FSSC 22000 version 6: what changed for supplier management

Version 6 did not invent supplier approval. It widened the clause and made it harder to close out with a folder of PDFs. The additional requirement that used to cover management of services became management of services and purchased materials, which pulls ingredients, packaging and other bought-in materials into the same control that previously sat mainly over laboratories, pest control, laundry and maintenance. Inside that requirement the scheme is explicit about several things a site has to have in place: a procedure for procurement in emergency situations, where a material is bought outside the normal approved route and still has to be released against specification; a review of supplier performance carried out on a risk basis rather than when someone remembers; and, where laboratory analyses support your food safety decisions, evidence that the laboratory is competent to produce them. Sites handling animal-derived materials carry further purchasing control over the status of those materials.

Underneath the scheme sits ISO 22000:2018 clause 7.1.6, unchanged, and still the reason your supplier documents exist at all: criteria for evaluating, selecting, monitoring the performance of and re-evaluating external providers, plus documented information on those activities and on any action arising from them. Version 6 changed the emphasis rather than the logic. The practical delta for a QA manager is that you must be able to show, per supplier and per material, four things: the approval decision, the evidence it rested on, whether that evidence is still valid today, and when the next review falls due. Version 6 also pushes supplier paperwork into neighbouring clauses. The allergen management requirement leans on supplier allergen declarations and on what those declarations actually say about the lines the material ran on, and both the food fraud vulnerability assessment and the food defence threat assessment depend on current knowledge of who supplies you, from where, and through how many hands.

One caution before you rebuild a procedure around a clause number. Version 6 was published in 2023 and audits have been conducted against it since 1 April 2024, and the scheme owner issues minor revisions that move numbering and wording. Read Part 2 of the scheme document for the version your certification body will audit you against, and confirm that version with them. This piece is a map of the obligations, not a substitute for the text.

Where document currency actually bites

Supplier documents split into two kinds, and plants that get audited badly usually treat them as one kind.

The first kind has an expiry date on its face. A supplier's own certification certificate under a GFSI-recognised scheme, a second-party audit certificate, an allergen declaration your procedure requires to be reissued annually, a third-party laboratory's accreditation scope, insurance where your procedure names it. These are per-supplier, they go stale on a known date, and they go stale silently.

The second kind is per-consignment. A certificate of analysis belongs to a lot, not to a relationship, and an auditor tracing a batch will ask for the CoA that came in with the material you used, not the most recent one on file. Both kinds sit in the same folder and only one of them can be kept current by a reminder.

What auditors do with this is sample. They take your approved supplier list, pick the highest risk material and the most recently added supplier, and ask for the file. The finding that follows an expired certificate is rarely a claim that the material was unsafe. It is that your own procedure says you hold current certification for approved suppliers and the record in front of the auditor shows you do not. That gap is written by your procedure, which makes it entirely fixable.

What a plant has to be able to show

Named plainly, and none of this depends on any particular software:

• An approved supplier list that says what each supplier is approved to supply, not just that they are approved.
• The required document set per supplier type, written down, so that missing is a defined state rather than an opinion.
• The approval evidence itself, with issue and expiry dates legible, for every document in that set.
• Evidence that review happened at the frequency your procedure names, with the outcome and the risk basis for the frequency.
• The emergency procurement procedure, and any record of the times it was used.
• Performance monitoring you actually act on: complaints, rejections, out-of-specification results, and the response.
• A route to suspend or remove a supplier, and evidence it has been used when it needed to be.
• For analyses that support a food safety decision, the laboratory's competence and the scope it covers.

The four failure states

Expired is the one everyone talks about: the date passed, the document is in the folder, nobody looked. Missing is cheaper to fix and more embarrassing to be caught by, because the required set was never completed for that supplier. Unknown is the worst of the three, because nobody in the room can say whether the document exists, and the auditor now has a reason to widen the sample.

The fourth is the quiet one. Filed but stale: the certificate on file is within its dates, but the supplier's certification was reissued with a reduced scope, or withdrawn, and nobody re-collected. Currency tracking catches the calendar, not the scope change, which is why a review step with a human in it stays in the procedure.

Closing the gap before the next audit

Write the required document set per supplier type first, because everything downstream is defined by it. Then get every expiry date into one place where a date can be sorted, which is why a spreadsheet remains a legitimate starting point for a site with thirty suppliers. Then move the chasing off discovery and onto a schedule, so that a document is requested while it is still valid rather than after an auditor names it. Then keep the request itself as a record, because the useful answer to "what did you do about this supplier" is a dated log, not a recollection. Finally, produce one view you can hand over in the audit room without assembling it that morning.

Where Certly fits, and where it does not

Certly is a certificate tracking and reminder system for a single plant. When it launches, it is built to hold your supplier list with the certificate types each supplier owes you, store the documents your QA team uploads against a supplier and type, and let a supplier upload a document themselves through a single-use expiring link sent by email with no login to create. It computes status from expiry dates against thresholds you set at 90, 60 and 30 days, sends chase emails on that schedule and on demand, logs each send with its delivery status, and shows current, expiring soon, expired and missing per supplier on one screen that exports to PDF. Supplier contact data can be erased on request, and data is scoped to your plant on every query.

What it does not do is satisfy a clause. It does not verify that a certificate is authentic, it does not read scope changes, it does not make an approval decision, and it does not guarantee regulatory compliance. That disclaimer sits on the dashboard and on the PDF export for the same reason it sits here: the tracking is ours, the judgement stays with your QA team, and an auditor is assessing your procedure, not your tooling.