RISK ASSESSMENT · SUPPLIER APPROVAL

Supplier Approval Risk Assessment: Deciding Who You Buy From on Evidence Instead of History

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 15 min read

Clause 3.5.1 of BRCGS Global Standard Food Safety Issue 9, management of suppliers of raw materials and packaging, is one of the twelve fundamental requirements, so a major against its statement of intent costs certification and a further full audit. Approval rests on a documented risk assessment covering the supplier, the material and its use in your product. The Supplier and Purchased Material Approval Risk Assessment Template (RA11) is R690.

Why supplier approval is a fundamental requirement and what that means for your audit

BRCGS Global Standard Food Safety Issue 9, published 1 August 2022, carries twelve fundamental requirements: 1.1, 2, 3.4, 3.5.1, 3.7, 3.9, 4.3, 4.11, 5.3, 6.1, 6.2 and 7.1. Clause 3.5.1, management of suppliers of raw materials and packaging, is on that list. A major non-conformity against its statement of intent is a fail, and it is closed by a further full audit rather than by submitting evidence within the usual window. The audit on the day either ends there or carries on as a non-certification gap audit, whichever the auditor, the certification body and site management agree.

That status changes how the clause should be treated internally. Most clauses in the Standard are things you fix. A fundamental is a thing you hold. When BRCGS marks a requirement as fundamental it is saying that a site which cannot demonstrate this has not demonstrated food safety at all, because everything downstream depends on it. Your HACCP study assumes the hazards you listed for each raw material are the hazards it actually carries. That assumption is only as good as your supplier and material approval.

The wider clause 3.5 covers supplier and raw material approval more broadly, and 3.5.1 sits inside it as the supplier management requirement. I am naming only these two clause numbers deliberately. Sites regularly quote sub clause numbers to me that do not exist in Issue 9, usually copied from an older issue or from a consultant’s summary, and an auditor notices when your procedure references a clause the Standard does not have.

The same requirement exists under every other scheme in different words. BRCGS Global Standard Packaging Materials Issue 7, published 28 October 2024 and audited from 28 April 2025, carries nine fundamental requirements, and supplier and raw material control sits in Section 3 of that Standard, so read the clause number off your own copy. FSSC 22000 Version 7, published in May 2026, builds on ISO 22000:2018 plus a sector prerequisite programme standard from the ISO 22002 series, and supplier control sits in the prerequisite layer. If you are choosing between schemes, our BRCGS, FSSC 22000 and IFS decision framework sets out the differences, and the BRCGS Issue 9 implementation guide covers the full system this clause sits in.

There is a legal layer underneath the certification layer, and it does not go away when your certificate does. Section 61 of the Consumer Protection Act 68 of 2008, liability for damage caused by goods, imposes liability on producers, importers, distributors and retailers for harm caused by unsafe goods, product failure, defects or hazards, or by inadequate instructions or warnings, and it does so irrespective of negligence. Section 55 gives the consumer a right to safe, good quality goods. If a contaminated ingredient reaches a consumer, the fact that your supplier caused it does not remove you from that chain. What you can produce is the evidence of the care you took when you chose them.

What the risk assessment has to cover: the supplier, the material and the use

Clause 3.5.1 of BRCGS Issue 9 names suppliers of raw materials and packaging, so a register that scores only the supplier cannot explain its own tiers, because the material and its use are where the tiers came from. Three things carry risk and all three must be scored: the organisation you buy from, the material itself, and what that material does inside your product. The same maize meal is a different risk before a kill step than in a ready to eat snack.

Sites collapse these three into one score because it makes the spreadsheet shorter. The result is a register where a low risk supplier of a high risk material scores as medium, and nobody can explain afterwards what the medium was made of. Score the three separately, then combine them with a stated rule, and write the rule into the procedure so a second person reaches the same answer.

The use dimension is the one most often missing, and it is the one that gives an auditor confidence that you understand your own process. Ask three questions of every material. Does a validated kill step follow its addition. Is it added late, after the last control point. Does the finished product carry a claim, such as gluten free or a specific origin, that depends entirely on this material being what the supplier says it is. A yes to the second or third question raises the tier regardless of how good the supplier looks.

Allergen status belongs in the material score, and it belongs there as a specific declaration rather than a blanket precaution. Regulation 44 of R146 of 2010 already assumes you hold a Supplier Ingredient Information File, because that file is the source of the uncommon allergen disclosure you owe a consumer, an inspector or the Department on request. The Allergen Management Risk Assessment Template (RA17) at R690 scores cross contact routes in the same register format, and our allergen labelling guide works through the declaration mechanics that follow from it.

How to risk rank raw materials

Clause 3.5 of BRCGS Issue 9 covers raw material approval, so rank every purchased material, packaging and processing aids included, on the hazards it can introduce and on what your process does about them afterwards. Score microbiological, chemical, physical and allergen hazards, then add authenticity, because an easily adulterated material carries a hazard the specification will not catch. The output is a tier per material.

Start from a complete list. Sites that have been trading for a decade almost never have one, because materials get added by purchasing without passing through technical. Pull the list from the enterprise resource planning system rather than from the QA folder, then reconcile the two. In my experience the gap is between ten and thirty per cent of line items, and the ones missing from the QA folder are usually the low value items nobody thought mattered: release agents, filtration media, gases, inks, adhesives, cleaning chemicals used on product contact surfaces.

Two of those rows deserve a note. Regulatory status matters more than sites expect. The NRCS administers compulsory specifications covering canned fish, canned marine molluscs and canned crustaceans under VC 8014, canned meat products under VC 8019, processed meat products under VC 9100, frozen fish and frozen marine molluscs under VC 8017, and smoked snoek under VC 8021. If you buy any of those as an input, the compliance status of your supplier is not a nice to have. Port Health inspects imported foodstuffs at points of entry and can detain a consignment, which is a supply risk as well as a safety one, and our guide to importing food into South Africa covers what that process asks for.

Authenticity is the second. Adulteration is an economically motivated act, so it does not follow the hazard logic your HACCP study uses. It follows price, opportunity and the length of the chain. Score it in the material ranking, then take the high scorers into a proper vulnerability assessment. The Food Fraud Vulnerability (VACCP) Risk Assessment Template (RA18) at R690 is the register that does that work, and it cross references the supplier register rather than duplicating it.

How to risk rank suppliers

Score the supplier on what they can control and on what you can see. The RA11 register at R690 uses six factors, and they carry most of the decision: certification status and scope, whether they manufacture or trade, their performance history with you, their transparency when asked hard questions, the length of the chain behind them, and their exposure to change such as new ownership or a new sub supplier.

Performance history is the factor sites weight too heavily and transparency the one they weight too lightly. A supplier who has delivered for eleven years without an incident has a good record, and a record is a description of the past. What tells you about the future is how they answer when you ask an uncomfortable question. Ask for the last audit report rather than the certificate. Ask which allergens are handled on the line that makes your material. Ask who their supplier is for the critical input. A supplier who answers those three questions in full is a different risk from one who sends a marketing pack.

• Certification status, the scheme name, the certified scope and any exclusions stated on the certificate
• Manufacturer, packer, broker, agent or trader, and if not a manufacturer, the named site behind them
• Delivery, complaint and non conformance history with your site over a defined period
• Responsiveness to technical requests, and whether specification and allergen answers are material specific
• Commitment to notify you of formulation, process, site or ownership changes before they affect delivery
• Length of the chain behind them and whether you can name the origin of the critical input
• Whether you have ever verified any of their claims independently, and what that verification showed
• Whether they are a sole source, which raises the consequence of every other factor

Sole source status is worth its own line. It does not make a supplier more likely to fail. It makes the consequence of failure much larger, because you have no alternative and production pressure will push you into the emergency purchase route described later in this article. Flag sole sourced high risk materials to your leadership team as a business risk, not only a food safety one.

A long relationship is a record of the past. Approval is a statement about the future, and it needs different evidence.

Matching approval evidence to the risk tier

BRCGS Issue 9 sets no tier names, so the point of ranking is to spend your own evidence budget where the risk is. A tier table states, in one place, what a material and supplier combination looks like at each level, what approval evidence is required before you may buy, and how often the approval is reviewed. Write it into the procedure and an auditor can follow your logic in five minutes.

The table below is the structure we use in the RA11 register. The tier names and the boundaries are a management convention, not a clause requirement, and you may set your own as long as the procedure states them and the register applies them. What matters to an auditor is that the evidence held for each supplier matches the tier the register assigned, with no unexplained exceptions.

Notice what the table does not say. It does not say that a certificate replaces a specification. A specification is the agreement about what you are buying, and without it you have no basis for rejecting a delivery, no input to your HACCP study and no defence if the material turns out to be something else. I have audited sites holding valid GFSI recognised certificates for every supplier and signed specifications for fewer than half of them. That is a system that has bought reassurance instead of control.

What a supplier certificate actually proves and what it does not

A certificate proves that a certification body audited a defined system, at a named site, against a named scheme, within a stated scope, on a stated date, and, where the scheme uses one, issued a grade or score. Not every scheme grades: BRCGS grades AA to D, SQF rates, IFS scores as a percentage, and FSSC 22000 and ISO 22000 certificates carry no grade at all. It does not prove that the material you buy falls inside that scope, that nothing was excluded, that the certificate is still valid, or that the grade was good. The scope line is where the risk sits.

Start with the vocabulary, because it is used loosely and auditors do not use it loosely. GFSI is hosted by The Consumer Goods Forum. It benchmarks schemes against its requirements. It does not certify anybody. There is no such thing as a GFSI certificate, only certification to a GFSI recognised scheme such as BRCGS, FSSC 22000, IFS or the GLOBALG.A.P. IFA GFS edition. ISO 22000 on its own is not GFSI recognised, which surprises suppliers who present an ISO 22000:2018 certificate as though it settles the question. It is still useful evidence. It is not the evidence a customer specification asking for GFSI recognition is asking for.

Then read the certificate itself, field by field. Five fields decide whether it is worth anything to you.

1. ScopeWhat product categories and processes were audited. If you buy a dried herb blend from a site whose scope reads “manufacture of canned vegetables”, the certificate does not cover your material and the auditor will see that before you do.
2. ExclusionsSchemes allow certain activities to be excluded from the audit. An exclusion is stated, and it is stated in small print. Read it and record it on your register, because an excluded activity is an unaudited activity in the site making your material.
3. Site addressThe certificate covers a site, not a company. Group certificates and multi site arrangements are common. Confirm that the address on the certificate is the address your material is actually made at, not the head office that sends the invoice.
4. Validity datesIssue date, expiry date and audit date. An expired certificate on file means your supplier is unapproved as of the expiry date, and an auditor will check the date on the certificate against the date of your last delivery.
5. Grade or resultSome schemes grade and some do not. Where a grade exists, record it. A BRCGS grade earned at an unannounced audit carries a plus suffix and is stronger evidence than the same grade from an announced audit, not weaker. Record the grade and let it move the review frequency.

One more discipline turns this from a filing exercise into a control: verify the certificate at the issuing body or the scheme directory rather than accepting a PDF by email, and diarise the expiry date. A calendar reminder set sixty days before expiry, owned by a named person, prevents the supplier finding I write most often, which is a file full of certificates that expired between audits.

Approving a broker, an agent or a trader

Clause 3.5.1 of BRCGS Issue 9 exempts nobody in the chain, so approve both parties. The broker is assessed on their own system, their traceability, their storage and transport arrangements and their contractual undertakings to you. The manufacturing site behind the broker is assessed on the same evidence you would ask of a direct supplier. A broker who will not name the manufacturing site has answered your risk assessment question already, and the answer is not a good one.

Brokers, agents, traders, importers and distributors are legitimate and often unavoidable. They hold stock, they aggregate small volumes, they carry currency and shipping risk, and for many South African manufacturers they are the only practical route to an imported ingredient. The problem is not the broker. The problem is a register line that names the broker and stops there, which leaves your traceability ending at a warehouse instead of at a factory.

Run a traceability test through the broker before you rely on the arrangement, not after. Pick a delivered batch, ask for the manufacturing batch identity, the manufacturing date and the site, and time how long it takes. A broker who takes three weeks to answer is telling you what a real recall will look like. The Traceability, Withdrawal and Recall Risk Assessment Template (RA20) at R690 scores exactly this kind of chain weakness, and the Storage, Warehousing and Transport Risk Assessment Template (RA12) at R690 covers the intermediate storage and vehicle controls a broker arrangement adds to your chain.

How to handle a supplier you cannot audit

Certification is one form of evidence, not the only form. A supplier whose only regulatory document is the Certificate of Acceptability required by regulation 3(1) of R638 of 2018 can still be approved on four things: an agreed and signed specification, a questionnaire you have verified rather than filed, a second party audit carried out by you or for you, and a testing programme sized to the hazard. What is not defensible is buying on nothing.

This matters in South Africa more than in most markets. A great deal of our supply base is small, local and uncertificated: a family spice packer, a regional dairy, a cooperative supplying fresh produce, a small print shop producing your labels. Refusing to trade with them is not a food safety strategy, it is an economic decision with development consequences, and B-BBEE procurement objectives often push in the opposite direction. The answer is to reach the same confidence through a different set of evidence, with the bar left where it is.

1. Agree a specification firstWrite it, send it, get it signed. It names the material, the parameters, the allergen status, the packaging, the labelling, the shelf life and the rejection criteria. Without it, everything that follows has nothing to be measured against.
2. Send a questionnaire and then verify itA questionnaire is a claim, not evidence, until you check something in it. Verify two or three answers independently: a Certificate of Acceptability under regulation 3(1) of R638 of 2018, a pest control contract, a water test result, a photograph of the production area.
3. Write a development plan with datesAgree what the supplier will improve and by when. This is what turns an uncomfortable approval into a defensible one, and it is what an auditor wants to see when the evidence pack is thin.

Those three steps are the part that belongs to an uncertificated supplier specifically. Around them sit two controls you would apply anyway: a testing programme sized to the hazard, with results trended against the specification rather than filed, and tighter goods receiving checks on early deliveries until the trend earns their removal.

The second party audit itself is a separate discipline, and we have already written it out in full rather than summarising it here: how to plan the visit, what to sample, how to question, and how to write a finding that survives being read back to the supplier. Work through our guide to building internal and supplier auditors who safeguard your business before you send anyone to a supplier site, and build the capability in house if you can, because an ASC consultant visiting twice a year is a different cost from your own technical officer visiting four times.

Say clearly on the register that the approval rests on second party audit plus testing rather than certification, and record why. Auditors do not object to an uncertificated supplier. They object to a register that does not admit it.

Ongoing performance monitoring and what triggers a re-assessment

Approval is a decision made once, and a BRCGS Issue 9 audit tests the evidence you hold today, not the decision you made three years ago. Track delivery performance, specification conformance, complaint and non conformance history, test results against agreed limits, and certificate status, then review the tier on a fixed cycle set by the tier itself. On top of the cycle, define event triggers that force a re-assessment before the cycle comes round.

The register should carry a small number of measures that a purchasing clerk can maintain without a technical degree. Deliveries received, deliveries rejected and why, out of specification results, complaints attributable to that material, and documentation failures such as a missing certificate of analysis. Five numbers, reviewed quarterly for the top tiers, is enough to see a trend forming. Twenty measures reviewed annually is a dashboard nobody updates.

Root cause is where supplier corrective action usually collapses. A supplier who replies “operator error, staff retrained” has not investigated anything, and accepting that reply puts the finding on your file rather than theirs. Ask for the method they used and the evidence that the cause was addressed. The training site publishes a practical guide to corrective action and root cause analysis for audit findings that is worth sending to a supplier along with the request.

Emergency purchases and the temporary approval trap

Sites buy outside the approved list under production pressure, and section 61 of the Consumer Protection Act 68 of 2008 does not pause for a Friday afternoon. That is a fact of manufacturing, and a procedure that pretends otherwise gets ignored. The fix is a written temporary approval route that names who may authorise it, the minimum evidence required, the additional controls applied to that delivery, and a fixed expiry date after which the material cannot be used again.

The failure is almost never the emergency purchase. It is what happens afterwards. The material worked, the line ran, the crisis passed, and the temporary approval was never closed out. Eighteen months later that supplier is on the delivery schedule every week, has never been assessed, and appears on the register with a status of “temporary, pending” and a date that has long expired. I have found that exact entry on more sites than I can count, and it is the version of this finding that an auditor treats most seriously, because it shows the system was overridden and then forgotten.

• A named authority level: who may approve a temporary purchase, and who may not
• Minimum evidence before delivery is accepted: a specification or technical data sheet and a certificate of analysis at a minimum
• Enhanced incoming controls for that delivery: additional inspection, targeted testing, positive release before use
• Quantity and batch limits: the temporary approval covers this delivery, not this supplier
• A hard expiry date on the register, diarised and owned by a named person
• Full traceability of every batch made with the material, recorded at the time, not reconstructed later
• A defined route to either full approval or removal, with a decision date, not an open ended status
• A quarterly report of temporary approvals to the site leadership team, so the pattern is visible

Track the count. If your site raises two temporary approvals a year, the route is working as designed. If it raises thirty, the approved supplier list is not fit for the way you actually buy, and the answer is to widen it properly rather than to keep using the emergency door. That number is also one of the more useful food safety culture measures a site can put in front of its leadership team, because it shows exactly where commercial pressure is winning against the system.

What an auditor asks for, and the findings that recur

An auditor tests clause 3.5.1 by sampling backwards. They pick a material from your raw material store or from a batch record, then ask to see its specification, its risk assessment entry, the supplier’s approval evidence, the date that evidence expires, the last performance review and the last delivery record. If any link in that chain is missing, the sample is expanded. This is the sequence to rehearse.

Rehearse it as a real exercise, not as a document review. Ask a colleague to pick three materials at random, one of them from a broker and one from an uncertificated supplier, then produce the full chain for each within fifteen minutes. Time it. Our BRCGS Issue 9 audit preparation countdown checklist sets out how to sequence that kind of preparation across the weeks before the audit.

The pattern across all eight is the same. In each case the site had the intention and not the evidence. Supplier approval is one of the areas where the gap between a system as written and a system as run is easiest for an auditor to expose, because purchasing runs on commercial time and technical documentation runs on technical time, and the two only meet when somebody makes them.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.