FSSC 22000 v6 supplier management requirements

FSSC 22000 version 6 supplier management is the set of scheme requirements that oblige a certified plant to approve its suppliers of materials and services against defined criteria, to hold the evidence of that approval, and to keep monitoring each supplier after approval rather than only at onboarding. In document terms, it is the reason your file carries an allergen declaration, a certificate of analysis and a third party audit certificate for each supplier, and the reason an auditor checks whether each one is still in date.

The scheme is ISO 22000, plus a sector prerequisite programme specification, plus the Foundation's own additional requirements. Supplier management is handled mainly in that third layer, which is why a plant that knows ISO 22000 well can still be caught out. The published version 6 scheme documents are the only authority on the exact clause wording, and your certification body audits against that wording, so treat what follows as a practical reading rather than a substitute for it.

An example

A plant buys from 60 raw material and packaging suppliers. Approval is documented for all 60. The auditor samples six and asks for the current evidence behind each one. Five are fine. The sixth has an audit certificate that expired seven weeks ago. The supplier renewed it in the meantime, but never sent it across and was never asked. Nothing about the material was unsafe. The finding is still written up, because the control the plant described in its own procedure was not operating, and a corrective action is now due inside the certification body's deadline.

Version 6 did not invent supplier management. It tightened the parts of it that were easiest to run informally. Three shifts matter for the paperwork, and all three are worth checking against the clause text in the current scheme documents before you rewrite a procedure.

• Approval has to be a described process, not a habit. The criteria, who decides, and what evidence is held, written down, and then applied to every supplier in scope rather than to the ones you remember.
• Monitoring continues after approval. Review on a defined frequency, with the record of that review kept, so a supplier approved three years ago cannot sit unexamined on the approved supplier list because nothing has gone wrong yet.
• Exceptions belong inside the system. Emergency purchasing and any supplier used outside the normal route need a defined path and a record. An auditor will look for the one delivery that bypassed the list.

Every one of those turns, at the audit table, into a request for a document with a date on it. That is where most mid-market plants lose marks. The procedure reads well, the sample is pulled, and the certificates behind it are three months stale because chasing 60 suppliers by email sits at the bottom of someone's week.

• Approved supplier list. The register of suppliers cleared to supply you, and the thing the version 6 requirement is ultimately asking you to keep honest.
• Document control. The wider discipline of knowing which version of a document is current and who holds it. Supplier certificates are document control applied to paper you do not author. There is a separate page on this.
• Certificate of analysis. A per batch or per product analytical record from the supplier, usually the certificate type that goes stale fastest.
• Allergen declaration. The supplier's written statement of allergens present and handled on their site, and the document most often requested first in an allergen trace.
• Non-conformance. The finding an auditor raises when evidence is missing or out of date, graded major or minor. There is a separate page on how the two differ.
• Corrective action. What you do, and record, to close out that finding inside the deadline. Covered on its own page.
• Unannounced audit. The audit route that removes the preparation window entirely, which is why the status of your supplier file matters on an ordinary Tuesday.