Hi, there are various risk assessment templates out there (including on here) so I'd use one to assess what controls are in place.
I'd include things like:
- Are your traders certified to a specific GFSI scheme for agents or brokers? And is the thing you're buying from them in scope?
- What is the specific risk to food safety, quality or authenticity of the ingredient or class of ingredients? So certain things are higher risk and they may prompt the supplier to be overall higher risk. (I would have a risk assessment of materials classes to feed into this.)
- Specifications for all materials must be obtained including where it's sourced from or where it was last "changed". Do not allow open market sourcing... And appropriate approval of that original supplier to GFSI standards within scope for the material. Personally though I'd want to know as much as I could. So if you had ground spices from the broker and the previous supplier just repacked them, I'd want to know where the original grinding took place.
- Ideally, because I'm risk averse, I'd want to know the length of the supply chain. I don't think any standard asks for this but I think it's a good idea to know to determine risk.
If no to question 1, I'd conduct your own audit with a scope of HACCP, trace, security, food defence, authenticity (probably one of the key issues for brokers) and general GMP (pest management particularly can be poorly controlled by some trading operations as they often are large sites with poor door control lacking the food safety expertise.) The trace exercise should include their supplier(s).
For ongoing supplier monitoring, this isn't necessarily done by you, possibly better from procurement (but they need to document) I would include on whatever period you deem appropriate:
- Any issues on product safety, legality, authenticity and quality (e.g. any complaints, any change in certification status, any serious issues not impacting site but they have dealt with internally etc.)
- Any non conforming materials delivered to you with CAPA
- Known risks (e.g. updates on authenticity testing and intelligence for spices might be key)
- Horizon scanning (they are more likely to know what's going on in their procurement than you are. This should include emerging concerns around availability.)
