Supplier approval program: what an SQF or BRCGS plant keeps on file

Every GFSI scheme a US food plant is likely to hold (SQF, BRCGS, FSSC 22000, IFS, PrimusGFS) expects you to control who supplies your ingredients, packaging and outside services. The name differs a little from scheme to scheme, but the job is the same: decide what each supplier must prove before you buy from them, collect the proof, and keep it current for as long as you keep buying.

This guide covers the written program, what goes in each supplier's file, how to tier suppliers by risk, and the routine that stops certificates from quietly expiring between audits. It does not replace your scheme's code: the exact wording and the edition your plant is certified to are what your auditor will hold you to, so read the supplier sections of your own code alongside it.

The two halves: the procedure and the files

An approval program has two parts, and auditors look at both.

The written procedure says how your plant decides. It names who is responsible, which materials and services are in scope, how you assess the risk of each one, what a supplier must provide to be approved at each risk level, how often you review them, and what happens when you have to buy from someone who is not yet approved.

The supplier files are the evidence that you follow the procedure. For each approved supplier there is a record of what they supply, the risk level you gave it, the documents you collected, and when each one renews. An auditor will typically pick a few materials from your receiving records or your formulas, trace them back to the supplier, and ask to see that supplier's file.

A strong procedure with stale files fails in the same place every time: the auditor opens a file and finds a certificate that expired last month.

What goes in a supplier's file

What you require is set by your own risk assessment, not by a universal list. That said, most food plants end up asking for the same handful of documents:

Two practical points. First, check that the certificate's scope actually covers the material you buy: a certificate for a supplier's dry blending site says nothing about the liquid product made somewhere else. Second, record the renewal date for every document, including the ones that print none. A letter of guarantee with no date on it is still a document you will be asked to keep current.

Tier suppliers by risk

Not every supplier needs the same file. A common approach is two or three tiers:

• Standard (or high) risk: ingredients that go into the product, food-contact packaging, and services such as pest control and testing labs. These suppliers owe the full set your procedure lists, usually including a GFSI certificate.
• Low risk: secondary packaging such as corrugated cases, and materials with no food contact. These may only owe a letter of guarantee and an allergen statement.
• Exceptions: a one-time emergency purchase, a broker who cannot provide the manufacturer's certificate. Your procedure should say what extra checks apply, such as testing on receipt or a time limit.

Write the tier and the reason into each supplier's file. When an auditor asks why a supplier has no GFSI certificate, the answer should be on paper before they ask.

Keeping it current between audits

Collecting documents once is the easy part. The work that never ends is renewals: with 80 approved suppliers and five documents each, that is 400 dates, and something comes due nearly every week.

A routine that holds up:

1. One renewal date per document. Use the printed expiry date when there is one. When there is none, use the issue date plus the interval your procedure sets (12 months for a letter of guarantee, for example).
2. Ask early, more than once. Many plants email suppliers 60 days before a renewal date and again at 30, 14 and 7 days. Certification bodies often issue a new certificate only shortly before the old one expires, so the later reminders are the ones that land.
3. Keep asking after it lapses. A supplier who missed the reminders needs a weekly nudge, and after several weeks without an answer the matter goes to purchasing or to a phone call, not to another email.
4. Check what comes back. Confirm the supplier name, the scope and the dates before the new copy replaces the old one. A renewed certificate sent for the wrong site is a common mix-up.
5. Keep the old copies. Superseded documents are part of your history. Many plants keep them for several years so an auditor can see the supplier was covered on any past date.

A before-the-audit checklist

Run this a month before the audit, then again the week before:

• Every active supplier has every document its tier requires.
• No document's renewal date has passed.
• Each GFSI certificate's scope covers the material you buy from that supplier.
• Each file shows the supplier's risk tier and why.
• Suppliers you stopped using are marked inactive, so nobody chases them or audits them.
• Exception purchases since the last audit have the extra checks your procedure requires.
• You can produce the register (supplier, document, renewal date, status) as one list.

Where Supplier Nudge fits

Supplier Nudge does the collecting and the chasing. Each supplier gets one upload link listing exactly what is missing or expiring, it reads expiry and issue dates from the certificates they upload, works out renewal dates for undated documents from the intervals you set, and emails the supplier at 60, 30, 14 and 7 days before each renewal date, then weekly for up to eight weeks. You see one red, amber and green list of every supplier, and you can download an audit pack: a ZIP of current documents and the register. Approving a supplier stays with your food safety team; it only collects, dates and reports the documents.