For supplier approval, the standard lists accreditation to a GFSI-benchmarked standard, supplier audits, or (for low risk suppliers only) SAQs as approval criteria, but version 8 doesn’t define the validity period for approval. Where suppliers are approved based on accreditation to a GFSI-benchmarked standard, you’re generally expected to renew approval at the expiry of their accreditation certificate… But there’s nothing to indicate how long a supplier could remain approved on the basis of 1st party audit, for example, so your best bet would be to define that for your own site in your supplier approval and performance monitoring procedure.
In terms of raw material approval, there are a couple of clauses that you can look at together:
The raw material specification has a validity period of 3 years (clause 3.6.4)
Clause 5.5.1.1 states:
“The risk assessment shall form the basis for the raw material acceptance and testing procedure and for the processes adopted for supplier approval and monitoring.
The risk assessment for a raw material shall be updated:
• when there is a change in a raw material, the processing of a raw material, or the supplier of a raw material
• if a new risk emerges
• following a product recall or withdrawal, where a specific raw material has been implicated
• at least every 3 years.”
So, at a minimum, the raw material risk assessment must be updated every 3 years.
The raw material vulnerability assessment has to be formally reviewed annually (clause 5.4.2)