4 minute read
Compliance Insights
By Robert Low, Lead Management System Specialist
Ask most manufacturers about their supplier approval process and the answer tends to focus entirely on the onboarding stage — the questionnaire, the initial audit, the certificate check. That is the visible, well-documented part. It is also, in most cases, the easier half of the problem.
The harder half — and the part that causes the most audit findings — is what happens after approval. A supplier approved two years ago is not automatically still suitable today, and treating approval as a one-time gate rather than an ongoing process is one of the most common gaps in supplier management across cosmetics and food manufacturing.
Initial approval typically covers a documented questionnaire covering the supplier’s own quality systems, relevant certifications, and risk profile based on what they are supplying. For higher-risk materials, this often extends to an on-site or remote audit before approval is granted. None of this is controversial — most manufacturers do this reasonably well, because it happens at a clear, deliberate moment with time allocated to it.
The problems start after approval. Certificates expire. Suppliers change their processes, their sub-suppliers, or their ownership without necessarily telling you. A supplier who was excellent eighteen months ago may have had a quality decline that nobody has noticed because nobody is actively monitoring.
A genuinely functional supplier approval workflow needs to track:
Certificate and approval expiry. If a supplier’s relevant certification lapses and nobody notices for three months, you have been using an unapproved supplier for three months without realising it. This needs to be flagged automatically, not caught during the next annual review.
Performance trends, not just incidents. A single late delivery or one out-of-spec batch might be noise. A pattern across six months is a signal. Without nonconformance records linked directly to the supplier who caused them, spotting that pattern requires someone manually cross-referencing records — which in practice means it rarely happens until something serious forces the question.
Risk-based review frequency. Not every supplier needs the same level of ongoing scrutiny. A supplier providing a critical raw material with food safety or product safety implications warrants more frequent review than a packaging supplier providing a low-risk component. A workflow that treats every supplier identically either over-burdens low-risk relationships or under-monitors high-risk ones.
When something goes wrong with a finished product, the first question is almost always: which batch, and which supplier’s materials were used in it. If that trail does not exist cleanly — if it requires cross-referencing a goods-in log, a production record, and a supplier file that are not connected to each other — a recall or investigation becomes significantly slower and more stressful than it needs to be.
Production control that links batch records directly back to the specific supplier and lot number used means this question has an immediate answer rather than requiring a multi-file investigation under time pressure.
A competent auditor will not just ask “do you have an approved supplier list.” They will pick a specific batch, trace it back to the raw material supplier, and check whether that supplier was approved and within their review cycle at the time the material was used — not whether they are approved today, looking back retrospectively. This distinction catches manufacturers who have let their approval records drift out of sync with reality.
None of this requires a dramatically different process — most manufacturers already understand intellectually that supplier approval should be ongoing rather than one-off. The gap is almost always operational: nobody is actively monitoring expiry dates and performance trends because doing so manually, across a meaningful supplier base, takes more sustained attention than most quality teams can realistically maintain by hand.
This is squarely where automated expiry alerts and performance tracking linked directly to nonconformance records earn their place — not as a nice-to-have, but as the only realistic way to keep supplier approval genuinely current rather than nominally current.
Back to all
