Templates and records · ISO 22000 · Clause 7.1.6
ISO 22000 supplier evaluation template
Raw materials, packaging, transport, cleaning, pest control, laboratory: every supplier that can affect food safety is evaluated before you work with them and monitored afterwards.
In one sentence
Supplier evaluation under ISO 22000 applies defined criteria to evaluate, select, monitor the performance of and re-evaluate those who provide processes, products or services that affect the system, communicates the requirements to them and retains evidence of those activities and any resulting actions, as required by clause 7.1.6.
- Where the standard requires it
- ISO 22000 · Clause 7.1.6 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
- Type of information
- Mandatory record Documented information to be retained (7.1.6)
- Who fills it in
- Purchasing and quality Quality sets the technical requirements and purchasing manages the relationship
- When
- Before approval and periodically And whenever there is a serious incident or a change of formulation
- How long it is kept
- Set by the organisation ISO 22000 only sets a minimum for traceability (8.3: the shelf life of the product). Covering the shelf life plus the three-year certification cycle lets you show the history at recertification.
What the standard requires
What ISO 22000 demands and what it leaves to your judgement
The organisation establishes and applies criteria to evaluate, select, monitor the performance of and re-evaluate external providers of processes, products or services, ensures that its requirements are communicated to them and that what they supply does not affect its ability to meet the system's requirements.
The standard does not set which criteria to use. The usual approach combines certifications (IFS, BRCGS, FSSC 22000), technical data sheets with allergen declarations, questionnaires, audits and incident history, with a level of scrutiny proportionate to the risk of what they supply.
The supplier approval PRP (8.2.4) and the goods-in PRP rely on this evaluation.
Structure
Fields the template should include
- Supplier, product or service supplied and its food safety risk
- Evaluation criteria applied
- Documentation: certificates, technical data sheets, allergen declaration
- Outcome of the initial evaluation and approval decision
- Performance monitoring: incidents, goods-in rejections, punctuality
- Date and outcome of the re-evaluation
- Resulting actions
- Person responsible and date
Example
Example: annual re-evaluation of a vegetable supplier (fictitious)
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Supplier | Valley Fresh Produce Ltd (fictitious) · fresh pumpkin and carrot · high risk |
| Criteria | Current GFSI certification, up-to-date technical data sheet, goods-in rejections, audit every two years |
| Documentation | IFS Food certificate valid until November 2026; technical data sheet dated January 2026 |
| Performance 2025 | 3 goods-in rejections out of 118 deliveries, two of them for temperature |
| Outcome | Approved with monitoring: the transport temperature requirement is communicated to them |
| Action | Tighter temperature checks at goods-in for three months |
| Responsible | Quality technician and purchasing manager · 30 January 2026 |
At the audit
Mistakes auditors commonly flag
- Service providers — cleaning, pest control, transport, laboratory — left out of the evaluation.
- Expired certificates or technical data sheets that nobody spots.
- The re-evaluation does not take goods-in rejections into account.
- A change in a supplier's formulation is not reviewed in the allergen matrix.
In Kimobox
How this record is kept in Kimobox
- 1Each supplier has its own record in the supplier portal, with certificates and technical data sheets.
- 2Expiry dates are tracked: the supplier receives a reminder and, if it does not renew, it is blocked.
- 3A new technical data sheet triggers a review of the products that use that raw material.
- 4Goods-in incidents feed the re-evaluation.
Frequently asked questions
What people ask us before getting started
Is it enough for the supplier to be certified?
It is a good criterion, but it does not replace evaluation: you must check that the certificate scope covers what they supply and monitor their actual performance with your own data.
Are service providers included?
Yes. Clause 7.1.6 refers to externally provided processes, products and services. A pest control contractor or a laboratory directly affects the system.
Keep your ISO 22000 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Support and suppliers
Resources, external providers, competence, communication along the food chain and documented information…
ISO 22000 prerequisite programmes (PRP) plan template
How to document ISO 22000 prerequisite programmes: selection, responsibilities, monitoring and verification…
ISO 22000 hazard analysis template
How to carry out the ISO 22000 hazard analysis: identification by step, acceptable level, significance…
ISO 22000 validation of control measures template
How to document validation of ISO 22000 control measures before applying them: method, evidence, outcome and…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.