Key Takeaways
- ISO 9001, HACCP and hygiene certificates confirm a system exists; they do not prove lot-level process control on packaging lines.
- Strong supplier quality agreements (SQAs) define change-control notice windows, audit access rights and evidence expectations in writing.
- Evaluate six operational signals: process discipline, change-control maturity, audit responsiveness, risk management, CAPA depth and specification control.
What's Inside
- Certificates as an entry gate, not a performance record
- What belongs in a mature packaging SQA
- Six operational criteria, from line discipline to deviation control
- How to lock evidence expectations into the written agreement
Certificates Confirm a System Exists — Not How It Performs Under Pressure
An ISO 9001 certificate attests that a quality management system was audited against a published standard on a defined cycle. It does not record how a converter handled the last ink, adhesive or substrate change on a food-contact line.
Surveillance audits typically land on a 9- to 12-month cycle. That leaves roughly 270 to 330 days of unobserved production runs each year. A standard certification audit samples about 3 to 5 production lots per facility, while a high-volume food-contact line might process 40 to 60 material changeovers in a single month. The arithmetic is the gap packaging engineers and quality managers actually face.
Certificate packs still arrive complete. Deviation history, change logs and CAPA evidence stay thin. One familiar pattern: a supplier holds a valid hygiene certificate yet fails to document a critical ink migration issue during a mid-run changeover. The framework was present. The lot-level control was not.
The rest of this article puts six evaluation criteria where they belong — inside the SQA and the supplier scorecard, not only in the onboarding checklist. The ISO 9001 quality management standard remains the baseline system reference; the SQA is what turns that baseline into enforceable packaging behaviour.
Criteria for Selection: What Belongs in a Mature Packaging SQA
Each criterion on the list below has to clear three filters. It must be observable in plant behaviour, documentable in the agreement, and reviewable after onboarding. If a signal fails any of those tests, it becomes theatre rather than control.
Scope stays tight. These criteria apply to primary and secondary packaging suppliers serving food, personal care and household FMCG. They do not apply to generic office vendors or one-off service providers.
Use the list in two places: RFQ scoring and the annual business review. RFQ models that weight SQA compliance at roughly 15 to 22 percent of the total supplier score push contractual gaps into the open earlier than models built only on price and lead time. Escalate shortfalls into clauses. Informal email trails do not survive a recall drill.
Main Point: Score the six signals at RFQ and again at annual review. Gaps that stay off-contract stay unfixed.
1. Process Discipline on the Line, Not Only in the Manual
Process discipline in packaging means stable set-up sheets, controlled work instructions at the press or converter, and operator adherence that survives shift changes. Manuals describe intent. The line reveals whether intent holds at 02:00 on a Sunday changeover.
Certificate audits often miss day-to-day parameter drift — seal temperature, coat weight, curing, web tension. Those drifts rarely appear in a polished management-review slide.
Buyers should request recent process capability summaries for critical parameters, in-process check records, and a clear path for how out-of-limit events escalate. Process capability indices (Cpk) for parameters such as seal temperature or coat weight should demonstrate a minimum of 1.33 over a 30- to 45-day production window, based on project outcomes. Anything shorter reads as a snapshot, not stability.
2. Change-Control Maturity Before the Next Material Swap
Change control is the highest-risk gap in packaging supply. A resin grade, ink system, adhesive, release liner or sterilisation route swap can alter barrier, migration or machinability before anyone updates the specification file.
Maturity shows up in classified change types, customer-notification triggers, validation or bridging data expectations, and freeze periods around seasonal peaks. Mandatory 60- to 90-day advance notifications for direct food-contact materials and primary barrier resins give quality teams room to revalidate rather than react.
Procurement teams sometimes start by requiring notification for every raw material adjustment. That approach floods quality managers with minor noise and gets abandoned. The workable pattern is narrower: define which changes matter, set timelines, and reserve approval rights in the SQA.
Caution: Reject the phrase “we will tell you if something major changes” when major, timelines and approval rights remain undefined.
3. Audit Responsiveness and Access When Issues Surface
Scheduled certification audits and for-cause customer audits are different instruments. The first checks the system on a calendar. The second answers a complaint, a foreign-body event or a specification failure.
Responsiveness markers are concrete: booking speed, unescorted access to relevant zones within agreed hygiene rules, and willingness to share raw check sheets rather than polished summaries alone. For-cause audits triggered by foreign-body events or critical specification failures require unescorted access to converting zones within 48 to 72 hours of the initial complaint.
Red flags stack quickly. Multi-week delays. Heavily scripted tours that skip converting or warehouse areas. Refusal to discuss recent nonconformances. Those behaviours belong on the scorecard, not in a hallway conversation after the visit.
4. Evidence-Based Risk Management Tied to Packaging Hazards
Generic risk matrices do not carry packaging work. The hazards that matter here include migration, allergen cross-contact from print or recycled content, moisture barrier loss, seal integrity and labelling mix-ups.
What good looks like is narrower and more demanding: hazard analyses linked to process steps, updated when materials or equipment change, with residual-risk decisions written down. Residual-risk files for multilayer films or folding cartons must be updated within 14 to 21 days following any major equipment installation or material substitution.
Holding a HACCP or hygiene certificate shows a framework exists. Buyers still need living risk files for their SKU families. The certificate is the shelf. The files are the contents.
5. CAPA Depth: From Containment to Verified Effectiveness
Certificate culture often stops at closed NCR numbers. FMCG brands need root-cause quality that prevents recurrence on shared assets — the same press, the same laminator, the same warehouse lane.
Evaluate method discipline in four moves: problem definition, evidence of true root cause (not only operator error), a clean split between corrective and preventive action, and effectiveness checks after a defined run length. Effectiveness checks on packaging-related CAPAs should be verified after a run length of 50,000 to 75,000 impressions or units, rather than immediately after the corrective action is implemented.
Practical review is simple. Sample two recent packaging-related CAPAs. Look for data, not narrative. Check whether similar defects reappeared. Depth also varies by pack type: effectiveness checks on primary food-contact films run deeper than those on secondary corrugated shippers, and the SQA should reflect that difference rather than force a single template.
Expert Tip: Ask for the effectiveness window in units or impressions, not calendar days alone. Calendar closure without run-length proof is containment dressed as CAPA.
6. Specification and Deviation Control That Survives a Mock Recall
Specification control is where lot genealogy either holds or collapses. When a deviation hits, traceability of affected lots into the brand’s batch genealogy must be completed within 2 to 4 hours during a mock recall exercise. That clock is the test. Narrative confidence is not.
Pre-shipment concession rules need equal clarity. Strict concession gates fit custom-printed or barrier-critical SKUs; enforcing the same gates on generic tertiary shippers often creates unnecessary supply chain bottlenecks without improving consumer safety. Write the distinction into the SQA so operations and quality are not improvising under pressure.
Deviation logs should name the specification clause breached, the lots touched, the disposition decision and the customer notification path. If any of those fields is optional in the supplier’s system, it will be empty when it is needed.
Writing the SQA So the Six Signals Stay Enforceable
The agreement is the memory of the relationship. Joint quality reviews should mandate retention of deviation logs and CAPA records for 36 to 60 months, matching typical FMCG shelf life plus a safety margin. Shorter retention leaves brands blind just as a market complaint arrives.
Translate each of the six signals into clauses with owners, timelines and evidence formats. Process capability summaries on a defined cadence. Change-notification windows by material class. Audit access terms for for-cause visits. Residual-risk update deadlines. CAPA effectiveness run lengths. Specification and concession rules by SKU criticality.
Scorecard the same items at the annual business review. An SQA that never reappears in the review cycle becomes shelfware. An SQA that drives scoring decisions stays alive.
An ISO certificate renews on a 36-month cycle. A single unannounced substrate change can compromise seal integrity on 10,000 to 15,000 units in one shift.
