Beyond the Survey: What Supplier Compliance Behavior Reveals About Food Safety Culture — Before It Becomes a Recall

Most food safety culture assessments still lean on annual surveys and self-reported audit responses — snapshots of what people say, taken once or twice a year. Supplier compliance behavior tells a more current story: how fast a vendor answers a document request, how often the same corrective action keeps coming back, and how long a supplier sits in an at-risk tier before anything changes. This article lays out a practical way to read that behavior as a culture signal, based on firsthand work redesigning a risk-tiered supplier verification system across a network of more than 1,000 suppliers.

The Blind Spot in How We Measure Culture

Food safety culture finally has a seat at the leadership table. GFSI’s latest position paper defines culture as the shared values, behaviors, awareness of risks and organizational learning that should be measurable and continuously improved, not just part of crisis communication¹. That’s progress. The problem? The tools most organizations use to measure food safety culture haven’t kept up with the definition.

Ask any quality team how they’re measuring culture, and you’ll get some variation on a survey: a yearly questionnaire, a maturity scale, an audit-tied score, a self-assessment. These tools are valuable in many ways, but they all suffer from the same structural limitation. They offer a snapshot of the present, and a representation of what someone has been encouraged to claim, not a reliable indicator of their past and future behavior.

One recent systematic review of food safety culture questionnaires found that respondents can suffer from lack of time or clarity to provide valid responses, and that survey questionnaires capture biased accounts rather than the actual behaviors they purport to represent². Other industry experts and researchers have voiced the exact same concern about survey results, pointing out that they represent recency bias and can create an impression of a food safety culture that differs from a company’s long-term, lived reality³.

This isn’t to say these instruments are useless. It simply means they answer a more specific, and often more limited, question than they are often perceived to answer. They provide insights into a food safety organization’s intentions or public image. They do not accurately or reliably assess what happens in a food supply chain when no one is there to fill out a form.

Behavior Is Harder to Fake Than a Survey Answer

This is where it all goes off the rails: Many existing compliance platforms are already leveraging a treasured trove of behavioral data on an ongoing basis, and it has zero to do with a survey. Supplier verification programs generate tons of it, as a matter of course.

Under the FSMA Foreign Supplier Verification Programs rule, for example, importers are expected to assess risk and performance on a continued basis and to maintain verification records,⁴ but regardless of whether the rule applies to a particular supplier, there is an underlying obligation that drives exactly the kind of evidence a culture survey never can: a history-complete with timestamps-of how a supplier acts when it is called to task in compliance.

That history might include things such as: How long it takes for a supplier to respond to an information request (e.g. Requesting an updated COA, corrective action response, and updated specification). Whether it appears to take two rounds of corrective action on a single nonconformance issue. How long does a supplier remain in at-risk status before its rating changes. Whether a serious incident is resolved before it becomes a near-miss or an open hold.

These aren’t opinions; they are objective records that the supplier produces because it had to, not because anyone asked a question that someone felt obliged to answer honestly.

Table 1 below shows how to interpret those kinds of signals and what happens typically when you don’t.

What This Looked Like in Practice

One of the most useful first observations we had during the process of redesigning an automated, risk-tiered system for verification of a supplier network of over 1,000 suppliers was entirely unrelated to tiering logic itself. This was an observation related to the movement (or lack thereof) of suppliers through the system over time.

A few of our suppliers seemed to continually generate the exact same corrective action, closed and reopened using slightly different phrasing. In terms of system reporting, each of these corrective actions were closed. The underlying problem is that it is simple as an allergen changeover step or a labeling control never actually gets fixed. It wasn’t reflected by tier status because our current tiering is dependent on the open/closed status of the corrective action, not the recurrence of the same underlying cause.

Once we began to also track the recurrences – a single nonconformance code against a single supplier within a specified period of time – we observed a pattern, not necessarily derivable from a survey: there was a select group of suppliers with a disproportionate number of recurrences, and a select group of suppliers which seemed to be consistently slower at responding to basic document requests than the remainder of the network. These two are not two different issues; they’re just two perspectives of the same underlying behavior.

This reframe altered the escalation process significantly; instead of escalating a supplier after a single audit or missed document request deadline, they now escalate automatically, prior to the hold, because they have two correlated issues.

From Lagging to Leading: Making the Shift

This difference matters because most food safety teams’ already existing metrics are backward-looking, they measure what’s already happened. Complaint totals and audit scores don’t predict whether we failed. Data from audits, complaints, and recalls tell us about the past, not what’s next⁵. They don’t give warnings about repeated mistakes.

Conversely, leading indicators were designed to signal what’s about to happen⁶. And supplier behavior is among the most readily available, and currently ignored, sources of leading intelligence organizations possess without purchase.

This shift in practice is achievable without new software. It just requires a new attitude toward the information organizations already possess:

Instead of, “Has the corrective action been closed?” the questions becomes, “Have these specific nonconformances ever come up for this supplier before-and if so, how often?”

Instead of, “What’s the supplier’s current tier?” the question is, “How long has the supplier been in this tier-is this time frame unusual?”

Instead of, “Was the audit finding addressed?” the question is, “How long has the closure of these findings taken relative to what other suppliers take on these same issues?”

Instead of, “Was the escalation resolved?” the question is, “What did it take for resolution to happen-and did that resolution occur before or after the occurrence of a near-miss?

These aren’t complex questions. Many compliance systems have this information at their disposal; it just is not being pulled to highlight trends because the reporting mechanisms were created to track status, not behavior.

Culture Shows Up in the Data You Already Have

Your survey is how you learn what your organization and its suppliers think about food safety, one to two times a year. Your supplier’s compliance behavior is what they do, day in and day out, because of the verification activity that is mandated by everyone anyway. It does not replace a culture survey, root cause analysis or a GFSI-based framework – it gives them an earlier, less easily “gamed” input signal.

The suppliers who get ahead of food recalls related to suppliers, usually aren’t those who had the most eloquently written survey.

They usually are the organizations who recognized a trend in response times, frequency and tier status, many months before a lab or customer alert became the warning. They aren’t just sitting there in some database; someone simply failed to connect the dots as culture, not forms.

References

1. Global Food Safety Initiative. “A Culture of Food Safety,” Position Paper, Version 2.0. GFSI, March 26, 2026.
2. Wang, Y., et al. “Measuring Food Safety Culture: A Systematic Review of Questionnaire Dimensions and Validation Practices.” Comprehensive Reviews in Food Science and Food Safety, 2026.
3. Alliance to Stop Foodborne Illness. “Assessing Food Safety Culture: What Works Best?” stopfoodborneillness.org, March 2026.
4. U.S. Food and Drug Administration. “FSMA Final Rule on Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals.” FDA.gov.
5. LRQA. “Food Safety Performance Indicators.” LRQA.com, March 23, 2022.
6. SafetyChain. “Food Safety KPIs: The Six Leading Indicators.” SafetyChain.com, June 4, 2026.
7. FoodSafetyTech. “Effective Root Cause Analysis for CAPA Management.” FoodSafetyTech.com, Dec. 5, 2023.