Supplier approval: small suppliers, specifications, lab results and Agents & Brokers

Approving artisan suppliers, what a specification should contain, checking third-party lab results and BRCGS Agents & Brokers clause 4.1.

Supplier approval is where good intentions meet real-world suppliers. These answers come from questions our community raised, from artisan food producers to textile importers.

Q: How do we approve small or artisan suppliers with limited technical documentation?

There are three usual routes:

• GFSI certification: unlikely for small suppliers.
• An audit: a non-GFSI third-party audit, or your own audit carried out by a trained, competent auditor. A remote audit is better than just a questionnaire.
• A questionnaire: common and acceptable, as long as the supplier and product are low risk (based on a risk assessment), the questionnaire is comprehensive, and a trained, competent person assesses the answers. BRCGS Food Safety Issue 9 sets out these approval routes in section 3.5.

We don't want businesses turning away talented local producers. A little effort gets the right assurances in place.

An ad-hoc advisor can also help small suppliers meet your requirements more affordably than full-time support.

Q: What should a raw material specification include?

• what is relevant to the product description: physical attributes, packaging format, quantity, origin and any claims
• the risk factors: microbiological, chemical, physical and allergen hazards, with limits
• quality attributes

When a delivery arrives, the certificate of analysis (CoA) or certificate of conformity confirms that batch meets the specification. A lab report is not a specification or a CoA. The supplier should have done its own product safety risk assessment (HACCP, HARA, FMEA or similar), and the specification should show the relevant risks are within limits. For food contact items, that includes every component, such as lids and seals, in the food contact declaration of conformity. Issue 9 section 3.6 expects specifications to be reviewed at least every three years.

Q: How do we know third-party lab results are genuine?

• Check the lab is accredited (for example to ISO/IEC 17025) and that the specific tests are within its scope of accreditation. If they aren't, it's often in the footnotes.
• Look for sample ID, test dates and signatures, and signs the report has been altered or copied.
• For a new or overseas lab, contact them directly or use any online or QR verification.
• Compare results with your own records and past data.
• Phone the lab to talk through results. Labs are usually happy to help, and it builds the relationship.

A test that isn't accredited, or is subcontracted to another lab, isn't automatically a problem, but you need to know and judge the impact if the result supports safety or legality. Ask when getting quotes whether tests are accredited, validated and done in-house.

Q: BRCGS Agents & Brokers: do I need to risk assess products or suppliers?

Both. Clause 4.1.1 requires a risk assessment covering all your suppliers and the products they supply, using the six criteria listed. The first criterion is the nature of each product and its risks, but you can't assess a product without thinking about who supplies it: the same product from two suppliers can carry very different fraud risk. Based on that low, medium or high result, you then choose approval methods from clause 4.1.2, and review them over time (4.1.7). Our BRCGS Agents and Brokers Issue 3 for Auditors & Sites course works through the risk assessment criteria.

Q: Is a contract enough to approve a low-risk non-food supplier?

For products you have assessed as low risk, the standard allows a legally enforceable contract or specification from the supplier, or a historical trading relationship (clause 3.7.4 also allows the latter). A specification is "an explicit or detailed description of a material, product or service", and that can be an email quote or a detailed online listing. It must include enough information for you to be satisfied you'll get what you need. What that means for a paper clip is very different from a mobile phone, which is why BRCGS leaves room for your expertise.

Q: Do I have to visit factories?

Not usually. Factory visits are expensive and rarely needed for medium-risk suppliers. A supplier audit under 4.1.2 can be any non-GFSI third-party audit, such as ISO 9001, as long as all clause points are covered; if not, you can audit the gaps yourself, even remotely. In practice most agents and brokers handling non-food products assess most products as low risk.

More short videos on our STC & QTC Explains channel: https://youtube.com/@stcandqtc

Reviewed by Chisala Ngandwe, Technical Manager & Trainer, STC · November 2026

These Q&As share general best practice from our trainers and auditors. They aren't consultancy advice for your site. For support specific to your site and systems, we can refer you to our sister company QTC.

Learn more: BRCGS Agents & Brokers, Risk Assessment and the course calendar. For help setting up supplier approval, contact QTC.