Supplier approval and traceability: your first defence

By Zynthio. Published 27 July 2026, updated 12 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

UK food law requires one step back, one step forward tracing. Supplier approval and traceability make that duty workable during a recall.

Article 18 of Regulation (EC) 178/2002 requires a food business to trace its food one step back and one step forward, which means being able to name the business that supplied each ingredient and, where you supply another business, the one that received it. Supplier approval and traceability are how that duty is met in an ordinary week: approval settles who you are prepared to buy from, and traceability records what arrived, when it arrived and who sent it.

An approved supplier list is the practical form the approval half takes. It is a working record of who you buy from, the checks carried out before the first delivery, and the evidence you hold that those businesses can be trusted with your kitchen. Without it, traceability turns into guesswork the moment a withdrawal notice lands, and the paperwork you do hold becomes noise rather than a trail anyone can follow.

Why supplier approval and traceability sit together

Approval is the front-end check and traceability is the back-end record, and treating them as separate jobs is where most kitchens come unstuck. Before you accept deliveries from a business, approval confirms that it is registered with its own local authority, that it can hold the cold chain in transit, and that its batch and allergen information is reliable. Once deliveries are flowing, traceability keeps enough detail to identify which batch went into which dish, on which date, at which site. Regulation (EC) 852/2004 puts a general obligation on food business operators to ensure that all stages of production, processing and distribution of food under their control satisfy the relevant hygiene requirements, and goods-in is one of those stages. A well-approved supplier with no traceable delivery notes still leaves you unable to act when a product is withdrawn, because approval says the supplier is generally sound and says nothing about which of last month's deliveries is affected today. The reverse holds as well: meticulous delivery records mean little if nobody checked the supplier at the start, because there is no baseline against which to judge whether a fault is a one-off or a pattern.

What one step back, one step forward means in practice

The regulation does not ask you to map a supply chain back to the farm. It asks for two fixed points: the business that sent you the ingredient, and, if you passed anything to another business, the one that received it. Article 18 also requires that information to be available to the enforcement authorities on demand, which is the part operators tend to underestimate, because a record that exists but cannot be produced quickly counts for very little. For most independent pubs, restaurants and cafes the forward step rarely applies, since food goes straight to the customer, so the weight sits almost entirely on the backward step. Every delivery needs to be linked to a supplier, a date and, where the product carries one, a batch or lot number, held somewhere staff can find it under pressure rather than filed loosely in a drawer. A fair test is to pick a dish on tonight's menu and ask whether anyone on duty could name the supplier and delivery date for its main ingredient within five minutes.

Building an approved supplier list that survives an audit

A workable list does not need to be elaborate. It needs the supplier name and contact details, the date of approval, what was checked at that point, and the date that check falls due again. Asking to see a food hygiene rating is the wrong check for most businesses that deliver to you: the Food Hygiene Rating Scheme in England, Wales and Northern Ireland, and the Food Hygiene Information Scheme in Scotland, cover businesses that supply consumers, so a wholesaler, manufacturer or distributor may carry no published rating at all. Ask instead for confirmation that the business is registered or approved with its local authority, a current third-party audit certificate where the supplier holds one, and written product specifications stating allergens and storage conditions. Suppliers taken on mid-week during a shortage are the classic gap, so a cheap substitute brought in on a Friday still needs the same short conversation about controls before the first box is accepted. Reviewing the list annually, and whenever a supplier changes hands, keeps it current rather than a task completed at opening and never revisited. A brief goods-in checklist covering vehicle condition, product temperature on arrival and packaging integrity catches problems long before any audit would.

Keeping records that hold up during a recall

The records that matter in a withdrawal are the ones nobody thinks about on a normal shift: delivery notes, invoices and the temperature checks taken on arrival. They need to be kept long enough to cover the shelf life of the product plus a sensible margin, and stored so that a specific delivery can be pulled up quickly rather than hunted through a filing box. Food safety retention periods and other business retention rules do not always match. The VAT record-keeping rules require VAT records to be kept for at least six years, whatever the shelf life of the product on the invoice, so it is sensible to set your filing around the longest relevant requirement rather than the shortest. One filing convention across food safety and finance saves duplicated effort and reduces the chance that a record sits in one system but not the other on the day it is needed.

Where traceability breaks down under pressure

The value of traceability shows on the worst day, not the average one. When a supplier issues a recall for an undeclared allergen, the businesses that can identify affected stock in minutes protect their customers first and their reputation second. Those relying on memory, a stack of loose delivery notes, or a manager who is off that day are exposed quickly once environmental health starts asking questions. The failure point is rarely an absence of paperwork; it is paperwork that exists somewhere but cannot be located, cross-referenced or trusted inside the time a recall allows. Recall notices usually give a batch code and a delivery window rather than a supplier name alone, so records have to be searchable by those specifics, not only by supplier or by month.

Linking traceability to allergens and recipes

Traceability is strongest when it sits alongside recipes, allergen data and stock records rather than in a silo kept for its own sake. Regulation (EU) 1169/2011 governs the provision of food information to consumers, and the allergen information you hand a customer is only as good as the specification the supplier handed you. Natasha's Law extended full ingredient and allergen labelling to food prepacked for direct sale from 1 October 2021, so a sandwich made and wrapped on site carries an ingredient list with the allergens emphasised, built from supplier data. A supplier that changes a formulation, substitutes an ingredient or switches factory can introduce an allergen your recipe cards do not yet show, which is the gap allergen management under Natasha's Law is meant to close. Updating the allergen matrix whenever a supplier specification changes keeps that link current, and the same discipline supports the due diligence defence your records provide if a complaint or an inspection follows. Date labelling sits in the same chain: if a batch is withdrawn you need to know not only where it came from but how long it had been open, which is where use-by and open-life labelling earns its keep. A food safety management system built on HACCP principles expects these controls to connect rather than run in parallel, which is the argument for holding them in one food safety software record rather than three.

Doing this without the paperwork

Paper handles approval checks, delivery logs and allergen updates well enough until a recall makes speed matter. Zynthio's food safety software generates the daily checks automatically, timestamps every entry against the person who completed it, accepts photo evidence, raises a corrective action when a temperature is logged out of range, and exports six weeks of records as a PDF. Batch and expiry tracking with a daily sweep and quarantine, delivery lines read from a photographed delivery note, and supplier performance scoring sit in stock control, which is part of the EPOS and Stock add-on. Recipe allergen assessments lapse when ingredients change, so a supplier substitution surfaces as work to do rather than passing unnoticed. Approving a supplier stays your decision and your list; what a linked record removes is the hour spent working out which deliveries a recall actually touches.

See how Zynthio handles this