What Costco Checks Before It Approves a New Supplier

A clean SQF certificate does not get a brand into Costco. Costco runs its own audit on top of the GFSI one, increasingly unannounced, and it can fail a supplier over a gap in sixty days of production records no matter how good the plant is. The certificate is the cost of being considered. It is not the thing that decides.

For Cinderhaven Provisions, Costco is 9% of revenue, about $2.25 million a year. Cinderhaven Provisions is a fictional company and its figures are a synthetic dataset; the requirement structure they illustrate is Costco's own. Every dollar of that channel sits behind a food-safety gate, and half of what the gate checks is not how the brand makes food. It is whether the brand can produce the data that proves it.

The GFSI certificate is table stakes, not the gate

Costco requires a current GFSI-benchmarked certificate: SQF, BRCGS, FSSC, or a peer scheme. Most brands treat earning one as clearing the bar. It clears the first bar. Costco then layers its own Costco Addendum on top, a set of requirements built onto the GFSI audit and scored separately, run at the same visit and adding audit hours.

The addendum is where Costco-specific expectations live: foreign-material control, allergen control, microbiological testing, product traceability, and supplier approval. Beginning in 2024, Costco moved most of these audits to unannounced. A supplier cannot dress the floor the week before. The audit sees the operation as it runs on an ordinary Tuesday, and the records as they actually are.

Half of what Costco checks is data, not food safety

Read the addendum as an operator and something becomes clear. A large share of it is not about how the food is made. It is about whether the brand can produce the records that prove how the food was made, and produce them on demand.

The bottom three rows are data problems wearing food-safety labels. A mock recall is a traceability query: take a finished pallet, trace it back to the raw-material lots and forward to where it shipped, fast and complete. A brand whose lot data lives partly in the ERP, partly in the co-packer's system, and partly in a spreadsheet cannot answer it in time. The plant is spotless. The lineage is broken. To a recall, a lot that cannot be traced is a lot that cannot be pulled, and Costco scores it that way.

The sixty-day records requirement is the same problem in a plainer form. It does not ask whether the brand runs clean lines. It asks whether the brand kept the records, all of them, for sixty days. A gap there is not a deduction to dispute. It is an automatic failure of the audit.

The club pack is a new item, and its data has to match the pallet

Costco does not stock a brand's grocery case. It stocks a club pack, usually a multipack built for the warehouse floor and shipped display-ready on a pallet. That is a new item: a new GTIN, a new case configuration, a new set of dimensions, and new packaging, whose makers sit under the same food-safety expectations and audit requirements as the food itself.

Every one of those fields is a place the brand's data can disagree with the physical pallet. When it does, the failure mode is the same fee schedule that runs at Walmart: a case pack the ASN reports wrong, a label the receiving scan rejects. Costco carries about four thousand items to a supermarket's thirty thousand, and it delists on velocity without sentiment. A club item generating compliance friction in its first quarter does not get a second one.

Approval is not the finish line; it is the start of the audit clock

A grocery buyer's yes is a sales event. A Costco yes is the starting gun on a food-safety and data process the buyer does not run and cannot waive. That inverts how most brands plan the launch. They staff the buyer meeting and treat the audit as a formality QA will handle, the same way a brand underestimates the gap between a Whole Foods approval and the first PO.

The traceability the audit tests does not live in the QA binder. It lives across the ERP, the co-packer's records, and whatever spreadsheet holds the lot codes, which is exactly why brands fail it: the data that proves the food is safe crosses the same systems that fail everywhere else. Costco is not asking the brand to make better food. It is asking the brand to prove, from its own records, that it already does. For a $2.25 million channel, that proof is the product.

Send me your last mock recall

Send me the results of your last mock recall, the raw trace and not the summary memo: lot numbers, timestamps, and the system each record came from. I will write back with where the lineage breaks between the ERP, the co-packer, and the spreadsheet, and how long a real trace actually takes. No call. Better to find the gap on your own clock than on Costco's. Start here.