We are a single ingredient provider who sources almost all our products directly from the growers who plant under contract to our company (pulses, cereals and oilseeds).
These vary from medium sized corporates (small percentage) to sole-proprietor family-owned businesses. In our network, which is in the hundreds, there would not be a single GFSI certified company so we would be relying on a completed supplier questionnaire (which we've done for decades anyway).
The current questionnaire asks a series of food safety and quality issues, as does the contract that is completed prior to the purchase of the product (in most cases before the crop is even planted).
It seems to me that this would be sufficient but I would be interested in the views of others on this scenario.