Support and suppliers

Resources and infrastructure (7.1.1 to 7.1.4)

Competent people, and infrastructure and a work environment suitable for applying the PRPs and the control plan. Where external experts are used to build or assess the system, the standard requires an agreement defining their competence, responsibility and authority.

Externally developed elements (7.1.5)

If the system relies on a sector guide, a consultancy or a generic plan from a trade association, the organisation must adapt it to its own processes and products, implement it, maintain it and update it. A copied plan that does not match the plant is a classic nonconformity.

Externally provided processes, products or services (7.1.6)

Criteria must be set and applied to evaluate, select, monitor the performance of and re-evaluate suppliers, requirements must be communicated to them, and documented information on those activities and any resulting actions must be retained.

Competence, awareness and communication (7.2 to 7.4)

Evidence is retained of the competence of the food safety team and of those monitoring CCPs and OPRPs. Staff must know the policy, their role and the consequences of not conforming.

External communication covers suppliers, customers, consumers and authorities, and evidence of it is retained; internal communication must get any change in product, process, equipment or legislation to the food safety team in time to update the system.

Documented information (7.5)

What the standard requires, what legislation and customers require, and what the company considers necessary. With version control, approval, distribution and protection against unauthorised changes.

What an auditor usually asks for

• Supplier evaluation and re-evaluation criteria, with their results
• Evidence of competence for whoever monitors each CCP and OPRP
• Record of external communications with customers and authorities
• External elements (guides, model plans) adapted to the plant
• Version control of PRPs, the control plan and procedures

How to cover support in Kimobox

1. 1Evaluate and re-evaluate suppliers in the supplier portal, with technical data sheets and certificates whose expiry is tracked.
2. 2Keep the training matrix by role, with a reminder before any hygiene training expires.
3. 3Control documentation with versions, approval and read receipts.

ISO 22000 templates and records in this chapter

• ISO 22000 supplier evaluation template · Mandatory record

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

1. ISO 22000:2018 — Food safety management systems. Requirements for any organization in the food chain ISO · 2018 ed. (2nd edition), published June 2018
2. ISO 22000:2018/Amd 1:2024 — Climate action changes ISO · February 2024
3. ISO/DIS 22000 — Draft revision of the standard (3rd edition) ISO · Under development
4. ISO 22002-100:2025 — Prerequisite programmes on food safety. Part 100: requirements for the food, feed and packaging chain ISO · 29 July 2025
5. ISO 22002-1:2025 — Prerequisite programmes on food safety. Part 1: food manufacturing ISO · 29 July 2025; replaces ISO/TS 22002-1:2009
6. General Principles of Food Hygiene, CXC 1-1969 Codex Alimentarius (FAO/WHO) · 2020 revision
7. Regulation (EC) No 852/2004 on the hygiene of foodstuffs EUR-Lex · 29 April 2004
8. Regulation (EC) No 178/2002, Articles 18 and 19 (traceability and withdrawal) EUR-Lex · 28 January 2002