ISO 22000 supplier control: keep external provision inside the food safety system

What clause 7.1.6 requires in practice

Clause 7.1.6 deals with anything the organisation obtains from outside that touches the food safety system: ingredients, packaging, services, contracted processes and similar provision. The requirement has four parts, all linked to protecting the system's ability to meet its own requirements.

First, set and apply criteria for evaluating providers, choosing them, monitoring how they perform, and evaluating them again. Second, make sure the provider receives adequate information about what is required. Third, make sure that what arrives cannot weaken the organisation's capacity to keep meeting its own food safety management system requirements. Fourth, keep documented information about these activities and about any actions that follow from evaluation and re-evaluation.

The standard requires criteria, not a specific list of approved suppliers, and it does not name a certificate that every provider must hold. The expected output is a defensible decision trail for each provider and provision.

Decide what matters about the provision

Begin with the product, process or service being purchased and how it affects food safety. An ingredient, food-contact material, outsourced processing step or specialist service can require different evidence. Avoid treating all suppliers as interchangeable simply because they share a purchasing system.

Set criteria that support an informed acceptance decision. Depending on the provision, relevant information might include technical specifications, competence, performance history or evidence about the provider's controls. These are examples of possible evaluation inputs, not a fixed ISO checklist or a universal requirement to obtain a particular certificate.

Evaluate, select and communicate requirements

Apply the criteria before relying on the provider. Make the decision and any conditions clear to purchasing and users. A technically approved provider may still supply an item outside the assessed scope; the organisation needs to understand what has actually been accepted.

Communicate adequate requirements. Specifications and agreements should give the provider usable information about what is needed and how relevant changes or problems are communicated. A generic statement to “comply with ISO 22000” may not explain the particular information, service condition or notification the customer requires.

Monitor performance and reconsider acceptance

Provider control continues after selection. Monitor relevant performance and re-evaluate using the established criteria. Complaints, nonconforming deliveries, late information or significant changes may indicate a need for further review. Good delivery punctuality should not conceal a weakness in food safety information.

Retain documented information about these activities and necessary actions following evaluation or re-evaluation. A record should support the decision made, including unresolved issues and restrictions where relevant. Keep the process connected with hazard analysis and operational controls when new information affects their assumptions.

Why provider control matters to the business

In food, a large share of the risk arrives through the back door. An ingredient from a changed source, a contract packer with weak habits or a transport partner that loses temperature discipline can all defeat controls that work perfectly inside your own walls. When something goes wrong, customers and regulators ask what you knew about the provider and what you did about it.

Clear criteria also help commercially. Purchasing, technical and operations teams can have a shared conversation about when a lower price or a faster delivery is acceptable and when it is not. Suppliers learn what you expect, disputes are easier to settle, and decisions made during a supply shortage do not erode the food safety position that took years to build.

How to implement clause 7.1.6

Start from what each provision does to food safety, then scale the control to match. One practical way is to build the approach around provision types rather than around a single supplier form.

1. Group what you purchase into types such as ingredients, food-contact packaging, outsourced processing, storage and transport, and note the food safety effect of each.
2. Write evaluation and selection criteria for each type, using technical, capability and performance information that is relevant to that effect.
3. Define what monitoring applies after approval, for example delivery conformity, complaints, changes notified and the quality of information received.
4. Agree who decides, who can approve urgent exceptions, and what must still be checked before an urgent purchase is used.
5. Send providers clear requirements and the route for telling you about changes or problems, and keep what they send back.
6. Re-evaluate on a basis that reflects the risk, and record the outcome, including restrictions or follow-up actions.
7. Feed provider findings into hazard analysis inputs and receiving arrangements where they change assumptions.

Illustrative example: a manufacturer changes an ingredient source

Illustrative example: a catering operator contracts transport

A hypothetical caterer serving a software company's campus contracts part of its food transport. It defines the relevant service requirements and communication of delays or changes. The caterer checks that the contractor understands the arrangement and assigns an internal owner for reviewing performance.

When the contractor changes its operating method, the caterer assesses the food safety implications before continuing on the old assumptions. The software company's core business is not the FSMS activity; the food service and its transport interface are the relevant operations in this example.

Separate provider assurance from your own responsibility

Certification or accreditation can contribute useful evidence where its scope and relevance are understood. It does not automatically establish that every supplied item or service is suitable. Check the actual scope, current evidence and conditions of the provision rather than using a certificate as a substitute for evaluation.

Externally developed FSMS elements are addressed separately in 7.1.5 and need adaptation to the organisation's processes and products. Hiring a consultant or buying a plan does not transfer ownership of implementation. Likewise, outsourcing a process does not remove the need to ensure appropriate control.

Evidence and common mistakes