Supply chain due diligence: a duty of enquiry rather than a supplier questionnaire

Risk-based means unequal attention, deliberately

Sending the same questionnaire to every supplier is the opposite of what these frameworks describe. The expectation is that a business identifies where severe harm is most likely — by sector, by process, by raw material, by country, by labour model — and puts its effort there, accepting lighter treatment elsewhere. That is uncomfortable internally, because it means telling a category manager that their large, well-run European supplier gets less scrutiny than a small one nobody has visited. The prioritisation itself is part of what an authority or a claimant will examine, so record why each area was ranked as it was and revisit it when sourcing shifts.

The chain you buy from is not the chain that carries the risk

Serious harm concentrates in raw material extraction, primary processing, agricultural inputs and labour-intensive finishing — usually beyond the supplier who invoices you. A fabricator can name its steel stockholder and not the mill; a garment brand knows its assembler and not the spinning mill. Mapping upstream is slow and partial, and pretending otherwise in a public report is riskier than admitting the limit. Practical progress usually comes from tracing one material at a time, starting with whichever has the strongest external signal of risk, and using industry initiatives where a single buyer has no leverage.

Prevention, mitigation and the awkward question of leverage

Finding an issue starts the harder part. The frameworks distinguish causing harm, contributing to it, and being linked to it through a business relationship, and they expect different responses to each. Where your own purchasing behaviour contributes — punitive lead times, prices below the cost of lawful labour, last-minute order changes — the remedy points inward. Where you are linked to harm through a distant supplier, the expectation is usually to use whatever influence exists, act with others, and treat disengagement as a last step with consequences of its own for the workers involved.

Grievance routes and remediation that people actually reach

A channel nobody uses is evidence of nothing. Workers several tiers away rarely raise concerns through a portal in a language they do not read, run by a company they have never heard of. Effective arrangements tend to be local, available in the languages spoken on site, reachable without a manager's knowledge, and protected against retaliation, with somebody accountable for closing cases. Where harm is confirmed, remediation means restoring the affected person rather than terminating a contract; the record of what was provided is often the most persuasive evidence a business holds.

What the paperwork does and does not achieve

Flow-down clauses, signed policies and certificates are useful and routinely mistaken for the duty itself. They allocate contractual risk; they do not demonstrate enquiry. Reporting expectations under most regimes ask what was found, what was done and what remains unresolved — the last being the part firms are tempted to omit. Since scope, thresholds and enforcement differ by jurisdiction and are actively changing, treat published guidance from labour and economic cooperation bodies as the method reference and take the applicability question to counsel rather than inferring it from a competitor's report.

Frequently asked questions

Is due diligence just supplier auditing under a different name?

No, and conflating them causes most of the trouble. An audit is a point-in-time check of one site against a checklist. Due diligence is an ongoing management process covering identification, action, tracking, communication and remedy across the business, including how your own commercial practices create pressure. Audits can feed it as one input among several, alongside worker voice, grievance data, sector research and what your own staff observe when they visit a plant.

We are a mid-sized manufacturer. Are we outside these duties?

Direct statutory duties frequently target larger enterprises, but exposure reaches smaller firms through customers who pass obligations down the chain, through financing conditions, and through import controls that stop goods regardless of company size. Many mid-sized suppliers first encounter this as a contractual demand from a major account with a deadline attached. Whether a specific law applies to your entity is a question for counsel; whether your customers will ask is usually a question of when.

What records should we be keeping as we go?

Keep the reasoning, not only the outputs: how you ranked risks and on what evidence, which suppliers and materials were prioritised, what enquiries were made and what came back, decisions taken including those to do nothing, and how any confirmed harm was addressed. Date everything and note who decided. The common failure is a business that did sensible work over several years and cannot reconstruct it because it lived in email and in the head of someone who has left.