# Food supplier risk assessment in the UK: build a scorecard that changes controls

A practical UK method for ranking food suppliers by product risk, evidence, delivery performance and change, then turning the result into proportionate controls.

> A useful UK food-supplier risk assessment does not award points for paperwork alone. It identifies the food and hazard, checks the supplier’s identity and relevant approval status, tests specifications and traceability, reviews delivery and complaint history, and records a decision: approved, conditional, suspended or rejected. The risk tier must change what happens next—such as certificate review, incoming checks, sampling, audit or management approval—and every exception needs an owner and expiry date.

Kivloo editorial team · 2026-10-27T07:30:00.000Z

## Define the supplier-product relationship before scoring

Assess the supplier for the exact site, product and service supplied. A distributor of sealed ambient goods creates a different exposure from a manufacturer of chilled ready-to-eat food. Record the legal entity, supplying site, product specification, intended use, allergens, storage conditions and whether an approval or identification mark is relevant for products of animal origin.

The FSA MyHACCP guidance recommends buying ingredients and supplies to specification from reputable suppliers and keeping functional specifications for materials that may affect the finished product. Treat these as evidence inputs, not automatic approval. A certificate cannot prove that the delivered lot matched your specification.

- Name the legal entity and actual supplying site.

- Link each product or service to an approved specification.

- Identify allergens, temperature and intended-use hazards.

- Record any relevant establishment approval or mark.

## Score inherent risk separately from supplier confidence

Use two dimensions. Inherent risk covers the food, process and intended consumer: ready-to-eat status, cold chain, allergen complexity, vulnerability to substitution and absence of a later kill step. Supplier confidence covers traceability, documented controls, audit or certification evidence, test results and your own history.

Keep the reasoning beside the score. If a high-risk ingredient receives a lower review frequency because of strong evidence, state exactly which evidence supports that decision and when it expires. Avoid averaging away a critical failure such as an invalid approval, unreported allergen change or inability to trace a lot.

- Rate food and process risk before supplier performance.

- Define non-negotiable failure criteria.

- Link every score to dated evidence.

- Set a review date and change triggers.

## Example record and review decision

Example: a bakery reviews a chilled egg-product supplier after a formulation change. Product risk is high because the ingredient is refrigerated, contains an allergen and enters products without a later validated lethality step. The supplier’s current specification, approval details and traceability test are acceptable, but two recent deliveries arrived above the agreed limit.

The team records conditional approval for eight weeks, increases temperature checks to every delivery, requires the supplier’s corrective-action evidence and schedules a performance review. The decision is not “72 points equals approved”; the record shows why the deviation matters and what must happen before full approval returns.

- Describe one real product and plausible decision.

- Record evidence reviewed and gaps found.

- Translate the tier into receiving controls.

- Set owner, due date and approval authority.

## Connect receiving evidence to reassessment in Kivloo

At goods-in, record supplier, product, lot, quantity, temperature where relevant, packaging condition, date marks and disposition. A rejection, substitution, complaint, recall or expired document should feed the supplier review rather than remain in a separate inbox. Periodic review should consider actual performance as well as submitted documents.

Kivloo can hold the risk assessment, approved-supplier status, supporting files, delivery exceptions and follow-up tasks together. Configure the workflow around your HACCP plan and purchasing authority. Kivloo does not certify a supplier or decide that food is legally acceptable; the food business remains responsible for its assessment and action.

- Link receiving exceptions to the supplier record.

- Prevent silent use after conditional approval expires.

- Verify corrective action with objective evidence.

- Retain the reviewer and decision history.

## Does UK law require one particular supplier scorecard?

No single universal scorecard is prescribed for every food business. Controls must suit the food, activity and applicable legal or assurance requirements. Use a documented, risk-based method that supports your HACCP and traceability system.

## Is a GFSI-recognised certificate enough to approve a supplier?

It can be useful evidence, but it does not replace checking scope, site, validity, product specification, traceability and your own delivery history. Define what additional verification is needed for the risk.

## Continue reading

- [Food batch traceability: connect deliveries, ingredients and finished products](https://kivloo.com/en/guides/food-batch-traceability-records)

- [Food receiving records: identify what arrived, not just what was ordered](https://kivloo.com/en/guides/food-receiving-record-identifiers)

- [Supplier document reviews: separate a stored file from an approval](https://kivloo.com/en/guides/supplier-document-review)

- [Rejected deliveries: connect the discrepancy and the stock decision](https://kivloo.com/en/guides/rejected-delivery-record)

- [Digital HACCP records: build a temperature log your team can actually use](https://kivloo.com/en/guides/digital-haccp-temperature-records)

- [Workplace safety inspections: turn findings into verified corrective actions](https://kivloo.com/en/guides/workplace-inspections-corrective-actions)

## Sources and further reading

- [Food Standards Agency — MyHACCP prerequisite guidance: supplier control](https://myhaccp.food.gov.uk/help/guidance/general-requirements-be-considered-each-prerequisite)

- [Food Standards Agency — Food traceability quick reference guide](https://www.food.gov.uk/business-guidance/food-incidents-product-withdrawals-and-recalls)

- [Food Standards Agency — Allergen information best practice](https://www.food.gov.uk/business-guidance/allergen-information-for-non-prepacked-foods-best-practice-voluntary-information)

- [GS1 — Traceability standard](https://www.gs1.org/standards/traceability)

Operational guidance, not a certification or a legal assessment. Adapt examples to your site, approved procedures and local requirements. Product links lead to the English website; this guide does not imply a fully translated application or verified hardware compatibility.

Canonical: https://kivloo.com/en/guides/food-supplier-risk-assessment-uk