We are also going through this process. I incorporate supplier risk assessment into our supplier approval process and risk rate using the following criteria:
SUPPLIER RISK ASSESSMENT CRITERIA
Certification to GFSI recognised standard (select the most appropriate option)
Yes/No/NA
Comment
1. BRC Grade AA+ OR
2. IFS Unannounced Higher Level
1. BRC Grade AA or A+ OR
2. IFS Announced Higher level OR
3. SQF Level 3
1. BRC Grade A OR
2. FSSC22000
1. BRC B+, C+, D+ OR
2. IFS Unannounced Foundation level
1. BRC B, C, D OR
2. IFS Announced Foundation level OR
3. SQF Level 2
Max Possible Score
120
Supplier QA documentation (select the all applicable options)
Completed questionnaire and supporting documents received & satisfactory OR Most recent certification audit report
Summary of
HACCP plan and process flowchart indicating
CCPs or equivalent acceptable
Up-to-date product specifications with all information required for product approval acceptable
Recent certificates of analysis showing results within acceptable limits received
Satisfactory batch identity and traceability system in place
Max Possible Score
20
Origin of products supplied (select the most appropriate option)
All products from country(ies) with known history of strict control
All or Some products supplied from country(ies) with known history of less control
All or some products supplied from country(ies) with known history of poor control or with no known history
Max Possible Score
10
2nd Party Audit (select the most appropriate option(s))
Most recent Supplier Audit score (>90%)
Most recent Supplier Audit score (70 -89.9%)
Most recent Supplier Audit score (<70%)
Most recent Customer Audit Passed
Max Possible Score
50
Supplier history (select the most appropriate option)
Existing supplier with no previous history of food safety and/or quality issues
Existing Supplier with history of minor quality issues
New Supplier; Existing supplier with history of major food safety or quality
Max Possible Score
25
Compliance with Customer requirements (select the all applicable options)
No complaints OR % Customer complaints closed >95% (past 12mths)
No complaints OR Avg Complaints resolution timeline (< 7days)
Supplier CPMU within target
No out of spec results since approval or last review
No Customer rejections since approval/last review
Max Possible Score
25
Total Score
0
I then assign a risk rating (High, Medium, Low) based on the total score. High risk to be reviewed annually, medium every 2 yrs and low risk every 3yrs.