Skip to content
Close
SEARCH
CONTACT
PHONE HOTLINE: 1 (800) 477-0778E-MAIL: US.Info@kiwa-asi.com
QUOTE REQUEST
PHONE HOTLINE: 1 (800) 477-0778E-MAIL: US.Info@kiwa-asi.com
QUOTE REQUEST

New Kiwa ASI Self-Paced Training: Train your whole team New Self-Paced Training: Train your whole team Browse Courses

Supplier Audits: Second-Party Audits & Retailer Audit Programs

A supplier audit — also called a second-party audit — is an on-site evaluation of a supplier's food safety systems, quality controls and regulatory compliance, conducted on behalf of a purchasing company. Kiwa ASI conducts second-party audits for retailers, food brands and foodservice companies across the United States, including proprietary retailer programs such as McDonald's SQMS and DQMP.

  • Approved for McDonald's SQMS & DQMP
  • Walmart, Kroger & Sprouts Partner
  • GFSI-Benchmarked Audit Options
  • Part of Kiwa — 30+ Countries
Request a Quote Call 1 (800) 477-0778

Last updated September 29, 2026

Get a Supplier Audit Quote

Tell us your buyer and product category and we'll confirm the audit you need, scope and pricing.

Kiwa ASI works with some of the largest retailers in the country such as Walmart, Kroger, and Sprouts to conduct supplier audits.

Kiwa ASI specializes in helping companies prepare for and navigate supplier audits effectively. With our extensive experience in food safety and compliance, we offer comprehensive services to ensure that your organization meets the rigorous standards and requirements of supplier audits.

What Is a Supplier Audit?

A supplier audit is an on-site evaluation of a supplier's facility, processes and food safety management systems conducted on behalf of a purchasing company (the buyer). Because the buyer — the second party — initiates it, it is known as a second-party audit. Major retailers, food brands and foodservice companies require these audits, or GFSI-benchmarked certification, as a condition of doing business.

Why they matter

Companies like Walmart, Amazon, Kroger, Sprouts Farmers Market, McDonald's and Yum! Brands each maintain supplier verification requirements — from proprietary quality management systems like McDonald's SQMS to GFSI-benchmarked certification mandates. Without a valid audit or certificate, supplier approval is denied or revoked, which makes supplier audits a business necessity rather than an option.

  • Conducted on Behalf of the Buyer

    Unlike first-party (internal) audits, second-party supplier audits are initiated by the purchasing company to verify supplier compliance with its specific requirements. When buyers outsource these audits to a qualified firm like Kiwa ASI, they get the rigor of an experienced auditing organization combined with buyer-specific audit criteria.

  • Comprehensive Scope

    Supplier audits evaluate GMP adherence, HACCP implementation, sanitation and hygiene programs, allergen management, pest control, traceability, product recall procedures, employee training and facility maintenance — every system that impacts product safety.

  • Risk Mitigation for Buyers and Suppliers

    For buyers, supplier audits reduce the risk of product recalls, regulatory enforcement and reputational damage. For suppliers, they demonstrate commitment to safety and quality — strengthening business relationships and opening doors to new retail partnerships.

First-Party vs. Second-Party vs. Third-Party Audits

The difference comes down to who commissions the audit. A second-party audit is performed for a customer against that customer's own criteria; a third-party audit is performed by an independent certification body against a published standard, such as SQF or BRCGS, and results in a certificate. For what to expect from one and who performs them, see our guide to third-party food safety audit companies.

  • INTERNAL

    First-Party Audit

    An internal audit the organization performs on itself — self-assessment against its own procedures and the standards it follows. Required by every GFSI scheme, and step one of audit readiness.

  • FOR THE BUYER

    Second-Party Audit

    Conducted by or on behalf of a customer to verify a supplier meets that customer's requirements — a supplier audit. This covers retailer programs like McDonald's SQMS and DQMP, buyer GMP protocols and custom audit criteria.

  • INDEPENDENT

    Third-Party Audit

    An independent certification audit against a published scheme — SQF, BRCGS, FSSC 22000, PrimusGFS — by an accredited certification body. Results in a certificate many retailers accept in place of, or alongside, their own audits.

Many buyers combine the two: a GFSI-benchmarked certificate as the baseline, plus a buyer-specific second-party audit or addendum on top. See GFSI certification for how the schemes compare.

Retailer-Specific Audit Programs

Most major retailers and restaurant brands run their own supplier audit programs on top of — or in place of — GFSI-benchmarked certification. Some, like McDonald's, use proprietary audit schemes delivered by approved audit firms. Others, like Walmart and Kroger, mandate GFSI certification and add buyer-specific audits or minimum grades. Kiwa ASI is approved to conduct McDonald's SQMS and DQMP audits and conducts supplier audits for Walmart, Kroger, Sprouts Farmers Market and Yum! Brands supplier verification programs, and delivers the GFSI-benchmarked certification audits (SQF, BRCGS, FSSC 22000, PrimusGFS) that most retailer programs are built on.

  • QSR — PROPRIETARY PROGRAM

    McDonald's SQMS

    Annual audit — two-day full SQMS audit or half-day addendum to a GFSI audit

    McDonald's Supplier Quality Management System (SQMS) sets food safety and quality requirements for suppliers of food products to McDonald's — patties, fries, produce, buns, cheese, sauces and more. The audit is required annually and can be delivered as a standalone two-day SQMS audit or, more commonly, as a half-day addendum combined with a GFSI-benchmarked certification audit. There is no certificate: results are scored A (Exceeds, 95–100 %), B (Meets, 85–94 %), C (Partially Meets, 70–84 %) or F (Fail), and reports go to McDonald's supplier quality database. As part of Kiwa, an approved McDonald's audit firm, Kiwa ASI conducts SQMS audits.

  • QSR — PROPRIETARY PROGRAM

    McDonald's DQMP

    Two-day unannounced audit of distribution centers

    The Distributor Quality Management Process (DQMP) applies McDonald's food safety and quality requirements to the warehouse and distribution operations that deliver to McDonald's restaurants. DQMP audits are typically two-day unannounced audits — or a half-day addendum to a GFSI audit — covering acceptance, storage and transport of McDonald's stock keeping units. As part of Kiwa, an approved McDonald's audit firm, Kiwa ASI conducts DQMP audits.

  • GFSI MANDATE

    Walmart & Sam's Club

    Annual GFSI-recognized audit for every site; small-supplier alternative available

    Walmart was the first nationwide U.S. grocer to require GFSI-recognized certification (2008). Every site producing product for Walmart or Sam's Club needs a current approved food safety audit each year, and letting it lapse can mean deactivated vendor numbers. Smaller fresh-produce suppliers (under $3 million global sales or $350,000 in Walmart sales) may qualify for an alternative audit through the GFSI Global Markets pathway while they progress to full certification. Kiwa ASI conducts the SQF, BRCGS and FSSC 22000 audits that satisfy Walmart's requirements.

  • GFSI + SECOND-PARTY FACILITY AUDITS

    Kroger

    GFSI certification for Our Brands plants, plus buyer facility audits

    Kroger requires every plant producing its Our Brands products, ingredients or food-contact packaging to hold a current GFSI-benchmarked certification (BRCGS, SQF, IFS or FSSC 22000), renewed annually. On top of that, Kroger's vendor policy calls for facility audits conducted by a Kroger representative or a Kroger-approved outside agent, at the vendor's expense. Losing GFSI certification can trigger "Problem Supplier" status.

  • PROPRIETARY + GFSI

    Albertsons & Safeway

    Annual Own Brands facility audits plus GFSI minimum grades

    Albertsons' Own Brands program (updated June 2026) requires an initial certification audit and then annual facility audits to Albertsons' own standards, performed by approved audit firms at supplier expense. Its GFSI requirements come with minimum grades — BRCGS grade B or better, SQF score 86 or better, IFS grade B, or an FSSC 22000 certificate — and fresh-produce suppliers submit GAP audits (PrimusGFS 90 %+, CanadaGAP 85 %+) through the Azzule platform.

  • GFSI MANDATE + BUYER REVIEWS

    Target

    GFSI certification for owned-brand food suppliers since 2009

    Target requires suppliers of its owned food brands — Good & Gather, Favorite Day, Market Pantry and Kindfull — to hold GFSI-recognized certification, a requirement in place since 2009. Target's own food safety and quality team also reviews and audits more than 1,100 vendor facilities a year, and expects preventive food safety plans, allergen management, traceability and environmental monitoring.

  • GFSI MANDATE

    Aldi

    GFSI audit report and certificate for every exclusive-brand facility

    Aldi requires every facility producing its exclusive-brand foods to be audited to GFSI-recognized standards, and its quality assurance team collects the full GFSI audit report and certificate for each facility. Supplier-owned warehouses need a GMP certificate, and agents and brokers handling Aldi exclusive brands are expected to certify to the SQF Agents & Brokers Code.

  • GFSI + BUYER VISITS

    Publix

    Third-party GFSI audits plus Publix's own supplier visits

    Publix requires suppliers of private-label products, ingredients for Publix manufacturing and fresh processed foods to pass a third-party audit against a GFSI-recognized scheme, and it conducts its own supplier visits and GFSI-conforming audits as well. Fresh-produce suppliers need annual GAP audits plus GMP/GHP audits covering each ranch, harvest crew, cooler and packinghouse — PrimusGFS is the most common scheme, submitted through Azzule.

  • APPROVED-VENDOR AUDITS

    Whole Foods Market

    Annual third-party audit from a Whole Foods–approved audit firm

    Whole Foods Market holds suppliers to its own quality standards and requires production in a certified commercial facility, with an annual third-party food safety audit — GMP or a GFSI scheme such as SQF — from an approved audit vendor. SQFI notes that very small suppliers may qualify for an SQF Fundamentals remote verification instead of a full on-site certification audit. Detailed requirements are shared through the Whole Foods supplier portal.

  • GFSI-BASED VERIFICATION

    Sprouts Farmers Market

    Third-party certifications and risk-based supplier oversight

    Sprouts requires third-party certifications, product specifications and regulatory compliance from its suppliers, with supplier compliance built around GFSI standards and risk-based oversight. Kiwa ASI works with Sprouts suppliers throughout the audit process to align with Sprouts' food safety and quality expectations.

  • GFSI OR HACCP CERTIFICATE

    Amazon

    Current GFSI certificate or HACCP certificate from an accredited body

    When approving grocery products, Amazon asks for a current GFSI certificate for the manufacturer from an accredited third-party certification body, or a current HACCP certificate. Suppliers to Amazon Fresh and Whole Foods channels follow the respective retail programs. Kiwa ASI is not an Amazon-approved audit provider. It can certify eligible sites to SQF, a GFSI-benchmarked scheme, and the supplier then submits that certificate to Amazon.

  • UNFI · TRADER JOE'S · SCHNUCKS

    Distributors & Regional Grocers

    Third-party audit certificates and GMP compliance

    UNFI requires new suppliers to submit their latest third-party food safety audit certificate and to operate under GMPs, including any co-packers. Trader Joe's states it buys only from licensed facilities holding food safety certifications such as GMP and HACCP, and is reported to run its own proprietary vendor audit program, with third-party GMP audit reports typically accepted. Regional grocers like Schnucks publish supplier food safety requirements of their own. A current GMP audit from Kiwa ASI gives suppliers documentation these buyers accept.

  • BROADLINE DISTRIBUTORS

    Sysco & US Foods

    Annual GFSI audits for private-brand suppliers, plus the distributors' own facility audits

    Sysco's Independent Audit Program requires approved Sysco Brand food and food-contact suppliers to complete an annual GFSI audit by an authorized certification body, with minimum scores and mandatory re-audit rules, while Sysco's own quality managers run initial facility audits and risk-based supplier visits. Produce suppliers submit third-party GAP audits (PrimusGFS, GLOBALG.A.P.) through Azzule. US Foods likewise requires GFSI certification of its Exclusive Brands produce suppliers and layers its own inspections on top.

  • QSR — MOVING TO GFSI

    Yum! Brands

    Proprietary Yum! audits being replaced by GFSI-recognized certification

    Yum! Brands (KFC, Taco Bell, Pizza Hut) is retiring its legacy supplier food safety audits in favor of certification to a GFSI-recognized scheme — BRCGS, IFS Food, FSSC 22000 or SQF — with GFSI Global Markets entry-level programs accepted for less mature sites. Suppliers in most risk categories were required to certify by the end of 2024, with the remainder due by the end of 2026. Kiwa ASI delivers the SQF, BRCGS and FSSC 22000 certification audits this transition is built on.

  • COMPASS · SODEXO · AVENDRA · CRACKER BARREL

    Foodservice & Hospitality

    Supplier codes of conduct backed by buyer-commissioned audits

    Contract catering and hospitality buyers typically combine supplier codes of conduct with buyer-commissioned audits. Sodexo's supplier code reserves the right to announced, semi-announced or unannounced on-site audits of suppliers, conducted by Sodexo or third-party firms on its behalf. Avendra runs risk-based supplier audits through contracted auditors plus unannounced delivery-point checks, and Cracker Barrel requires suppliers to submit full audits annually. These buyer-commissioned audits are exactly the second-party audits Kiwa ASI conducts.

  • KRAFT HEINZ & BRAND OWNERS

    Food Brands & CPG

    Supplier quality manuals plus the brand's own second-party audits, on a GFSI base

    Large food brands audit their supply base directly. Kraft Heinz manages suppliers and co-manufacturers against its Supplier Quality Expectations manual, runs its own on-site and desktop supplier audits, and publicly reports the share of ingredients sourced from GFSI-certified Tier 1 facilities. For suppliers, that means holding GFSI certification and being ready for buyer-specific audits on top — both areas where Kiwa ASI can help.

Program requirements change; always confirm current requirements with your buyer's supplier quality team. Kiwa ASI can help you map exactly which audit your buyer will accept — request a quote and we'll confirm scope before anything is scheduled.

Who Needs a Supplier Audit?

Any facility that manufactures, processes, packs, stores or distributes food for a retailer, food brand or foodservice company may be required to undergo a second-party supplier audit. The audit standard and scope depend on the buyer's requirements, the product category and the regulatory environment.

  • Retail Suppliers

    Suppliers to Walmart, Kroger, Sprouts & other retailers

    Companies supplying food to major retailers must maintain a current GFSI-benchmarked certification or a retailer-approved audit. Kiwa ASI is an approved audit provider for Walmart, Kroger and Sprouts Farmers Market supplier verification programs.

  • QSR & Foodservice

    McDonald's, Yum! Brands & foodservice suppliers

    Quick-service restaurant chains require suppliers to comply with proprietary quality management systems. Kiwa ASI is approved to conduct McDonald's SQMS audits for food suppliers and DQMP audits for distribution and warehousing operations.

  • Food Manufacturing

    Processing, packaging & co-manufacturing plants

    Facilities involved in thermal processing, canning, bottling, extrusion, blending, fermentation, baking and co-manufacturing. Audits evaluate process controls, HACCP plans, GMPs and production environment management.

  • Cold Chain & Distribution

    Warehousing, cold storage & transportation

    Distribution centers, cold storage warehouses, refrigerated transport operators and 3PL providers. Audits focus on temperature control, cross-contamination prevention, inventory management and product integrity in storage and transit.

  • Fresh Produce & Agriculture

    Growers, packers & fresh-cut operations

    Fresh produce farms, packing houses, fresh-cut processors and produce distribution centers. Audits evaluate Good Agricultural Practices (GAP), post-harvest handling, water quality, worker hygiene and traceability from field to retail.

  • Ingredient & Raw Material Suppliers

    Ingredient manufacturers & commodity suppliers

    Companies supplying ingredients, spices, seasonings, additives, flavorings and raw materials to food manufacturers. Audits verify supplier approval programs, incoming material controls, COA processes and allergen segregation.

  • Private Label & Contract Manufacturers

    Co-packers & private label producers

    Contract manufacturers and co-packers producing retailer-branded products face heightened audit scrutiny, because product failures directly affect the retailer's brand reputation.

  • Import & Export Operations

    Importers, brokers & export facilities

    Food importers subject to FSMA Foreign Supplier Verification Program (FSVP) requirements, trade brokers and export-oriented facilities. Audits provide documented evidence of compliance for buyers, customs and regulatory review.

What Are the Benefits of Second-Party Supplier Audits?

  • Retailer & Market Access

    Supplier audits are the entry requirement for supplying Walmart, Amazon, Kroger, Sprouts, McDonald's and other major buyers. A current, credible audit gives your facility the verified status buyers require to approve or maintain supplier relationships.

  • Buyer-Specific Verification

    Second-party audits are tailored to the purchasing company's requirements — not a generic checklist. The audit evaluates exactly what the buyer cares about, whether that's McDonald's SQMS requirements, Walmart's food safety expectations or a custom GMP protocol.

  • Reduced Audit Fatigue

    When multiple buyers accept audits from the same qualified firm, a single comprehensive supplier audit can satisfy several customers at once — instead of hosting separate audits for each buyer with different protocols, timelines and auditor teams.

  • Operational Improvement

    Supplier audits identify gaps in GMP programs, HACCP plans, sanitation, allergen controls and training before they become safety incidents. The corrective action process drives measurable improvement in food safety systems and documentation.

  • Supply Chain Risk Mitigation

    For suppliers and the companies they serve, supplier audits reduce the risk of recalls, regulatory enforcement and reputational damage. A documented audit history demonstrates due diligence in supplier verification.

  • Regulatory Alignment

    Supplier audits align with FDA FSMA requirements, including the Preventive Controls for Human Food rule (21 CFR 117), the FSVP rule for importers and the Produce Safety Rule. A second-party audit can serve as a supplier verification activity under FSMA.

What Does a Supplier Audit Cover?

A second-party supplier audit is a comprehensive on-site evaluation of the systems, programs and practices that directly impact food safety and product quality. The exact scope depends on the buyer's requirements and the applicable standard, but most supplier audits cover these core areas.

Key Audit Areas

Audit AreaKey Focus Points
GMP & Prerequisite ProgramsFacility construction and design, equipment maintenance, pest control, water supply, waste management, cleaning and sanitation programs, chemical control, employee hygiene.
HACCP & Food Safety PlansHazard analysis, critical control points, critical limits, monitoring procedures, corrective actions, verification activities, record-keeping systems.
Allergen ManagementAllergen identification and labeling, cross-contact prevention, production scheduling, equipment cleaning validation, staff training on allergen risks.
Traceability & RecallOne-up/one-back traceability, lot coding, mock recall effectiveness, product identification, withdrawal and recall procedures including notification timelines.
Supplier Approval ProgramsIncoming material specifications, approved supplier lists, certificate of analysis (COA) verification, receiving inspection, supplier monitoring.
Sanitation & HygieneMaster sanitation schedules, pre-operational and operational sanitation, monitoring and verification, environmental monitoring programs (EMPs), Listeria controls.
Personnel PracticesEmployee training, personal hygiene standards, illness reporting, visitor control, protective clothing, food safety culture practices.
Storage & TransportationTemperature-controlled storage, FIFO/FEFO inventory management, product segregation, loading dock controls, transport temperature monitoring, damage and contamination prevention.
Documentation & RecordsRecord accuracy and completeness, retention policies, electronic vs. paper systems, change management, corrective action documentation, management review.
Food Defense & Food FraudVulnerability assessments, facility security, intentional adulteration prevention (FSMA IA Rule), supply chain fraud mitigation, economically motivated adulteration controls.

Non-Conformity Categories

  • Critical

    An immediate food safety hazard or a fundamental breakdown of the food safety management system posing a direct risk to consumer health. Requires immediate corrective action and may result in audit failure, suspension of supplier status or product hold.

  • Major

    A significant deficiency in a food safety or quality system that could lead to a food safety failure if left unaddressed. Requires a documented root cause analysis and corrective action plan within the timeframe the audit standard specifies — typically 14–28 calendar days.

  • Minor

    A partial failure to meet a requirement that does not pose an immediate food safety risk but indicates an area for improvement. Still requires documented corrective action and evidence of resolution before the next scheduled audit.

Corrective action requirements. When non-conformities are identified, suppliers implement a formal Corrective and Preventive Action (CAPA) process: immediate containment, root cause analysis, corrective action to eliminate the root cause, and preventive measures so the issue does not recur. The documented CAPA is submitted with supporting evidence within the timeframe the audit program specifies, and verified at or before the next audit.

How to Prepare for a Supplier Audit

Most facilities need 3–6 months to prepare for their first supplier audit, depending on the maturity of their existing food safety systems. Here is a step-by-step approach to audit readiness.

  1. Step 1: Identify Your Buyer's Requirements

    Confirm exactly which audit standard or program your buyer requires. Walmart mandates GFSI-benchmarked certification; McDonald's requires SQMS or DQMP; other buyers accept a general GMP or food safety audit. Contact your buyer's supplier quality team — or Kiwa ASI — to clarify the requirements before you begin preparation.

  2. Step 2: Conduct a Gap Analysis

    Evaluate your current programs, documentation and facility conditions against the applicable standard. A gap analysis shows where your systems already comply and where improvements are needed. Kiwa ASI offers pre-assessment and consulting services to help facilities build a prioritized action plan.

  3. Step 3: Strengthen Your Foundational Programs

    Make sure GMP programs, prerequisite programs and your HACCP or food safety plan are fully documented, implemented and working — sanitation SOPs, pest control contracts, allergen procedures, water quality testing, equipment maintenance and training records. These are the baseline every supplier audit evaluates.

  4. Step 4: Implement Traceability and Recall Systems

    Build or verify one-up/one-back traceability, lot coding and a mock recall program. Run a mock recall and document the results — time to completion, percentage of product accounted for, gaps found. Most audit standards require mock recalls at least annually.

  5. Step 5: Train Your Team

    Ensure your food safety team holds the required qualifications, including HACCP and PCQI credentials where applicable, and train all employees on GMPs, hygiene, allergen awareness and your facility's food safety policies. Kiwa ASI offers HACCP, PCQI, cGMP, internal auditing and food safety culture training.

  6. Step 6: Conduct Internal Audits

    Perform a thorough internal audit of your facility, programs and documentation using the audit standard's requirements as your checklist. Document findings, implement corrective actions and verify effectiveness. Internal audits should be run by trained personnel independent of the areas they audit.

  7. Step 7: Schedule Your Supplier Audit

    Contact Kiwa ASI to schedule the audit. We confirm the audit scope, assign a qualified auditor with relevant industry experience and coordinate timing around your operations. For retailer programs such as McDonald's SQMS and DQMP, we confirm the exact requirements and deliverables before the audit date.

Training That Prepares You for a Supplier Audit

Buyers expect trained teams. These Kiwa ASI courses build the qualifications supplier audits look for — HACCP and PCQI credentials, GMP knowledge, internal auditing skills and food safety culture.

Training and consulting are delivered by ASI Training and Consulting, LLC, separately from the certification body. Browse the full training catalog.

Why Choose Kiwa ASI for Your Supplier Audit?

Kiwa ASI brings deep food safety expertise, major retailer approvals and the global reach of the Kiwa network to every supplier audit engagement.

  • EXPERIENCE

    Deep Food Safety Expertise

    Kiwa ASI's auditors bring decades of combined experience in food manufacturing, processing, distribution and supply chain management, with specialists in GMP, HACCP, FSMA compliance, allergen management and environmental monitoring — every audit is conducted by someone who understands your operations, not just the checklist.

  • RETAILER APPROVED

    Approved by Major Retailers & Brands

    Kiwa ASI is approved to conduct supplier audits for Walmart, Kroger, Sprouts Farmers Market, McDonald's (SQMS and DQMP) and Yum! Brands. We also deliver the GFSI-benchmarked certifications (SQF, BRCGS, FSSC 22000) that major retailers require as a condition of supplier approval.

  • TRAINING & CONSULTING

    Comprehensive Preparation Support

    Beyond the audit itself, Kiwa ASI offers training, consulting, gap analysis and pre-assessment services to help your facility prepare. Our consulting arm, ASI Training and Consulting, LLC, operates independently from our accredited certification body, ensuring no conflicts of interest.

  • SCHEDULING & SUPPORT

    Responsive Scheduling & Client Service

    Supplier audits often carry tight deadlines tied to buyer onboarding timelines. Kiwa ASI's client services team accommodates your scheduling needs, communicates clearly throughout and delivers audit reports promptly so you can share results with your buyers without delay.

  • GLOBAL NETWORK

    Part of the Kiwa Global Network

    As part of Kiwa, a global testing, inspection and certification organization operating in more than 30 countries, Kiwa ASI offers the local expertise of a food safety specialist backed by the resources and international consistency of a global organization.

All consulting services are offered through ASI Training and Consulting, LLC. All activity is conducted separately from our accredited certification body, ASI Food Safety, LLC, in order to safeguard against any conflicts of interest.

Frequently Asked Questions About Supplier Audits

What is a supplier audit and why is it important?

A supplier audit — also known as a second-party audit — is an on-site evaluation of a supplier's food safety systems, quality controls and regulatory compliance conducted on behalf of a purchasing company. It is called a second-party audit because the buyer (the second party) initiates it to verify that suppliers meet specific requirements. Major retailers and food brands require these audits as a condition of doing business, so a current audit protects both supplier approval status and consumers.

What is a retailer-specific audit program?

A retailer-specific audit program is a proprietary set of food safety and quality requirements a retailer or restaurant brand applies to its suppliers, on top of — or in place of — GFSI-benchmarked certification. Examples include McDonald's SQMS and DQMP, Albertsons' Own Brands facility audits and Kroger's approved-agent facility audits. Each program defines its own audit criteria, frequency and approved audit firms.

What is McDonald's SQMS certification?

SQMS (Supplier Quality Management System) is McDonald's global food safety and quality standard for its food product suppliers. Suppliers complete an SQMS audit annually — a standalone two-day audit or a half-day addendum to a GFSI-benchmarked certification audit. No certificate is issued; audits are scored A (95–100 %), B (85–94 %), C (70–84 %) or F, and results are reported to McDonald's. The related DQMP applies to distribution centers, typically through two-day unannounced audits. Kiwa ASI conducts both as part of Kiwa, an approved McDonald's audit firm.

What food safety certification does Walmart require from suppliers?

Walmart and Sam's Club require suppliers of private-brand and fresh or high-risk foods to hold certification against a GFSI-recognized scheme such as SQF, BRCGS or FSSC 22000, with an approved audit for every production site each year. Smaller fresh-produce suppliers may qualify for an alternative audit through the GFSI Global Markets pathway while they work toward full certification.

Does GFSI certification satisfy retailer-specific requirements?

Usually it is the foundation, but often not the whole answer. Many retailers — Walmart, Kroger, Target, Aldi — accept or mandate GFSI-benchmarked certification, then layer their own requirements on top: minimum scores or grades, buyer-specific facility audits, program addendums or unannounced audit rules. Always confirm with your buyer's supplier quality team which combination applies to you.

What standards do supplier audits follow?

Supplier audits can follow GFSI-benchmarked standards (SQF, BRCGS, FSSC 22000, IFS, PrimusGFS), retailer-specific programs (McDonald's SQMS and DQMP, Albertsons' Own Brands audits) or custom GMP-based audit protocols defined by the buyer. The applicable standard depends on the buyer's requirements and the products supplied. Kiwa ASI can help you determine which standard applies.

How long does a supplier audit take?

Audit duration depends on the scope, size and complexity of the operation. A standard GMP supplier audit of a single-product facility typically takes one to two days on site. Retailer programs set their own durations — a full McDonald's SQMS audit runs two days on site (or a half-day addendum combined with a GFSI audit), and DQMP audits are typically two days. Document review and reporting add time beyond the site visit.

How often should supplier audits be conducted?

Most retailer programs require an audit every year — Walmart and McDonald's SQMS and DQMP all run on annual cycles, and GFSI-benchmarked certificates are also renewed through annual recertification audits. High-risk suppliers or those with significant non-conformities may face more frequent audits, as determined by the buyer or the audit standard.

Are supplier audits announced or unannounced?

It depends on the program. McDonald's DQMP audits are typically unannounced two-day audits. Most general GMP supplier audits and initial audits are announced and scheduled with the facility, while several retailer and GFSI programs include unannounced audits on a recurring basis. Your buyer's program rules determine which applies.

What happens if non-conformities are found during the audit?

Kiwa ASI provides a detailed audit report classifying each finding as critical, major or minor. The supplier submits a documented corrective action plan — root cause analysis, corrective measures and preventive actions — within the timeframe the standard specifies, typically 14–28 days for major findings. Critical findings require immediate action and can result in audit failure or suspension of supplier status.

What is the difference between a first-party, second-party and third-party audit?

A first-party audit is an internal audit an organization performs on itself. A second-party audit is conducted by or on behalf of a customer — supplier audits fall into this category because the purchasing company initiates them. A third-party audit is an independent certification audit, such as SQF, BRCGS or FSSC 22000, performed by an accredited certification body and resulting in a certificate.

Can one supplier audit satisfy multiple retailers?

Often, yes. When several buyers accept audits from the same qualified audit firm — or accept the same GFSI-benchmarked certification — a single comprehensive audit can serve multiple customers at once. Proprietary programs are the exception: audits like McDonald's SQMS follow program-specific criteria, though they can frequently be combined with a GFSI certification audit in one visit.

Is Kiwa ASI approved to conduct McDonald's supplier audits?

Yes. Kiwa ASI is approved to conduct audits according to McDonald's SQMS (Supplier Quality Management System) for food product suppliers and DQMP (Distributor Quality Management Process) for distribution and warehousing operations. SQMS audits can be delivered standalone or as addendums to GFSI-benchmarked certifications; DQMP audits are typically two-day unannounced audits.

How much does a supplier audit cost?

Costs vary with the audit standard, scope, facility size, number of product categories and location. Pricing depends on the auditor days required, travel and whether program-specific audits such as SQMS or DQMP are needed. Contact Kiwa ASI at US.Info@kiwa-asi.com or 1 (800) 477-0778 for a quote tailored to your buyer's requirements.

Can Kiwa ASI help my facility prepare for a supplier audit?

Yes. Through ASI Training and Consulting, LLC — our consulting entity that operates independently from our accredited certification body — we offer gap analysis, pre-assessment, mock audits, food safety plan development and training to help facilities prepare. This separation between consulting and certification ensures there are no conflicts of interest.

Do supplier audits satisfy FSMA requirements?

They can serve as a supplier verification activity under FSMA's Preventive Controls for Human Food rule (21 CFR 117) and the Foreign Supplier Verification Program (FSVP) rule for importers. Many buyers also require or accept GFSI-benchmarked certification, but FDA has not declared any certification scheme adequate on its own. An audit done for a scheme such as SQF counts toward supplier verification only to the extent it meets the applicable rule's onsite audit requirements, including considering the FDA food safety regulations that apply, and the receiving facility or importer may need to supplement it. Many facilities use a combination of second-party audits and certification.

Ready to schedule your supplier audit?

Tell us who your buyer is and what you make — we'll confirm the exact audit you need, quote it and schedule around your production calendar.

Request a Quote Call 1 (800) 477-0778
Approvals & Trust

Kiwa ASI is approved to conduct McDonald's SQMS and DQMP audits and conducts supplier audits for Walmart, Kroger, Sprouts Farmers Market and Yum! Brands supplier verification programs. As part of Kiwa, a global testing, inspection and certification organization operating in more than 30 countries, Kiwa ASI combines local food safety expertise with international consistency. All consulting services are offered through ASI Training and Consulting, LLC. All activity is conducted separately from our accredited certification body, ASI Food Safety, LLC, in order to safeguard against any conflicts of interest.