supplier-approval

---
name: supplier-approval
description: Turns a drawer of delivery notes, a cash and carry receipt and a supplier's PDF into a supplier file that proves who you buy from, a one step back traceability record the enforcement officer can read in ten minutes, and a withdrawal page you write before you need it. Use when you are asked to prove where an ingredient came from, when you take on a new supplier, when a supplier changes a recipe, or when your supplier paperwork is a pile of invoices in a box.
---

# Prove where every ingredient came from, in ten minutes, on the day you are asked

You give me what actually exists: a month of delivery notes, a cash and carry receipt with no product detail on it, a WhatsApp from the fish man confirming Friday's box, a supplier questionnaire somebody filled in two years ago, and the label off a five kilo bag of chicken. You get back a supplier list with a status against every name, a one step back record for every delivery that meets the wording of the law rather than your memory of it, the allergen paperwork you are missing named supplier by supplier, a retention rule for each type of record with the reason beside it, a rehearsed traceability drill you can run in an afternoon, and a one page withdrawal plan that says who rings whom.

## What it does

1. **Write down every supplier you actually buy from, not the ones on the approved list.** Start with bank statements and card statements for the last three months, not the folder marked suppliers. The folder holds the four big accounts. The statements hold the other eleven: the cash and carry run on a Tuesday, the greengrocer who takes cash, the man who brings the eggs, the sister-in-law who does the cakes, the wholesaler you use when the main one is out of stock, the local butcher for the Sunday joint. Put each one on a line with what you buy from them, roughly how often, and how the goods arrive. This list is the whole skill in miniature, because Article 18 of Regulation (EC) No 178/2002, as retained in UK law, says that food business operators "shall be able to identify any person from whom they have been supplied with a food, a feed, a food-producing animal, or any substance intended to be, or expected to be, incorporated into a food or feed. To this end, such operators shall have in place systems and procedures which allow for this information to be made available to the competent authorities on demand." Any supplier not on your list is a hole in that sentence.

2. **Capture the three pieces of information the law wants against every delivery, and stop trying to capture more.** The Food Standards Agency's guidance sets out what has to be available for food one step back and one step forward, and the list is short: "name and address of supplier/business customer", "details of product, to enable its identification, and quantity in which supplied", and "the date of the transaction and delivery". That is it. Three things. You almost certainly already hold all three on paper you throw away, because the same guidance says "Traceability information can be found on a variety of documents, including invoices, delivery documents or receipts." The job is not to build a system, it is to stop binning the delivery note. Where a cash and carry receipt does not name the product properly, photograph the case label on the back door before it goes in the fridge and staple the photo reference to the receipt.

3. **Record the batch or lot code, because a missing code turns one pallet into everything you own.** The FSA guidance is blunt about what happens if you cannot narrow it down: "In the event of a food safety incident, Regulation (EC) No. 178/2002 considers a whole batch, lot or consignment unsafe unless it can be demonstrated otherwise." Read that as a cost. If the code on the box of cooked prawns is written down, a recall costs you the box. If it is not, and your supplier's notice covers three weeks of production, you cannot demonstrate which box you had, and the safe answer is to bin the lot and to tell your customers you served an unknown quantity of it. Take the code off the outer case, not off a single pack, and write it on the delivery note in pen before the case is broken down. Keep raw materials in their original packaging where you can, which the same guidance recommends, because the packaging is the record.

4. **Separate the suppliers who only need to be registered from the ones who must be approved, and check them differently.** Every food business in Great Britain has to be registered: GOV.UK states "You must register with your local authority to run a food business" and "You are required to register at least 28 days before trading." Registration is a low bar and a supplier meeting it tells you very little. A narrower group of establishments handling products of animal origin, meat, fish, dairy, egg products, has to be approved rather than merely registered, and approved premises carry an approval number and an identification mark on the product. The Food Standards Agency publishes "Lists of approved food premises and types of establishments approved by us and local authorities." So for meat, fish and dairy suppliers, write the approval number from the label or the invoice into your supplier file, then check it against the published list yourself rather than taking the supplier's word on the phone. The FSA guidance also notes that businesses handling products of animal origin or sprouted seeds "must also comply with more specific food traceability requirements", which is why these suppliers get their own column.

5. **Get allergen information in writing, from the supplier, per product, and date it.** You cannot work out the allergens in a bought-in sauce by tasting it, and your kitchen team will guess if you leave a gap. Ask every supplier for a product specification sheet for every bought-in composite product, and hold it against the fourteen named allergens, which the Food Standards Agency lists as "celery, cereals containing gluten (such as wheat, rye, barley, and oats), crustaceans (such as prawns, crabs and lobsters), eggs, fish, lupin, milk, molluscs (such as mussels and oysters), mustard, peanuts, sesame, soybeans, sulphur dioxide and sulphites (if the sulphur dioxide and sulphites are at a concentration of more than ten parts per million), tree nuts (such as almonds, hazelnuts, walnuts, brazil nuts, cashews, pecans, pistachios and macadamia nuts)". The same FSA guidance says allergen ingredients information should be "recorded on product specification sheets", that "ingredients should be kept in original or labelled containers", and that it should be "up to date", warning that "you need to consider the impact when recipes change". A specification sheet with no date on it is not evidence of anything, because the thing that gets people hurt is a silent reformulation. Write the date you received each sheet on the sheet.

6. **Ask each supplier one question about their own traceability, and file the answer.** The FSA sets this out as best practice rather than law, and the distinction matters when you talk to your enforcement officer: "It is recommended that FBOs confirm that the suppliers that they trade with also have effective traceability systems and procedures in place." One email is enough. Ask them to confirm they can trace their own one step back, who to contact out of hours if a product has to be withdrawn, and how they will tell you. File the reply. If a supplier cannot answer that in a week, you have learnt something useful about what will happen at nine o'clock on a Saturday night when their notice arrives.

7. **Set a retention period per record type and write the reason beside it, because the law does not give you a number.** The FSA guidance says plainly "It is for FBOs to determine how long they need to keep traceability information unless specific food regulations state a defined period", and then gives a best practice figure to work from: "it is best practice to maintain traceability information on pre-packed foods for the shelf life of the food plus 12 months as a minimum." For foods pre-packed for direct sale, loose foods and meals served, the guidance says these "should be considered on a case by case basis, in consultation with the enforcement authority", so that is a conversation to have at your next visit rather than a number to invent. Write your chosen period on the front of the box with the sentence explaining why you chose it. An officer can disagree with a reasoned period. They cannot do anything with a shrug.

8. **Run the drill once a year and after every supplier change, and time yourself.** Pick a dish off last week's menu, take one ingredient, and see how fast you can name the supplier, the delivery date, the quantity and the batch code from the paperwork alone, without ringing anyone. Then do the same backwards from one delivery note to every dish it went into. The FSA recommends the timing: "Traceability systems should be reviewed at least on an annual basis, or sooner if there has been a significant change within a business e.g. change of supplier." Write down how long it took and what was missing. Ten minutes is a working system. Two hours is a system that will fail on the night you need it, and the failure will happen while someone is waiting on the phone.

9. **Write the withdrawal page now, on one side of paper, and pin it inside the office door.** When a supplier tells you a product is unsafe you do not get thinking time. GOV.UK's guidance on food incidents tells businesses to "immediately withdraw or recall the food from the market". The FSA guidance names who has to be told, in order: "their enforcement authorities and the FSA/FSS", "their suppliers and business customers (including brand owners)", and "consumers (only in the case of a recall)", and adds "Notification should not be delayed. If all the information is not readily available, provide what details are available." Your page needs four things on it: the name and out of hours number of your enforcement officer at the local authority, the reporting route to the FSA, the line that stock comes off the line and goes into "a quarantined area" away from non-affected food, and the name of the one person who decides. Add one warning in bold to the bottom, because people improvise under pressure: you "must seek agreement from their enforcement authority before any food that has been previously recalled or withdrawn is re-worked or re-labelled."

## Then it checks

1. Every supplier found on three months of bank and card statements appears on the supplier list, and every line on the list says what is bought, how often, and whether that supplier needs approval or only registration.
2. Every delivery in the last month has all three of the required items recorded against it: supplier name and address, product detail and quantity, and the date of transaction and delivery. Any delivery missing one is named, not averaged away.
3. Every meat, fish, dairy or egg product supplier has an approval number written in the file, with the date it was checked against the published list and by whom.
4. Every bought-in composite product has an allergen specification sheet with a date on it, and no dish on the current menu depends on an allergen judgement that has no sheet behind it.
5. Every record type has a written retention period with the reason beside it, and no box of delivery notes has been thrown away earlier than that period.
6. The drill has been run in the last twelve months, the time it took is written down, and the withdrawal page exists with a named decision maker and a working out of hours number for the local authority.

Any check fails: name it, redo that step once. Failed twice: say what is wrong and stop.

## Rules
- Public information only.
- Never invent a fact, a number or a quote.
- Anything sent in someone's name says whose name it is.
- Never write "approved" against a supplier because they said so on the phone or because it appears in their email signature. Approval is a published status with a number attached, and the point of writing it down is that somebody other than you can check it.
- Never treat a signed supplier questionnaire as a substitute for the delivery record. The questionnaire describes what a supplier intends to do. The delivery note is evidence of what arrived, on what day, in what quantity. An officer asking where the chicken came from wants the second one.
- Never decide an allergen is absent from your own reading of a product. If there is no dated specification sheet, the honest answer to a customer is that you do not know, and that answer is safe. A guess is not.
- Never mark the one step forward records as not applicable just because you serve the public. Retailers and caterers are not required to keep traceability information on sales to the final consumer, but the moment you supply another business, a market stall, a pop up, a neighbouring pub, the requirement applies to that supply and most venues forget it.
- This output is a working document prepared for the owner's environmental health officer, food safety adviser or solicitor to check before it is used or relied on. It does not decide whether your business complies with food law, it does not approve any supplier, and it is not legal advice.

## Built from
- Regulation (EC) No 178/2002, Article 18 (Traceability), as retained in UK law, https://www.legislation.gov.uk/eur/2002/178/article/18, latest available revised version, read 14 September 2026: the verbatim duty to identify any person from whom you have been supplied and to make that available to the competent authorities on demand, which is the whole of step 1, plus the paragraph 3 duty to identify the businesses you supplied, which shaped the last rule.
- Food Standards Agency, "Guidance on Food Traceability, Withdrawals and Recalls within the UK Food Industry", https://assets.publishing.service.gov.uk/media/69fc4f404fb0713aa63ea57e/food-traceability-withdrawals-and-recalls-guidance.pdf, March 2019, read 14 September 2026: the three item traceability list in step 2, the whole batch presumption in step 3, the products of animal origin note in step 4, the best practice supplier confirmation in step 6, the shelf life plus twelve months retention figure and the "it is for FBOs to determine" line in step 7, the annual review timing in step 8, and the notification order, quarantine wording and re-work warning in step 9.
- GOV.UK and Food Standards Agency, "Food incidents, product withdrawals and recalls", https://www.gov.uk/guidance/food-incidents-product-withdrawals-and-recalls, published 5 February 2018, last updated 20 August 2026, read 14 September 2026: the instruction to immediately withdraw or recall the food from the market, quoted in step 9.
- GOV.UK, "Register a food business", https://www.gov.uk/food-business-registration, last updated 25 June 2026, read 14 September 2026: the duty to register with the local authority and the 28 days before trading requirement, both quoted in step 4 to set the floor a supplier has to clear.
- Food Standards Agency, "Approved food establishments", https://www.gov.uk/government/publications/approved-food-establishments, published 18 December 2017, no last updated date shown on the page, read 14 September 2026: the existence of published lists of approved food premises, which is what step 4 tells you to check a supplier's approval number against.
- Food Standards Agency, "Allergen guidance for food businesses", https://www.gov.uk/government/publications/allergen-guidance-for-food-businesses/allergen-guidance-for-food-businesses, published 17 July 2026, read 14 September 2026: the verbatim list of the fourteen allergens and the requirement that allergen information is recorded on product specification sheets, kept up to date, and reconsidered when recipes change, which is the whole of step 5 and the sixth rule.

# supplier-approval

## You are given
A folder of inputs from a UK hospitality business: three months of bank and card statements, a box of delivery notes photographed page by page, cash and carry receipts that name a card number and a total and no product at all, a WhatsApp export where the fish supplier confirms Friday's box, a supplier questionnaire filled in two years ago, product specification PDFs, photographs of case labels and approval marks taken at the back door, and an existing supplier list that is out of date. Handwriting is bad, several delivery notes have no batch code on them, and the same supplier appears under three different names.

## Produce
Write into an `output/` folder next to the inputs:

1. `supplier-list.csv` - one row per distinct supplier found anywhere in the inputs, including the ones found only on a statement. Columns exactly, in this order:
`supplier_ref,supplier_name_as_written,other_names_seen,supplier_address_as_written,what_is_bought,how_goods_arrive,frequency_seen_in_inputs,products_of_animal_origin_yes_no,approval_number_as_printed,approval_number_source_document,date_approval_number_read,registration_evidence_in_inputs,first_seen_date,last_seen_date,source_files`
 - `supplier_ref` is `SUP-001` upwards, assigned in alphabetical order of `supplier_name_as_written`, and never reused.
 - `approval_number_as_printed` is transcribed character for character from a label, invoice or specification sheet. If none was supplied the cell is `NO NUMBER IN INPUTS`.
 - `products_of_animal_origin_yes_no` is `yes` only where the inputs name meat, fish, shellfish, dairy, egg products or sprouted seeds against that supplier; otherwise `no` or `NOT STATED IN INPUTS`.
 - There is no status, rating or approval column in this file and none is to be added.
2. `delivery-records.csv` - one row per delivery evidenced in the inputs. Columns exactly, in this order:
`delivery_ref,supplier_ref,supplier_name_as_written,supplier_address_as_written,product_description_as_written,quantity_as_written,unit_as_written,date_of_transaction,date_of_delivery,batch_or_lot_code_as_printed,document_type,source_file,page_or_photo_reference`
 - `document_type` is one of exactly `delivery note`, `invoice`, `till receipt`, `message thread`, `case label photograph`, `email`.
 - `batch_or_lot_code_as_printed` is transcribed exactly, including leading zeros and letters. Where none is visible the cell is `NO CODE ON DOCUMENT`.
 - The three traceability items are the first six columns after `delivery_ref`. A delivery missing any of them still gets a row, with `NOT ON DOCUMENT` in the missing cell, and is listed in file 7.
3. `one-step-forward.csv` - one row per supply the inputs show going out to another business rather than to a final consumer, for example a market stall, a pop up, a neighbouring venue or a caterer. Columns exactly: `supply_ref,business_customer_name,business_customer_address,product_description_as_written,quantity_as_written,date_of_transaction,date_of_delivery,source_file`. If the inputs evidence none, write the header row and nothing else; never write `not applicable`.
4. `allergen-specification-register.csv` - one row per bought-in composite product named in the inputs. Columns exactly, in this order:
`product_ref,supplier_ref,product_name_as_written,supplier_product_code,specification_sheet_held,specification_sheet_date,allergen_wording_as_printed,version_or_recipe_date_on_sheet,source_file`
 - `specification_sheet_held` is `yes` or `no`.
 - `allergen_wording_as_printed` is the exact allergen text read off the sheet or label, in quotation marks. It is never rewritten into a tidy list and never derived from the product name.
 - Where `specification_sheet_held` is `no`, the allergen and version cells stay empty and the row is listed in file 7.
5. `retention-register.csv` - columns exactly: `record_type,retention_period_stated_in_inputs,reason_stated_in_inputs,where_stored,oldest_record_held,source_file`. One row per record type found: delivery notes, invoices, till receipts, specification sheets, supplier correspondence, case label photographs, withdrawal notices. Where the inputs state no period, both the period and the reason cells are `NOT STATED IN INPUTS`. Never write a number of months or years that no input states.
6. `traceability-drill-sheet.csv` - a blank sheet for the owner to run and time. Columns exactly: `drill_date,direction,starting_point,supplier_named,delivery_date_found,quantity_found,batch_code_found,minutes_taken,what_was_missing,run_by`. Two rows per drill, one with `direction` pre-filled `one step back` and one `one step forward`. Every other cell ships empty.
7. `missing-and-expired.csv` - the exceptions file, and the one the officer will read first. Columns exactly, in this order:
`item_ref,supplier_ref,what_is_missing_or_expired,which_document_would_fix_it,date_of_the_document_that_expired,source_file,question_for_the_adviser`
 - `what_is_missing_or_expired` is one of exactly `no supplier address`, `no product detail`, `no quantity`, `no transaction date`, `no delivery date`, `no batch or lot code`, `no approval number`, `no registration evidence`, `no allergen specification sheet`, `specification sheet undated`, `specification sheet older than the supplied recipe change`, `no retention period stated`, `supplier on statement only`.
 - Every delivery, supplier and product with a gap appears here. Nothing is averaged away or rolled up into a count.
8. `withdrawal-page.html` - one printable A4 sheet to pin inside the office door, carrying: the local authority enforcement contact and out of hours number as given in the inputs or `NOT SUPPLIED`, the reporting route as given in the inputs or `NOT SUPPLIED`, the named decision maker as given in the inputs or `NOT SUPPLIED`, the quarantine instruction, and the supplier contact table drawn from `supplier-list.csv` with columns `supplier_ref`, `supplier_name_as_written`, `contact_name`, `telephone`, `out_of_hours_contact`. Black on white, 11pt minimum, margins at least 10mm. Nothing on it is invented; an unsupplied number reads `NOT SUPPLIED`.
9. `README.md` - what was read, the date range of the delivery records, the count of suppliers, deliveries and products, and what could not be transcribed.

## Rules
- Never write that a supplier is approved, vetted, verified, checked, trusted, reputable or acceptable, and never write `approved supplier` as a heading, a column or a value. Transcribe the approval number as printed with the document it came from and the date it was read, and stop there. Whether that number is current is checked by a person against the published list.
- Never state what a certificate, registration or approval permits a supplier to supply. Extract the number, the dates and the wording; put the question in `missing-and-expired.csv`.
- Never derive an allergen from a product name, an ingredient list you reason about, or a previous version of a specification sheet. Only wording read from a supplied sheet or label goes in `allergen_wording_as_printed`. Absent means no sheet was supplied, and that is a row in file 7.
- Never invent a retention period, a batch code, an address, an approval number or a delivery date. A cell with no evidence behind it reads `NOT ON DOCUMENT`, `NO CODE ON DOCUMENT`, `NO NUMBER IN INPUTS` or `NOT STATED IN INPUTS`, and the row goes in file 7.
- Never merge two supplier names into one row on a judgement that they are the same business. Keep them separate, list the alternatives in `other_names_seen`, and put the question in file 7.
- Never treat a signed supplier questionnaire as a delivery record. A questionnaire evidences intent; only a delivery note, invoice, receipt, label photograph or dated message evidences what arrived.
- Never fill in `traceability-drill-sheet.csv`. It ships blank apart from the two `direction` cells.
- Every figure, date, code and number in every output must trace to a supplied input file named in the row's `source_file` cell.
- Food law enforcement, registration and approval arrangements are not identical across England, Wales, Scotland and Northern Ireland. Do not write any output that assumes one nation's regime or one national register.
- British English, £ where any cost appears, dates written as DD Month YYYY. No em dash characters anywhere. No emoji.
- Put this line at the top of `missing-and-expired.csv` as a final comment row, at the foot of `withdrawal-page.html` and at the end of `README.md`: "Working document prepared for the owner's environmental health officer, food safety adviser or solicitor to check before it is relied on. It does not approve any supplier and it is not legal advice."

## Return
The absolute path of each of the nine files, the number of suppliers listed, how many were found on a statement only, the number of deliveries recorded, how many are missing at least one of the three traceability items, how many have no batch or lot code, the number of bought-in products with no dated allergen specification sheet, and the number of rows in `missing-and-expired.csv`. State plainly that no supplier was described as approved.