Supply-Chain Due Diligence for a Food Acquisition: The Procurement Red Flags

Most commercial due diligence on a food asset stops at the P&L: revenue quality, margin trend, customer concentration, working capital. That work is necessary, but it almost always misses the COGS time bomb sitting one layer below the financials — supplier concentration, un-hedged input exposure, and a co-manufacturer dependency with a short exit clause. These risks don't appear in the data room because they aren't accounting line items; they're commercial relationships and contract terms you have to go find. This is a procurement due diligence checklist for screening a food or ingredient target before LOI, built from how a senior buyer actually stress-tests a cost structure.

Quick answer: the procurement red flags that move valuation (TL;DR)

A supply-side read on a food company comes down to five questions the seller's deck won't answer:

1. Concentration — How few suppliers, and how few origins, does the top quartile of spend depend on?
2. Input exposure — How much of COGS is exposed to volatile commodities, and does the company actually pass those moves through to customers?
3. Co-man dependency — If the asset doesn't own its plants, how long is the exit clause and how qualified are the alternatives?
4. Compliance — Is the sourcing base ready for EUDR, RSPO and similar regimes, or is there a re-qualification cost no one has priced?
5. Spec fragility — How many SKUs ride on a single approved supplier or a single-source spec that can't flex?

Each of these can swing achievable EBITDA by enough to matter at a typical mid-market multiple. None of them is hard to assess pre-LOI if you know what to ask for.

Key takeaways – Commercial DD that stops at margin trend systematically under-prices supply-side risk in food assets. – The five red flags — supplier/origin concentration, un-hedged input exposure, co-man dependency, sourcing-compliance gaps, and single-spec fragility — all live below the P&L. – You can run a decision-grade supply-side screen on public and lightly-requested data before LOI; you don't need the full data room. – The valuation impact isn't the headline number — it's the volatility and the cost-to-fix, both of which belong in the model and the SPA. – The cheapest insurance is asking for the supplier-by-spend table and the co-man contract term sheet early, while you still have leverage to re-price.

Why the financials hide the supply-side risk

Audited financials are a backward-looking, smoothed view of cost. A target that locked in good annual contracts last year, or that happened to buy through a benign stretch of the commodity cycle, will show a clean, stable gross margin — and that stability reads as quality. It often isn't. It's a snapshot of a cost position that may have already turned, or that depends on a single relationship the seller has every incentive not to flag.

Three structural reasons the P&L hides this:

• COGS is reported as a number, not a structure. "Cost of goods sold: stable at X% of revenue" tells you nothing about whether that X rests on one supplier, one origin, one un-hedged commodity, or one co-man contract. The risk is in the composition, and composition isn't in the income statement.
• Contracts expire after the diligence window. The margin you're underwriting may be protected by a supply agreement or a customer pass-through clause that lapses shortly after close. The historicals look great right up until renewal.
• The seller curates the data room. They'll populate it with what flatters the asset. A short co-man exit clause or a sole-source ingredient is not something a seller volunteers — you have to request it specifically and read the actual contract, not the summary.

The job of supply-side DD is to convert that smoothed COGS line back into its underlying structure, then ask what happens to each component under stress. The rest of this checklist is the five places that structure most often breaks.

Red flag 1 — Supplier and origin concentration

Start with a spend-by-supplier table and don't accept a summary. You want the top suppliers by annual spend, what they supply, and — critically — where it physically originates. Two distinct concentrations matter, and people routinely conflate them:

• Supplier concentration: how few vendors carry the top quartile of spend. A target where a handful of suppliers cover the majority of direct material has a negotiating-leverage problem and a continuity problem.
• Origin concentration: how few geographies or growing regions those suppliers themselves depend on. You can have several "different" suppliers who all source the same nut, cocoa, or oil from the same country. On a map that's diversified; on a weather event or an export ban, it's a single point of failure.

What most people miss: a vendor count looks healthy while the origin map is dangerously narrow. I've seen sourcing bases with a dozen approved suppliers that all funneled back to one or two producing regions. The fix — qualifying a second origin — is real money and real time, and if it isn't already underway, it's a post-close cost the model should carry. For the mechanics of building that resilience deliberately, see when to dual-source and the worked cocoa multi-sourcing and EUDR case.

Red flag 2 — Un-hedged input-cost exposure and pass-through gaps

Two questions, in order. First: what share of COGS sits in volatile, traded inputs — oils, grains, dairy, sugar, cocoa, energy, key packaging substrates? Second, and this is the one people skip: when those inputs move, does the company actually pass it through to its customers, and how fast?

The gap between input volatility and pricing power is where margin quietly dies. A business can look like it has healthy gross margin in a flat commodity year and have no contractual or commercial mechanism to defend that margin when the input spikes. Walk through it concretely:

• Hedging / forward coverage. Does the target lock forward, and how far out? A book that's well-covered today may be exposed the moment those positions roll off — inside your hold period.
• Pass-through mechanics. Are customer contracts indexed to input cost, or is pricing fixed while the inputs float? Fixed-price-out against floating-cost-in is a structural short position on the commodity, whether or not anyone calls it that.
• Lag. Even where pass-through exists, the lag between a cost increase and the price adjustment can eat a chunk of margin every cycle.

Model the COGS line under a realistic adverse move in the top two or three inputs, net of whatever hedging and pass-through genuinely exists. That stressed margin — not the trailing-twelve-months margin — is what you're buying. For how input cost actually behaves and what real hedging looks like in one category, olive oil cost drivers and hedging is a useful template.

Red flag 3 — Co-manufacturer dependency and exit terms

If the target is asset-light and runs production through one or more co-manufacturers, the co-man contract is one of the most valuation-relevant documents in the deal — and it's frequently buried or summarized. Read the actual agreement and look for:

• Exit and termination terms. How short is the notice the co-man can give you? A short termination clause on a sole-source co-man is a gun pointed at the asset. If they can walk on short notice and there's no qualified alternative, the business has a continuity exposure that should be priced and papered into the SPA.
• Pricing and escalators. How is the conversion fee set, and what can the co-man pass through? Open-ended escalators on a sole-source relationship are a slow margin leak.
• Capacity and priority. Is your tolling volume contractually prioritized, or can the co-man bump it for a bigger customer in a tight season?
• IP and spec ownership. Who owns the formulation and the process know-how — the target, or the co-man? If it's the co-man, switching costs are far higher than they look.

The diligence question behind all of these: how long, and how expensive, is it to qualify an alternative co-man? If qualifying a replacement is a multi-quarter project with a meaningful spend, then a short exit clause isn't a contract detail — it's a discount. Frameworks for assessing co-man quality and the build-vs-outsource trade are in how to choose a co-manufacturer and the should-cost model for make-vs-buy.

Red flag 4 — Sourcing-compliance exposure (EUDR, RSPO)

Regulatory and scheme-based sourcing requirements have moved from "nice to have" to "you can't sell into this market without it," and they land directly on the cost base. The EU Deforestation Regulation, RSPO for palm, and the broader traceability push all share one feature: compliance often requires re-qualifying or geo-tracing a sourcing base that was built before anyone asked. That re-qualification has a cost and a timeline, and a seller is unlikely to have it sitting in the data room as a liability.

What to check pre-LOI:

• Exposure mapping. Which of the target's key inputs touch a regulated commodity — cocoa, coffee, palm, soy, rubber, wood-fiber packaging — and into which markets does it sell?
• Traceability readiness. Can the company already trace those inputs to the required level (origin, plot, certification)? If not, that's a project, not a checkbox.
• Certification gaps. For scheme-based requirements like RSPO, is the supply base certified at the level the customer demands, or is there mass-balance-versus-segregated ambiguity that a major buyer could reject?

The valuation point: a non-compliant sourcing base in a regulated category is either a re-qualification cost or a revenue-at-risk, sometimes both. Price it as one. The cocoa multi-sourcing and EUDR guide walks through what readiness actually requires in a high-exposure category.

Red flag 5 — Single-spec yield and qualification fragility

The most granular red flag, and the one generalist DD never reaches. For each material SKU, ask: how many approved suppliers exist for the critical inputs, and how tight is the spec? A business can carry plenty of suppliers in aggregate while its highest-margin or highest-volume products each ride on a single approved source with a spec so narrow nothing else qualifies without a customer-side re-approval.

This is fragility, not just concentration:

• Single approved spec. If only one supplier's material passes the spec, a quality event, a price hike, or a discontinuation at that one vendor hits the P&L immediately, with no fast substitute.
• Qualification lock-in. In regulated or branded food, switching an ingredient can trigger customer re-qualification, shelf-life re-testing, or label changes. The technical cost of change is far higher than the price delta suggests.
• Yield sensitivity. A spec change to a cheaper input can move process yield. A target running an unusually tight, single-source spec may be doing so because nothing else hits the yield — which means the "obvious" sourcing saving in your value-creation plan doesn't exist.

The take-away for the deal model: a business whose margin depends on single-source, single-spec inputs has less procurement optionality than its supplier count implies — which means fewer post-close levers than the value-creation thesis assumes. See supplier qualification in food ingredients for how qualification cost and time actually accrue.

How to run this fast, pre-LOI

You don't need the full data room or a six-figure engagement to get a decision-grade read. The minimum request list:

1. Spend by supplier (top suppliers, with material and origin).
2. COGS bridge by major input category, with hedging/forward coverage and contract tenor.
3. Customer pricing terms — fixed vs. indexed, and the pass-through lag.
4. Co-man contracts — the actual agreements, focused on exit, pricing, capacity, IP.
5. Compliance status for any regulated commodity exposure.

With those five inputs you can build a stressed COGS view and a concentration map in days, not weeks. If the seller won't release supplier-level data pre-LOI, that refusal is itself a signal — and you triangulate with category benchmarks and origin maps from market intelligence. How procurement-intelligence options compare lays out when external intel substitutes for data-room access and when it doesn't.

What each red flag does to the cost curve

The point of the screen isn't a yes/no on the asset — it's to put a number, and a volatility band, on COGS. Each red flag maps to a specific distortion in the cost curve you'd otherwise underwrite:

• Concentration → leverage loss and continuity risk. Widens the downside tail; rarely shows in the mean.
• Un-hedged input + pass-through gap → margin volatility. Turns a "stable" gross margin into a swing factor across the hold.
• Co-man dependency → a structural cost floor you don't control, plus a discontinuity risk if the exit clause is short.
• Compliance gap → a one-time re-qualification cost and/or revenue-at-risk.
• Single-spec fragility → fewer cost-out levers than the value-creation plan assumes.

The honest output is a base, downside, and "what-it-costs-to-fix" view of COGS, with the trailing margin treated as the optimistic case — not the expected one.

CTA: Get a decision-grade supply-side read before LOI. A Custom Deep Dive (from $1,490) maps supplier and origin concentration, stresses your COGS line against real input volatility, and pressure-tests co-man dependency and compliance exposure — the structure underneath the P&L that the data room won't hand you. Request one and walk into the negotiation knowing what you're actually buying.

Common mistakes in supply-side DD

• Counting suppliers instead of origins. A healthy vendor count over a narrow origin base is the classic false positive. Map where it grows, not just who invoices.
• Trusting the trailing margin as the forward margin. A clean historical gross margin in a benign commodity year is the optimistic case, not the expected one. Stress it.
• Reading the co-man summary, not the contract. Exit terms, escalators, and IP ownership live in the agreement, never in the deck summary. Get the document.
• Treating compliance as a checkbox. EUDR/RSPO readiness is a project with a cost and a timeline, not a yes/no field. Price the gap.
• Assuming sourcing savings the spec won't allow. Single-source, single-spec inputs often can't be switched without customer re-qualification or a yield hit. Verify the lever exists before you put it in the model.
• Doing it post-LOI. Once you're exclusive, you've spent your leverage. The whole value of this screen is that it runs before you commit a price.

FAQ

What is supply chain due diligence for a food company? It's the part of commercial diligence that examines the cost structure beneath the P&L — supplier and origin concentration, input-cost exposure and hedging, co-manufacturer dependency, sourcing-compliance readiness, and spec fragility. The goal is to convert a smoothed COGS line into its underlying structure and stress-test each component before you commit to a price.

How is procurement due diligence different from standard commercial DD? Standard commercial DD focuses on revenue quality, margin trend, and customer concentration — things visible in the financials. Procurement due diligence targets the supply-side risks that don't appear as accounting line items: contract terms, supplier relationships, and origin maps. The two are complementary; the procurement layer is the one most often skipped.

Can you assess raw-material cost risk before LOI without the full data room? Yes. A spend-by-supplier table, a COGS bridge by input category with hedging detail, customer pricing terms, the co-man contracts, and a compliance status read are enough to build a stressed COGS view and a concentration map. Where the seller withholds supplier-level data, category benchmarks and origin intelligence fill the gap.

Which procurement red flag most often moves valuation? It depends on the asset, but the co-manufacturer dependency with a short exit clause and the un-hedged input exposed by a fixed-price customer book are the two that most frequently turn a "stable" margin into a priced risk. Both are invisible in the trailing financials and both belong in the SPA, not just the model.

Does sourcing compliance like EUDR really affect the purchase price? When a target sells a regulated commodity into a market that requires traceability or certification, a non-ready supply base is either a re-qualification cost or revenue-at-risk. That's a quantifiable adjustment to the deal, not a soft factor — and sellers rarely surface it on their own.

Written by Amin Dabbech, founder of ProCure Navigators. 18 years in procurement across General Mills and IMERYS, specializing in food ingredients and packaging — multi-sourcing, supplier qualification, and cost-savings initiatives. Connect on LinkedIn.