I too work as a consultant, but I also do BRC audits as a subcontractor for a certification body, including S&D.
With respect to the specifications question. You will definately need full specifications for any product which is sold under your client's own name. (W1.3.1) For products which are clearly sold under a manufacturer's or other distributor's own brand ,eg Heinz Baked Beans, you would not be expected to hold full specifications even if you could get them. The ground in the middle can get complex. If there is no clear name, or the product is sold loose, such as fruit and veg, it will be assumed that your client has title and you would be expected to have some form of specification. For fruit and veg, this could simply be the Class 1,2 etc specifications governed by DEFRA. If the product is packed by your client under one of their individual customer's names, again a full specification is needed. (The S&D Standard does cover loose foods such as fruit & veg, fish and meat which is broken down from large trays into smaller packs, but there are limitations to the scope)
Remember also that specifications are also needed for any relevant service as well as individual products.
Supplier approval and monitoring is required (S2.9.1), but the phrase "based on risk analysis" is used. Again using the example of Heinz Baked Beans, you would not be expected to audit or get a questionnaire from Heinz, but if your client buys the beans from a distribution company some form of approval or monitoring would be needed.
This may all change with Issue 2 and I have yet to go on the update course, but I hope it helps