Supplier Scorecard for Food Manufacturers

Procurement's supplier scorecard says a supplier is excellent. They are cheap, they deliver on time, and their fill rate is strong. Meanwhile your inbox says their certificates of analysis arrive late, their GFSI certificate lapsed in March, and they have had two corrective action requests this year.

Both scorecards are measuring real things. Only one of them is measuring what you are accountable for. A supplier scorecard built for food safety and quality assurance looks different from a procurement scorecard, and in a food manufacturing facility it does a different job: it produces the running evidence that your supply-chain program is working.

What is a supplier scorecard?

A supplier scorecard is a structured, weighted evaluation that measures supplier performance against defined criteria over time, producing a score you can compare across suppliers and track across periods.

That definition is where most published guidance stops. In food manufacturing there is a second half. Under FSMA, receiving facilities have to approve suppliers, determine and conduct risk-based verification activities, and document all of it. A scorecard is the most practical way to generate that documentation continuously instead of assembling it in a panic before an audit.

The distinction matters because it changes what belongs on the scorecard. Cost competitiveness and ESG performance are legitimate procurement metrics. They are not evidence that a supplier is controlling a hazard.

If you have not yet formalised which suppliers are approved and on what basis, start with your supplier approval program. Approval comes first, scoring comes after.

Why food manufacturers are required to do this

Most supplier scorecard content treats the practice as optional best practice. For a food facility, the underlying obligation is not optional.

21 CFR 117 Subpart G establishes the supply-chain program. Where you identify a hazard requiring a supply-chain-applied control, you have to establish a written program, approve your suppliers before receiving material from them, determine appropriate verification activities, conduct them, and keep records. The general requirements and the records requirements are both explicit.

FDA has also published guidance covering supply-chain program requirements and co-manufacturer supplier approval, which is worth reading if you use contract manufacturers.

For imported ingredients, the Foreign Supplier Verification Program adds its own layer. The scorecard does not replace FSVP, but a well-built one produces much of the same evidence.

A scorecard does not satisfy these requirements by existing. It satisfies them by being populated, reviewed, and acted on. That last part is where most programs fall down.

What to measure: the FSQA metric set

Replace the procurement metric set with one built around food safety risk. Six groups cover most operations.

Documentation currency. The percentage of required documents that are current and unexpired. This is the single best leading indicator of a supplier problem, because document drift almost always precedes performance drift.

COA performance. On-time rate, completeness, and whether results match specification. A supplier who sends the certificate of analysis three days after the truck arrives is creating a receiving decision you cannot make properly.

Certification status. Which GFSI-recognised scheme they hold, whether the certificate is valid, the audit grade, and the result of any unannounced audit. Check the scope on the certificate, not just the logo.

Quality incidents. Non-conformances raised, customer complaints traced back to their material, foreign material events, and out-of-spec results.

Corrective action responsiveness. How quickly they acknowledge and close a supplier corrective action request, and whether the same issue recurs. Recurrence is more informative than raw count.

Delivery and service. On-time in full, temperature compliance on arrival, and load rejection rate. This is the one area where the FSQA and procurement scorecards genuinely overlap.

Leave cost and ESG on procurement's scorecard. Including them here dilutes the food safety signal and invites a low price to offset a compliance failure.

Tier your suppliers before you weight anything

Applying one fixed weighting to every supplier is the most common flaw in published scorecard models. A corrugate supplier and a ready-to-eat ingredient supplier do not present the same risk and should not be scored the same way.

Risk tiering also maps directly to the regulation. Section 117.425 requires you to determine appropriate verification activities and their frequency based on risk, which is the same judgment that should drive your weighting.

Treat those figures as a starting point rather than a standard. What matters is that the weighting is deliberate, written down, and reviewed, so that when an auditor asks why a supplier scored the way it did you have a defensible answer.

Risk tiering also connects to your food fraud vulnerability assessment. Materials with high economic adulteration exposure often deserve a tier bump regardless of their microbiological profile.

Allera's Supplier Management module supports this directly. Request Forms are configured per supplier and per Site, so a high-tier supplier is automatically asked for a larger document set than a corrugate supplier, and you are not manually chasing different requirements across a spreadsheet.

How to calculate the score

Scoring mixes units that do not naturally combine. A percentage, a count, and a number of days all have to land on one scale.

Normalise each metric onto a common 1 to 5 scale first, with the anchors defined in writing. For documentation currency, 100% current might be a 5, 95 to 99% a 4, 90 to 94% a 3, and so on. For corrective action closure, under 14 days might be a 5 and over 60 days a 1. Write the bands down once and apply them consistently.

Then apply the tier weighting and sum. A worked example for a medium-risk ingredient supplier:

Two practical rules. Use a rolling 12-month window rather than a point-in-time snapshot, so one bad month does not define a supplier and one good month does not hide a trend. And handle missing data honestly: if a supplier has not submitted anything to score, that is a documentation finding, not a neutral result.

What happens when a supplier scores badly

A score with no defined consequence is theatre. Decide the thresholds and the actions before you issue the first scorecard, so the response is procedural rather than political.

Writing the consequence down before the first score protects you from the conversation where a supplier scores badly and everyone finds reasons why this particular case is different.

When a score triggers action, that action should route through your corrective action plan process so the follow-up is tracked to closure rather than living in an email thread.

Who owns the scorecard, QA or procurement?

This is the question that quietly kills scorecard programs. Two departments, two scorecards, two verdicts, and no decision.

A split that works in practice: QA owns the food safety weighting and holds a veto on approval status. Procurement owns commercial terms and cannot override a compliance failure with a better price. Both sit in the same review meeting and look at the same supplier list.

Run the joint review on a fixed cadence, quarterly for most operations. Bring the scores, the open corrective actions, and the expiring documents. The agenda is short: which suppliers changed tier, which need action, and which are candidates for removal.

Document the decision, including who was present. Supplier approval decisions are records under the supply-chain program, and "we discussed it" is not a record. This connects to your wider food safety management system governance.

Compliance crosswalk

Different frameworks ask for supplier monitoring in slightly different language. The scorecard can evidence all of them at once.

The primary documents are worth going to directly: the SQF Food Safety Code for Food Manufacturing (Edition 9), the BRCGS Global Standard Food Safety (Issue 9), the FSSC 22000 Scheme Version 6, and the GFSI Benchmarking Requirements. For checking whether a supplier's certificate comes from a scheme that counts, GFSI maintains the list of recognised certification programme owners.

Audit preparation guidance for the individual schemes lives in our SQF audit checklist, BRCGS certification, and FSSC 22000 Version 6 guides.

Scoring co-manufacturers and co-packers

A co-manufacturer scorecard is not an ingredient supplier scorecard with a different name. You are evaluating an entire facility and its management system rather than a material stream.

Add fields for the currency of their food safety plan, the maturity of their own supplier program, their change notification discipline, and who holds hold-and-release authority on your product. Change notification is the one that causes the most trouble in practice: a co-manufacturer who switches an ingredient supplier without telling you has changed your product without your knowledge.

FDA's guidance on supply-chain program requirements explicitly covers co-manufacturer approval and verification, which makes it the right reference point for building this variant.

Running scorecards without a spreadsheet graveyard

Most supplier scorecards start as a spreadsheet and die as one. The pattern is consistent. One person maintains it, document expiry is tracked manually or not at all, supplier responses live in an inbox, and the file is three months stale by the time anyone opens it in a review meeting.

The parts worth automating are narrow and specific. Collecting documents from suppliers without email chains. Knowing which certificates expire in the next 60 days before they lapse. Seeing current approval status across the whole supplier base without rebuilding a pivot table. Having an activity log that shows who submitted what and when.

Allera's Supplier Management module handles that layer. Suppliers are onboarded with a magic-link login rather than a password setup, so response rates are better than a portal nobody logs into. Request Forms are assigned per facility Site. The Renewal workflow flags expiring documents and can pre-fill from the last approved submission. Reminder nudges are rate-limited with a visible history, so chasing is systematic rather than personal. A compliance dashboard rolls up total suppliers, fully approved percentage, pending requests, and overdue items, and a filterable activity feed gives you the audit trail.

That gives you most of the raw inputs a scorecard needs without anyone transcribing them. The scoring judgment stays yours.

Broader tooling options are covered in our guide to supplier quality management tools, and the wider context sits in food and beverage supply chain.

Start with the data you already have

Most facilities already hold everything a first scorecard needs. Expiry dates sit in a folder somewhere. COA arrival times are in an inbox. Non-conformances are in a log. The work is not collecting new data, it is putting the existing data in one place and attaching a consequence to it.

Pick your six metric groups. Tier your top twenty suppliers. Score them for the last twelve months and see what the numbers say. The suppliers that surprise you are the reason to do this at all.

If the collection layer is where you keep getting stuck, Allera's Supplier Management module is built for exactly that problem, and the broader food quality management software overview shows how supplier records connect to the rest of your quality system.