Approve suppliers on evidence, not on a filed certificate
This page covers the supplier approval and re approval programme ASC builds and runs across your whole supply base. If you want ASC to audit one named supplier in your name, on your own protocol, see second party audits. Supplier and vendor audits are how a food business proves its suppliers are controlled. ASC builds and audits the supplier approval system: raw material risk tiering, approval routes, certificate scope verification, specifications, certificate of analysis review, monitoring rules and de listing. ASC is not a certification body and does not certify suppliers.
Auditing is charged hourly and a full programme is quoted on scope once ASC has seen the site. ASC will tell you before the quote if the work is smaller than you think.
Every food business buys risk. Material arriving at your goods in bay carries whatever hazard your supplier failed to control, and once it is inside your process it becomes your product, your complaint and your withdrawal. Supplier approval is the control that stops that, and it is often the weakest documented system on site.
The problem is rarely that nobody thought about suppliers. It is that the thinking never became a system. Certificates are collected and filed. A questionnaire goes out when someone remembers. A supplier is approved because they have always delivered. Then an auditor asks on what basis, and the answer is a folder rather than a decision.
A supplier and vendor assurance system answers that question in writing. It tiers raw materials by the risk they carry, sets an approval route for each tier, records the evidence that satisfied the route, monitors performance between approvals, and states what happens when performance drops. It also carries a rule for the day production needs material at short notice from someone who is not on the list.
That protects you twice: from the supplier failure that becomes your recall, and from one of the most reliable sources of major non conformance in a certification audit. Both are expensive, and only one is visible in advance.
Where supplier assurance usually breaks
Supplier assurance is sold in two shapes. One is a template pack: a procedure, a questionnaire and a spreadsheet, offered on the promise that the documents will satisfy an auditor. The other is an audit day: someone visits a supplier, scores a checklist and sends a report. Neither on its own is a system.
The template approach produces approvals nobody can defend, because a completed questionnaire is a supplier’s own opinion of itself. The audit only approach treats one day as though it settled the question permanently, while the supplier changes site, process, certificate or ownership and nothing in the system notices.
ASC works on the decision rather than the document. We start from the raw material and what it can do to a consumer, set the approval route the risk justifies, then write the rules that make the system move on its own: the complaint trend that lifts a supplier a tier, the result that forces a re approval, the certificate expiry that suspends supply.
We also cover what most systems leave out: service providers, transport and cold chain operators, laboratories, and above all co packers, where another business makes your product under your name.
Key facts at a glance
When a business calls ASC in
- Your certification audit raised a finding against supplier approval, and your corrective action was a revised procedure rather than a working system.
- You hold certificates for most suppliers and nobody has checked whether the certified scope covers the product you actually buy.
- A raw material caused a complaint, a rejection or an out of specification result, and no written rule says what that does to the supplier’s status.
- You are onboarding a supplier for a high risk material, such as a ready to eat ingredient or primary packaging in direct food contact.
- Production has accepted material from an unapproved supplier, and the deviation was recorded afterwards or not at all.
- You use a co packer, and your control over that site is a supply agreement rather than a verified programme.
How ASC does the work
1
Risk assess the material, not just the supplier
The question that decides everything downstream is not how good the supplier looks, it is what the material can do if the supplier gets it wrong. ASC tiers each raw material, packaging item and outsourced service against fixed factors: the hazard it carries, whether microbiological, chemical, physical, allergenic or radiological; whether it is eaten without a further kill step in your process or the consumer’s kitchen; whether it introduces an allergen you would otherwise not handle; whether it has a history of adulteration or substitution; its origin; and the proportion of the finished product it becomes.
That last factor is the one most matrices leave out, and it changes answers. A flavouring dosed at a fraction of a percent and a base powder making up most of the formulation do not deserve the same assurance effort, even when both are ambient dry powders from the same country. Tier the material first and its supplier second, because one supplier can sit in two tiers for two different lines. The output is a matrix with a written rule behind every score, so a technologist who joins next year reaches the same tier as the person who built it.
2
Approval routes, and what each one actually proves
Certification to a recognised scheme is the strongest routine route, provided the certificate is verified at source with the certification body or the scheme directory rather than accepted as a document emailed by the supplier, and provided the scope is checked. A second party audit is the strongest route available, because the criteria are yours and the auditor answers to you. ASC performs those audits as your appointed auditor through the second party audits service, following ISO 19011, at one day on site with the report issued within two weeks.
A supplier questionnaire proves that a supplier was willing to answer questions and that somebody there knew the right words. It is a screening tool and the agenda for a later audit, not verification, and relying on it alone for a high risk material is among the most common findings ASC writes. Where a questionnaire is the route, it should be signed by a named responsible person, supported by the attachments you asked for, and reviewed by someone prepared to challenge what came back.
The remaining routes are a specification and certificate of analysis review, for lower risk materials under meaningful analytical control, and historical performance, legitimate only where that performance is recorded. Without the delivery, complaint and test record behind it, you have habit rather than a route. One check sits ahead of all of them for a local supplier operating food premises: under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972 and the general hygiene requirements published as R638 of 22 June 2018 in Government Gazette 41730, those premises must hold a valid certificate of acceptability from the local authority.
3
Certificate scope, the failure hiding in a compliant looking file
A certificate approves a scope, and the scope is where supplier files come apart. It names a site, a set of products and usually the processes covered. Buyers check the expiry date and stop there.
The failures repeat. The certificate covers the group’s principal factory and you buy from a satellite site with its own address. It covers ambient dry goods and you buy the chilled ready to eat line. It covers manufacture but not the storage and distribution the supplier also does for you. It covers the agent you buy from, who holds a broker scope, while the manufacturer holds nothing. The file looks complete and the assurance is zero.
ASC verifies the scope, site address, product categories, exclusions, the accreditation status of the certification body and the grade where the scheme publishes one, then records that verification with the date and source. Where the scope does not cover what you buy, the approval route changes.
4
Specifications and certificates of analysis
A raw material specification is a written agreement about what acceptable looks like. A real one names the material and its supplier code, the country of origin and manufacturing site, the full compositional declaration, the allergen status including allergens handled on the same line and the cross contact controls, microbiological and chemical limits with the test method and sampling plan behind each, physical and organoleptic parameters, pesticide, mycotoxin and heavy metal limits where the material warrants them, packaging configuration, shelf life and storage conditions, labelling compliance including R146 of 1 March 2010 where the material arrives labelled, and a signature and review date from both parties. A specification neither party has signed is a wish list, and one not reviewed since the supplier changed a process is worse, because it is trusted.
Certificates of analysis are treated as filing in most businesses, and filing is not review. Reviewing one means comparing every result against the specification limit, confirming the lot number matches the material received, checking that the tests reported are the tests the specification requires rather than a convenient subset, noting whether the laboratory is accredited to ISO/IEC 17025 for that method, and watching for results that sit inside the limit but are drifting. Train your team to notice the certificate that reports the same value to the same decimal place delivery after delivery. That is telling you something, and it is not that the process is stable.
5
Monitoring between audits, and the rule that moves a tier
Approval is a moment. Assurance is what happens in the months afterwards. Monitoring connects what the business already knows: complaints attributable to a raw material, rejections at goods in, out of specification results, delivery temperature and vehicle hygiene failures, missing certificates of analysis, incorrect lot coding, late deliveries that force substitution, and changes in the supplier’s certification status.
What is nearly always missing is the rule. Data without a threshold produces a report nobody acts on. ASC writes the trigger explicitly: a defined number of related complaints in a rolling period, a repeat of the same non conformance, any positive result for a pathogen or an undeclared allergen, a certificate suspension, a change of site or ownership, or a failed traceability exercise. Each trigger names its consequence: increased sampling, a corrective action request with a due date, an unscheduled audit, a move up a tier, suspension, or de listing.
De listing needs its own procedure, because it is the step businesses avoid. It states who authorises it, how open orders and stock on hand are handled, whether the supplier can be re approved and on what evidence, and who tells the customer when a specification or label changes.
6
Food fraud vulnerability and traceability through the supplier
Certification schemes require a documented vulnerability assessment on raw materials and mitigation where the vulnerability is real. Done properly it is a supply chain question rather than a hygiene question: how many hands the material passes through, whether you buy direct or through a trader, whether there is an economic incentive to adulterate, and whether you hold any method that would detect substitution.
In South Africa this is concrete. Research published by Stellenbosch University in 2013 reported a high incidence of species substitution and mislabelling in processed meat products sampled on the local market, and the materials with a global fraud history, honey, olive oil, spices, juice concentrates and fish species, all move through South African supply chains. Mitigation has to be specific: species testing, authenticity analysis where a method exists, tighter supply chain mapping, or an audit that follows the material back a step.
Traceability is the practical test of all of it. A mass balance run through a supplier reconciles what they say they received against what they say they produced and dispatched to you, within a defined tolerance and with losses explained. Schemes require a traceability test at least annually against a completion time the site sets for itself, and a test that stops at your goods in bay has checked half the chain.
7
Emergency supply, outsourced processes and co packers
Most supplier systems fail in the same place. Production is short, the approved supplier cannot deliver, and material arrives from someone who is not on the list. A system with no route for this does not prevent it, it only guarantees it goes unrecorded. FSSC 22000 requires a documented emergency procurement procedure in the relevant food chain categories, and this is exactly why.
A workable emergency route is written in advance and deliberately narrow: who may authorise it, the minimum evidence required before acceptance, such as a certificate verified at source, a signed specification, a certificate of analysis for that lot and an allergen declaration, the additional verification applied, such as segregated quarantine or positive release on test, the number of deliveries the concession covers, and the date by which full approval is completed or supply stops. Record it as a concession with a named authoriser, so the exception stays visible.
Outsourced processes and co packers carry the highest risk in the supply base and usually the thinnest assurance. Another site makes your product, applies your label and trades on your name. That relationship needs a defined specification, agreed process parameters, an approved list of the co packer’s own suppliers, your right of access to audit, agreed handling of complaints and non conforming product, and traceability running through their records into yours. A supply agreement is a commercial document, not verification.
How ASC helps, in practice
These are illustrative composites of the pattern of work ASC does. They name no client and report no measured outcome.
The file that passed until somebody read the certificate
A processor held certificates for most of its ingredient suppliers and had never been challenged on supplier approval.
ASC verified each certificate at source and mapped the certified scope, site address and product categories against the actual purchase order lines.
Several certificates covered another site of the same group or a category the business did not buy, and those materials moved onto a second party audit route.
Emergency supply that had quietly become the normal route
A supplier brought in once during a shortage had carried on delivering for months, with no approval and no concession record.
ASC wrote an emergency procurement procedure with a named authoriser, a minimum evidence set and an expiry, then put the supplier through full approval.
The business kept a supplier it needed, this time on evidence, and unrecorded acceptance stopped being normal practice.
The co packer nobody had audited
A brand owner outsourced a chilled line and held a supply agreement and a certificate, with nothing covering how the site actually ran.
ASC built the assurance package: agreed specification and process parameters, the co packer’s approved supplier list, complaint handling, and a traceability exercise run from dispatch back through the co packer’s records.
The exercise exposed where lot identity was being lost inside the co packer, closing a gap that would have made a withdrawal impossible to bound.
What you receive
| Deliverable | What it contains |
|---|---|
| Supplier approval and monitoring procedure | Your written system: approval routes by risk tier, the evidence each route requires, who decides, review periods, and the rules for suspension, re approval and de listing. |
| Raw material risk tiering matrix | Every raw material, packaging item and outsourced service scored against fixed factors, with the written rule behind each score and the approval route that tier demands. |
| Supplier approval file pack | Questionnaire, specification template, certificate scope verification record, certificate of analysis review record and approval decision sheet, built around your materials rather than a generic set. |
| Supplier monitoring and review record | The measures tracked between audits, the thresholds that trigger action, the consequence attached to each trigger, and the format of the periodic supplier review. |
| Food fraud vulnerability assessment | Raw materials assessed for adulteration and substitution vulnerability across the supply chain, with mitigation assigned and justified where the assessment calls for it. |
| Emergency and unapproved supply procedure | The narrow authorised route for short notice material, with the minimum evidence set, the additional verification applied, and the date that forces full approval or ends the supply. |
The rest of the ASC audit programme
Supplier assurance connects to everything else ASC audits. These are the services buyers combine with it.
Other ASC audits
One audit team, one method, across the whole programme.
Build or fix the system
Where the audit finds a gap, ASC implements the fix with your team.
Train and equip
Online courses and editable document toolkits.
Who this work suits
ASC works with businesses whose supply base is genuinely difficult: meat and poultry processors, dairy processors, bakeries and snack manufacturers, beverage and juice producers, chilled prepared food operations, spice and sauce blenders, fruit and vegetable packhouses, seafood processors along the coast, contract packers, and retail and quick service groups managing own brand supply.
The common difficulty is a mixed supply base: some suppliers certified to a recognised scheme, many not, small local businesses for whom certification was never realistic, and at least one outsourced process. A supplier system has to work with that rather than pretend it away. ASC audits are led by lead auditors registered with SAATCA, Exemplar Global and IRCA. ASC Food Safety Consultants operates from Gqeberha, formerly Port Elizabeth, in Nelson Mandela Bay in the Eastern Cape, with teams in Johannesburg, Cape Town, Durban and across South Africa, and is SAATCA registered and a FoodBev SETA Accredited Provider No. 587/00337/1900. ASC Consultants SA is also a member of the Sustainability Initiative of South Africa, membership number 20240910 112270.
Where ASC stops
ASC Food Safety Consultants is an independent consultancy and second party audit provider. We are not a certification body. We do not certify your management system and we do not certify your suppliers, and no report issued by ASC confers certified status on any organisation. A certification decision belongs to an accredited certification body following its own third party audit.
The approval decision on a supplier stays with you. ASC designs the system, verifies the evidence and recommends with the reasoning recorded. Where the applicable version of a scheme or a transition date is in question, confirm it with your certification body.
Frequently asked questions
Is a supplier certificate enough on its own?
For many lower risk materials it is the appropriate route, and it is meaningful evidence. It is only enough when the certificate has been verified at source with the certification body or the scheme directory rather than accepted as a document sent by the supplier, and when the certified scope covers the site you buy from, the product you buy and the process used to make it. Scope, not validity, is where these files fail.
What does a supplier questionnaire actually prove?
That a supplier answered questions about itself. Nothing on a returned questionnaire has been verified by an independent party, so it works as a screening tool and as the agenda for an audit, not as approval evidence for a material carrying real risk. If a completed questionnaire is your only evidence for a ready to eat or allergen bearing ingredient, expect a finding at your next certification audit.
How do we approve a small local supplier with no certification?
With a second party audit, a signed specification and a defined monitoring regime, all sized to the risk the material carries, plus confirmation that the premises hold a valid certificate of acceptability. Most South African businesses have suppliers in this position, and the honest answer is to verify directly and record what was verified. ASC performs those audits as your appointed auditor, one day on site, with the report within two weeks.
How often should suppliers be audited and re approved?
The default cycle is annual, with the written report issued within two weeks of the audit, and frequency should then follow risk rather than a flat rule. Higher risk materials, uncertified suppliers, outsourced processes and suppliers with open findings warrant more frequent verification. Re approval should also be event driven, because a change of site, ownership, process or certification status resets the question regardless of the calendar.
Production needs material tomorrow from a supplier who is not approved. What do we do?
Use a written emergency procurement route rather than an unrecorded decision. It should require a named authoriser, a minimum evidence set before the material is accepted, additional verification such as segregated quarantine and positive release on test, and a date by which full approval is completed or the supply ends. A system without that route does not prevent unapproved supply, it only keeps it out of the records.
Who owns the supplier approval decision, us or ASC?
You do. ASC designs the system, verifies certificates and evidence, audits where an audit is the route, and recommends approve, approve with conditions or do not approve, with the reasoning recorded in writing. The decision itself, and the commercial consequence that follows it, stays with your business.
Build a supplier system you can defend
Tell ASC how many suppliers you carry, how many of them are certified, and where your last supplier related finding came from, and a senior consultant will come back with a scope and a quotation. Auditing is charged hourly and a full programme is quoted on scope.
Not ready for a quote? Use Where Do I Start, or book a virtual consultation.