Dear Tatjana,
What you need for information from your suppliers depends on:
1) the products they are supplying to you,
2) the risks you have identified,
3) the standard you are certificated,
4) the standard the supplier is certificated and
5) legal requirements.
For ALL products, ingredients, raw materials and packaging materials you will need a thoroughly product specification indicating at least product description, ingredients, treatment, storage conditions, allergens, GMO statement (can also be a separate document), shelf life, microbiological parameters and chemical parameters.
From ALL suppliers you need name, address, phone number, contacts, etc. and you need to have evidence of your approval. If in your procedure supplier approval is stated that you approve your suppliers based on valid certificates, these should be present. If you approve suppliers based on audit reports, these should be present. Etc
Further you might want to know who you need to be contacted in case of emergency or recall. Within and outside operating hours.
ad 1) depending on the products or services you might need more information based on your risk assessment or based on legal requirements.
ad 2) depending on your own hazard identification and risk assessment, you need information from your supplier how he has covered the hazards/risks. E.g. if you are buying processed vegetables and you have identified the hazard of pesticide in this raw material/product, you might want information from the supplier how he has covered this hazard. Perhaps you might also want to know, based on your hazard identification/risk assessment, if there is a metal detector or Xray and on what limits it is set. If you have a thoroughly working metal detector yourself, this information might not be relevant to you.
Ad 3) the standards have requirements on the information you want from your suppliers. E.g. BRC is requiring food grade statements for packaging materials and other materials in contact with your products, contracts with service suppliers, audit report or certificate from raw material suppliers, etc. (note: issue 7 want you to know the allergen status of lubrications (4.7.6)) in general GFSI standards wants your suppliers to be certificated against GFSI certificate.
Ad 4) If your supplier is ISO 22000 or HACCP certificated. You only know that they have a HACCP based management system. You have no information for this suppliers regarding preventing metal contamination, sample plans etc. You might want this information depending on 2 and 3 above.
If your supplier is ISO 9001 certificated you only know they have a quality management system. HACCP would not have to be part of this.
Ad 5) depending on the type of product, there are legal requirements. E.g. approval to supply within Europe (facility code) for meat, fish and dairy. Histamine analyse reports for Tuna, Aflatocin analyse reports for peanuts, etc.
Regarding certificates. If you are approving your suppliers by certificates. You need to check the validity of the certificates. A possibility is to request a copy of the new certificate if the old one is expired. There seems to be a lot of false certificates and to be honest, I am sure that I myself, without any specific knowledge of graphic design, can make a false certificate. Therefore it is better and easier to check this on the website of the standard owners. E.g. for Global Gap and BRC the directories are public accessible and easy in use. IFS portal is AFAIK only accessible for IFS certificated companies. I have no information about other standards.
If you receive certificates from suppliers, please check if the products supplied to you, fit in the scope of the certificate and if the address of the certificate is indeed the address of the facility producing the products you buy.
Regarding frequency of requesting this information from your supplier:
Some information does not change and there might be no need to ask for this more than once in a couple of years. E.g. contract, contact persons, EG-approval numbers. GFSI certificates have a validity of 1 year, so you need to refresh the information annually, by asking your supplier or by checking on directories of the standard owners.
Specifications need to be actual and correct. These have to be updated every time the product change or if legal requirements change. Next to this, it is common, if the product is not changed, to ask for a updated specification at least every 3 years.
