Supplier Approval Risk Signs

Supplier approval rarely fails because a team has no process. It fails because the process is treated as paperwork rather than a risk decision. Common causes include:

• Approval by questionnaire alone. A self-assessment tells you what a supplier says about itself. On its own it is not evidence.
• Checking that a certificate exists, not what it covers. A valid certificate for the wrong site, product category or process gives no assurance for the material you buy.
• No link to the hazard analysis. The level of checking should follow the hazard the material brings. A sugar supplier and a ready-to-eat protein supplier should not be approved in the same way.
• Commercial pressure. A new supplier is often needed quickly, so technical approval is asked to catch up after the first delivery.
• Approval that never moves. A supplier approved three years ago may have changed site, ownership, process or sub-suppliers since.

The law in this area is explicit. For example, under the US Foreign Supplier Verification Programs rule (21 CFR Part 1 Subpart L), an importer must approve foreign suppliers on the basis of a documented evaluation that considers the hazard analysis, the supplier's procedures, its regulatory compliance and its food safety history, including audit results, test results and how quickly it corrects problems. Even if FSVP does not apply to you, it is a useful model of what a defensible approval looks like.

Documents are your first line of evidence. Read them as an auditor would, not as a filing clerk.

Expired Certificates

• The certificate expiry date has passed, or will pass before the next review.
• The certificate has been suspended or withdrawn. Check the scheme owner's public directory where one exists, not just the PDF you were sent. Public directories include the BRCGS Directory, the FSSC 22000 Public Register and the SQF Certified Site Directory. The IFS Database needs a login, so for IFS certificates ask the supplier or its certification body to confirm status.
• The supplier sends a certificate but cannot send the matching audit report.
• Dates, grades or site details on the certificate do not match the audit report.

Scope Gaps

• The certificate covers a different site from the one that makes your product. Multi-site groups sometimes share one certificate that does not cover every site.
• The product category or process on the certificate does not include what you are buying, for example a certificate covering ambient packing when you are buying a cooked chilled product.
• Key activities are outsourced, such as storage, a processing step or packing, and are not covered by the certificate or by a separate approval.
• The supplier is an agent or broker, not the manufacturer, and cannot tell you where the material is made.

Missing Specifications

• No signed, version-controlled specification for the material.
• The specification has no microbiological, chemical or physical limits, or limits that do not match your own hazard analysis.
• Allergen information is missing, vague (such as "may contain traces") or does not cover cross contact on the supplier's site.
• Country of origin, shelf life, storage conditions or packaging details are blank.
• The specification is older than the last change to the product or process.

Other Document Warning Signs

• Certificates of analysis that look identical from batch to batch, or that show results without a method or laboratory.
• No traceability information, or a supplier who cannot show a recent traceability test.
• No recall, withdrawal or incident contact.
• Documents that are copied from another supplier or carry another company's name.

A certificate to a scheme recognized by the Global Food Safety Initiative (GFSI) is strong evidence, but it is not the end of the check. GFSI recognizes certification programs that meet its Benchmarking Requirements, and it does not provide food safety certification itself (GFSI, Certification). It does not audit or approve individual suppliers for you. When you rely on a certificate, check:

1. The certificate is genuine and current. Confirm it in the scheme owner's or certification body's directory where one is available.
2. The scope matches your purchase. Site, products, processes and any exclusions.
3. The audit report supports the result. Read the non-conformities, not just the grade. Repeated non-conformities in the same area are a pattern worth asking about.
4. Corrective actions were closed. Ask for evidence, not a statement.
5. The certification body is accredited for that scheme and scope.
6. Announced or unannounced. Note which audit type was used. Schemes differ: for example, BRCGS Food Safety Issue 9 has announced, blended announced and unannounced audit programs (GFSI, recognized CPOs), and IFS Food requires at least one in every three audits to be unannounced (IFS Food).

Where a supplier has no recognized certificate, you will need other evidence. FSVP lists the kinds of verification activity that can give assurance: onsite audits, sampling and testing, and review of the supplier's food safety records. For a hazard where exposure could cause serious adverse health consequences or death, FSVP expects an onsite audit before first import and at least annually, unless the importer makes an adequate written case that other activities, or less frequent audits, are appropriate. That is a sound benchmark for high risk materials anywhere.

The BRCGS Global Standard for Food Safety also expects sites to manage supplier approval and monitoring based on risk. Check the current issue of the Standard for its exact clauses and requirements.

Some of the most useful signs do not appear on any document. They show up in how a supplier deals with you.

• Slow or partial answers. Documents arrive in pieces, or only after several reminders.
• Evasive answers on sites and sub-suppliers. The supplier will not name the manufacturing site or its own raw material sources.
• Resistance to audits or visits. Reasonable notice is refused, or the visit is limited to the office.
• Inconsistent information. The specification, certificate and sales sheet describe the product differently.
• Unexplained changes. A new site, pack format or origin appears on a delivery without notice.
• Prices out of line with the market. UK government guidance on avoiding food crime advises checking whether a price is in line with the current market, and being wary of products offered below the usual price (GOV.UK, starting a food business).
• Poor complaint handling. Complaints are disputed rather than investigated, or root causes are never shared.

None of these proves a problem on its own. Together, they tell you where to look harder. They are also relevant to your vulnerability assessment for food fraud and to your Food Defense planning.

A risk rating turns your evidence into a consistent decision. Keep it simple enough that two people on your team would score the same supplier the same way.

A practical approach uses two dimensions:

Combine the two to set the level of control:

This matrix is illustrative. Your own hazard analysis and HACCP team should set the scoring rules, and the rationale should be written down. FSVP, for example, requires the supplier evaluation and the approval decision to be documented, and the same discipline helps in any third party audit.

Approve

Approve when the material risk is understood, the supplier's evidence covers the material you buy, and nothing in its documents or behavior contradicts that evidence. Record who approved it, when, and on what evidence.

Conditionally Approve

Conditional approval is useful when a supplier is broadly sound but something is missing or new. Make the conditions specific and time limited, for example:

• Positive release of each delivery against a certificate of analysis and your own test
• A site audit within a set number of weeks
• A signed specification by a set date
• Restricted use, such as only in products with a later control step

If conditions are not met by the deadline, the approval should lapse rather than roll on quietly. FSVP allows temporary use of unapproved foreign suppliers only when the food is subject to adequate verification activities before import, which is a useful principle to follow.

Reject

Reject when the material risk is high and the supplier cannot show adequate evidence, when key documents are false or contradictory, or when the supplier refuses reasonable verification. Record the reason, so a later request to use the same supplier starts from the facts.

Approval is a status that needs maintaining. Build reviews around events as well as dates:

• Certificate expiry and audit dates. Track them so nothing lapses unnoticed.
• Changes at the supplier. New site, ownership, process, origin or sub-supplier.
• Your own data. Goods-in rejections, test results, complaints and non-conformances.
• External information. Recalls, regulatory action and industry alerts.
• A fixed backstop. FSVP, for example, requires the importer to reevaluate promptly when it becomes aware of new information, and at least every three years if no reevaluation has happened in that time.

UK guidance from the Food Standards Agency is that ingredients and supplies should, wherever possible, be bought to specification from reputable suppliers. Traceability records of your suppliers are a legal requirement for UK food businesses (GOV.UK, managing food safety), so your approval file and your traceability records should agree.

Primority's Supplier Quality Management module helps teams keep supplier documents, specifications and approval status in one place, and customers can invite their suppliers from day one. See our SQM page for more.