BRCGS supplier approval and performance monitoring: the document evidence explained

The BRCGS Food Safety standard requires a documented procedure for approving suppliers of raw materials and packaging, built on a risk assessment, and it requires that approved suppliers keep being monitored afterwards. Two separate things have to exist: the written procedure, and the records showing you applied it to every supplier you actually bought from.

In practice an auditor is looking for a chain they can follow for any supplier they pick:

• The risk assessment behind the material and the supplier, covering the hazards that matter for that material, including allergens, microbiological and chemical risk, foreign body, substitution or adulteration, and legal requirements for the country of sale.
• The approval route you chose and why, whether that is valid third-party certification against a recognised scheme, a supplier audit, or a questionnaire where the risk assessment supports it.
• The evidence that route depends on, which is where certificates, questionnaires, specifications and declarations live.
• A review frequency written into the procedure, and dated evidence that reviews happened.
• Ongoing monitoring of performance between those reviews, with defined measures and recorded outcomes.
• A defined response when a supplier fails a measure or lets certification lapse.

It is worth knowing where this clause sits in the standard's hierarchy. Management of suppliers of raw materials and packaging is treated as a fundamental requirement in Issue 9, and a major non-conformity against a fundamental is the kind that puts certification itself at risk rather than generating a routine corrective action. Suppliers of services and outsourced processing sit under their own clauses with a similar shape. Clause numbering moves between issues of the standard, so read the issue your site is audited against rather than a blog's summary of it, including this one. The standard itself is published by BRCGS and the text is the only authority on wording.

Approval is a decision made at a point in time. Monitoring is a stream of evidence that runs for as long as the supplier keeps delivering. Most supplier files are strong on the first and thin on the second, because onboarding has an owner and a deadline while monitoring has neither.

The gap shows up quickly under questioning. An auditor rarely starts from your approved supplier list. They start from goods-in records, pick a delivery from four months ago, and work backwards: who is this supplier, are they on the approved list, what approved them, is that evidence still valid today, and what have you done since to check they are still performing. A file that answers the first three questions and stops at the fourth is where a finding gets written.

The other common mismatch is between the list and reality. Sites buy from a one-off supplier during a shortage, or a broker substitutes a source, and the approved supplier list is not updated. The list should reconcile against what actually came through the gate in the audit period, in both directions: every supplier who delivered is on the list, and suppliers on the list who no longer deliver are marked as such rather than left to age.

Treat approval as the gate and monitoring as the tripwire. The gate is a folder. The tripwire is a calendar.

Audit certificates are the easy half of the file, because the document states the date it stops being true. A large part of the supplier pack does not. An allergen declaration, a completed vendor questionnaire, a continuing guarantee and a signed specification usually carry only the date they were issued, and nothing on the page says when to ask for a fresh one.

Leave those undated in whatever system you run and they never come up at all. That is how a declaration signed four years ago ends up describing a product that has been reformulated twice, and it is one of the few cases where a complete-looking folder is the problem rather than the defence. Practitioners discussing allergen statements make the fair point that a statement stays accurate until something changes at the supplier's end, which is true and also unverifiable from your side, so the common answer is to ask annually for confirmation that nothing has changed.

The practical move is to stop waiting for the document to tell you and set the interval yourself.

• Pick a renewal period per document type. A plant might monitor allergen declarations on a three-year cycle and ask for an annual confirmation in between, while questionnaires follow the reissue cycle written into the approval procedure. The number matters less than the fact that it is written down.
• Count from the date on the form, not the date you filed it. The issue date is what the supplier signed against, and it is the only date an auditor can tie to the document in front of them.
• Treat the result as a monitored date. Once the interval is in the procedure, a derived due date is as legitimate a thing to track as a printed expiry, and it is defensible because the rationale sits in the procedure beside it.
• Accept either a reissue or a dated confirmation. A new signed declaration resets the clock, and so does a written confirmation that the previous one still stands. Both need a date and both belong in the supplier file rather than in a mailbox.

Where the standard itself sets a reissue cycle, for instance for approval based on questionnaires, that interval is a floor rather than a target, and your own risk assessment can call for more often. Read the issue your site is audited against for the interval and the wording.

Monitoring is the part sites find hardest to evidence, because it is made of small events spread across a year rather than one document you can print.

A workable programme names the measures in advance and records them in one place. The usual measures are conformance of certificates of analysis against specification, results of your own incoming testing or verification programme, complaints and non-conformances traced back to a supplier's material, delivery rejections for food safety reasons, incident or withdrawal notifications the supplier sent you, documentation failures such as a pack that arrived late or incomplete, and the supplier's certification status itself.

That last one deserves its own line. Certification status is a monitored parameter, not a filing detail. If a supplier's certificate lapses, or their grade drops, or their scope changes so it no longer covers the material they ship to you, your procedure should say what happens next and the file should show that it happened. A lapse with no recorded response is worse than a lapse with a dated decision to continue under additional controls, because the second shows a functioning system.

The review itself needs a shape. A short, dated record per supplier, or a periodic review covering the group of suppliers, showing what was looked at, what the outcome was and what action followed. It also helps to name the events that trigger a reassessment outside the cycle: a certificate expiring, a change of site or ownership, a reformulation, a complaint trend, a recall. Auditors are not usually looking for volume here. They are looking for a rhythm that clearly ran without them in the room.

None of the patterns below are exotic. They are what happens when a document-heavy control depends on someone remembering.

The expired certificate on file

The document exists, the folder looks complete, and the expiry date passed in the spring. The supplier is still delivering. Nobody chased because nobody was watching that date.

The list that does not reconcile

Goods-in shows a supplier who is not on the approved list, usually a temporary source brought in under pressure and never added, or added and never evidenced. The reverse also costs you: a supplier you stopped buying from two years ago still sits on the list with a lapsed certificate against their name, so the file looks worse than the plant actually is.

The approval that never got reviewed

The onboarding pack is thorough and three years old. The procedure says annual review. There is no record of a review, so there is no evidence the procedure is being followed.

The declaration that outlived the product

An allergen statement signed before a reformulation. No expiry was printed on it, so nothing ever brought it back up. The material changed, the document did not, and the specification on file no longer describes what arrives on the pallet.

The chase that lived in an inbox

The QA manager did chase, four times, from a personal mailbox. None of it is in the supplier file, so at audit it did not happen. The subtler version is a chase that was sent and never arrived, because the contact had left and the address bounced, which looks like diligence in the sent folder and is not.

The cost of these is rarely dramatic in isolation: a non-conformance to close out, corrective action with a deadline, evidence to submit. Cumulatively, and particularly when an unannounced audit lands in the middle of a busy period, they turn a week of preparation into a scramble, and a pattern of them raises questions about document control in general rather than about one certificate. Sibling pages in this pillar define non-conformance grading, corrective action and document control, and explain what an unannounced audit involves, if any of those terms need pinning down.

A spreadsheet is a legitimate way to run an approved supplier programme, and plenty of well-run sites do exactly that. It strains for a specific, arithmetic reason.

Take fifty suppliers and three required document types each, for example an audit certificate, an allergen declaration and a current CoA arrangement. That is one hundred and fifty dates to hold, each with a different renewal cycle, some printed on the document, some driven by the supplier's audit anniversary and some derived from your own review frequency because the document carries no date of its own. Add a deeper supplier base, two hundred suppliers rather than fifty, and the number climbs faster than the time available to check it.

Conditional formatting turns a cell red, but only for someone who opens the file. Reminders set in a personal calendar leave with the person who set them. Chasing happens by email, so the evidence of chasing lives in a mailbox rather than next to the supplier record, and nothing in the mailbox tells you whether the message was actually delivered. And the master file tends to fork: one copy on the shared drive, one on a laptop, one attached to an email sent to the technical manager last month.

The question is not whether a spreadsheet can hold the data. It can. The question is whether anything in the system will tell you that a certificate expires in sixty days when you are dealing with a line stoppage, and whether the chase you sent in March can be produced in September.

BRCGS supplier approval and performance monitoring is a documentation problem wearing a food safety hat. The hazards are assessed once and reviewed periodically. The approval route is a decision you justify and record. The evidence is a small, predictable set of documents, some with dates printed on them and some where you set the interval yourself. The monitoring is a rhythm that has to leave a trail.

What separates a file that survives an unannounced audit from one that does not is rarely knowledge of the standard. It is whether the dates are watched by something other than memory, whether the documents that carry no expiry still come up for review, whether the chase is logged where the auditor can see it along with whether it was delivered, whether the version that was valid last spring is still retrievable, and whether the list of suppliers matches the suppliers who actually delivered. Get those right and most of the rest is filing.

Read the issue of the standard your site is certified against for the exact wording and clause numbering, and treat your certification body's guidance as the authority on interpretation for your scope.