What’s your approach to managing and documenting supplier assurance for small or artisanal producers with limited technical documentation?

[Sam]

Many companies source from small-scale suppliers, but ensuring they meet technical or audit requirements (like BRCGS or GFSI) can be tricky.

 

[Steph]

Hi Sam, my approach would be to find a reputable advisor for the business who could come in and assist on an ad-hoc basis to provide the knowledge and service they need. This would be a cheaper option than looking for full-time support, but would ensure that they can meet the standards required.

 

[Cathy Gladwin]

Great question and @Steph is quite right that advisors / consultants can always support, since the question specifically states that we're talking about small businesses here. If we're talking about a typical certified business being the customer and the artisan supplier of raw material / ingredients being the supplier, then we are typically looking for the 3 options of supplier approval:

1. the supplier has GFSI certification - definitely not the case when (as Sam states), they have limited technical docs.
2. the supplier has been audited (non GFSI 3rd party audit or the buyer has audited them. This is again a solution - it's unlikely they have any certification but the buyer can absolutely conduct the audit if the auditor is trained and competent and this can provide great assurance of the suppliers manufacturing skills in creating a good, safe and legal product.
3. where an audit isn't practical or feasible, maybe due to distance (although we always advise that a remote audit is better than just a questionnaire), then there's the questionnaire approach that is very common and not an issue at all - as long as...

• the supplier and the product in question is low risk (risk assessment needed here)
• the questionnaire is comprehensive
• the completed questionnaire is assessed by a trained and competent person

I really don't think that we want to say no to doing business with local suppliers who have fantastic creative skills in making beautiful product. It only takes a little effort in getting those documented assurances in place to be able to approve them.

 

[Laura]

'where an audit isn't practical or feasible, maybe due to distance (although we always advise that a remote audit is better than just a questionnaire), then there's the questionnaire approach that is very common and not an issue at all - as long as...

• the supplier and the product in question is low risk (risk assessment needed here)'

1. How is the risk assessment done for products? We only sell textiles. In comparison to food, our textiles are low risk products. But If I compare basic Tshirts to UV-protection swimwear I would evaluate the UV-protectio clothing as higher risk product. So what does the BRCGS (Agents & Brokers) want me to compare in my product risk analysis? Or are textiles (clothing and hometextiles) generally classified as low-risk products?

2. For non-food products assessed as low-risk the BRCGS Agents&Brokers also gives the option to use a 'legally enforcable contract/specification from the supplier' as supplier approval. Does it mean a contract would be enough? There are no requirements what the contact must inculde?

 

[Cathy Gladwin]

Hi @Laura thanks for your question - you won't be the only one wondering how to go about this.
BRC's agents and broker standard is pretty flexible on this because they are quite practical. They know that when you need to buy and sell products, you need to be able to function as a business. BRCGS is giving us deliberate flexibility on this point.

A contract is simply an agreement that's enforceable, right? Even if that's an online purchase then it's all the details supporting that online purchase. Just as an example I say I talk about online purchase because this is the way the world works now. Although there is no definition in the glossary for contract, the clause is giving us the other option of specification, as you rightly pointed to. The glossary says this about a specification: An explicit or detailed description of a material, product or service. Again whether you purchase via an email quote, which gives you all the necessary information you need about the material, or whether you make an online purchase and the product listing gives you all the information you need to ensure that you get the product you thought you were going to get, then that clause is covered.

To answer your question more specifically, what a contract or specification must include is enough information for you to be satisfied that you're going to get what you need. If you don't, you can go back to the supplier and complain. I bet you can imagine how very different this would be for a paper clip versus a mobile phone and that's why BRCGS can't be specific. They're happy to give you flexibility so you can apply your expertise here. Your example of the UV-protection clothing is perfectly demonstrating your expertise. Apply that in a simple document showing what you believe to be low vs high risk items or properties of those items and the auditor is going to be happy. They know that sites are the experts and it's only where they see a risk that the site hasn't addressed that a non-conformity is then a possibility.

Last point to make here, clause 3.7.4 in the A&B standard even allows for a historical trading relationship (again, only for something you have assessed as low risk). I like this, very practical. If you've been buying those Tshirts from your supplier for a few years and everyone is happy with the product and the service, why change anything. Just pop that in your risk assessment and Voilà.

 

[Laura]

I am a little bit confused by the wording of the Interpretation Guideline concerning clause 4.1.2:

'The acceptable methods of supplier approval will be dependent on the product type and the risk
associated with the product (i.e. the output of clause 4.1.1). Supplier approval must be based on: .....'

That sounds as if only a product risk assessment would be necessary.

But what I understood from the BRCGS Agents and Brokers Clause 4.1 is, that:

- 4.1.1 requires a risk assessment for suppliers inculding the 6 named criteria
- first criteria is 'the nature of each product and its associated risks' : means a product risk analysis is only the first step and needs to be included in the 'supplier risk analysis'
- based on the identified risks on supplier level(classification into low risk supplier/medium risk supplier/ low risk supplier?) supplier approval must be based on the the requirements named in clause 4.1.2

4.1.7 names the criteria for ongoing review.

To me these are 4 different steps needs to be done.

Can someone help to clarify?

 

[Cathy Gladwin]

@Laura you're right, all 4 steps are included in the overall process. And although it sounds like the standard is using "product" and "supplier" almost interchangeably, it's because we can't assess one without thinking about the other. Take your UV protection clothing example you gave us before. Say you have two suppliers, one in country A making the UV claims and another in country B (I had named these countries but then thought it unfair to generalise) - but you do your risk assessment and look at the likelihood of fraud related to your two suppliers. Country A's products cost a lot and similar products with the same claim from country B cost a fraction of the price. You see there's a history of fraud for this type of product coming from country B. Same product but the "nature" of the product is that there's specifically a UV protective claim involved and now there's value associated with the claim and a higher risk of fraud. There's no way you can risk assess the product without also risk assessing the supplier so overall supplier approval must look at the product (and all 6 criteria) while thinking about who the supplier is. If you're using a spreadsheet or table, then risk for supplier A's product is going to look quite different to risk for supplier B, even though it's the same kind of product, you're just dual sourcing. And then of course, that can all change over time, hence the periodic review.

 

[Laura]

Thanks Cathy.

I think it's quite difficult to use this Method for all our supplier-product combinations, as we have like 50 supplier in our pool list and minimum 15 product categories. But we try...

Coming again to clause 4.1.2: 'the process for the initial and ongoing approval of manufactures of products shall be based on risk'

If we categorised our supplier in 4.1.1 into low risk, middle risk or high risk supplier, can the approval process look like this:

- low risk supplier = customer specific certificates and audits need to be fulfilled
- middle risk supplier= customer specific certificates and audits need to be fulfilled + factory visit
- high risk supplier= customer specific certificates and audits need to be fulfilled + factory visit including QM-Audit according to 4.1.2

OR does all supplier (low, middle and high risk supplier) meet the QM-Audit requirements mentioned in 4.1.2?

Textile supplier in Asia normally don't have GFSI benchmark certification so we can only go for the second option. Some supplier have ISO 9001, but with ISO 9001 they don't fully fulfil the BRC requirements in clause 4.1.2. so we would need to implement a new process .

 

[Cathy Gladwin]

Hi @Laura apologies in advance if we're misunderstanding each other - explaining via chat isn't as easy as a zoom call for example if you ever need consultation support, please don't hesitate to contact us at https://qtc.support/ and we'd be able to support you fully!

Saying that, we can certainly chat further here. So I see this as 2 parts.
1. the risk assessment process (including the 6 bullet point risk criteria) is needed for all your suppliers and covering all the products they provide. If this isn't done, it's going to be an audit NC - just saying, I know you're going to get it in place, I feel your pain.
2. based on the risk level that exercise gives you - your low, middle or high - you then decide on how to deal with the supplier right.

Your plan looks good, but over the top if anything. Factory visits are certainly not necessary for a middle risk supplier and not commonly seen - now if you're visiting the factories anyway - great and don't stop because I say so. But it's expensive and to be fair, if they can give you assurances in other ways, such as through other certificates they have. The clause 4.1.2 here talks about a supplier audit - this can be any third party audit that is not GFSI. It can be ISO 9001 for example as long as all clause requirements are covered. If not, then you can audit them to cover all points. This can even be done remotely (of course onsite is better, I'm just giving you all practical options).


But back to your question: "OR does all supplier (low, middle and high risk supplier) meet the QM-Audit requirements mentioned in 4.1.2?" Yes, all your suppliers must first be risk assessed per 4.1.1 and then based on the result (low, middle or high) be approved according to the options in 4.1.2. I will say that practially, most Agents/Broker sites not handling food, will have their products risk assessed as low risk. Most of them will be using the options seen at the end of 4.1.2:
• a legally enforceable contract/specification from the supplier
• a historical trading relationship.

Of course your risk assessment might show that you have some middle or high suppliers for non food products, but it's not seen often. I hope this helps.