Summary
In short
- Approve a site and a material. Company-level approval permits supply from manufacturing locations nobody has assessed.
- Certification is a starting point, not the assessment. It confirms a system was audited against a scheme at a point in time and says nothing about your specific requirements.
- Agree the specification before approval, not after first delivery. A dispute about what was supposed to be supplied is much harder once product is on site.
- Risk-based approval means the evidence scales with consequence, and a low-risk material with a strong history does not need what a new supplier of a critical ingredient needs.
- Approval decays. Ownership changes, site changes, process changes and personnel changes all affect capability and none of them announce themselves.
- Where a supplier is a distributor or broker, the approval has to reach the actual manufacturer, or you have approved a relationship rather than a source.
What it is
What it is
What is a supplier approval record?
The record establishing that a supplier can consistently meet requirements for a specific material from a specific site: the evidence gathered, the technical requirements agreed, any trial or validation performed, and the approval decision with its scope and conditions.
Why does the approval scope matter?
Because the scope defines what the approval covers. A supplier approved for one material from one site is not thereby approved for another material, or for the same material from a different site, and unscoped approvals are how unassessed manufacturing locations enter a supply chain without anyone making a decision.
When to use it
When to use it, and when not to
This approves a supplier for a scope. Ongoing performance and audit sit separately.
Use it for
- Approving a new supplier for a specific material from a specific site
- Extending approval to an additional material or an additional manufacturing site
- Reassessing after ownership, site, process or certification change
- Approving distributors and brokers, where the manufacturer must also be identified
- Recording conditions or limitations attached to an approval
Not for
- Supplier audits, which are an input to approval and to ongoing verification
- Supplier performance monitoring, which tracks delivered quality over time
- Incoming material inspection and certificates of analysis
- The supply agreement and commercial terms
- Supplier risk assessment, which addresses dependency as well as hazard
Standards
What it is built against
Supplier control requirements appear across quality and food safety standards with a consistent risk-based structure.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.4.1 | Criteria for evaluation, selection, monitoring and re-evaluation of external providers, with records retained | Header |
| ISO 9001 cl.8.4.2 | Type and extent of control based on the effect on conformity of products and services | Evidence gathered |
| ISO 9001 cl.8.4.3 | Requirements communicated to the external provider before communication | Technical requirements |
| SQF Edition 9 cl.2.3 | Approved supplier programme with risk assessment, approval criteria and monitoring | Header |
| BRCGS Issue 9 cl.3.5 | Supplier and raw material approval based on risk assessment with defined approval procedures | Evidence gathered |
| 21 CFR 117 Subpart G | Supply chain programme where a hazard requires a supply chain applied control | Technical requirements |
| ISO 22000 cl.7.1.6 | Control of externally provided processes, products and services affecting food safety | Trial and decision |
| IATF 16949 cl.8.4.2.4 | Supplier monitoring with defined performance indicators and escalation | Trial and decision |
What it does not cover
- Supplier audits, an input to approval and to ongoing verification.
- Supplier performance monitoring, tracking delivered quality over time.
- Incoming inspection and certificates of analysis.
- Supply agreements and commercial terms.
- Supplier risk assessment, which addresses dependency as well as hazard.
Filling it in
Filling it in well
Define the scope precisely, scale the evidence to the risk, and agree the specification first.
Manufacturing site address, the specific materials covered, and any conditions: volumes, grades, packaging formats or seasonal restrictions. Then make the purchasing system enforce it, because an approval scope that exists in a quality file and not in the ordering process constrains nothing.
A new supplier of an allergen-containing ingredient for a ready-to-eat product needs more than a long-standing supplier of packaging outer cases. Risk-based approval is explicit in the standards and it is what makes the programme sustainable, because uniform requirements produce either an unmanageable workload or a token exercise.
Attributes, limits, methods, sampling, certification and what happens on a deviation. A specification agreed after product arrives is a negotiation with material already on site and money already committed, and it is settled on very different terms from one agreed while the supplier is still being selected.
Where the supplier is a distributor, broker or agent, identify the actual manufacturing site and apply the approval there. Otherwise the approval covers a commercial relationship, and the distributor can change source without breaching anything you have agreed.
Audit findings
Common audit findings
Supplier approval findings concentrate on scope and on what the evidence establishes.
| Finding | Clause | What fixes it |
|---|---|---|
| Approval granted at company level rather than site and material. | BRCGS 3.5 | Name the site; company approval permits supply from unassessed locations. |
| Certification treated as the assessment. | ISO 9001 cl.8.4.1 | It confirms a scheme audit at a point in time, not your requirements. |
| Specification agreed after first delivery. | ISO 9001 cl.8.4.3 | Requirements communicated before supply; afterwards it is a negotiation. |
| Uniform evidence requirements regardless of risk. | ISO 9001 cl.8.4.2 | Scale to consequence; uniform requirements produce a token exercise. |
| Distributor approved without identifying the manufacturer. | 21 CFR 117 Subpart G | Reach through; otherwise the source can change without notice. |
| Approval not reviewed after ownership, site or process change. | SQF 2.3 | Capability changes with all three and none announce themselves. |
| Approval scope not enforced in the purchasing system. | ISO 9001 cl.8.4.1 | A scope in a quality file constrains nothing at the point of ordering. |
| No trial or validation for a critical new material. | ISO 22000 cl.7.1.6 | Establish performance before commitment where consequence warrants it. |
| Allergen and regulatory status not confirmed at material level. | 21 CFR 117.135 | These attach to the material and the site, not to the supplier. |
| Emergency or temporary suppliers used outside the approval process. | BRCGS 3.5 | Define an expedited route with defined minimum evidence rather than an exception. |
Worked case
Case in point: the same company, a different plant
An ingredient supplier was approved on the strength of a site audit, current certification, specifications and satisfactory trial results. The approval was recorded against the company name.
Eighteen months later a quality investigation into an out-of-specification delivery established that the material had been manufactured at a second plant belonging to the same company, in a different country. The move had happened some months earlier for capacity reasons and had not been notified, because nothing in the agreement required it.
The second plant was not certified to the same scheme, used a different process for one step, and had never been assessed. No rule had been broken: the approval named a company, and the company had supplied the material.
Definitions
Definitions and key terms
- Approval scope
- The specific site, materials and conditions an approval covers, which defines what may be supplied.
- Risk-based approval
- Scaling the evidence required to the consequence of failure for that material.
- Supply chain applied control
- A preventive control applied by the supplier where the hazard is controlled before receipt.
- Second-party audit
- An audit conducted by the customer, scoped to the customer's requirements rather than to a scheme.
- Certificate of analysis
- Supplier confirmation of results for a delivered batch, which verifies rather than approves.
- Reach-through
- Identifying and approving the actual manufacturer where the supplier is a distributor or broker.
- Approval decay
- Loss of validity through ownership, site, process or personnel change occurring without notification.
- Expedited approval
- A defined shorter route with minimum evidence, used instead of bypassing the process under pressure.
FAQ
Frequently asked questions
What should an approval cover?+
A specific site and specific materials, with any conditions attached. Company-level approval permits supply from any manufacturing location the company operates, including ones with different equipment, controls and certification status that nobody has assessed. The scope also needs enforcing in the purchasing system, because a scope recorded only in a quality file constrains nothing at the point of ordering.
Is certification enough?+
No. Certification confirms that a management system was audited against a scheme at a point in time, by someone assessing conformity to that scheme rather than to your requirements. It is a useful starting point and it establishes a baseline, and it does not address whether the supplier can meet your specification for your application consistently.
How much evidence is enough?+
It scales with consequence. A new supplier of an allergen-containing ingredient for ready-to-eat product warrants far more than a long-standing supplier of outer packaging. Risk-based approval is explicit in the standards, and applying uniform requirements produces either an unmanageable workload or a process everyone completes without reading.
What about distributors and brokers?+
The approval has to reach the actual manufacturing site. Otherwise you have approved a commercial relationship, and the distributor can change source at any time without breaching anything, which is a common route by which unassessed manufacturers enter a supply chain invisibly.
When does an approval need revisiting?+
On ownership change, manufacturing site change, significant process change, loss or change of certification, and a pattern of performance issues. None of these announce themselves, which is why the agreement should require notification and why periodic reassessment exists as a backstop for the changes that were never notified.
The agents
What the agents do with it
The record approves a source. What fails is a scope naming a company and a source that moved without notice.
Holds approval scoped to site and material with conditions, and scales evidence requirements to the risk of the material.
Enforces the approval scope at the point of ordering, so an unapproved site cannot supply against an approved code.
Flags ownership, certification and site changes as approval review triggers rather than waiting for a periodic cycle.
Tracks certification expiry and scheme scope, distinguishing what certification establishes from what it does not.
This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.
Sources
Sources
- ISO 9001:2015 clause 8.4, control of externally provided processes, products and services
- SQF Edition 9 clause 2.3, approved supplier programme
- BRCGS Food Safety Issue 9 clause 3.5, supplier and raw material management
- 21 CFR 117 Subpart G, supply chain programme, FDA
- ISO 22000:2018 clause 7.1.6, control of externally provided processes, products and services