Help with Supplier Approval and Assessment Program

Hello! Brand new to this website, but I've had a blast scouring through old threads (some were over 10 years old, wow!).

I am looking for help with improving my Supplier Approval/Assessment Program. I've looked through some old threads about this topic, but I'm struggling to really fit the pieces together.

My company is in the alcoholic beverage space. Currently FSSC 22000 certified.

I manage a diverse portfolio of suppliers ranging from very low risk ingredients to higher risk ingredients.

In terms of resources, it's basically just me.

What's already in place: we collect required documentation/questionnaires. We have also conducted fairly in-depth ingredient risk assessments to identify the hazards/controls for each ingredient. So I feel like with those two things combined, I should be able to put together a supplier assessment program, but I'm struggling with figuring out how to do it.

I've read that you typically want to start with the ingredient risk and then look at what controls are in place to determine a final score for that supplier, or something like that.

So I'm hoping someone can walk me through an example. Let's say I have 9 suppliers:

Supplier 1: High risk ingredient. GFSI certified

Supplier 2: High risk ingredient. Not GFSI certified, but has HACCP and GMPs and a few other QFS programs.

Supplier 3: High risk ingredient. No or minimum QFS programs in place.

Supplier 4: Medium risk ingredient. GFSI certified

Supplier 5: Medium risk ingredient. Not GFSI certified, but has HACCP and GMPs and a few other QFS programs.

Supplier 6: Medium risk ingredient. No or minimum QFS programs in place.

Supplier 7: Low risk ingredient. GFSI certified

Supplier 8: Low risk ingredient. Not GFSI certified, but has HACCP and GMPs and a few other QFS programs.

Supplier 9: Low risk ingredient. No or minimum QFS programs in place.

What type of calculations or formulas or matrix would someone use to determine a final "risk score" or "risk level" for these suppliers?

Hi JeremyJL,

:welcome:

Welcome to the IFSQN forums.

For FSSC 22000 certification the requirements stipulated in ISO 22002-1 Prerequisite programmes on food safety are not particularly prescriptive:

9 Management of purchased materials - 9.2 Selection and management of suppliers

There shall be a defined process for the selection, approval and monitoring of suppliers. The process used shall be justified by hazard assessment, including the potential risk to the final product, and shall include:

a) assessment of the supplier’s ability to meet quality and food safety expectations, requirements and specifications;

b) description of how suppliers are assessed;

NOTE Examples of a description of how suppliers are assessed include:

1) audit of the supplying site prior to accepting materials for production;

2) appropriate third party certification.

c) monitoring the performance of the supplier to assure continued approval status.

NOTE Monitoring includes conformity with material or product specifications, fulfilment of COA requirements, satisfactory audit outcomes.

Initially you could use a simple risk assessment of 3 x 3:

3 - High risk ingredient

2 - Medium risk ingredient

1 - Low risk ingredient

3 - No or minimum QFS programs in place

2 - Not GFSI certified, but has HACCP and GMPs and a few other QFS programs.

1 - GFSI certified

Multiply ingredient risk x supplier program

9 - Delist the supplier

6 - Audit or Full copy of audit and review, plus verify certificate

4 - ? Consider if Audit is necessary or there is sufficient evidence supplied of system or assurance by product testing prior to use

2 - Medium risk/GFSI Approve.

2 - Low risk/No GFSI  approve based on questionnaire with scope that includes product safety, product security and food defence, product authenticity, traceability, HACCP review and good manufacturing practices

1 - Approval based on low risk and GFSI

I would like to emphasise that the material assessment is very important as a first step. Risks to consider include:

allergens (allergen content and potential contamination/cross-contamination)

chemical, microbiological or physical contamination

variety or species cross-contamination

substitution or fraud

any risks associated with materials which are subject to legislative control (considering country of production and sale of finished product)

When considering these risks you also need to consider if the ingredient is subject to a process on site that eliminates or reduces the hazards identified to an acceptable level

When deciding the level of supplier assurance required then you will consider the risk as above but also:

History of supply

Level of compliance of the ingredient during the period of supply

Geographic origins (some origins may carry a greater risk due to less developed food safety controls)

Significance of the ingredient to the final product (such as flour in bread making, which fundamental to the quality of the finished product and therefore require higher levels of control to ensure consistent quality)

Volume/proportion of ingredient used

If claims are being made about the final product such as ‘organic’ or ‘allergen free’

My main concerns in supplier assurance are always hazards that are out of my control and are critical to food safety, for example a chocolate topping on a cake that is purchased and not processed on site but has the potential for Salmonella contamination.

Kind regards,

Tony

Hi Tony,

I sincerely appreciate you taking the time to reply and give me some examples. You've given me some things to think about!

Just as a thought experiment I built the attached risk matrix. The exact numbers/ratios/thresholds are all just placeholders and can be adjusted, but does the theory behind it make sense? Or am I just going in the wrong direction? Any glaring gaps?

I would appreciate any insight!

All the best,

Jeremy

Hi Jeremy,

I like the idea, your program score appears to be based on deductions which I do understand why some people/standards use, but at the same time they have ‘knockout’/’mandatory’ requirements. In this case a program can score 75% without a HACCP System in place, and that doesn’t really work for me. I would prefer to see compulsory elements in your program assessment.

Also, I’m not sure how you factor in my points in the previous post: ‘When deciding the level of supplier assurance required then you will consider the risk as above but also: … etc.’

Finally, I would ask yourself if you are adapting your system to suit your suppliers or are you looking to define minimum company requirements that you expect of your suppliers?

Kind regards,

Tony

Hi Tony,

Thank you for the feedback. I totally understand your concerns around a supplier being able to score 75% without having HACCP. Unfortunately, we do work with some suppliers of very low risk ingredients where they don't have a HACCP plan, and we are OK with that. So the absence of a HACCP plan being a "knockout" may not be feasible. I would need to fiddle with the numbers some more, but my hope would be that if a supplier does not have a HACCP plan, then they'd be considered "medium" risk at minimum, and therefore I would need to document any hazards (if any) and how they're being controlled.

Can you clarify what you mean when you say "I would prefer to see compulsory elements in your program assessment" - are you saying that you'd want to see a list of minimum requirements? (e.g., HACCP, Allergen Controls, etc.).

As for your other recommendations around needing to consider geographic origins, history of supply, level of compliance during the period of supply, significance of the ingredient to the final product, volume/proportion of ingredients used, etc. - thank you for pointing these out. I've never really worked with these attributes before, so it will take me a bit of time to figure out how to incorporate them into the matrix. Do you have any recommendations or ideas of how to incorporate these? Would quantifying them into the "QFS Program Score" make sense? Or should these be considered from a different angle entirely?

Lastly, to answer your question "I would ask yourself if you are adapting your system to suit your suppliers or are you looking to define minimum company requirements that you expect of your suppliers?" - I think I'm adapting it to suit my suppliers, which I suspect isn't the best way to approach it...  it's difficult because we have a very diverse portfolio of ingredient suppliers, so establishing minimum blanket requirements across the board is tricky. I'll need to ruminate on this a bit more.

Again, I appreciate your time and perspective!

Thanks,

Jeremy

Hi JeremyJL,

There may be some exceptions to the rule, can you give me an example of a very low risk ingredient where the supplier doesn’t have a HACCP Plan?

Regarding compulsory elements in the program assessment, yes I'd like to see a list of minimum requirements product safety/HACCP, product security/food defence, product authenticity, traceability, and good manufacturing practices. You could decide that your systems are robust enough to only require this for medium/high risk materials/suppliers and approval of low risk is by consideration of potential hazards and the supplier questionnaire.

When considering geographic origins, history of supply, level of compliance during the period of supply, significance of the ingredient to the final product, volume/proportion of ingredients etc. I think you can consider and note any relevant points as an additional column in your assessment. Examples:

Purchasing large quantities of a medium risk ingredient that goes into a large proportion of your products at a high percentage would make me treat the supplier as high risk.

Regarding geographic origins, you may want to increase the risk category of ingredients were there is a known risk or a history of problems.

Spices are a classic example where there have been micro and chemical contamination issues with spices from suppliers in South Asia:

Spices from India ‘could be contaminated with pesticide’

Spice Manufacturing: Racking up Contamination Violations

FDA Study: Some Imported Spices Contaminated With Salmonella

Of the spices sampled, contamination was most prevalent in imports from Mexico and India.

Other major contamination issues have been with Melamine in products/ingredients from China:

Melamine in milk products in China: Examining the factors that led to deliberate use of the contaminant

Melamine recalls shaped pet food trends, safety programs

Clearly if purchasing such ingredients you should be aware of previous food safety issues and apply suitable additional assurance such as ingredient/product testing in addition to closer scrutiny of suppliers from the region during your supplier assurance process.

Kind regards,

Tony