A customer asks for a document. You know where to find it.

A customer asks for the packaging supplier’s current assessment before an audit. The file exists, but it covers a different material. Another document has expired, and the approval decision is buried in an email. Sending everything in the folder would not answer the customer’s question. The team needs to determine what applies, what is missing and who can accept the resulting evidence.

This guide is for food quality teams, supplier-quality owners and food business managers. It provides a proposed documentation workflow and a hypothetical packaging-supplier case. It is not a HACCP plan, a recall instruction or a certification assessment. The plant’s actual products, hazards, legal obligations and applicable customer requirements remain the basis for its decisions.

Separate law, certification and customer requirements

EU food law places responsibilities on food business operators, including food safety and traceability. The hygiene framework includes Regulation 852/2004 and, where applicable, specific rules for food of animal origin. The Commission’s guidance on food safety management systems explains the relationship between hygiene practices, HACCP-based procedures, documentation and verification. The organisation must assess the actual scope of those requirements.

IFS Food and BRCGS Food Safety are private certification programmes. Their requirements can also matter through customer contracts, but certification does not replace legal responsibilities. A customer questionnaire may request additional information. Keep the legal source, licensed standard and customer specification distinct so that the reviewer knows why a document is needed.

The language of this guide does not determine the competent authority or national procedures. Confirm the establishment’s jurisdiction and applicable local rules. Use the current programme documents for the agreed audit and a lawful copy of any licensed material. The operating methods below are our recommendations rather than additional statutory obligations.

Define the supplier case precisely

In the hypothetical example, a plant changes packaging for a chilled food product. The packaging supplier sends several documents that refer to different material codes and intended uses. Purchasing considers the folder complete because all requested file types are present. Quality has not yet confirmed whether they cover the actual supplied packaging.

Start the case with supplier identity, manufacturing site, material code, intended use, affected product and source requirement. Record the change date and any stock already received. The same supplier name on two documents is not enough to establish that both cover the same material. A clear case boundary prevents an old approval from being reused for a new scope without review.

The owner determines the evidence needed with the appropriate technical experts. Pulsar GRC can link the source requirement, action and documents. It does not assess migration testing or other product-specific technical suitability on its own. Those judgements belong to qualified people using the actual specifications and results.

Establish evidence acceptance before requesting files

Define what each requested document must demonstrate. Check material and site scope, relevant use conditions, source, version or validity information and the responsible reviewer. Record which criteria are required by the applicable source and which are additional internal safeguards. A single list without that distinction can create unnecessary supplier work or miss a real requirement.

For example, the plant might receive a document that describes packaging suitable for a different temperature range. That document is not necessarily false; it may simply be irrelevant to this product. Mark the mismatch, ask the supplier a specific question and retain the response with the case. “Please send current documents” is less useful than a request naming the material and intended conditions.

When several documents together establish suitability, keep their relationship visible. An assessment may refer to a specification, supporting test and supplier declaration. The final reviewer should be able to follow those references. If a supporting record is unavailable, record the limitation rather than treating a reference as if it were the evidence itself.

Review the gap before approving supply

Assign responsibility for obtaining missing information and a separate responsibility for the approval decision. These may be held by the same person in a small plant, but their purposes differ. Purchasing can request a document; the technical reviewer decides whether it is adequate. A file arriving in the inbox should not automatically change the supplier’s status.

If material has already been received, assess the affected stock and products under the plant’s procedures. Do not infer a safe release or a necessary recall from a missing administrative document alone. Establish the facts, product implications and applicable criteria. The authorised owner records containment, further assessment or another justified decision.

Keep temporary approval or restriction explicit where the organisation’s applicable procedures allow it. State its scope, rationale, expiry or review trigger and responsible person. A temporary decision without a trigger can become an indefinite exception. The record should show that the organisation knows the limitation and controls the related action.

Preserve original observations

A missing monitoring or verification record cannot be replaced by a later invented entry. Record the absence and distinguish the original activity, later investigation and decision. This matters when a reviewer asks what was known at the time of release. A neat retrospective form may conceal the uncertainty the food safety team actually had.

Similarly, do not alter a supplier document to make its material code match the case. Obtain an authentic correction or clarification from the source, or record the plant’s interpretation and its basis. Preserve the original and subsequent versions. The organisation needs to be able to explain who changed information and why.

AI can help structure supplied material and propose mappings, but a person checks references, meaning and applicability. A suggested link between a requirement and a document is not a technical acceptance decision. Treat ambiguous product names, tables and scope statements as review points rather than trusting a fluent summary.

Connect a documentation gap to corrective action

If repeated supplier cases are incomplete, investigate the process that creates the gap. The request template may omit intended-use information. The material master may fail to trigger reassessment. The approval role may not be available during urgent purchasing. Each possibility requires supporting evidence and a different action.

In the hypothetical plant, the supplier-change request names the supplier but not the material code. Consequently the supplier sends its general document set, and quality discovers the mismatch late. The immediate correction is to obtain the relevant evidence. Cause removal changes the request and approval workflow so future cases carry the necessary scope before documents are requested.

Define implementation evidence and effectiveness separately. The revised request form and approved instruction show implementation. Subsequent supplier changes using correct identifiers and accepted evidence show whether the mechanism works. Review meaningful changed cases, not only unchanged suppliers whose approvals were already complete.

Rehearse the customer audit question

Give a colleague the customer’s actual question or a labelled demonstration equivalent. Ask the colleague to retrieve the source requirement, relevant supplier documents, assessment and approval decision. The colleague should explain which product and period are covered and which gaps remain. Opening a folder is not the same as answering the question.

Agree the audit scope and sharing method with the recipient. Supplier cases may contain prices, personal contacts or confidential information irrelevant to the review. Share only the justified material with appropriate access. Retain the original protected records and identify any redacted or limited copy supplied to the customer.

If a document changes after the package is issued, notify the recipient and identify the replacement version. Do not silently overwrite the earlier file. A small version register helps both sides refer to the same evidence and prevents the audit discussion from turning into an argument about which attachment was current.

Keep food safety operations in their own systems

Pulsar GRC supports documentation, audit actions and decisions. The plant’s HACCP system, batch traceability, laboratory testing and production monitoring remain separate operational capabilities. A well-organised GRC case can refer to their evidence, but it does not create missing measurements or prove that a production control operated correctly.

For a traceability or recall exercise, define the product scope, records used, roles and acceptance criteria through the actual plant procedures. Review completeness alongside elapsed time. A quick database query does not establish that all affected stock and recipients were identified. CrewShift can support role preparation and exercises within the current service scope; the food safety team owns the technical decisions.

Test one case before importing the archive

Choose one changed supplier, one routine approval and one exception. Evaluate whether the process captures the right identifiers, assigns decisions and retains a usable history. Record retrieval time, evidence rejected because of wrong scope and ongoing maintenance effort. Use the plant’s baseline rather than an invented industry percentage.

Expand only when another colleague can maintain the record and follow the decision without private email explanations. If the pilot exposes an unclear supplier procedure, repair it before increasing the number of cases. More imported documents will not resolve an unclear acceptance criterion.

Keep the supplier decision available during absence

The complete case should remain usable when its original reviewer is away. Identify a suitable substitute and ask that person to locate the current approval, understand any restriction and identify the next review trigger. The substitute should know which decisions require further technical authority and should not infer approval from a document’s presence.

In the hypothetical packaging change, an urgent purchasing request arrives during the reviewer’s leave. A recorded restriction prevents the buyer from confusing “documents requested” with “material accepted.” The substitute sees what is missing and routes the request to the authorised person. This is a useful handover test because it checks the operating decision as well as file retrieval.

If the substitute needs an undocumented private conversation to explain the case, add the missing context. The aim is understandable organisational memory, with appropriate confidentiality and authority, rather than dependence on the person who assembled the original folder.

See the documentation and actions workflow, then check the current features and offer. Pulsar GRC does not replace HACCP, batch traceability, laboratory tests or certification. The current trial is 14 days and requires a payment method. Start with a representative supplier case whose evidence your team can assess responsibly.