GFSI Supplier Approval Audit Readiness Scorer
Auditors spend up to 30% of their on-site inspection reviewing your supplier approval files. Self-diagnose compliance gaps against SQF Edition 9 Module 2 and BRCGS Issue 9 Section 3.5 before your certifying auditor arrives.
SQF Edition 9 vs. BRCGS Issue 9: Supplier Compliance Matrix
Clause-by-clause regulatory cross-reference identifying the specific mandatory requirements enforced across global GFSI audit schemes.
| Compliance Domain | SQF Edition 9 | BRCGS Issue 9 | Core Mandated Requirement | Auditor Verification Focus |
|---|---|---|---|---|
| Documented Supplier Approval Procedure | SQF Ed 9 Clause 2.3.4.1 | BRCGS Issue 9 Section 3.5.1.1 | A fully documented procedure defining criteria for approving, monitoring, and delisting suppliers of raw materials, packaging, and services. | Checks procedure revision date, PCQI signature, and whether delisting criteria are clearly defined. |
| Raw Material Hazard Risk Assessment | SQF Ed 9 Clause 2.3.4.2 | BRCGS Issue 9 Section 3.5.1.2 | Documented hazard analysis assessing biological, chemical (allergens, mycotoxins, heavy metals), and physical risks for each raw material. | Reviews risk assessment matrices to verify that risk tiers (High/Med/Low) are objectively justified by historical data. |
| Third-Party Auditing of High-Risk Suppliers | SQF Ed 9 Clause 2.3.4.3 | BRCGS Issue 9 Section 3.5.1.3 | High-risk suppliers must be approved via valid GFSI certification, or an on-site audit conducted by an experienced food safety auditor. | Verifies active GFSI certificate, accredited CB seal, unannounced audit status, and review of minor corrective actions. |
| Ongoing Supplier Performance Monitoring | SQF Ed 9 Clause 2.3.4.4 | BRCGS Issue 9 Section 3.5.1.4 | Continuous monitoring of incoming batch compliance, analytical COA variance, on-time delivery quality, and corrective action response times. | Examines historical receiving logs for rejections and verifies documented supplier root cause investigations. |
| Emergency Raw Material Purchasing Protocol | SQF Ed 9 Clause 2.3.4.5 | BRCGS Issue 9 Section 3.5.1.5 | Documented protocol permitting emergency procurement from non-approved suppliers under restricted QA risk assessment and release. | Audits emergency release log to confirm that material was tested, quarantined, and authorized by the QA Director prior to use. |
| Approved Supplier Register (ASL) Maintenance | SQF Ed 9 Clause 2.3.4.6 | BRCGS Issue 9 Section 3.5.1.6 | A live, verified register of approved suppliers specifying manufacturer site address, approved SKUs, risk rating, and approval status. | Samples 5 random receiving receipts from warehouse docks and matches supplier names against the current register. |
6 Mandatory Focus Areas Evaluated During Site Audits
Ensure your quality management documentation meets or exceeds these baseline verification criteria.
Does the register reflect the exact manufacturing plant address (not just corporate broker sales office)? Is the register version controlled?
Are all GFSI certificates, Letters of Guarantee, and Liability Insurance binders current and verified within the past 12 months?
Do written specifications exist for every raw material and packaging SKU? Have they been formally reviewed within the statutory 3-year window?
Are delivery COAs reviewed and signed off against specification limits before inventory is released into batch processing?
Is the hazard evaluation methodology quantitative and repeatable, or does it rely on subjective qualitative guesswork?
Can your team execute a complete trace-back and trace-forward mass balance recovery of an ingredient lot within 240 minutes?
Top 8 Supplier Approval Audit Pitfalls & Major Findings
Review the primary non-conformance patterns cited by SQF and BRCGS certification auditors.
| Audit Pitfall / Defect | Severity Level | Audit Score Impact | Mandatory Corrective Action (CAPA) |
|---|---|---|---|
| 1. Lapsed GFSI certificates on active raw material suppliers | Major Non-Conformance | Deduction of 10 points on SQF score; mandatory 30-day CAPA submission and potential re-audit fee. | Implement automated 60-30-14 day renewal notices with secure magic-link upload portals. |
| 2. Receiving goods from an unapproved vendor or alternate plant | Major Non-Conformance | Auditor cites facility for receiving goods from an unverified manufacturing site masked by a corporate sales office. | Lock ERP receiving docks so purchase orders cannot be received without verified ASL approval status. |
| 3. Outdated raw material specifications exceeding 3-year review cadence | Minor Non-Conformance | Cited under BRCGS Clause 3.6.1 for failure to maintain current technical ingredient agreements. | Establish digital document lifecycle workflows prompting annual technical specification reviews. |
| 4. Accepting supplier questionnaires in lieu of audits for high-risk goods | Major Non-Conformance | Both SQF and BRCGS forbid self-assessment questionnaires as sole approval for High-Risk ingredients. | Mandate independent accredited 3rd-party GFSI audit reports for all high-risk food raw materials. |
| 5. Inability to produce completed corrective action reports (CAPA) | Major Non-Conformance | Suppliers with identified minor non-conformances lack documented closure evidence, invalidating audit certification. | Require suppliers to upload full audit reports including documented CB corrective action sign-offs. |
| 6. Missing PCQI annual re-evaluation approval sign-offs | Major Non-Conformance | Auditors cite plants where certificates were collected but no documented review or QA sign-off occurred. | Enforce cryptographic digital signatures for annual supplier re-approval workflows. |
| 7. Uncontrolled emergency purchasing releases | Major Non-Conformance | Emergency purchase protocol abused beyond statutory limits without documented QA risk assessment. | Formalize emergency conditional release logs with 48-hour expiration limits and mandatory QA Director approval. |
| 8. Receiving dock staff unloading trucks without live ASL visibility | Major Non-Conformance | Dock workers unload shipments from suspended vendors because they were never notified of ASL status changes. | Provide warehouse receiving docks with live digital ASL lookups integrated with handheld barcode scanners. |
Internal Audit to CAPA Resolution SOP (SQF 2.5.5 / BRCGS 3.4)
Under GFSI rules, conducting an annual self-assessment is mandatory. When gap scores reveal non-conformances, QA teams must follow this 4-step corrective action resolution protocol.
1. Gap Identification & Scorecard Logging
Record all deficit findings in your internal audit register. Export the timestamped scorecard from this tool to provide objective evidence of assessment date and reviewer identity.
2. Root Cause Analysis (5-Why Method)
Determine why the gap occurred (e.g. why did a certificate expire? Lack of automated reminders vs. vendor failure to reply). Superficial fixes without root cause analysis are rejected by auditors.
3. CAPA Implementation & Verification
Execute systemic fixes (such as implementing automated vendor upload portals) within 30 days. The QA Manager must verify and sign off that the corrective action is effective.
GFSI Audit Scoring Mechanics: SQF vs. BRCGS Deduction Logic
Understand the direct mathematics behind audit grading and how supplier approval defects jeopardize your facility's certification tier.
| Non-Conformance Level | SQF Edition 9 Impact | BRCGS Issue 9 Impact | Mandatory Closure Window |
|---|---|---|---|
| Minor Non-Conformance | Deduction of 1 point (Score remains 99/100) | Up to 5 minors tolerated for Grade AA | 30 calendar days (SQF) / 28 days (BRCGS) |
| Major Non-Conformance | Deduction of 10 points (Disqualifies from Excellent) | 1 Major drops grade to B; 2 Majors drop grade to C | Mandatory re-audit within 30 - 60 days |
| Critical Non-Conformance | Automatic audit failure & certificate revocation | Uncertified status; immediate customer notice | Immediate suspension; full re-certification required |
10-Point On-Site Auditor Inspection Checklist
Lead auditors verify these 10 physical and digital records during the supplier management review session.
1. Approved Supplier Register
Live list detailing physical site addresses, approval dates, risk tiers, and PCQI signature records.
2. Valid GFSI Certificates
Certificates with active dates matching current receiving calendar and accredited CB marks.
3. Signed Technical Specs
Dual-signed specification documents with microbiological and chemical tolerances on file.
4. Receiving COA Verifications
Dock receiving logs proving lot COA parameters were checked prior to manufacturing release.
5. Annual Risk Assessments
Quantitative hazard evaluation matrices justifying High, Medium, and Low risk classifications.
6. Emergency Purchasing Logs
Documented risk assessments and QA Director written authorizations for emergency loads.
7. Allergen Matrix Declarations
Signed Big 9 allergen declarations (including sesame) updated within the preceding 12 months.
8. 4-Hour Mock Recall Dossier
Annual exercise dossier proving 100% mass balance reconciliation completed under 240 minutes.
9. Full 3rd-Party Audit Reports
Complete 40+ page audit reports from accredited bodies with evidence of minor NC closures.
10. Supplier CAPA Trackers
Documented corrective action tracking for out-of-spec deliveries and packaging defects.
Frequently Asked Questions About GFSI Readiness
Practical guidance on navigating SQF Edition 9, BRCGS Issue 9, and third-party certification audits.
What are the top supplier-related non-conformances in SQF and BRCGS audits?
Historical audit data shows the top 3 supplier non-conformances are: 1) Lapsed third-party audit certificates on active raw material vendors; 2) Inadequate hazard evaluations that fail to justify why a supplier was deemed Low Risk; and 3) Missing raw material specifications or unverified Letters of Guarantee older than 12 months.
How does an auditor verify an Approved Supplier Register?
During the site audit, the auditor pulls 5 to 10 random receiving lot records from your warehouse dock and checks every single supplier against your Approved Supplier List. If any vendor is unapproved, unverified, or operating under expired certificates, a Major non-conformance is issued.
Can this tool scorecard be presented during an audit as proof of internal audit verification?
Yes. Both SQF (Clause 2.5.5) and BRCGS (Section 3.4) mandate annual internal audits of the supplier approval program. Printing this timestamped scorecard serves as objective evidence of proactive internal program verification.
What constitutes a Major Non-Conformance in SQF Edition 9 Clause 2.3.4?
A Major non-conformance is issued if a facility receives raw materials from an unapproved supplier without documented emergency approval, or if high-risk raw material suppliers lack annual third-party GFSI audit verification.
How does Evidlane assist in achieving an SQF Excellent rating?
Evidlane automates real-time ASL validation, enforces mandatory PCQI digital sign-offs, tracks certificate expiration dates with automated reminders, and generates auditor-ready evidence dossiers in seconds.
What is the difference between Desk Audits and On-Site Facility Audits?
A Desk Audit consists of reviewing documentary evidence (GFSI certificates, questionnaires, COAs, HACCP plans) from a distance. An On-Site Audit involves physical inspection of the supplier’s processing floor, sanitation practices, and employee hygiene by an accredited auditor.
How often must ingredient technical specifications be re-approved?
BRCGS Clause 3.6.1 mandates formal review of raw material specifications at least every 3 years, or whenever a change in formulation, process, or supplier manufacturing site occurs. SQF best practices encourage annual re-affirmation.
Can an unannounced audit lead to automatic certificate suspension if failed?
Yes. A Critical non-conformance identified during an unannounced GFSI audit results in immediate certificate suspension or revocation, requiring notification of all customers within 24 to 48 hours under SQF and BRCGS mandatory reporting rules.
What proof is required for temporary emergency supplier approval?
Emergency approval requires a documented risk assessment, temporary physical quarantine of inbound lots, mandatory composite analytical testing against technical specs, and formal written authorization by the plant QA Director.
How does automated supplier software protect against human spreadsheet error?
Spreadsheets lack audit trails, user access controls, and automated alert hooks. Software platforms enforce relational data integrity, automated timestamped change logs, and ERP webhook blocking that eliminates human oversight.
How do we demonstrate objective ongoing supplier performance monitoring to an auditor?
Under SQF 2.3.4.4 and BRCGS 3.5.1.4, auditors require quantifiable vendor scorecards tracking delivery acceptance rates, analytical COA compliance, packaging integrity non-conformances, and turnaround times for corrective action requests (CARs).
What is the formal procedure to appeal an unjustified audit non-conformance?
If a lead auditor issues a non-conformance that contradicts the written scheme guidance, facilities have 14 calendar days from the closing meeting to submit a technical appeal to the certification body’s compliance committee, accompanied by objective historical records and PCQI signed justifications.
Ensure 100% GFSI Supplier Compliance with Evidlane
Automate vendor certificate renewals, hazard matrices, receiving dock integrations, and 1-click audit binder generation.