Building a Risk-Based Supplier Approval Program (What SQF and BRCGS Actually Expect)
By Anu Bernier, is a food safety professional with decades of experience helping food and beverage businesses turn food safety principles into practical, effective systems. With deep expertise across GMP, HACCP, food safety management systems, regulatory requirements, and leading GFSI standards including BRCGS, SQF, and FSSC 22000, she brings both scientific knowledge and real-world industry insight to her work. Through her writing and training, Anu makes complex food safety topics easier to understand, offering practical guidance that professionals can confidently apply in their everyday operations.
Introduction
Approving a supplier on paperwork alone is one of the fastest ways to inherit someone else’s risk. Even sites with a strong approved-supplier binder on the shelf can still be exposed, because a stack of certificates isn’t the same thing as a controlled, risk-based program.
Both SQF and BRCGS treat supplier approval as a core requirement, not an administrative afterthought – and as an auditor, this is one of the areas where I most often see sites doing the minimum instead of what the standard actually intends.
What SQF and BRCGS Actually Require
Under the SQF Code (Food Manufacturing edition, clauses 2.3.4.1- 2.3.4.6), sites must operate a documented Approved Supplier Program that assesses supplier risk before approval and monitors performance on an ongoing basis — SQFI’s own guidance describes an approach that scales with risk, from a solid supply history and third-party certification review, up to personally auditing higher-risk suppliers.
BRCGS Global Standard for Food Safety Issue 9 covers this under Section 3.5, “Supplier and raw material approval and performance monitoring.” Issue 9 broadened the scope beyond safety, quality, and legality to explicitly include authenticity, and requires that the approval method – certification, audit, or a documented risk based questionnaire – be proportionate to the risk the supplier or ingredient represents.
Neither scheme prescribes the exact mechanics. GFSI’s Benchmarking Requirements set the expectation that supply chain risk is controlled, but leave the operational “how” to the individual standard. What both schemes share is the underlying principle: approval has to be evidence-based and risk-based, not a box-checking exercise.
Worth noting: SQF Edition 10 was published in March 2026, with mandatory audits expected from January 2027. It’s worth keeping an eye on for any renumbering of the supplier program clause as more detail becomes available from SQFI.
Start With Ingredient and Supplier Risk
Not every ingredient – or every supplier – carries the same risk. A robust program starts by asking:
- Ingredient risk: Is this an allergen? A ready-to-eat ingredient added post-kill-step? High moisture? Imported? A commodity known for fraud or adulteration (olive oil, honey, and spices are recurring examples in CFIA’s own food fraud testing)?
- Supplier risk: What’s their certification status, audit history, country of origin, and track record for transparency and responsiveness?
The point isn’t to treat every supplier identically – it’s to put your tightest controls where the risk is genuinely highest.
Verify Certifications the Right Way
A certificate handed to you by a supplier is only as good as your ability to confirm it’s real and current. Both major certification bodies now offer direct verification tools:
- SQF: the SQF Assessment Database and Certification Body Directory (sqfi.com)
- BRCGS: the BRCGS Directory, including BRCGS Verify, where certificates are uploaded directly by certification bodies and updated in real time – specifically designed to eliminate the risk of forged or expired certificates
Checking the directory takes a few minutes and closes a gap that paperwork alone can’t.
Evidence, Not Assumptions
COAs, audit reports, spec sheets, and test results should actively confirm – not just imply – that a supplier can consistently meet your safety expectations. Practical ways to go beyond the file:
- Test incoming product and confirm the results actually align with the supplier’s CoA.
- Trend receiving temperatures over time, not just spot-check them.
- Audit the supplier, onsite or remote – even a short, risk-based audit can surface gaps a certificate won’t show.
- Request batch-specific documentation: allergen statements, metal detection or foreign-material logs, sanitation verification, or environmental monitoring summaries.
When a Supplier Falls Short
Every program eventually hits this moment a missed COA, a failed spec, a customer complaint traced upstream, or an audit finding. What you do next is what separates a reactive program from a genuinely risk-based one:
- Act on performance signals early. Late paperwork, failed specs, and rising complaint rates are leading indicators – don’t wait for them to become a bigger issue.
- Require a real CAPA. Root cause, correction, preventive action, and evidence of effectiveness. “We’ll do better” isn’t a corrective action.
- Reassess the risk level. A high-risk ingredient paired with a declining supplier justifies tighter controls, or a temporary suspension.
- Know when to remove a supplier. If issues repeat, or the risk stays uncontrolled, both SQF and BRCGS expect you to be able to demonstrate a risk-based decision – even if that decision is to walk away.
- Document everything. Decisions, communications, CAPAs, and re-evaluations are exactly what an auditor wants to see – not perfection, but control.
Approval Isn’t Forever
Re-evaluation should be triggered by performance, not just a calendar reminder. Certificates lapse, ownership changes, and a supplier that was low-risk two years ago may not be low risk today. Strong documentation is good. Independent verification – testing, trending, and the occasional audit – is better.
Sources & Further Reading
Let's Strengthen Your Food Safety - Together
Partner with experienced consultants, auditors, and trainers to strengthen your systems, protect your brand, and build a food safety culture that lasts.