Based on our experience on our last audit June 2018 against BRC7, we have minor NCs due to the foreign supplier that are not GFSI scheme certified. We only send questionnaire, but the auditor did not accept our procedure. He cited that a supplier that is not GFSI certified, cannot be rated as LOW RISK supplier, and it should be audited by us (buyers) of the HACCP program and traceabilty.
Our CA on that NC is to revised our procedure and it states that all suppliers that is not GFSI scheme certified must be audited at least annually by third party auditor or by us.
He okayed the CA and we have our grade A certificate.
I don't think the auditor was correct or they considered that the products/suppliers were not low risk:
BRC 7 184.108.40.206: The approval and monitoring procedure shall be based on risk and include one or a combination of:
• certification (e.g. to BRC Global Standards or other GFSI-recognised scheme)
• supplier audits, with a scope to include product safety, traceability, HACCP review and good manufacturing practices, undertaken by an experienced and demonstrably competent product safety auditor
or, for suppliers assessed as low risk only, supplier questionnaires.
Where approval is based on questionnaires, these shall be reissued at least every 3 years and suppliers will be required to notify the site of any significant changes in the interim.
Where risk assessment (completed as part of this clause) indicates that a supplier is low risk (e.g. due to history of trading with the site, the nature of the raw materials traded etc.) the completion of a supplier questionnaire may be sufficient. If a supplier questionnaire is the only mechanism used to assess a supplier (i.e. there are no additional activities such as supplier audits) then it is important that the questionnaire (and replies from the ingredient supplier) contains all the relevant information to allow the site to confidently make a decision on approval.
For BRC 8 (effective from 1st February 2019) 220.127.116.11: The approval procedure shall be based on risk and include either one or a combination of:
• a valid certification… etc.
• supplier audits …. etc.
• where a valid risk-based justification is provided and the supplier is assessed as low risk only, a completed supplier questionnaire may be used for initial approval. The questionnaire shall have a scope that includes product safety, traceability, HACCP review and good manufacturing practices, and it shall have been reviewed and verified by a demonstrably competent person.
Similar to BRC 7 but note: The auditor will expect to see, and will challenge, risk assessments.
Either way I think you have introduced a more robust system now so that can only be for the good