BRCGS clause 3.5, and what evidencing it actually takes

Approval is an event. Monitoring is a state.

Clause 3.5.1.2 requires a documented supplier approval procedure. Clause 3.5.1.3 requires a documented process for ongoing supplier performance review.

Those are not the same difficulty.

Section 3.5.1 is one of the Standard’s fundamental requirements.

Approval is an event. You assess a supplier, you approve them, you file the assessment. Almost every certified manufacturer does this well.

Monitoring is a state. It has to be true continuously, and it has to be demonstrable for any point in the period since your last audit. This is where small manufacturers lose marks, and it is not because they are careless. It is because continuous evidence is genuinely hard to produce by hand.

What acceptance can be based on

Clause 3.5.2.1:

And:

Three things worth reading twice.

“Specific to the consignment.” A certificate of analysis on file for a supplier is not a certificate of analysis for the lot you received. If your acceptance route is COAs, the document has to correspond to the actual consignment, and you have to be able to show that it does.

“Implemented.” Defining the parameters is the easy half. Showing they were applied to every lot across the audit period is the half that takes the fortnight.

“Reviewed.” The record is required by the text rather than inferred from it: clause 3.5.1.3 ends “Records of the review shall be kept.” If nobody can point at when the parameters were last looked at, they were not reviewed.

Where it commonly comes apart

Approvals with no basis on file. A supplier approved on a certification basis, where the certificate was never actually filed. Not expired. Never there. Invisible to every reminder system, because there is no date to remind against, and it stays invisible until an auditor picks that supplier off your list and asks to see the basis.

Certification review WF5-DATAGAP

Certificates that never arrived. Not deliberately ignored. Requested once, the supplier did not reply, the person who asked moved on to something urgent, and there is no mechanism that brings it back.

Certificates that arrived for the wrong lot. Filed by a busy person who did not cross-check the batch number, and now indistinguishable from a correct one.

Certificates filed without an expiry date. Present, and therefore assumed monitored. Not monitorable at all.

Chase history that exists only as sent mail. When an auditor asks what you did about a missing certificate, “we chased them” is weaker than a dated sequence.

What continuous evidence requires

Four properties. Any system missing one of them is producing evidence with a hole in it.

Completeness. Every lot in a known state at all times. Not most lots. The ones that fall out of view are precisely the ones that get sampled.

Attribution. Each certificate provably tied to a specific consignment, by something more reliable than a filename.

Contemporaneity. Records written when events happen. A record created later is a reconstruction, and reconstructions inherit the gaps of whatever they were built from.

Basis checking. The approval itself tested against what supports it, not just the dates on whatever happens to be filed. Absence is harder to detect than expiry, and it is the failure mode nobody has a process for.

Scope note

This page covers 3.5.1.2, 3.5.1.3 and 3.5.2, supplier approval, monitoring and raw material acceptance. Clause 3.5.1.1 covers raw material risk assessment, which is yours. Clause 3.5.3 covers suppliers of services and 3.5.4 covers outsourced processing. Opscera does not address any of those three.