Whether your approval process is operated as well as written, tested against your own procedure and against what the files and the purchase orders show.
A supplier approval system review examines the process a business uses to decide which suppliers may provide material and how it monitors them afterwards. It covers the written procedure, the approval criteria, the risk classification behind them, the ongoing monitoring, and whether practice matches what the procedure says. Supplier approval is among the most commonly failed clause areas in every major standard.
Almost every business has a procedure. Far fewer operate one. The gap opens because the procedure describes documents to collect without stating what would cause a supplier to be refused, and a process that cannot produce a refusal is not making decisions.
The process behind the files, tested against your own procedure and against practice. Delivered remotely, in any language, quoted on scope.
Eight elements, each assessed for whether it exists and whether it does anything.
| Element | What it should do | Common failure |
|---|---|---|
| Approval criteria | What a supplier has to satisfy before it may be used, defined per risk category. | Criteria that describe documents to collect without stating what would cause a refusal. |
| Risk classification | How suppliers and materials are categorised, and what monitoring each category attracts. | A classification that exists on paper with every supplier treated identically in practice. |
| Approval decision | Who assesses a supplier, against what, and how the decision is recorded. | Documents collected with no evidence a decision was ever taken. |
| Approved supplier list | A controlled record of who may supply what, with the basis for each approval. | A list maintained separately from purchasing, so buyers order from suppliers not on it. |
| Ongoing monitoring | Performance measures, review frequency and what triggers a reassessment. | Approval treated as permanent once granted. |
| Emergency purchase route | How an unapproved supplier may be used under pressure, and what happens afterwards. | No route defined, so it happens informally and is never recorded. |
| Non conforming supplier handling | What happens when a supplier fails, including escalation and de listing. | A failing supplier retained because nothing in the procedure forces a decision. |
| Outsourced processing | Whether co packers and contract processors are treated as suppliers with the same rigour. | Outsourced processing sitting entirely outside the approval system. |
Five statements that appear in most supplier approval procedures, alongside what the evidence usually shows.
| The procedure says | What the evidence shows |
|---|---|
| Suppliers are approved before first delivery. | First deliveries arriving from suppliers approved weeks later, or never. |
| Suppliers are risk classified and monitored accordingly. | Every supplier monitored identically, with the classification unused. |
| Performance is reviewed annually. | No review records, or reviews carried out only for suppliers with problems. |
| Only approved suppliers appear on purchase orders. | Purchasing operating from its own list, unconnected to the approved one. |
| Failing suppliers are escalated and de listed. | Long standing suppliers retained through repeated failures because nothing forces the point. |
Eight reasons this clause area is among the most commonly failed in every major standard.
It lists documents to obtain and never states the criteria that would cause a supplier to be refused. Collecting paperwork is not approval, and auditors test whether a decision was made.
Suppliers are categorised and every category receives the same treatment. The classification satisfies the clause on paper and changes nothing in practice.
The approved supplier list is maintained by technical, and buyers order from a system that does not reference it. Material arrives from suppliers nobody approved.
No review frequency, no performance trigger and no reassessment. A supplier approved four years ago is still approved on that basis.
Under supply pressure someone buys from an unapproved supplier, correctly prioritising continuity. With no defined route, it is never recorded and never regularised.
Outsourced processing treated as a service and not as a supply, so a business making your product receives less scrutiny than a business selling you a box.
Complaints, rejections and out of specification results accumulate with no threshold that triggers escalation. The supplier continues because stopping requires an active decision nobody owns.
Approval knowledge held individually and never written into the procedure. It works until that person leaves, and the files then show gaps nobody can explain.
Findings are evidenced against your own procedure, so the assessment is about your system and not a generic model.
| Element | What it covers |
|---|---|
| Procedure assessment | Your written procedure against your standard's requirements, clause by clause. |
| Criteria review | Whether approval criteria are defined well enough to produce a refusal. |
| Classification review | Whether risk classification exists and whether it changes anything. |
| File sampling | A sample of supplier files tested against your own procedure. |
| Practice comparison | Where practice diverges from the procedure, evidenced. |
| List integrity check | Whether purchasing and the approved supplier list are connected. |
| Monitoring assessment | Review frequency, performance measures and reassessment triggers. |
| Compliant framework | A revised approval framework where the current one cannot be made to work. |
Food businesses required to demonstrate supplier control under a certification standard. It suits operations failing the clause repeatedly, and businesses whose supplier base has grown faster than the process managing it.
Supplier approval has been raised as a finding more than once.
Your procedure exists and nobody is confident it is followed.
Purchasing and the approved supplier list have drifted apart.
Risk classification exists and every supplier gets the same treatment.
Emergency purchases happen and nothing records them.
Co packers and contract processors sit outside the system.
A failing supplier has been retained because nothing forced a decision.
The person who ran supplier approval has left.
You share the written procedure, the approved supplier list, your risk classification and a sample of supplier files.
The procedure is assessed against your standard and against whether its criteria could produce a refusal.
Whether risk classification exists is established, along with whether it changes the treatment a supplier receives.
Files are tested against your own procedure, so findings are about your system and not a generic checklist.
Divergence between procedure and practice is evidenced, including whether purchasing uses the approved list.
Monitoring and escalation are assessed, and a revised framework is provided where the current one cannot be made to work.
Auditing your suppliers, and full file review across the whole base. Both are separate services, and this review samples files to test the process behind them.
Implementing the framework and retraining the people who operate it.
Where the existing procedure is sound and simply not followed, the review says so. Rewriting a working procedure changes nothing.
Every review is quoted against its own scope. A single site with thirty suppliers and a group operating one procedure across four sites are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
It is the documented process a business uses to decide which suppliers may provide material and how it monitors them afterwards. It covers approval criteria, risk classification, who decides and on what basis, the approved supplier list, ongoing monitoring, and what happens when a supplier fails.
Because almost every business has a procedure and far fewer operate one. The procedure describes collecting documents without stating what would cause a refusal, risk classification exists without changing anything, and purchasing works from a list unconnected to the approved one. Auditors test the process, not the folder.
What a supplier must satisfy before it may be used, defined by risk category, and stated clearly enough that a supplier could fail them. Criteria that only list documents to obtain do not constitute approval, because nothing in them produces a decision.
Most standards expect it, and the point is that classification should change what you do. High risk materials attract more scrutiny and more frequent review. Where every category receives identical treatment, the classification is nominal and auditors treat it as such.
That happens, and the answer is a defined emergency route instead of a prohibition. The route should set out what minimum assurance is required, who authorises it, what additional verification applies to the material, and how the supplier is regularised afterwards. Without one, it happens informally and is never recorded.
Yes, and they usually warrant more scrutiny than a material supplier, since they are making your product. Outsourced processing sitting outside the approval system is a common and serious gap.
On a frequency driven by risk classification, with defined triggers for reassessment outside that cycle. Triggers typically include complaints, rejections, out of specification results, a change of site or ownership, and a lapse in certification.
The procedure should force a decision. Where nothing sets a threshold for escalation, failing suppliers are retained by default because stopping requires an active decision nobody owns. Defining that threshold in advance is what makes the decision possible.
A document review checks the files you hold. This review checks the process that produced them, including whether the criteria could produce a refusal, whether classification changes anything, and whether practice matches the procedure. Businesses failing the clause repeatedly usually need this one.
Where the current one cannot be made to work, a revised framework is provided. Where it is sound and simply not followed, the review says so, because rewriting a working procedure changes nothing.
Yes, and divergence between sites is common. Sites in the same business frequently operate different approval practice under one procedure, which is a finding against the system and not against any one site.
A procedure assessment against your standard, a criteria review, a classification review, file sampling tested against your own procedure, evidence of where practice diverges, a list integrity check, a monitoring assessment and a compliant framework where the current one cannot be repaired.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
A review of the documentation you hold for each supplier, checking it is current, complete and covers the material you buy.
Read about Supplier Document Review →A defensible risk classification across your supplier base, so monitoring effort goes where the hazard really is.
Read about Supplier Risk Classification →A second party audit of one of your suppliers, carried out on your behalf against your own requirements or a recognised standard.
Read about Supplier Audit →Certificated course covering approval systems, risk classification and supplier auditing.
View Certified Supplier Approval Specialist →Expert supplier approval programme consulting worldwide. Risk-based supplier tiering, verification activities, and approval programmes aligned with GFSI, FSMA, and...
See Supplier Approval Programme Consulting →Expert BRCGS Food Safety consulting worldwide. Gap assessments, Issue 9 certification prep, mock audits, Grade AA support and ongoing compliance for food...
See BRCGS Food Safety Consulting →Expert FSSC 22000 consulting worldwide. Gap assessments, certification prep, Version 7 transition support, internal audits and ongoing compliance for food...
See FSSC 22000 Consulting →Send your procedure, your approved supplier list and a sample of files, and receive a written quote covering the scope, the deliverable and the price.