A defensible scoring of your supplier base, with a monitoring schedule sized against what your team can deliver.
Supplier risk classification is the process of scoring suppliers and the materials they provide, so monitoring effort goes where the hazard really is. It produces a risk scored supplier register, a documented methodology behind the scoring, and a monitoring schedule proportionate to each band. Standards expect classification to exist and to change what a supplier receives, which is where most classifications fail.
Classification is a resource allocation tool. Its value is that it lets you spend less on the suppliers that warrant less, which is what makes proper attention to the high risk ones affordable. A classification where every band receives the same treatment has allocated nothing.
Scored at material level, with each band stating what it changes and a schedule sized against real capacity. Delivered remotely, in any language, quoted on scope.
Eight factors, weighted against each other. Material hazard carries most, because it is the only one independent of everything else.
| Factor | What it covers | Weighting |
|---|---|---|
| Material hazard | The intrinsic risk of the material, covering pathogen support, allergen content, contaminant history and susceptibility to adulteration. | Highest weighting, since it is independent of who supplies it. |
| Use in your process | Whether the material receives a kill step after it arrives, or goes into ready to eat product untreated. | High. The same material carries different risk in different processes. |
| Volume and spread | How much you buy and how many products it enters, which sets the consequence of a failure. | Moderate. Drives recall scope more than probability. |
| Supplier assurance | Recognised certification, its scope, audit history and whether an alternative basis exists. | Moderate. Reduces residual risk without changing intrinsic hazard. |
| Performance history | Complaints, rejections, out of specification results and how the supplier handled them. | Moderate, and the most predictive factor for future performance. |
| Supply chain length | How many steps sit between the origin and you, including brokers and agents. | Moderate. Each additional step reduces visibility. |
| Geographic and regulatory context | Regulatory environment at origin, and known category risks in that supply chain. | Applied on evidence, never as a blanket assumption about a country. |
| Substitutability | Whether an alternative supplier exists, which affects your ability to act on a failure. | Commercial, not food safety, and it still belongs in the decision. |
A band that changes nothing is decoration. This is the treatment attached to each, adjusted to your operation and your capacity.
| Band | Typical profile | Monitoring | Review |
|---|---|---|---|
| High | High hazard material, no kill step, or weak assurance. | Site audit on a defined cycle, full documentation, enhanced verification of incoming material. | Reassessed on any incident, and at shorter intervals. |
| Medium | Moderate hazard, or high hazard with strong assurance and a kill step. | Documentation review on a cycle, periodic questionnaire, monitoring of performance data. | Reassessed annually or on trigger. |
| Low | Low hazard material with recognised certification covering it and clean history. | Certificate currency check and performance monitoring only. | Reassessed on certificate expiry or on trigger. |
Eight failures that turn classification into an exercise producing a spreadsheet and no risk reduction.
Suppliers are scored, banded and then all treated identically. It satisfies the clause on paper and delivers no risk reduction, and auditors test what the band changes.
A well certified supplier scored low while supplying a high hazard ingredient. Intrinsic material hazard does not change according to who ships it.
The same ingredient carries very different risk going into a cooked product against a ready to eat one. Classification that ignores the receiving process misses that entirely.
A blanket assumption applied to a whole geography. It is imprecise, it is indefensible when challenged, and it distracts from evidenced factors.
Certification reduces residual risk and does not change intrinsic hazard. A certified supplier of a high hazard material is still supplying a high hazard material.
Classification carried out once and never revisited. A supplier that has had three rejections this year sits in the same band it was placed in two years ago.
Scores exist with no record of how they were derived. It cannot be defended at audit and it cannot be repeated consistently by anyone else.
Classification reverse engineered so the resulting schedule matches what the business already does. Nothing changes and the exercise was decorative.
Built so your own team can score a new supplier consistently after handover.
| Element | What it covers |
|---|---|
| Scored register | Every supplier and material scored against each factor, with the totals shown. |
| Documented methodology | How scoring works, what each factor weighs and why, written so it can be repeated. |
| Band definitions | What each risk band means and what it changes about the monitoring a supplier receives. |
| Monitoring schedule | The activity and frequency attached to each band, sized against your capacity. |
| Reassessment triggers | The events that move a supplier between bands outside the normal cycle. |
| Resource estimate | What the schedule would cost in time, so the classification is deliverable. |
| Outliers | Suppliers whose current treatment diverges most from what their risk warrants. |
| Maintenance guidance | How to score a new supplier and how to keep the register current. |
Food businesses managing supplier approval under a certification standard. It suits operations with more suppliers than monitoring capacity, which is most of them, and any business whose classification has been questioned at audit.
Your standard requires risk based supplier monitoring and you have none.
Classification exists and every supplier receives the same treatment.
Monitoring effort is spread evenly across a base that is not evenly risky.
Your schedule is larger than your team can deliver.
Scoring was done on suppliers with no regard to what they supply.
The methodology was never written down and cannot be repeated.
Your supplier base has grown and nothing has been reassessed.
An auditor has questioned how your classification was derived.
Suppliers and materials are listed at material level, since one supplier can provide materials of very different risk.
The factors that apply to your operation are agreed and weighted, with the reasoning recorded so it can be defended.
Each material is scored on its own hazard, independently of who supplies it.
Scores are adjusted for how the material is used in your process and for the assurance the supplier provides.
Bands are assigned, and the monitoring treatment attached to each is stated explicitly.
The resource the schedule requires is estimated, and the schedule is adjusted until it is deliverable.
Carrying out the monitoring the schedule calls for. Supplier audits and document reviews are separate services, and the classification decides which suppliers warrant them.
A full food fraud vulnerability assessment. Susceptibility is one scoring factor, and a dedicated assessment against a fraud specific methodology is separate.
Where the schedule exceeds your capacity, it is adjusted. A schedule nobody can complete produces evidence of a system not being followed.
Every project is quoted against its own scope. Thirty suppliers of two material categories and three hundred across twelve are very different pieces of work. These factors set the price.
These are the primary sources this work is built on. Where a market you sell into has its own requirement, that takes precedence and we assess against it.
It is the process of scoring suppliers and the materials they provide so monitoring effort goes where the hazard really is. It produces a scored register, a documented methodology and a monitoring schedule proportionate to each band. Standards expect it to exist and to change what a supplier receives.
Material hazard, how the material is used in your process, volume and how many products it enters, supplier assurance including certification and its scope, performance history, supply chain length, regulatory context at origin, and whether an alternative supplier exists. Material hazard usually carries the highest weighting.
Both, and the material matters more. Intrinsic hazard does not change according to who ships it, so a well certified supplier of a high hazard ingredient is still supplying a high hazard ingredient. Scoring only the supplier is one of the most common errors.
It reduces residual risk without changing intrinsic hazard. Certification is one factor among several, and treating it as the whole answer produces a register where high hazard materials sit in the low band because their supplier holds a certificate.
Country of origin can be one evidenced factor where a specific regulatory or category risk exists in that supply chain. Applied as a blanket assumption about a geography it is imprecise, it is indefensible when challenged, and it distracts from factors that predict better.
Three is common and workable. More bands create distinctions too fine to act on differently, and two rarely separates the base usefully. What matters more than the number is that each band changes what a supplier receives.
On a defined cycle with triggers for reassessment outside it. Typical triggers are a complaint, a rejection, an out of specification result, a change of site or ownership, a lapse in certification, and any change to how you use the material.
Then the classification is wrong for your business. A schedule nobody can complete produces evidence of a system not being followed, which is worse than a lighter schedule that runs. The output includes a resource estimate so the schedule is sized against real capacity.
Material susceptibility to substitution, dilution and misrepresentation is one of the factors considered. A full vulnerability assessment against a fraud specific methodology is separate, and the classification flags where one is warranted.
An approval system review examines the whole process, including criteria, decisions and monitoring. This service produces the classification itself, which is one component of that system. Businesses whose classification is the specific weakness should take this one.
Yes. Large bases are scored in material risk order so the consequential suppliers are settled first, and the methodology is written so your team can score the remainder and any new supplier consistently.
A scored register covering every supplier and material, the documented methodology behind the scoring, band definitions stating what each changes, a monitoring schedule with frequencies, reassessment triggers, a resource estimate, an outlier list and guidance for keeping the register current.
Confi Food assigns work by subject. HACCP, labelling, certification standards, regulatory compliance, supplier assurance and monitoring are separate disciplines, and each piece goes to someone who works in that area. Every deliverable is reviewed internally by a second specialist before it reaches you.
Our technical positions are built from primary sources, meaning the legislation, the competent authority, Codex Alimentarius, the certification scheme owner or the relevant standards body. We set out how that works in our technical review and editorial policy, and what happens at each stage of an engagement in how Confi Food works.
A review of how you approve and monitor suppliers, which is one of the most commonly failed clauses in every major standard.
Read about Supplier Approval System Review →A second party audit of one of your suppliers, carried out on your behalf against your own requirements or a recognised standard.
Read about Supplier Audit →Certificated course covering approval systems, risk classification and supplier auditing.
View Certified Supplier Approval Specialist →Expert supplier approval programme consulting worldwide. Risk-based supplier tiering, verification activities, and approval programmes aligned with GFSI, FSMA, and...
See Supplier Approval Programme Consulting →Expert TACCP and food defence consulting worldwide. Threat assessment, food defence plans, and alignment with the FDA Intentional Adulteration Rule, BRCGS Issue 9,...
See TACCP & Food Defence Consulting →Expert VACCP and food fraud consulting worldwide. Food fraud vulnerability assessment, horizon scanning, and mitigation aligned with GFSI, BRCGS, SQF, and FSSC 22000...
See VACCP & Food Fraud Consulting →Tell us how many suppliers and material categories are in scope, and receive a written quote covering the scope, the deliverable and the price.