Why supplier approval matters
Many food safety problems start with a raw material. That is why GFSI-recognized schemes such as FSSC 22000, IFS Food and BRCGS Food Safety ask you to approve suppliers before you buy from them, and to keep monitoring them afterwards.
The schemes do not prescribe in detail how you do that, but they do require that your approach is based on risk, documented and followed. In practice it comes down to four steps: assessing the risk, collecting information, approving and monitoring.
Assess the risk per raw material
Start with what you buy, not with who supplies it. For every raw material, look at the hazards: microbiological, chemical, physical and allergens, and at the likelihood of fraud or adulteration. Take into account where the raw material comes from, how it is processed further and what you know from earlier incidents and RASFF notifications.
The higher the risk, the more you ask of a supplier: a valid certificate, additional analyses, a questionnaire or an audit at the supplier itself.
What to ask a supplier for
Which documents you ask for depends on the risk. These are the most common ones.
- Certificate
- A valid certificate under a GFSI-recognized scheme, such as FSSC 22000, IFS or BRCGS, with a scope that covers the products supplied.
- Specification
- What the product is exactly: composition, origin, microbiological and chemical requirements, shelf life and packaging.
- Allergen information
- Which allergens the product contains and which cross-contamination is possible.
- Analyses
- Certificates of analysis or test results for the hazards that go with the raw material, such as mycotoxins or pesticide residues.
- Declarations
- For example about GMOs, or a declaration of compliance for packaging that comes into contact with food.
- Questionnaire
- A questionnaire about the supplier’s food safety system, especially when it has no certificate.
Approve and record
Assess the information against your requirements and record the decision: approved, approved under conditions or rejected, with the reason. Keep an up-to-date list of approved suppliers and the products they are approved for.
Agree when you reassess a supplier, for example every year, and sooner after an incident or a changed product.
Keep monitoring suppliers
Approval is not the end. Keep track of whether certificates stay valid, because a certificate can expire or be withdrawn. Follow RASFF notifications about the products and countries of your suppliers, and keep track of complaints, deviations at receipt and the results of your own analyses.
Use that information when you reassess: a supplier with repeated deviations calls for more checks, a supplier without problems perhaps for fewer.
The evidence for the audit
An auditor wants to be able to verify that your approach works. Show the risk assessment per raw material, the list of approved suppliers, current certificates and specifications, the follow-up of incidents and notifications, and who took which decision when.
The faster you have that together, the calmer the audit. Evidence spread across mailboxes and folders is the hardest to show.
How Traecy helps with supplier approval
In Traecy all your suppliers are listed with their contacts, category and the status of their FSSC 22000 certificate, which is checked every morning. You request documents with requests that are sent and followed up by themselves, review them per document and see which suppliers a RASFF notification concerns. Every decision is recorded for the audit.