Coles supplier audit requirements,
and how to be ready
What Coles auditors check, the records to have on hand, and a 12-week plan. Written for the person at a small or mid-sized manufacturer who owns food safety.
To supply Coles, you’ll generally need a GFSI-recognised certification (SQF, BRCGS or FSSC 22000) plus Coles’ own layer. For Coles Brand manufacturers, that layer is the Coles Food Manufacturing Supplier Requirements (CFMSR). Branded suppliers are audited against a Coles Supplier Requirements addendum in the same audit as their scheme. Own Brand suppliers also sit in the Coles Ethical Sourcing Program.
Which Coles standard applies to you?
Coles keeps its requirement documents on its supplier portal, not the open web. Public sources describe two strands.
| You make… | Food safety layer | How it’s audited | Also in scope |
|---|---|---|---|
| Coles Brand (own brand) products | Coles Food Manufacturing Supplier Requirements (CFMSR), currently Version 3 | A GFSI certification is described as the prerequisite. CFMSR adds Coles-specific requirements on top. | Coles Ethical Sourcing Program, including your packing or manufacturing sites |
| Your own brand, sold at Coles | Coles Supplier Requirements (CSR) addendum | Certifiers describe the Coles criteria as sitting alongside your base scheme (such as BRCGS or SQF) and being assessed in the same audit, by a Coles-approved certification body. | Ethical sourcing expectations; check with your buyer |
| Fresh produce | HARPS (currently Version 2.0) | A bolt-on to a GFSI-benchmarked base such as Freshcare, GLOBALG.A.P., SQF or BRCGS. | Ethical Sourcing Program if the produce carries a proprietary brand |
If your paperwork only says “the Coles audit”, ask your Coles contact for the document name and version. Sources: Coles Quality Academy, BSI on the Coles addendum, SGS on CSR-F, HARPS.
What CFMSR Version 3 asks for on top
Version 3 audits began in January 2022. These are the areas consultants flag as the step up from a standard GFSI audit.
GFSI first
A current GFSI-recognised certification is the entry ticket. Coles’ requirements are assessed on top of it, not instead of it.
Food defence (TACCP)
A documented threat assessment of your site and a vulnerability review, using a recognised method such as CARVER+Shock.
Your suppliers are certified too
Ingredient and packaging suppliers are expected to operate under GFSI-certified programs. Your approved supplier list has to prove it.
Trained internal auditors
Internal auditors with formal, examined training. Your internal audit schedule has to show they actually audit.
Allergen hierarchy
Controls that start with elimination and only fall back to precautionary labelling when nothing else works.
Policy, culture and environment
A food safety policy signed by senior management and reviewed yearly, plus a formal environmental management plan.
Summarised from QMS Audits on CFMSR Version 3. Coles runs CFMSR training through the Coles Quality Academy with SAI Global. The standard itself is the final word.
What Coles auditors check, and the evidence to have ready
A procedure on file isn’t proof. Auditors sample records and trace them back.
| Area | What the auditor looks for | Evidence to have ready |
|---|---|---|
| HACCP and CCPs | A current HACCP plan that matches what happens on the floor | CCP monitoring records for the sampled dates, signed, with deviations linked to corrective actions |
| Supplier approval | Every ingredient and packaging supplier approved, with valid certification | Approved supplier list; current GFSI certificates; how you track expiry dates |
| Food defence | A threat assessment that reflects your real site | TACCP assessment, review date, and actions from it |
| Allergens | Controls that follow the hierarchy, and labels that match recipes | Allergen matrix; changeover validation; label checks against current specifications |
| Traceability | You can trace a Coles product forward and back quickly | A recent trace test with timings; batch and lot records; recall procedure |
| Internal audit | A schedule that runs, done by trained auditors | Internal audit plan, reports, auditor training records, findings closed out |
| Corrective actions | Findings closed with root cause, not just a quick fix | CAPA register with owner, due date, root cause and verification evidence |
| Culture and management | Senior management visibly owns food safety | Signed policy, yearly review record, management review minutes, training records |
A planning guide based on the areas above. Your certifier’s checklist for the current version is what the auditor will use.
Coles Ethical Sourcing: what Own Brand suppliers need
This runs separately from your food safety audit, with its own deadlines. Miss one of the four steps below and your status can drop from Approved to Conditionally Approved or Not Approved.
Join a platform
Hold current Sedex or Fair Farms membership, linked so Coles can see it.
Risk assessment
Complete the risk assessment questionnaire, and keep it within 12 months old.
Social audit
SMETA 4-Pillar or Fair Farms, by an APSCA-qualified firm, every 12 to 36 months depending on risk.
Close findings
Non-conformances closed by the auditor’s date, and no later than 120 days after the audit.
Keep wage records, working-hour logs and a list of subcontractors and labour hire providers ready, because Coles can ask to review them. Source: Coles Ethical Sourcing Program Requirements (version dated June 2022) and Supplier Requirements.
Your 12-week run-up to a Coles audit
A planning guide for an existing GFSI site adding Coles. Allow longer for a first certification.
Get the right document
Ask your Coles contact which standard and version applies, and which certification bodies are approved. Check your scheme edition too: SQF Edition 10 audits are expected from 1 January 2027.
Gap-check the Coles layer
Walk the Coles requirements against your GFSI system. Food defence, supplier certification and internal auditor training are common gaps.
Fix the records
Chase expired supplier certificates, close open corrective actions, and run a timed trace test on a product you’ll supply to Coles.
Check your ethical status
Confirm your Sedex or Fair Farms link, risk assessment date and social audit date. Book the audit now if it’s due.
Mock audit
Have your internal auditor run the Coles checklist. Time how long each record takes to produce.
Organise by requirement
Group evidence by clause. Brief the people who will answer questions on the floor.
Close out on time
Respond to each finding with root cause, action and evidence by the date your certifier sets.
Every Coles record, findable in under a minute
The hard part of a Coles audit isn’t filling in records. It’s producing the right one when the auditor asks.
Coles requirements tracked alongside your scheme
EthicalHub tracks retailer audit programs, including Coles, next to SQF, BRCGS or FSSC 22000 clauses. You see which requirement each record supports.
Supplier certificates that don’t lapse
A certificate vault with expiry alerts and approved supplier records. You chase renewals before the auditor finds the gap.
CCPs, PRPs and corrective actions in one place
HACCP and CCP monitoring with deviation alerts, all 18 PRPs as templates, and CAPA with root cause, owner, due date and evidence.
Audit pack in about a minute
One click exports your evidence, organised by requirement. Batch and lot records are there for the trace test.
Consultant preparing several sites for Coles? The consultant dashboard shows every client in one view. See how the audit pack works.
Free: 59-point Retailer Audit Readiness Checklist (PDF + Excel)
Work through it before your Coles gap-check. It shows which records an auditor would question today.
Related guides
Coles supplier audits: common questions
What are the Coles supplier audit requirements?
Is CFMSR the same as the Coles Supplier Requirements?
Do I need SQF or BRCGS to supply Coles?
Does Coles require an ethical sourcing audit?
I supply fresh produce to Coles. What audit do I need?
Walk into your Coles audit ready.
Keep every record Coles asks for in one place, and export your audit pack in a click.