I had a similar situation during my desk audit. You should have access to the supplier's specifications for product, ingredients and packaging. For example, what storage parameters are required (ie. refrigeration, shelf-life, etc.), inherent hazards to the product or ingredients. You can use that information to conduct your hazard analysis and risk assessment. For example, a raw ingredient that has been implicated in a recall with Listeria may be grounds to include that ingredient as part of your raw material sampling and analysis plan.
As for the packaging, it should be relevant to the type of packaging and the risk to the product. For example, is film food grade? Are you using outer cases and shippers? If so, what are they made of? (ie. cardboard, is it food grade?).
You should review the ingredients, products, and packaging on a defined basis (verify) and adjust your risk assessment according to any changes you identify. Many operations have "part numbers" defined as part of inventory. You may need to get updates of newly added materials from your purchasing department.
You should have the specifications for each ingredient, product and package and the only way to get that is to knock on your supplier's door. In addition, you could include this info on Forms 1 & 2 of your HACCP plan and definitely in your risk assessment.