CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
Supplier Audits: Second-Party Audit Services for Retailers & Food Brands
A supplier audit, commonly known as a second-party audit, is an on-site evaluation of a supplier's food safety systems, quality controls, and regulatory compliance conducted on behalf of a purchasing company. Unlike third-party certification audits (SQF, BRCGS, FSSC 22000), second-party supplier audits are driven by the buyer's specific requirements.
Kiwa ASI partners with major retailers and food brands to conduct supplier audits that verify GMP adherence, HACCP implementation, and supply chain integrity across food manufacturing, distribution, and storage operations.
- Approved for McDonald's SQMS & DQMP
- Walmart, Amazon, Kroger & Sprouts Partner
- Part of Kiwa — Operating in 30+ Countries
Kiwa ASI works with some of the largest retailers in the country such as Walmart, Amazon, Kroger, and Sprouts to conduct all supplier audits.
Kiwa ASI specializes in helping companies prepare for and navigate supplier audits effectively. With our extensive experience in food safety and compliance, we offer comprehensive services to ensure that your organization meets the rigorous standards and requirements of supplier audits.
What Is a Supplier Audit (Second-Party Audit)?
A supplier audit is a second-party audit — an on-site evaluation of a supplier's facility, processes, and food safety management systems conducted on behalf of a purchasing company (the buyer). In the audit classification system, a first-party audit is an internal audit conducted by the organization itself, a second-party audit is conducted by or on behalf of the customer, and a third-party audit is an independent certification audit (such as SQF, BRCGS, or FSSC 22000) conducted by an accredited certification body. Supplier audits fall into the second-party category because they are initiated by the buyer to verify that their suppliers meet specific purchasing requirements.
Major retailers and food brands require their suppliers to undergo regular second-party audits as a condition of doing business. Companies like Walmart, Amazon, Kroger, Sprouts Farmers Market, McDonald's, and Yum! Brands each maintain specific supplier verification requirements — from proprietary quality management systems like McDonald's SQMS (Supplier Quality Management System) and DQMP (Distributor Quality Management Process) to custom GMP and food safety audit protocols. Many buyers outsource these second-party audits to qualified auditing firms like Kiwa ASI, which conducts the audit on the buyer's behalf using the buyer's standards and requirements. These audits serve as the foundation of supply chain risk management, helping brands verify that every link in their supply chain upholds the food safety standards their customers expect.
For suppliers, passing a second-party supplier audit is often the gateway to shelf space. Without a current, credible audit result, many retailers will not approve a new supplier or renew an existing relationship. The audit verifies adherence to Good Manufacturing Practices (GMP), HACCP principles, prerequisite programs, sanitation controls, allergen management, traceability systems, and any retailer-specific requirements — giving buyers documented assurance that the products entering their supply chain are safe, compliant, and consistent. Some buyers may also require or accept third-party GFSI-benchmarked certifications in addition to or in place of second-party audits — Kiwa ASI delivers both.
Second-Party Audit — Conducted on Behalf of the Buyer
Unlike first-party (internal) audits, second-party supplier audits are initiated by the purchasing company to verify supplier compliance with their specific requirements. When buyers outsource these audits to a qualified firm like Kiwa ASI, they get the rigor of an experienced auditing organization combined with the buyer-specific focus of a second-party evaluation.
Retailer & Brand Requirement
Walmart, Amazon, Kroger, Sprouts, McDonald's, and Yum! Brands each require suppliers to pass second-party audits or maintain GFSI-benchmarked certifications. Without a valid audit, supplier approval is denied or revoked — making these audits a business necessity, not an option.
Comprehensive Scope
Supplier audits evaluate GMP adherence, HACCP implementation, sanitation and hygiene programs, allergen management, pest control, traceability, product recall procedures, employee training, and facility maintenance — covering every system that impacts product safety.
Risk Mitigation for Buyers & Suppliers
For buyers, supplier audits reduce the risk of product recalls, regulatory enforcement, and reputational damage. For suppliers, they demonstrate commitment to safety and quality — strengthening business relationships and opening doors to new retail partnerships.
WHO IT'S FOR
Who Needs a Supplier Audit?
Any facility that manufactures, processes, packs, stores, or distributes food products for a retailer, food brand, or foodservice company may be required to undergo a second-party supplier audit. The specific audit standard and scope depend on the buyer's requirements, the product category, and the regulatory environment.
Retail Suppliers
Walmart, Amazon, Kroger & Sprouts Suppliers
Any company supplying food products to major retailers must maintain a current GFSI-benchmarked certification or retailer-approved third-party audit. Kiwa ASI is an approved audit provider for Walmart, Amazon, Kroger, and Sprouts Farmers Market supplier verification programs.
QSR & Foodservice
McDonald's, Yum! Brands & Foodservice Suppliers
Quick-service restaurant chains require suppliers to comply with proprietary quality management systems. Kiwa ASI is approved to conduct McDonald's SQMS audits for food suppliers and DQMP audits for distribution and warehousing operations.
Food Manufacturing
Processing, Packaging & Co-Manufacturing Plants
Facilities involved in thermal processing, canning, bottling, extrusion, blending, fermentation, baking, and co-manufacturing operations. Audits evaluate process controls, HACCP plans, GMPs, and production environment management.
Cold Chain & Distribution
Warehousing, Cold Storage & Transportation
Distribution centers, cold storage warehouses, refrigerated transport operators, and third-party logistics (3PL) providers. Audits focus on temperature control, cross-contamination prevention, inventory management, and product integrity during storage and transit.
Fresh Produce & Agriculture
Growers, Packers & Fresh-Cut Operations
Fresh produce farms, packing houses, fresh-cut processors, and produce distribution centers. Audits evaluate Good Agricultural Practices (GAP), post-harvest handling, water quality, worker hygiene, and traceability from field to retail.
Ingredient & Raw Material Suppliers
Ingredient Manufacturers & Commodity Suppliers
Companies supplying ingredients, spices, seasonings, additives, flavorings, and raw materials to food manufacturers. Audits verify supplier approval programs, incoming material controls, certificate of analysis (COA) processes, and allergen segregation.
Private Label & Contract Manufacturers
Co-Packers & Private Label Producers
Contract manufacturers and co-packers producing retailer-branded (private label) food products. These facilities face heightened audit scrutiny because product failures directly affect the retailer's brand reputation.
Import & Export Operations
Importers, Brokers & Export Facilities
Food importers subject to FSMA Foreign Supplier Verification Program (FSVP) requirements, trade brokers, and export-oriented facilities seeking to meet international buyer standards. Third-party audits provide documented evidence of compliance for customs and regulatory review.
ADVANTAGES
What Are the Benefits of Second-Party Supplier Audits?
Retailer & Market Access
Second-party supplier audits are the entry requirement for supplying to Walmart, Amazon, Kroger, Sprouts, McDonald's, and other major buyers. A current, credible audit conducted by a qualified firm like Kiwa ASI gives your facility the verified status buyers require to approve or maintain supplier relationships.
Buyer-Specific Verification
Second-party audits are tailored to the purchasing company's specific requirements — not a generic checklist. This means the audit evaluates exactly what the buyer cares about, whether that's McDonald's SQMS requirements, Walmart's food safety expectations, or a retailer's custom GMP protocol. The result is verification that directly satisfies the buyer's supplier approval criteria.
Reduced Audit Fatigue
When multiple buyers accept audits from the same qualified auditing firm, a single comprehensive supplier audit can satisfy several customers simultaneously. Rather than hosting separate audits for each buyer — each with different protocols, timelines, and auditor teams — one recognized audit provides the documentation multiple buyers need, freeing your team to focus on operations.
Operational Improvement
Supplier audits identify gaps in GMP programs, HACCP plans, sanitation procedures, allergen controls, and employee training before they become safety incidents. The corrective action process drives measurable improvement in food safety systems, process consistency, and documentation practices.
Supply Chain Risk Mitigation
For both suppliers and the companies they serve, second-party supplier audits reduce the risk of product recalls, regulatory enforcement actions, and reputational damage. A documented audit history demonstrates due diligence in supplier verification — a key component of FSMA Preventive Controls and Foreign Supplier Verification Program (FSVP) compliance.
Regulatory Alignment
Supplier audits align with FDA FSMA requirements, including the Preventive Controls for Human Food rule (21 CFR 117), the FSVP rule for importers, and the Produce Safety Rule. Second-party audits can serve as a supplier verification activity under FSMA, and many buyers also require or accept GFSI-benchmarked third-party certifications, which the FDA has recognized as being in alignment with FSMA regulations.
THE AUDIT
What Does a Supplier Audit Cover?
A second-party supplier audit is a comprehensive, on-site evaluation of the systems, programs, and practices that directly impact food safety and product quality. The specific audit scope depends on the buyer’s requirements and the applicable standard, but most supplier audits cover the following core areas.
Key Audit Areas
| Audit Area | Key Focus Points |
|---|---|
| GMP & Prerequisite Programs | Facility construction and design, equipment maintenance, pest control, water supply, waste management, cleaning and sanitation programs, chemical control, and employee hygiene practices. |
| HACCP & Food Safety Plans | Hazard analysis, critical control point identification, critical limits, monitoring procedures, corrective actions, verification activities, and record-keeping systems. |
| Allergen Management | Allergen identification and labeling, cross-contact prevention, production scheduling, equipment cleaning validation, and staff training on allergen risks. |
| Traceability & Recall | One-up/one-back traceability, lot coding systems, mock recall effectiveness, product identification, and withdrawal/recall procedures including notification timelines. |
| Supplier Approval Programs | Incoming material specifications, approved supplier lists, certificate of analysis (COA) verification, receiving inspection procedures, and supplier monitoring processes. |
| Sanitation & Hygiene | Master sanitation schedules, pre-operational and operational sanitation procedures, sanitation monitoring and verification, environmental monitoring programs (EMPs), and Listeria controls. |
| Personnel Practices | Employee training programs, personal hygiene standards, illness reporting policies, visitor control, protective clothing requirements, and food safety culture practices. |
| Storage & Transportation | Temperature-controlled storage, FIFO/FEFO inventory management, product segregation, loading dock controls, transportation temperature monitoring, and damage/contamination prevention. |
| Documentation & Records | Record accuracy and completeness, retention policies, electronic vs. paper systems, change management, corrective action documentation, and management review records. |
| Food Defense & Food Fraud | Vulnerability assessments, facility security measures, intentional adulteration prevention (FSMA IA Rule), supply chain fraud mitigation, and economically motivated adulteration controls. |
Non-Conformity Categories
CRITICAL
An immediate food safety hazard or a fundamental breakdown in the food safety management system that poses a direct risk to consumer health. Critical findings require immediate corrective action and may result in audit failure, suspension of supplier status, or product hold.
MAJOR
A significant deficiency in a food safety or quality system that, if left unaddressed, could lead to a food safety failure. Major non-conformities require a documented root cause analysis and corrective action plan submitted within the timeframe specified by the audit standard (typically 14–28 calendar days).
MINOR
A partial failure to meet a requirement that does not pose an immediate food safety risk but indicates an area for improvement. Minor non-conformities still require documented corrective action and evidence of resolution before the next scheduled audit.
Corrective Action Requirements
When non-conformities are identified, suppliers must implement a formal Corrective and Preventive Action (CAPA) process. This includes immediate containment of the issue, root cause analysis to determine why the failure occurred, corrective action to eliminate the root cause, and preventive measures to ensure the issue does not recur. Documentation of the entire CAPA process must be submitted within the timeframe specified by the audit standard — typically 14 to 28 calendar days for major findings. Kiwa ASI auditors verify corrective action closure at subsequent audits or through desktop review, depending on the severity of the finding.
Retailer-Specific Audit Programs
In addition to standard GMP and food safety audits, Kiwa ASI is approved to conduct audits under proprietary retailer quality management systems:
| Program | Description |
|---|---|
| McDonald’s SQMS | Global Supplier Quality Management System — a comprehensive set of food safety and quality requirements for all McDonald’s suppliers of processed food products (burgers, patties, fries, vegetables, buns, sauces, etc.). Delivered as a full audit or as an addendum to GFSI-benchmarked certifications. Annual audit required. |
| McDonald’s DQMP | Distributor Quality Management Process — food safety and quality requirements for distribution centers and warehousing operations making deliveries to McDonald’s restaurants. Typically conducted as a two-day unannounced audit. Covers acceptance, storage, and transport of McDonald’s SKUs. |
| Walmart / Sam’s Club | All food and pet food suppliers must maintain GFSI-benchmarked certification or a Walmart-approved alternative food safety audit. Kiwa ASI conducts the GFSI-recognized audits (SQF, BRCGS, FSSC 22000) that satisfy Walmart’s supplier requirements. |
| Sprouts Farmers Market | Supplier verification program requiring current food safety audits for all direct suppliers. Kiwa ASI works with Sprouts suppliers throughout the audit process to ensure alignment with Sprouts’ high standards for food safety and product quality. |
How to Prepare for a Supplier Audit
Most facilities need 3–6 months to prepare for their first supplier audit, depending on the maturity of their existing food safety systems. Here is a step-by-step approach to building audit readiness.
01
Identify Your Buyer's Requirements
Start by confirming exactly which audit standard or program your buyer requires. Walmart mandates GFSI-benchmarked certification. McDonald's requires SQMS or DQMP compliance. Other buyers may accept a general GMP or food safety audit. Contact your buyer's supplier quality team — or reach out to Kiwa ASI — to clarify the specific requirements before you begin preparation.
02
Conduct a Gap Analysis
Evaluate your current food safety programs, documentation, and facility conditions against the requirements of the applicable audit standard. A gap analysis identifies where your systems meet the requirements and where improvements are needed. Kiwa ASI offers pre-assessment services and consulting to help facilities conduct a thorough gap analysis and develop a prioritized action plan.
03
Strengthen Your Foundational Programs
Ensure your GMP programs, prerequisite programs, and HACCP/food safety plan are fully documented, implemented, and functioning effectively. This includes sanitation SOPs, pest control contracts, allergen management procedures, water quality testing, equipment maintenance schedules, and employee training records. These foundational programs are the baseline every supplier audit evaluates.
04
Implement Traceability and Recall Systems
Build or verify your one-up/one-back traceability system, lot coding procedures, and mock recall program. Conduct a mock recall exercise and document the results, including time to completion, percentage of product accounted for, and any gaps identified. Most audit standards require mock recalls to be conducted at least annually.
05
Train Your Team
Ensure your food safety team has the required qualifications, including HACCP certification and PCQI credentials where applicable. Train all employees on GMP requirements, personal hygiene standards, allergen awareness, and your facility's food safety policies. Kiwa ASI offers HACCP, PCQI, cGMP, Internal Auditing, and Food Safety Culture training courses to build your team's competency.
06
Conduct Internal Audits
Perform a thorough internal audit of your facility, programs, and documentation before the second-party supplier audit. Use the audit standard's requirements as your checklist. Document all findings, implement corrective actions, and verify effectiveness. Internal audits should be conducted by trained personnel who are independent of the areas being audited.
07
Schedule Your Supplier Audit
Contact Kiwa ASI to schedule your supplier audit. Our team will work with you to confirm the audit scope, assign a qualified auditor with relevant industry experience, and coordinate timing that works for your operations. For retailer-specific programs (McDonald's SQMS/DQMP, Walmart, Sprouts), we'll confirm the exact requirements and deliverables with you before the audit date.
Why Choose Kiwa ASI for Your Supplier Audit?
Kiwa ASI brings deep food safety expertise, major retailer approvals, and the global reach of the Kiwa network to every supplier audit engagement.
Experience
Deep Food Safety Expertise
Kiwa ASI's auditors bring decades of combined experience in food manufacturing, processing, distribution, and supply chain management. Our team includes specialists in GMP, HACCP, FSMA compliance, allergen management, and environmental monitoring, so every audit is conducted by someone who understands your operations, not just the checklist.
Retailer Approved
Approved by Major Retailers & Brands
Kiwa ASI is approved to conduct supplier audits for Walmart, Amazon, Kroger, Sprouts Farmers Market, McDonald's (SQMS and DQMP), and Yum! Brands. We also deliver the GFSI-benchmarked certifications (SQF, BRCGS, FSSC 22000) that major retailers require as a condition of supplier approval.
Training & Consulting
Comprehensive Preparation Support
Beyond the audit itself, Kiwa ASI offers training, consulting, gap analysis, and pre-assessment services to help your facility prepare. Our consulting arm (ASI Training and Consulting, LLC) operates independently from our accredited certification body, ensuring no conflicts of interest while giving you access to expert guidance.
Scheduling & Support
Responsive Scheduling & Client Service
We understand that supplier audits often carry tight deadlines tied to buyer onboarding timelines. Kiwa ASI's client services team works to accommodate your scheduling needs, provides clear communication throughout the process, and delivers audit reports promptly so you can share results with your buyers without delay.
Global Network
Part of the Kiwa Global Network
As part of Kiwa, a global testing, inspection, and certification organization operating in more than 30 countries, Kiwa ASI offers the local expertise of a food safety specialist backed by the resources, infrastructure, and international consistency of a global organization. Wherever your supply chain extends, Kiwa has you covered.
Why Choose Kiwa ASI for Your Supplier Audit?
A supplier audit — also known as a second-party audit — is an on-site evaluation of a supplier's food safety systems, quality controls, and regulatory compliance conducted on behalf of a purchasing company. It is called a second-party audit because it is initiated by the buyer (the second party) to verify that their suppliers meet specific requirements. Supplier audits are important because major retailers (Walmart, Amazon, Kroger, Sprouts) and foodservice companies (McDonald's, Yum! Brands) require them as a condition of supplier approval. The audit provides documented verification that a supplier's facility meets the buyer's food safety standards — protecting both the buyer's supply chain and the supplier's business relationships.
Supplier audits can follow GFSI-benchmarked standards (SQF, BRCGS, FSSC 22000, IFS, PrimusGFS), retailer-specific programs (McDonald's SQMS/DQMP, Walmart's GFSI requirements), or custom GMP-based audit protocols. The applicable standard depends on the buyer's requirements and the type of products being supplied. Kiwa ASI can help you determine which standard applies to your situation.
Audit duration depends on the scope, size, and complexity of your operation. A standard GMP supplier audit for a single-product facility may take one to two days. Larger operations, multi-product facilities, or audits under retailer-specific programs (such as McDonald's SQMS) typically require two to three days on-site, plus time for document review and reporting.
Most retailer programs require annual supplier audits. GFSI-benchmarked certifications operate on a three-year cycle with annual surveillance audits. McDonald's SQMS and DQMP require annual audit completion. High-risk suppliers or those with significant non-conformities may face more frequent audit schedules as determined by the buyer or the audit standard.
When non-conformities are identified, Kiwa ASI provides a detailed audit report classifying each finding as critical, major, or minor. You will need to submit a documented corrective action plan — including root cause analysis, corrective measures, and preventive actions — within the timeframe specified by the standard (typically 14–28 days for major findings). Critical findings require immediate corrective action and may trigger a follow-up audit. Kiwa ASI verifies corrective action closure before audit completion.
A first-party audit is an internal audit conducted by the organization itself. A second-party audit is conducted by or on behalf of the customer (the buyer) — supplier audits fall into this category because they are initiated by the purchasing company to verify their suppliers' compliance. A third-party audit is an independent certification audit (such as SQF, BRCGS, or FSSC 22000) conducted by an accredited certification body against a recognized standard. Kiwa ASI conducts both second-party supplier audits on behalf of retailers and brands, and third-party GFSI-benchmarked certification audits — giving facilities a single partner for both audit types.
Yes. Kiwa ASI is approved to conduct audits according to McDonald's SQMS (Supplier Quality Management System) for food product suppliers and DQMP (Distributor Quality Management Process) for distribution and warehousing operations. SQMS audits can be delivered as standalone audits or as addendums to GFSI-benchmarked certifications. DQMP audits are typically conducted as two-day unannounced evaluations.
Supplier audit costs vary based on the audit standard, scope, facility size, number of product categories, and location. Factors that influence pricing include the number of auditor days required, travel and logistics, and whether additional program-specific audits (such as SQMS or DQMP) are needed. Contact Kiwa ASI at info@asifood.com or call 1 (800) 477-0778 for a customized quote tailored to your specific requirements.
Yes. Through ASI Training and Consulting, LLC — our consulting entity that operates independently from our accredited certification body — we offer gap analysis, pre-assessment, mock audits, food safety plan development, and training services to help facilities prepare for supplier audits. This separation between consulting and certification ensures there are no conflicts of interest. Contact us to discuss preparation support.
Yes. Second-party supplier audits can be used as a supplier verification activity under FSMA's Preventive Controls for Human Food rule (21 CFR 117) and the Foreign Supplier Verification Program (FSVP) rule. Additionally, the FDA has recognized that major GFSI-benchmarked food safety standards are in alignment with FSMA regulations, making both second-party supplier audits and third-party GFSI certifications practical paths to demonstrating FSMA compliance for domestic manufacturers and importers.
All consulting services are offered through ASI Training and Consulting, LLC. All activity is conducted separately from our accredited certification body, ASI Food Safety, LLC, in order to safeguard against any conflicts of interest.