Templates and records · ISO 22000 · Clause 7.1.6

ISO 22000 supplier evaluation template

Raw materials, packaging, transport, cleaning, pest control, laboratory: every supplier that can affect food safety is evaluated before you work with them and monitored afterwards.

In one sentence

Supplier evaluation under ISO 22000 applies defined criteria to evaluate, select, monitor the performance of and re-evaluate those who provide processes, products or services that affect the system, communicates the requirements to them and retains evidence of those activities and any resulting actions, as required by clause 7.1.6.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 22000 · Clause 7.1.6 Clauses are cited using the numbering of ISO 22000:2018, the current edition. ISO is preparing a third edition that may renumber them; when it is published it will have its own transition period.
Type of information: Mandatory record Documented information to be retained (7.1.6)
Who fills it in: Purchasing and quality Quality sets the technical requirements and purchasing manages the relationship
When: Before approval and periodically And whenever there is a serious incident or a change of formulation
How long it is kept: Set by the organisation ISO 22000 only sets a minimum for traceability (8.3: the shelf life of the product). Covering the shelf life plus the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 22000 demands and what it leaves to your judgement

The organisation establishes and applies criteria to evaluate, select, monitor the performance of and re-evaluate external providers of processes, products or services, ensures that its requirements are communicated to them and that what they supply does not affect its ability to meet the system's requirements.

The standard does not set which criteria to use. The usual approach combines certifications (IFS, BRCGS, FSSC 22000), technical data sheets with allergen declarations, questionnaires, audits and incident history, with a level of scrutiny proportionate to the risk of what they supply.

The supplier approval PRP (8.2.4) and the goods-in PRP rely on this evaluation.

Read it in context: Support and suppliers, in the ISO 22000 Academy

Structure

Fields the template should include

Supplier, product or service supplied and its food safety risk
Evaluation criteria applied
Documentation: certificates, technical data sheets, allergen declaration
Outcome of the initial evaluation and approval decision
Performance monitoring: incidents, goods-in rejections, punctuality
Date and outcome of the re-evaluation
Resulting actions
Person responsible and date

Example

Example: annual re-evaluation of a vegetable supplier (fictitious)

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Supplier	Valley Fresh Produce Ltd (fictitious) · fresh pumpkin and carrot · high risk
Criteria	Current GFSI certification, up-to-date technical data sheet, goods-in rejections, audit every two years
Documentation	IFS Food certificate valid until November 2026; technical data sheet dated January 2026
Performance 2025	3 goods-in rejections out of 118 deliveries, two of them for temperature
Outcome	Approved with monitoring: the transport temperature requirement is communicated to them
Action	Tighter temperature checks at goods-in for three months
Responsible	Quality technician and purchasing manager · 30 January 2026

At the audit

Mistakes auditors commonly flag

Service providers — cleaning, pest control, transport, laboratory — left out of the evaluation.
Expired certificates or technical data sheets that nobody spots.
The re-evaluation does not take goods-in rejections into account.
A change in a supplier's formulation is not reviewed in the allergen matrix.

In Kimobox

How this record is kept in Kimobox

1Each supplier has its own record in the supplier portal, with certificates and technical data sheets.
2Expiry dates are tracked: the supplier receives a reminder and, if it does not renew, it is blocked.
3A new technical data sheet triggers a review of the products that use that raw material.
4Goods-in incidents feed the re-evaluation.

Frequently asked questions

What people ask us before getting started

Is it enough for the supplier to be certified?

It is a good criterion, but it does not replace evaluation: you must check that the certificate scope covers what they supply and monitor their actual performance with your own data.

Are service providers included?

Yes. Clause 7.1.6 refers to externally provided processes, products and services. A pest control contractor or a laboratory directly affects the system.

Keep your ISO 22000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring