How to pass a Whole Foods supplier audit: what they actually check, and where small producers fail

A founder running a 12-person hot sauce brand emailed me last week. Her line had just been picked up by a Whole Foods regional buyer. The buyer's onboarding packet arrived two days later — a 41-page PDF, a RangeMe profile request, a Repositrak login, and a one-line sentence at the bottom that said her facility would need to be "audit-ready within 60 days."

Her question was the same one I keep getting:

"Audit-ready for what? They sent four different checklists."

That's the part nobody tells small producers. "A Whole Foods audit" isn't one audit. It's a stack of four overlapping reviews, run by different teams, against different standards, on different timelines. Each one fails for different reasons, and missing any of them can stall your account before your first PO ships.

This post is the map. If you're a small producer getting onboarded by Whole Foods Market — or by any of the retailers that have copied their supplier program (Sprouts, Wegmans, Erewhon, Fresh Market, most regional natural-grocery chains) — here's what each layer is, where small producers actually fail, and what to do in the two weeks before your first audit visit.

The four audits, stacked

Whole Foods' Supplier Quality Assurance program layers four distinct reviews on top of every supplier. They don't always happen in the same order, but every one of them gets done before you go national, and most of them get re-checked annually.

1. The ingredient / quality standards review

This is the Whole Foods–specific one and the only audit that's unique to them. It checks your product against the Whole Foods Market Quality Standards — most notably the Unacceptable Ingredients for Food list, which currently bans more than 230 ingredients (high-fructose corn syrup, artificial colors, sodium benzoate in many categories, partially hydrogenated oils, bleached flour, and so on).

It also checks sourcing claims: if your label says "organic," you need a current USDA Organic certificate. If it says "non-GMO," you'll be asked for Non-GMO Project Verified status or an equivalent IP-preserved sourcing record. Animal proteins get the additional Global Animal Partnership (GAP) tier review.

Where small producers fail: an ingredient deep in the formulation list (often a natural flavor or a citrus preservative blend) contains a sub-ingredient on the banned list. The supplier's spec sheet doesn't disclose it. You don't catch it until Whole Foods' QA team does. Fix: get a complete sub-ingredient declaration from every flavor, color, and preservative supplier before you submit your product spec, not after.

2. The third-party food safety audit (GFSI)

This is the audit most people mean when they say "the audit." It's not run by Whole Foods directly — they require you to hold a current certificate from a GFSI-benchmarked scheme, which in practice means one of:

• SQF (Safe Quality Food) — most common for small US producers
• BRCGS (formerly BRC) — common for producers who also sell into UK / European retailers
• FSSC 22000 — common for ingredient suppliers and co-packers
• PrimusGFS or GLOBALG.A.P. — common for fresh produce

A certified third-party auditor visits your facility once a year, runs you against the scheme's full checklist (hundreds of clauses), scores you, and either issues / renews the certificate or hands you a corrective-action list. Whole Foods then pulls the certificate from Repositrak — they don't re-audit what your auditor already audited.

For very small producers: if you're under roughly $1M in revenue and Whole Foods has picked you up as a local / regional vendor, they sometimes accept a HACCP plan plus a passing FDA inspection in lieu of a full GFSI certificate. Don't assume this — confirm it with the buyer's QA contact in writing.

Where small producers fail: they sign up for the SQF audit assuming it's a paperwork exercise, and the auditor finds that the pre-requisite programs (allergen control, sanitation, supplier approval, traceability) aren't documented at the level the scheme demands. The fix is to start the SQF self-assessment 6 months before the audit, not 6 weeks. Most failures are documentation failures, not facility failures.

3. The traceability and recall readiness check

This is the layer that has changed the most in the last 18 months — and the one this site exists to help with. Whole Foods' supplier program now requires that every supplier can:

1. Trace any lot one step back and one step forward within hours of a request
2. Produce a traceability lot code (TLC) for every finished lot
3. Run a mock recall at least annually with documented results
4. Identify which finished lots used which ingredient lots without consulting paper records or memory

Most of this comes straight out of the FSMA 204 Food Traceability Final Rule, even though the FDA's own deadline has been pushed to January 2028. Whole Foods, like Sprouts and Erewhon, has decided not to wait. They want the Key Data Elements (KDEs) now, regardless of whether your product is on the Food Traceability List.

Where small producers fail: the mock recall. Whole Foods (or your SQF auditor on Whole Foods' behalf) will say "pick a finished lot you shipped to us last month and show me every ingredient lot that went into it, plus every other customer who received that batch, in under 4 hours." If your answer involves opening invoices in a filing cabinet, you fail. If your answer is a spreadsheet that you've been "meaning to clean up," you fail. The only passing answer is a system — paper, spreadsheet, or software — where the lot chain is already linked, before the call comes in.

This is precisely what we obsess over in FSMA204Hub's compliance score — a single live number that tells you what percent of your recent batches are fully traceable. If it's green, the mock recall is a 3-minute screenshot.

4. The label, claims, and packaging compliance review

The audit nobody talks about until it stops a launch. Whole Foods runs every label through a labeling review that checks:

• FDA-compliant nutrition facts (current 2016 format, correct serving sizes, DV percentages)
• Allergen statements that match the Big 9 (including sesame, added in 2023)
• Country-of-origin labeling under 19 CFR Part 134
• "Organic," "natural," "non-GMO," and any structure / function claims backed by documentation
• Net weight verification matching declared weight ± USDA tolerance

Where small producers fail: the allergen "may contain" disclosure. Their co-packer also runs peanut products on the same line; the producer's label doesn't say so; Whole Foods catches it on the first shelf check and the SKU gets pulled until a re-printed label arrives. Cost: usually 4–8 weeks of lost sales and a six-figure relabeling bill if you'd already produced inventory.

The five places small producers actually fail

If I had to rank the failure modes by frequency from talking to operators, they're not the obvious ones. They're:

1. Sub-ingredient disclosure gaps. Your flavor supplier hides a banned ingredient three layers deep in their spec sheet. You don't know because you never asked for the full breakdown. Whole Foods QA does ask, and finds it.

2. A mock recall you've never actually run. The corrective-action list from your SQF audit said "perform annual mock recall." You wrote a procedure. You never executed it. The auditor asks for the report. You don't have one.

3. Supplier approval program that's mostly verbal. You've worked with your milk supplier for 8 years. You trust them. You've never collected a current letter of guarantee, a copy of their GFSI certificate, or a Cert of Analysis for any lot. The auditor flags every receiving event as missing supplier-approval evidence.

4. TLC discipline collapses on rework or repacking. You receive a lot of caps that didn't seal properly, repack the product into new containers, and forget to issue a new TLC for the reprocessed lot. The chain breaks. Whole Foods' mock recall hits the gap and they can't trace forward from the rework event.

5. Label artwork drift. You re-print labels with a 2-point font change to make room for a new claim. Nobody re-routes the artwork through Whole Foods' labeling review. The new label hits shelves; the review team flags it; the SKU pauses.

None of these failures are about your facility being unsafe. They're all about documentation and process discipline — the part SaaS can actually help with.

What to skip

A lot of the onboarding packet is informational, not gating. You can answer briefly and move on:

• "Do you have a SMETA social audit?" (Optional for most food categories. If you don't, say so.)
• "Do you use blockchain for traceability?" (Nobody does. Don't pretend.)
• "Can you support EPCIS electronic event messaging?" (Enterprise-tier. Not required for small producers.)
• "Do you participate in Repositrak / ReposiTrak for compliance document hosting?" (Yes — you'll get an invite, accept it, upload your certificates, done. ~30 minutes.)
• "Do you have a C-TPAT certification?" (Only if you import. Skip if you don't.)

If a question isn't about ingredient compliance, food safety, traceability, or labeling — the four audit layers above — it's almost always extra credit.

A 2-week prep plan

Two weeks before your first Whole Foods audit visit (or your annual SQF re-cert under Whole Foods' supplier program), this is the work I'd do, in this order:

Days 1–2: Ingredient deep-dive. Open the Unacceptable Ingredients list. Walk every product spec, sub-ingredient by sub-ingredient. Get fresh spec sheets from every flavor, color, preservative, and processing-aid supplier. Flag anything ambiguous and email the supplier directly. Resolve before the audit.

Days 3–5: Supplier approval folder. For every ingredient supplier: current letter of guarantee, current GFSI certificate (or HACCP plan for very small suppliers), most recent COA per lot received in the last 90 days, allergen statement. One PDF per supplier. Upload to Repositrak.

Days 6–8: Traceability dry run. Pick three random finished lots you've shipped in the last 60 days. For each one, produce a one-page report showing: input ingredient lots, production date, finished lot TLC, all customer ship-tos for that TLC. Time yourself. If any of the three takes more than 30 minutes, fix the gap before the auditor finds it. (If you're on FSMA204Hub, this is a screenshot — that's why the product exists.)

Days 9–11: Mock recall. Pick one ingredient lot. Trace forward to every finished lot it went into, every customer those finished lots shipped to, and the quantity at each destination. Document the start time, end time, gaps found, and the corrective actions you took. File the report. This is the document the auditor will ask for.

Days 12–13: Label sweep. Pull the current physical label of every SKU you'll be selling to Whole Foods. Compare nutrition facts, allergen disclosure, net weight, organic claims, and any "no [X]" claims against the actual current formulation. Flag any drift. Route any flagged labels through your buyer's labeling contact before the audit.

Day 14: Quiet day. Don't change anything. Print your supplier approval folder index. Have your mock recall report on the table. Make sure whoever's walking the auditor through your facility has rehearsed the traceability dry run at least once.

The shortcut nobody tells you

Most of the failures above stem from one root cause: the data you need for the audit only exists in your head, in spreadsheets, or in paper files that aren't linked to each other. You can fix that with discipline and a year of practice. Or you can fix it with a system that enforces the linkage every time a lot moves.

That's the bet behind FSMA204Hub — a traceability tool built around the exact lot-flow Whole Foods' supplier program checks for. The compliance score on the dashboard is the answer to "can you prove, right now, that you know where your lots are?" If it's green, the audit is a screen-share. If it's amber, you know exactly which batch needs fixing, before anyone asks.

We're onboarding early access customers now. If a Whole Foods audit is on your calendar in the next 90 days and you want a second pair of eyes on your readiness, request access from the home page — we'll get back to you within a working day.

---

Working through a Whole Foods supplier packet right now? Forward me the PDF — reply to our newsletter or email [email protected] and I'll send you a quick read on which of the four audits is the highest risk for your category.

Written by Anas N., Co-founder of Darza Technologies. Last reviewed 2026-05-12.