Dear Zapate,
Ah!, the notorious BRC risk assessment again. This has a variety of acceptable practical interpretations ranging from the super-complex to the mundane. The preferred option may depend on yr specific product-process situation, eg fish, vegetables, RTE etc. There are several quite detailed official schemes already presented on this forum, most of which lead to an appropriate sampling frequency based on a menu of standardised (risk oriented) questions.
If you wish to do it on yr own, I can suggest a basic, Two-Stage Procedure –
(1) Initial Evaluation of Suitability via a minimum menu of, for example, (a) possession of appropriate cetifications such as ISO 9001, ISO 22000, other GFSI approved standards (b) satisfactory audit, © satisfactory product specifications, (d) satisfactory samples
(2) Operational Evaluation of Suitability via (a) use of supplier grading procedure based on overall, time-based, eg monthly, average defect levels, eg 1%, 3%, 5% lot rejections, (b) a subsidiary evaluation / corrective action procedure within (a) prioritised on HACCP safety aspects, eg safety/non-safety factors.
The above basic format has been utilised by organisations for many years in different ways.
Elements 3.6.2 - .3.6.4 can be included within this overall scheme.
Rgds / Charles.C
PS BTW, Welcome to the Forum! 