Welcome to Elsmar Cove
Right now, your internal procedures define you . There are other options, but your procedures will need to be revised.
My suggestion is to have different rules for different categories of suppliers. You can call this strategy Risk-Based Supplier List management. The risk of disruption from suppliers who sell packaging or cleaning supplies is much lower than that from suppliers of raw materials or outside services which become part of the product you produce. So the effort to approve and monitor low risk suppliers is comensurately lower. The former are called indirect suppliers and the latter, direct suppliers.
Another distinction, commonly used, is reduced approval/monitoring requirenments for Commercial Off-the-Shelf (COTS) parts, also called catalog parts. COTS examples are fasteners and connectors which are assembled into your products. These are lower risk because the same part number is used by dozens of companies in differnt industries, and parts are likely produced in high volume batches from dedicated tooling. In the rare event a quality problem is discovered with a COTS part number, odds are good the problem would be first discovered and resolution demanded by other customers purchasing the same part number.
There are other avenues for Supplier Approval and Monitoring, in addition to the two you mentioned:
- desk audit of current suppliers (review their past track record, judging the severity of any quality hiccups, late deliveries or undershipments).and judge acceptable, discontinue or needs followup
- a Zoom interview or in-person visit to complete your supplier questionnaire might produce better cooperation than mailing out a survey
- a thorough review of prospective supplier's website and reputation/reviews, completed by your SQE or Buyer, to judge capabilities and dedication to quality and customer satisfaction
- find inroads to one of your supplier's top managers via networking, through LinkedIn connections for example., to foster better cooperation
You ask about lacking initial approval records. Since you mentioned this was a recertification audit and you are assigned to remedy the process, it sounds like this area received a non-conformance in the last audit. It is understood that to remedy an NC, changes to the process must be made, and full implementation takes time. Generate a plan, timetable and prioritized list to bring current suppliers into compliance with the newly revised procedure requirements. Legacy suppliers with positive track records can probably be grandfathered for the first year, as long as there is a long-term plan and commitment to address gaps.
My advice on corrective actions is
be careful what you sign up for. You will be expected to live with whatever remedy you decide on. I see sometimes, in their haste and eagerness to close the NC and satisfy the auditor, an organization will write procedures and implement paperwork requirements they can't reasonably maintain for years into the future. So consider all your options and choose wisely.