Hi GMO,
I’m not sure that the suppliers you mention were low-risk? Normally I would NOT consider a supplier of primary packaging a low-risk supplier or primary packaging a low-risk raw material. Also, I would expect all my suppliers of primary packaging to have certification to a GFSI-benchmarked standard with a scope that includes the packaging supplied.
By definition low-risk materials/suppliers are not a priority for site audits.
There may be hundreds of raw materials/suppliers to assess so we prioritise supplier approval and monitoring based on our risk assessment: High-risk>Medium-risk>Low-risk
Our Supplier Approval Strategy may be:
Highest risk - we decide to conduct a site audit and require certification to a GFSI-benchmarked standard
Medium risk - we require certification to a GFSI-benchmarked standard
Low risk - we prefer certification to a GFSI-benchmarked standard but may accept certification to ISO 22000 or ISO 9001 and a completed supplier questionnaire covering relevant other information.
Clearly, we would prefer to have all suppliers certified as above but in certain circumstances we may accept a low risk raw material/suppler without any certification via a completed supplier questionnaire which includes relevant information provided we had a history of supply with no issues and the incoming raw material was monitored to the extent that any food safety risks would be identified.
I didn’t realise that you were a pioneer of food safety culture, I thought I was there 10 years before you!

Kind regards,
Tony