true. A supplier certified in March can be delivering warm stock in September. Supplier approval and traceability sets out the principle; the stages below are the evidence side of it.

Stage one: build an approved supplier list that survives scrutiny

An approved supplier list says who may deliver to the site, and on what basis. Work through it in order.

1. List every supplier currently delivering, including the cash-and-carry account, the greengrocer and the one-off who brings the eggs.
2. For each, record legal name, address, contact, food business registration or approval number, the products supplied, and the date approval was granted.
3. Risk-rate them. Treat raw meat, fish, shellfish, dairy, ready-to-eat products and anything carrying a free-from claim as high risk; dry goods and packaging as lower.
4. Set the assurance each band needs: a certification certificate plus signed product specifications for high risk, a completed questionnaire for the rest.
5. Give the list a named owner and a review date - twelve months by default, and immediately after any failure.
6. Name who may add to it. An unapproved delivery accepted at 6am by whoever opened up is how a good list quietly stops being true.

Two columns matter more than the others: the date approval was granted, and the evidence it was granted on. Without those the list is a contacts book.

Stage two: hold the traceability records the law requires

General food law states the duty plainly. Under Regulation (EC) 178/2002, traceability shall be established at all stages of production, processing and distribution. Article 18 splits that into the two directions operators know as one step back and one step forward.

• One step back. Operators shall be able to identify any person from whom they have been supplied with a food, and shall have systems and procedures that allow the information to be made available to the competent authorities on demand.
• One step forward. Operators shall have in place systems and procedures to identify the other businesses to which their products have been supplied. A restaurant selling only to diners has no forward step. A venue supplying a sister site, a market stall or an outside catering client does.
• On demand. The duty is to produce the information, not merely to possess it. A box of delivery notes nobody can search does not meet it.

The practical minimum per delivery is supplier, product description, batch or lot code where one is printed, quantity, and date received. Keep the delivery note itself rather than a summary, because the note carries the codes a recall is issued against.

Enforcement sits in national law. In England, regulation 19 of the Food Safety and Hygiene (England) Regulations 2013 provides that any person who contravenes or fails to comply with any of the specified EU provisions commits an offence. Subject to the exceptions the regulation itself sets out, the general penalty on conviction on indictment is imprisonment for a term not exceeding two years, a fine, or both. Operators in Scotland, Wales or Northern Ireland should work to the equivalent instrument for their own nation.

Stage three: check the delivery before anyone signs for it

Acceptance is a legal decision taken at the back door, often by the least senior person on shift. Regulation (EC) 852/2004 states that a food business operator is not to accept raw materials or ingredients if they are known to be, or might reasonably be expected to be, contaminated to the point where the final product would be unfit for human consumption.

• Vehicle and load. Clean, covered, raw kept apart from ready-to-eat, nothing stacked on open produce.
• Temperature. Probe between packs rather than reading the lorry gauge. Food that needs refrigeration must be kept at 8°C or below in England, Wales and Northern Ireland, and most operators work to 5°C or below so the legal limit is never in question. The four-hour tolerance in the rules applies to display and service, not to a pallet on a pavement.
• Packaging and date codes. Intact, legible, and with enough shelf life left to be useful; a short date is a rejection, not a favour.
• Identity. What arrived against what was ordered. A substitution is a different product with a different specification and possibly different allergens.
• The record. Time, temperature reading, the name of the person who checked, and what was rejected.

The same regulation states that the cold chain is not to be interrupted, while allowing limited periods outside temperature control for the practicalities of handling, transport, storage, display and service. A chilled delivery left on a loading bay through a lunch service is the interruption that wording is aimed at. Temperature monitoring and the cold chain covers the fridge and freezer records these readings feed.

Record rejections as carefully as acceptances. A refused pallet with a time, a reading and a photograph behind it is a performance record that justifies de-listing later.

Stage four: get allergen information in writing from the supplier

Allergen accuracy in a kitchen cannot be better than the supplier data underneath it. Natasha's Law - full ingredient and allergen labelling on food prepacked for direct sale - has applied since 1 October 2021, and every label a venue prints inherits whatever the specification sheet said.

• Hold a current, dated specification for every bought-in product that names the allergens present.
• Re-request specifications on a fixed cycle, and immediately after any substitution or brand change.
• Ask suppliers in writing to notify recipe changes, and keep the request on file; a supplier who will not agree to it is a risk the list should reflect.
• Treat an unfamiliar pack, a new code or a swapped brand as unverified until the paperwork arrives.
• Record who checked the specification, on what date, and which dishes it feeds.

Free-from claims need separate treatment. A claim that a product is free from an allergen is a supplier assurance the venue repeats to a customer, so it needs a document behind it and a review date on that document. Allergen management under Natasha's Law covers how that information reaches the guest.

Stage five: act on a supplier failure the day it happens

A supplier failure runs from a single warm delivery to a national recall. The sequence is the same either way.

1. Quarantine physically. Separate the stock, label it, and stop it being used while the question is open.
2. Use the traceability record to find every affected batch, across every site, including product already prepped into dishes.
3. Where food supplied is harmful to health, unfit for people to eat or does not meet legal requirements, government guidance is to immediately withdraw or recall the food from the market and to tell your competent authority, meaning the local authority or port health authority.
4. Where unsafe food has already reached consumers, tell the Food Standards Agency incidents team as well.
5. Record the decision: quantity, batch codes, disposal route, and the manager who authorised it.
6. Settle the supplier's status. A first failure earns a documented corrective action and a shortened review date; a repeat inside that period moves the supplier off the approved list.

Government guidance makes the link explicit: to run a withdrawal or recall, you need to be able to identify your suppliers and food business customers. That sentence is why stage two is not filing for its own sake. Read the guidance on food incidents, product withdrawals and recalls before it is needed rather than during.

The record an inspector will ask for

Certificates are the easiest thing to produce and the least revealing. Expect the questions to run the other way: where did this come from, show the delivery record for it, show what happened the last time something arrived out of temperature, and show that the person who accepted it knew what to check. Five things answer most of that.

• The approved supplier list, with approval dates and the evidence behind each one.
• Delivery records covering recent weeks, carrying temperatures, times and the name of the person who checked.
• At least one corrective action raised on a failed delivery, closed out with its outcome.
• Allergen specifications for bought-in products, dated and matched to dishes.
• Evidence that a supplier issue was investigated and the supplier's status reviewed afterwards.

Records in that shape do double duty, because they are also the material behind a due diligence defence if a prosecution ever follows. Paper can carry all of it, and paper also loses the names, the times and the readings that made the record worth keeping.

Zynthio logs temperatures as a validated min/max field and auto-raises a corrective action on an out-of-range reading, timestamps and names every entry, supports photo evidence, and exports six weeks of records as a PDF. Its recipe module records a three-state allergen assessment - contains, free from, not assessed - and lapses it when ingredients change, so a substituted supplier product stops reading as assessed. The food safety software pages set out how those checks are built and signed off.

See how Zynthio handles this