Approved Supplier Checklist: Restaurant FDA Compliance

Sourcing Food Safely: The Core FDA Mandate

In commercial food service, ingredient safety is determined before delivery trucks arrive at your back door. Sourcing food from unapproved, unregulated, or unlicensed sources is a leading contributor to foodborne illness outbreaks in the United States. If an ingredient enters your facility contaminated with biological pathogens, chemical toxins, or undeclared allergens, no level of in-house cooking, sanitizing, or handling can fully eliminate the public health risk.

Under the US Food and Drug Administration (FDA) Food Code Section 3-201.11, all food served in a commercial food establishment must be obtained from sources that comply with local, state, and federal laws. This means a restaurant cannot legally purchase ingredients from home kitchens, unlicensed local gardens, or unauthorized distributors.

An Approved Supplier Program is a systematic management system restaurants use to vet, verify, and monitor the companies supplying their ingredients. By implementing a formal approval process, restaurant managers ensure that every supplier maintains a robust, audited food safety program that matches federal and state standards. This guide provides a detailed breakdown of the regulatory landscape, vetting checklists, and daily receiving practices required to keep your establishment fully compliant and inspection-ready.

The Legal and Regulatory Landscape in the United States

Building a compliant sourcing program requires understanding how food safety laws are structured and enforced in the United States across federal, state, and local jurisdictions.

Federal Sourcing Regulations

At the federal level, food safety oversight is divided between two primary agencies. The United States Department of Agriculture (USDA) Food Safety and Inspection Service (FSIS) has direct federal jurisdiction over meat, poultry, and processed egg products. Any domestic supplier of raw or cooked meat and poultry must operate under continuous USDA inspection and hold an active FSIS establishment number.

The FDA regulates all other food products, including seafood, dairy, shelled eggs, produce, and packaged dry goods. Under the Food Safety Modernization Act (FSMA), food manufacturers, processors, and wholesalers must register their facilities with the FDA and implement risk-based preventive controls, including written supply-chain programs under 21 CFR Part 117 Subpart G. Although retail food establishments such as restaurants are exempt from the FSMA preventive controls rule, they must verify that their suppliers are fully registered and in compliance with these federal regulations.

State and Local Retail Laws

While federal agencies regulate food in interstate commerce and at the manufacturing level, they do not directly inspect or license retail restaurants. Restaurant food safety is governed by state and local authorities, typically county or municipal health departments.

The FDA publishes the Food Code, which serves as a model regulation representing the agency's best scientific advice for retail food protection. This model code is not federal law. Instead, state and local jurisdictions adopt specific editions of the FDA Food Code (such as the 2022 Food Code) into their own state statutes or local ordinances. Because adoption rates vary, a restaurant operator in Texas may be subject to a different version of the Food Code than an operator in California or New York. During routine health department inspections, local sanitarians will verify your compliance with the approved source laws adopted by your specific jurisdiction.

Core Criteria of an Approved Supplier

A supplier is not considered approved simply because they have a commercial business license or offer low prices. To meet FDA Food Code expectations and qualify as an approved source, a food distributor or manufacturer must provide verifiable evidence of active food safety management. When vetting a new supplier, restaurant procurement teams must evaluate four core criteria.

Active Licensing and Registration

Every commercial food facility must be licensed by their state or local health department to manufacture, pack, hold, or distribute food. If the supplier processes or holds food that travels across state lines, they must also provide their FDA Food Facility Registration number. A restaurant should never sign a purchasing agreement with a vendor who cannot immediately provide a copy of their current regulatory permit or license to operate.

Documented Food Safety Programs

A reputable supplier must have an active food safety program based on preventive principles. For manufacturers of meat, poultry, seafood, juice, and acidified foods, a written Hazard Analysis Critical Control Point (HACCP) plan is legally mandated. For other food manufacturers, FSMA requires a written Food Safety Plan that identifies potential biological, chemical, and physical hazards and specifies the preventive controls used to manage them. If your kitchen requires custom safety planning, you can learn more about developing these processes in our USA Restaurant HACCP Plan Guide.

Independent Third-Party Audits

While regulatory inspections establish a baseline, high-risk ingredient suppliers should undergo annual, independent third-party food safety audits. The gold standard for supplier audits are those benchmarked by the Global Food Safety Initiative (GFSI), such as Safe Quality Food (SQF), British Retail Consortium (BRCGS), or FSSC 22000. These audits provide comprehensive, unbiased verification that a supplier’s manufacturing facilities, pest control, hygiene, and processing steps are maintained to world-class standards.

Allergen Management and Traceability

Suppliers must have a written allergen control program to prevent cross-contact during processing, warehousing, and transport. This is particularly critical for ingredients containing any of the major food allergens. You can cross-reference your supplier's allergen declarations with the requirements listed in our USA Nine Major Food Allergens Guide. Additionally, suppliers must have a documented recall procedure and a tracing system capable of identifying which specific production batches or raw material lots were sent to your restaurant in the event of a public health alert.

The Restaurant Approved Supplier Vetting Checklist

Use this checklist to qualify and approve any food vendor before receiving their first shipment. Restaurant managers should maintain a digital or physical folder for each vendor containing the completed checklist and supporting documentation.

Operational Sourcing and Receiving Controls

A supplier vetting program is only effective if paired with disciplined receiving controls at your back door. Even the most reputable distributor can suffer a cold-chain breakdown or transport a damaged shipment. Your receiving dock is the final control point to prevent unsafe food from entering your establishment.

Training the Sourcing and Receiving Team

Restaurant managers must train receiving staff to inspect every delivery before signing the invoice. If the delivery driver is in a hurry, staff must refuse to sign until they have completed their critical temperature and quality checks. To implement a highly disciplined receiving protocol, kitchen teams should run a daily food receiving checklist for every delivery vehicle that arrives.

Critical Receiving Standards for Chilled and Frozen Foods

All cold-chain deliveries must meet strict temperature requirements upon arrival:

• Chilled TCS Foods: All Time/Temperature Control for Safety (TCS) foods must be received at a temperature of 41°F (5°C) or below, unless a different temperature is specifically permitted by law.
• Raw Shell Eggs and Fluid Milk: May be received at an ambient air temperature of 45°F (7°C) or below, provided they are immediately cooled to 41°F (5°C) or below after receipt.
• Frozen Foods: Must be received frozen solid, with zero evidence of previous thawing, such as fluid staining, misshapen packaging, or heavy ice crystal build-up inside the product bags.

All temperature readings must be documented at the door on a dedicated temperature log. If a delivery temperature fails to meet these thresholds, the reading must be logged alongside the corrective action taken.

Packaging and Label Integrity

Staff must inspect the physical condition of all containers. Reject any items exhibiting the following issues:

• Dented, rusted, swollen, or leaking canned goods.
• Vacuum-packaged products that have lost their seal or show signs of ballooning or gas production.
• Torn bags, water-damaged cardboard boxes, or packaging with evidence of pest gnawing or droppings.
• Missing or illegible product labels, which must include the product name, ingredient list, allergen warnings, manufacturer details, and lot codes.

Shellfish and Seafood Traceability

Sourcing molluscan shellfish (oysters, clams, mussels) requires specialized recordkeeping under federal law. Every container of shellstock must arrive with an official harvester or dealer tag attached. The restaurant must keep these tags attached to the container until the container is empty, and then record the date the last shellfish was sold or served. These tags must be kept in chronological order for at least 90 days from that date. For a step-by-step compliance workflow, refer to our guide on USA shellfish tags recordkeeping.

What Health Inspectors and Managers Review

During routine inspections, regulatory sanitarians and internal quality managers will specifically audit your approved supplier program. Knowing what they look for will help ensure your restaurant remains fully compliant.

The Health Department Inspector's Focus

A local health inspector’s primary goal is to verify that no unapproved or unsafe food is being prepared or served. During an audit, the inspector will typically:

• Examine Invoices and Receipts: Inspectors will ask to see recent invoices or bills of lading to trace kitchen items back to an approved commercial source. Failing to prove a commercial source is a critical violation that can result in immediate product seizure and destruction.
• Verify Shellfish Tags: They will review your 90-day shellfish tag log, checking that tags are complete, dated, and stored in chronological order.
• Audit Raw Fish Records: If you serve raw or undercooked fish (such as sushi or ceviche), the inspector will demand to see your parasite destruction letters or freezing logs from your supplier.
• Inspect Storage Areas: Sanitarians will search dry storage, walk-ins, and freezers for home-canned items, unlabeled foods, or ingredients purchased from unapproved retail outlets.

Internal Management Audits

Restaurant managers should conduct monthly internal reviews to keep the sourcing program sharp, including:

• Registry Updates: Ensure that active health permits and liability insurance certificates for every vendor on your Approved Supplier Registry are up to date and have not expired.
• Receiving Log Audits: Verify that staff are filling out receiving temperature logs daily and that no entries are missing or pencil-whipped.
• Vendor Scorecards: Keep a monthly log of vendor performance, including late deliveries, temperature failures, short weights, and damaged boxes.

Supplier Failures, Corrective Actions, and Rejection Protocols

Even with vetted suppliers, shipment failures will occur. When a delivery fails to meet your receiving standards, your team must execute a clear, consistent rejection protocol.

Immediate Corrective Actions

If an ingredient arrives damaged, warm, or unlabeled, your staff must take the following immediate steps before the delivery driver leaves your facility:

• Refuse the Out-of-Spec Items: Do not accept the failed product. Leave the rejected items on the delivery truck.
• Document the Failure: Take a high-resolution photograph of the issue, such as a probe thermometer displaying an out-of-spec temperature inside a meat case.
• Annotate the Delivery Invoice: Write the exact reason for the rejection (e.g., "Rejected 2 cases of raw chicken received at 48°F") directly on both the kitchen's copy and the driver's copy of the invoice. Ensure the driver signs both copies to acknowledge the rejection.
• Log the Event: Record the date, supplier name, item, invoice number, and rejection reason in your kitchen's central vendor failure log.

Post-Rejection Escalation

After rejecting a delivery, the kitchen manager must notify the supplier's account representative or quality control department within two hours, sending the invoice annotations and photo evidence. The vendor must issue a credit memo for the rejected items and schedule an emergency redelivery of compliant ingredients if the kitchen's prep needs are affected. If a supplier exhibits a pattern of multiple temperature or packaging failures within a 90-day period, their approved status must be suspended until they provide a written corrective action plan detailing how they have resolved their cold-chain or warehousing issues.

Local and Jurisdictional Sourcing Caveats

Because retail food regulations are adopted at the state and local level, restaurant operators must be aware of regional variations that could affect their approved supplier program.

Wild Mushroom Foraging

If your culinary team wants to feature wild-harvested mushrooms on the menu, you must navigate highly localized regulations. Under FDA Food Code Section 3-201.16, wild mushrooms must be approved by the local regulatory authority. Some states permit restaurants to buy directly from local foragers, provided the forager has completed an approved mushroom identification course and provides a written certification for each species. Other jurisdictions ban the sale of wild-harvested mushrooms in restaurants entirely, requiring all mushrooms to be commercially cultivated and packaged.

Cottage Food and Home-Prepared Foods

Cottage food laws exist in almost every US state, allowing individuals to prepare low-risk foods (like baked goods, jams, and spice mixes) in their home kitchens to sell directly to consumers at farmers' markets. However, these laws do not apply to commercial restaurants. Under FDA Food Code Section 3-201.11(B), food prepared in a private home may never be used or offered for consumption in a licensed food establishment. Even if a local home baker is highly skilled, purchasing their products for your restaurant is a major health code violation.

Direct Farm Sourcing

Sourcing produce directly from local farms is an excellent way to support the community and secure fresh ingredients. However, you must still verify that the farm complies with local agricultural and health department laws. Under the FSMA Produce Safety Rule, farms growing fresh produce must follow federal standards for agricultural water quality, biological soil amendments, and hygiene. When purchasing from a local farm, obtain a written statement or self-audit showing their compliance with these produce safety requirements to prove to your health inspector that the farm is an approved source.

Streamlining Supplier Compliance with Food Ops

Managing supplier registries, verifying business licenses, and maintaining manual receiving logs across multiple restaurant locations can quickly become overwhelming. Paper binders get stained, logs are forgotten, and critical food safety records are easily misplaced.

Food Ops digitizes your entire approved supplier program, allowing you to focus on running a successful kitchen. With our platform, you can maintain a secure digital approved supplier registry, upload and track vendor insurance renewals, and deploy automated, step-by-step mobile receiving checklists for your staff. Eliminate pencil-whipping with Bluetooth-connected probe thermometers that write temperatures directly to your secure, cloud-based logs. In the event of a vendor failure, staff can capture photo evidence directly within the app and automatically escalate the issue to management and the vendor. Try our Food Ops interactive demo today to build a modern, paperless food safety culture that keeps your kitchens safe and inspection-ready.

Official sources

• FDA Food Code
• USDA Food Safety and Inspection Service Sourcing Standards
• CDC Food Safety Programs and Outbreaks
• FDA Food Safety Modernization Act Guidance