Supplier Approval Questionnaires: What a Certified Exporter Sends Back

Buyer’s snapshot

• In 2024 the EU’s Alert and Cooperation Network logged 392 notifications on herbs and spices, 4 percent of the year’s total, with multiple pesticide residues in cumin and unauthorised dyes among the recurring hazards (European Commission, ACN 2024 Annual Report).
• A supplier approval questionnaire (SAQ) is the buyer’s side of a legal duty: US importers must verify foreign suppliers under the FDA’s FSVP rule, and a certified site must risk-assess its suppliers under BRCGS and FSSC 22000.
• Every SAQ section maps to a controlled document a certified site already holds. The table below names the section, what it tests, and the record that answers it.
• Silk Route Ventures answers from the BRCGS and FSSC 22000 V6 audited Silk Foods Ceylon site in Matale, with a certificate of analysis on every batch and traceability to farm.
• For procurement and technical teams in the EU, UK and US who need a Ceylon supplier approved before the first PO.

Most supplier approval questionnaires that reach a Sri Lankan exporter run past 30 pages, and most of the answers already exist in the site’s audit file. The questionnaire is slow when the supplier treats it as a form to fill in, and fast when the supplier treats it as an index to documents it already holds.

Silk Route Ventures (SRV) answers these questionnaires for buyers in the EU, UK, US and Australia on behalf of its manufacturing arm, Silk Foods Ceylon (SFC), in Matale. This post walks a typical buyer SAQ section by section and names the document that closes each one. It does not restate what BRCGS certification signals to a retail listing buyer or what an FSSC 22000 V6 scope line proves. Those posts are the hubs. This one is the questionnaire.

Why does every buyer send a supplier approval questionnaire?

A supplier approval questionnaire exists because the buyer is itself audited on supplier approval. Under the FDA’s Foreign Supplier Verification Programs rule, in force since January 2016, a US importer must analyse the hazards in each imported food, evaluate the foreign supplier’s procedures and compliance history, verify the supplier, and re-evaluate at least every three years (US FDA, FSVP final rule). A certified buyer in the EU or UK carries the same duty through its own scheme.

On the BRCGS side, clause 3.5.1 of the Global Standard Food Safety makes supplier approval a fundamental requirement: a documented risk assessment of the supplier, the material and its use, which must consider substitution or fraud. FSSC 22000 V6 carries the equivalent in additional requirement 2.5.1. Neither standard tells the buyer which questions to ask, which is why every SAQ looks slightly different and asks largely the same things. As of 2026, GFSI recognises 13 certification programme owners, BRCGS and FSSC 22000 among them (GFSI), and a current certificate from one of them usually collapses half the questions into one attachment. The other half are site-specific.

The map: each SAQ section, what it tests, and the document that answers it

A standard buyer SAQ has eight to ten sections, and a BRCGS and FSSC 22000 V6 certified site holds a controlled document for each. BRCGS reports more than 22,000 certified sites in over 130 countries (BRCGS, 2026), and every one of them keeps the same core records, which is what makes a questionnaire answerable in days rather than weeks.

SAQ section	What the buyer is testing	The document that answers it	Where the standard asks for it
GFSI certificate	Third-party audit to a recognised scheme, scope covering the product bought	Certificate, full scope statement, complete final audit report	BRCGS and FSSC 22000 V6 certificates
HACCP	Hazards controlled by a plan built on Codex principles	HACCP plan: hazard analysis, CCPs, critical limits, monitoring, validation records	Codex CXC 1-1969 (rev. 2020); ISO 22000 clause 8
Allergens	Cross-contact assessed and controlled, not assumed absent	Site allergen list, cross-contact risk assessment by line, cleaning validation, training records	FSSC 22000 V6 2.5.6; BRCGS 5.3
Food fraud	Materials at risk of economically motivated adulteration identified and mitigated	Vulnerability assessment (VACCP) and mitigation plan, reviewed annually	BRCGS 5.4; FSSC 22000 V6 2.5.4
Food defence	Deliberate contamination assessed, site access controlled	Threat assessment (TACCP per PAS 96:2017) and food defence plan	BRCGS 4.2; FSSC 22000 V6 2.5.3
Traceability and recall	A lot traceable both ways quickly, and withdrawable	Last trace test with timing; recall procedure and last mock recall report	BRCGS 3.9 and 3.11; ISO 22000 8.3 and 8.9
Pest control	Pests managed under contract with records and trend review	Pest control contract, device plan, inspection reports, trend analysis	BRCGS 4.14; ISO/TS 22002-1
Foreign body control	Metal, glass and brittle plastic controlled at the right points	Glass and brittle plastic register, sieve and magnet checks, metal detection records where fitted	BRCGS 4.9 and 4.10; ISO/TS 22002-1
Per-lot evidence	The spec met on this lot, not on a template	Batch certificate of analysis against the agreed spec; organic transaction certificate where claimed	Supply agreement; Regulation (EU) 2018/848 for organic

Source: SRV supplier-approval desk mapping against BRCGS, FSSC 22000 Scheme Version 6 and Codex CXC 1-1969.

The certificate section decides whether the reviewer reads on; the per-lot section decides whether the first container clears intake. Everything between them is where a questionnaire stalls, usually because the supplier sent a policy where the reviewer wanted a dated record. For the Ceylon spice range SRV supplies against a buyer’s spec, those records are the ones the site is audited on each year.

How should an exporter answer the allergen section?

The allergen section is the one most often answered with a reflexive “none handled on site”, and for a multi-category Sri Lankan site that answer is usually wrong. The EU lists 14 substances in Annex II of Regulation (EU) 1169/2011, and the US has listed nine since sesame was added on 1 January 2023 under the FASTER Act (US FDA, 2023). Mustard and celery are allergens in the EU and not in the US, so one answer rarely serves both markets.

The Silk Foods Ceylon catalogue includes mustard seed and powder, soya and oat plant milks and a cashew cheese, so the honest answer at SFC is a site allergen list, a cross-contact risk assessment by line, and validated cleaning between allergen-bearing and allergen-free runs. FSSC 22000 V6 added exactly this structure in requirement 2.5.6: a list of all allergens handled, documented validation of the controls, and allergen training (Foundation FSSC, 2023). A buyer who sees “no allergens” from a site that mills mustard reads the whole questionnaire differently.

State which lines share equipment with which allergens, and whether cleaning validation was by swab or by visual check, even if the form has no field for it. That is the answer the technical reviewer wanted.

Certification snapshot: Silk Foods Ceylon, Matale BRCGS (spices, herbs, coconut, fruit powders, plant-based and retorted lines) FSSC 22000 V6 (full processing scope, including capsules, plant-based milks and plant-based meat alternatives) USDA Organic and EU Organic on the relevant SKUs Registered with the Sri Lanka Export Development Board; US FDA-registered facility Site 1 km from Nalanda Gedige, Matale, Central Province

Food fraud and food defence: the two sections suppliers most often answer wrongly

Food fraud and food defence are separate questions with separate documents. Fraud is economically motivated adulteration, assessed by vulnerability (VACCP) under BRCGS clause 5.4 and FSSC 22000 V6 requirement 2.5.4. Defence is deliberate contamination, assessed by threat (TACCP) under the BSI guide PAS 96:2017 and FSSC requirement 2.5.3 (BSI, 2017). An SAQ that receives one plan for both is marked incomplete.

In 2024 the EU’s Alert and Cooperation Network logged 9,460 reports, 5,250 of them RASFF notifications, and herbs and spices accounted for 392 (European Commission, ACN 2024 Annual Report). One cumin sample carried 18 different pesticide residues. Others carried Sudan dyes, Orange II and Rhodamine B, colourants with no legal use in food that turn up in a spice lot for one reason. That is the baseline the fraud section is written against: not whether adulteration is possible in spices, but what this supplier has done about it.

The vulnerability assessment at SFC ranks raw materials by the adulteration history of the category, price pressure, supply-chain length and ease of detection, and attaches a control to each: botanical identity confirmed at intake, a batch certificate of analysis covering heavy metals and pesticide residues where the destination market requires them, and third-party testing for any parameter a customer names. How to read a per-lot heavy metal and pesticide COA covers the numbers. The food defence plan is shorter and more physical: who can enter the processing floor, how raw material stores are secured, how a tamper would be noticed. Both carry a review date inside the last twelve months, because both standards require it.

Traceability, recall, pest and foreign-body control: the operational sections

These four sections test records rather than policies. BRCGS expects a certified site to complete a full traceability test, forward and backward, within four hours, and to test its recall procedure at least annually. A questionnaire reviewer looks for the date and the result of each, not for the procedure. A supplier who sends the procedure without the last test result has answered the wrong question.

Silk Foods Ceylon traces a spice or herb lot to the farm or collection point and ships a certificate of analysis with every batch, so the traceability section is answered with the most recent trace test, its elapsed time and the lot it followed. The recall section gets the last mock recall report: the lot chosen, the customers reached, the time taken to reconcile the quantity. How traceability depth and COA cadence are written into a supply contract is covered separately.

Pest and foreign-body control are where a Sri Lankan site is judged against the climate it works in. The answer is a contracted pest programme with a device plan and trend analysis, and for dried products the foreign-body controls that fit: sieving on the spice and herb lines, magnets at the right points, a glass and brittle plastic register, and whatever metal detection step the customer spec requires. The reviewer wants the check frequency and the last out-of-limit event. A line with no recorded deviations in three years draws more questions than one with two deviations and two closed corrective actions.

What speeds supplier approval?

Approval is fastest when the supplier sends a pre-built dossier that answers the standard sections before the questionnaire arrives, references the clause each document satisfies, and attaches the full audit report rather than the certificate alone. Buyers are trimming from their side too: in October 2025 Sedex cut its goods-provider self-assessment questionnaire from a maximum of 286 questions to 158, after pilot suppliers took between an hour and half a day to complete it (Sedex, 2025).

Buyer’s checklist: what a complete SAQ return from a Ceylon supplier contains

1. Current BRCGS and FSSC 22000 V6 certificates, full scope statements, complete final audit reports
2. HACCP plan summary with CCPs, critical limits and the last validation date
3. Site allergen list and cross-contact risk assessment by line, with the cleaning validation method
4. Food fraud vulnerability assessment and food defence plan, each reviewed inside twelve months
5. Last traceability test (date, elapsed time, lot) and last mock recall report
6. Pest control contract summary, device plan and the last two inspection reports
7. Glass and brittle plastic register and foreign-body check frequencies by line
8. A sample batch COA against the spec you intend to buy, plus the shipping document pack

Three habits save the most time. Answer the question asked, in the field provided, with the supporting document named beside it; reviewers approve from the questionnaire, not from the attachments. Date everything, because a reviewer working to the FSVP three-year re-evaluation is checking currency as much as content. And say what the site does not do: a spice site that states it holds no cosmetic GMP certification and sends pesticide residue panels to a third-party laboratory is more credible than one that ticks every box. The documents that travel with each container are listed by owner in the 2026 Ceylon export compliance checklist, and how to write a spice RFQ covers the spec side of the same conversation.

Frequently asked questions

What is a supplier approval questionnaire in food manufacturing?

A supplier approval questionnaire (SAQ) is the form a manufacturer, distributor or retailer sends a prospective supplier to evidence its food-safety controls before approval. It exists because the buyer is itself audited on supplier approval: BRCGS clause 3.5.1 requires a documented risk assessment of every supplier, and the FDA’s FSVP rule requires US importers to verify foreign suppliers (US FDA, 2016).

Does a GFSI certificate replace the supplier approval questionnaire?

No. A current BRCGS or FSSC 22000 V6 certificate, with its scope statement and full audit report, typically closes the certification, HACCP and prerequisite sections; GFSI recognises 13 programme owners whose certificates buyers accept for this (GFSI, 2026). The allergen, fraud, defence, traceability and per-lot sections are site-specific and still need their own documents.

Which allergens must a Sri Lankan spice exporter declare on an SAQ?

Whichever list the buyer’s market uses. The EU requires 14 under Annex II of Regulation (EU) 1169/2011, including mustard and celery; the US lists nine under FALCPA and the FASTER Act, with sesame added from 1 January 2023 (US FDA, 2023). The exporter declares every allergen handled on site, then shows the cross-contact assessment for the line the buyer’s product runs on.

Does Silk Route Ventures provide a completed supplier approval pack before a first order?

Yes. Silk Route Ventures sends a pre-built dossier from the BRCGS and FSSC 22000 V6 audited Silk Foods Ceylon site in Matale: certificates with scope, audit report, HACCP summary, allergen list, fraud and defence plans, the latest trace and mock recall results, and a sample batch COA. Buyers complete their own SAQ from it; first orders start at 50 kg per SKU.

How Silk Route Ventures can help

Silk Route Ventures (SRV) supplies spices, herbs, coconut, tea, capsule, plant-based and functional food lines under one supplier, one certification stack (BRCGS, FSSC 22000 V6, and USDA Organic and EU Organic on the relevant SKUs), one shipping document pack and one consolidated freight schedule, all from the Silk Foods Ceylon (SFC) site in Matale. Distributors and manufacturers running a multi-category programme can approve one site instead of five to nine, with the supplier approval dossier sent before the first questionnaire arrives. First-order MOQ is 50 kg per SKU, with volume pricing at 500 kg, 1,000 kg and 2,500 kg breaks; samples ship by international courier in 3 to 5 business days. Contact us to request the supplier approval pack and the consolidated catalogue.

Sources

• US FDA, “FSMA Final Rule on Foreign Supplier Verification Programs (FSVP)” (2016). https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-final-rule-foreign-supplier-verification-programs-fsvp-importers-food-humans-and-animals. Retrieved 5 October 2026.
• BRCGS, “Global Standard Food Safety” (over 22,000 certified sites in more than 130 countries). https://www.brcgs.com/our-standards/food-safety/. Retrieved 5 October 2026.
• Foundation FSSC, “FSSC 22000 Scheme Version 6” (2023), additional requirements 2.5.1, 2.5.3, 2.5.4 and 2.5.6. https://www.fssc.com/wp-content/uploads/2023/03/FSSC-22000-Scheme-Version-6-.pdf. Retrieved 5 October 2026.
• GFSI, “GFSI-Recognised Certification Programme Owners.” https://mygfsi.com/how-to-implement/recognition/certification-programme-owners/. Retrieved 5 October 2026.
• European Commission, DG SANTE, “Alert and Cooperation Network: 2024 Annual Report” (2025). https://op.europa.eu/en/publication-detail/-/publication/65ee7b44-35eb-11f0-8a44-01aa75ed71a1/language-en. Retrieved 5 October 2026.
• FAO/WHO Codex Alimentarius, “General Principles of Food Hygiene, CXC 1-1969” (revised 2020). https://www.fao.org/fao-who-codexalimentarius/codex-texts/codes-of-practice/en/. Retrieved 5 October 2026.
• US FDA, “FASTER Act: Sesame as the Ninth Major Food Allergen” (2023). https://www.fda.gov/food/food-allergies/faster-act-sesame-ninth-major-food-allergen. Retrieved 5 October 2026.
• European Parliament and Council, Regulation (EU) No 1169/2011, Annex II. https://eur-lex.europa.eu/eli/reg/2011/1169/oj. Retrieved 5 October 2026.
• BSI, “PAS 96:2017 Guide to protecting and defending food and drink from deliberate attack” (2017). https://www.bsigroup.com/en-ID/pas-96-food-defence/. Retrieved 5 October 2026.
• Sedex, “Changes coming to the Self-Assessment Questionnaire (SAQ) for Goods providers” (8 October 2025). https://www.sedex.com/knowledge-hub/news/changes-coming-to-the-self-assessment-questionnaire-saq-for-goods-providers/. Retrieved 5 October 2026.

Further reading

• Techni-K, “Are supplier assessment questionnaires getting out of control?” https://techni-k.co.uk/supplier-management/are-supplier-assessment-questionnaires-getting-out-of-control/
• Eissa, F. et al., “Contamination of herbs and spices: a 23-year EU RASFF notifications analysis,” Journal of Food Safety (2024). https://onlinelibrary.wiley.com/doi/10.1111/jfs.13131

Written by the Silk Route Ventures Trade Team. Silk Route Ventures (E-Silk Route Ventures (Pvt) Ltd, T/A Silk Route Ventures) is a Sri Lankan B2B supply-chain operator for the Food, Beverage, Wellness, and Nutraceuticals sectors. The Silk Foods Ceylon manufacturing arm holds BRCGS and FSSC 22000 V6 certifications. Questions or to request a sample: contact https://www.esilkroute.com.lk/contact or email info@esilkroute.com.lk.