Non-conformance against clause 2.4.4.8

Non-conformance: The facility has not identified the risk rating for raw material suppliers, packaging suppliers and contract service providers.

Auditor told me I could just add another column onto our registry for suppliers and contractors and rate the risk they pose (low, medium, high).

Is it really that simple? I feel like this isn't enough, and can't find anything on here when I search.

Please Advise.

Thank you so much in advance

Yeah it generally is. However note that your FSMA food safety plan does require a more formal hazard analysis for each category of ingredient.

It will depend on auditor as to how robust your "risk rating" system needs to be, but definitely not having one in general will give you a big 'ol NC.

Pretty much.

In my industry, I has only 4 ingredients and some packaging materials.  I put the packaging as 'low' risk, because food doesn't touch it, the ingredients that are used BEFORE a cook step as medium because cooking will help eliminate problems, and the 'after cooking' ingredients as 'high risk'.  Then I required a COA for the after cooking products to address their riskier nature.

Hi,this is Anil Dhawan from India. In case you feel just adding risk level is not enough you could carry out a brief analysis of some of the risk factors. In brief you can list the factors and if it adds up to (Low, Medium or High) that's the risk category for the supplier. The imp thing is to 'keep it simple' in order to avoid questions!