Auditing ISO 22000 Clause 7.1.6: Control of External Suppliers

The Control Requirement and Systemic Rationale

Under DS/EN ISO 22000:2018, an organization cannot ensure end-product food safety without extending operational control across its external supply chain. Clause 7.1.6 obliges organizations to establish and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers of processes, products, and services. This mandatory requirement applies not only to raw material and ingredient suppliers, but also to providers of packaging materials, processing aids, cleaning chemicals, laboratory testing, pest control, equipment maintenance, transport, storage, and outsourced processing activities. Failing to control external providers exposes the organization to unvetted biological, chemical, physical, or allergen hazards.

The systemic rationale for Clause 7.1.6 rests on the principle that unmanaged external inputs directly compromise the validity of an organization's hazard analysis. Clause 8.5.1.2 requires the food safety team to maintain documented information concerning all raw materials, ingredients, and product contact materials, including acceptance criteria related to food safety appropriate to their intended use. Furthermore, Clause 8.2.4(f) mandates that prerequisite programmes (PRPs) address supplier approval and assurance processes, while Clause 8.1 requires that outsourced processes remain strictly controlled within the food safety management system (FSMS).

Effective external control demands structured communication channels to convey technical and regulatory expectations. Clause 7.1.6(b) and Clause 7.4.2(a) require effective external communication with external providers and contractors regarding product specifications, statutory regulations, and food safety requirements. In addition, Clause 9.3.2(c)(7) dictates that information on the performance of external providers must serve as a mandatory input to management review. Quality managers, compliance leads, and internal auditors must therefore evaluate supplier control as an integrated feedback loop rather than an isolated purchasing function.

Practical Implementation of Supplier Controls

To comply with Clause 7.1.6 and its supporting operational clauses, an organization must implement a documented, multi-stage control mechanism. Internal auditors must verify that this process systematically governs external providers throughout their engagement lifecycle.

1. Establish comprehensive specifications for all incoming raw materials, ingredients, product contact materials, and external services under Clause 8.5.1.2, detailing biological, chemical, physical, and allergen acceptance criteria.
2. Formulate explicit evaluation and selection criteria under Clause 7.1.6(a) to assess prospective providers on their food safety capability, technical competence, regulatory compliance, and system certification prior to contract award.
3. Communicate mandatory food safety requirements to approved providers under Clause 7.1.6(b) and Clause 7.4.2, incorporating technical specifications, handling instructions, and statutory compliance expectations into formal agreements.
4. Conduct routine performance monitoring upon material receipt under Clause 8.2.4(g) through receiving inspections, certificate of analysis verification, and periodic laboratory testing against established acceptance criteria.
5. Execute periodic re-evaluations of external providers under Clause 7.1.6(a), assessing performance history, nonconformities, and corrective action effectiveness while maintaining documented information under Clause 7.1.6(d).
6. Present aggregated external provider performance data to top management as a mandatory review input under Clause 9.3.2(c)(7) to decide contract continuations, conditional approvals, or provider disqualifications.

Audit Matrix for Externally Provided Processes and Materials

Internal auditors should use a structured audit matrix when evaluating compliance against Clause 7.1.6 and related requirements. This matrix aligns standard requirements with auditor verification checks and mandatory documented evidence.

Auditing Supplier Approval and Verification in Practice

Auditing Clause 7.1.6 requires examining how purchasing controls integrate with operational hazard analysis under Clause 8.5.2. Internal auditors must trace raw materials and services from purchase specifications down to receipt verification, traceability logs, and hazard control plan execution.

Example

During an internal audit of an ambient food manufacturing facility, the auditor reviews the hazard analysis for an imported raw ingredient under Clause 8.5.1.2. The specification defines acceptable limit criteria for heavy metals and pesticide residues, identifying supplier certificates of analysis as the primary verification control. When examining receiving logs under Clause 8.2.4(g) and Clause 8.3, the auditor discovers that four recent deliveries were accepted without receiving certificates of analysis or conducting internal verification testing. Additionally, annual re-evaluation records under Clause 7.1.6(a) show that the supplier was flagged for missing paperwork, but no corrective action or risk review was documented under Clause 7.1.6(d). The auditor raises a nonconformity against Clause 7.1.6(a) and (d) for failing to apply re-evaluation criteria and failing to retain documented information of necessary actions resulting from supplier performance evaluations.

Before your audit

• Verify that documented evaluation, selection, monitoring, and re-evaluation criteria exist for all external providers under Clause 7.1.6(a).
• Check that specifications for all raw materials, ingredients, and product contact materials contain documented food safety acceptance criteria per Clause 8.5.1.2.
• Ensure that service level agreements and specifications exist for external service providers including transport, pest control, off-site storage, and sanitation.
• Confirm that documented evidence of supplier evaluations, re-evaluations, and resulting corrective actions is retained under Clause 7.1.6(d).
• Validate that incoming receipt verification procedures under Clause 8.2.4(g) align with the acceptance criteria established in raw material specifications.
• Check that supplier performance trends and re-evaluation summaries are included as documented inputs to management review under Clause 9.3.2(c)(7).

Questions people ask

Does Clause 7.1.6 require auditing every raw material supplier on-site?

No, DS/EN ISO 22000:2018 does not mandate on-site audits for every external provider. The organization must establish appropriate evaluation and selection criteria based on risk, which may include third-party certification, questionnaires, testing history, or on-site audits depending on the hazard profile.

Are external service providers like pest control or calibration labs covered under Clause 7.1.6?

Yes, Clause 7.1.6 explicitly encompasses externally provided processes, products, and services. External service providers that impact food safety—such as pest control, equipment calibration, transport, storage, and cleaning services—must be evaluated, selected, and monitored against defined criteria.

How do raw material specifications under Clause 8.5.1.2 connect to supplier control under Clause 7.1.6?

Raw material specifications under Clause 8.5.1.2 establish mandatory biological, chemical, physical, and food safety acceptance criteria that external providers must meet. Clause 7.1.6 provides the management framework to communicate these specifications, evaluate supplier compliance, and verify that incoming products meet established acceptance criteria.

What documented information must an organization retain for Clause 7.1.6?

Under Clause 7.1.6(d), the organization must retain documented information of supplier evaluation, selection, monitoring, and re-evaluation activities, as well as any necessary actions resulting from these evaluations. This includes evaluation records, approved supplier lists, performance logs, and corrective action records.

Reference documents

• DS/EN ISO 22000:2018 Food safety management systems – Requirements for any organization in the food chain
• DS/ISO 22003-1:2022 Food safety – Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022 Food safety – Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system