A practical supplier ethics framework for buyers

Most supplier programs fail because they apply one set of requirements to every supplier regardless of whether the buyer has any ability to make them stick.

A supplier ethics framework starts with influence—your share of the supplier's revenue—and pairs it with the likelihood and severity of harm to people. Those two axes shape what you can realistically require and verify.

What to take away

Step one: the two axes

Influence. Your share of the supplier's revenue, roughly. Under a few per cent, your requirements are a document they sign. Above a quarter, they are instructions.

Risk. Not your commercial risk. The likelihood and severity of harm to people in that supplier's operation: labor intensity, the country's enforcement record, whether the work is seasonal, whether recruitment runs through intermediaries, whether the process is dangerous.

Plot every supplier on those two axes and you get four segments. The mistake the standard program makes is treating the whole grid as one.

The OECD Due Diligence Guidance for Responsible Business Conduct describes risk-based due diligence, while the UN Guiding Principles on Business and Human Rights set out the corporate responsibility to respect human rights. Both are useful reference points for supplier due diligence.

Step two: the playbook per segment

High influence, high risk: where the program lives

This is where nearly all your effort belongs, and it is usually a small number of suppliers.

Require specific, verifiable things rather than a long code: disclosure of subcontracting before use, access at short notice extending to sites used on your behalf, direct access to workers off site, and survival of payment obligations on termination.

Fund what you require. Work out what compliance with your own standards implies at your volumes, and check it against your unit price. If the arithmetic does not close, you are asking the supplier to absorb your ethics, and some will appear to.

Verify by comparing findings from announced and unannounced checks at the same sites, and by checking declared production capacity—workers, shifts, equipment, and stated output—against order volumes, delivery dates, and actual receipts.

On a remediable finding, use a consequence short of termination: set a corrective-action plan with milestones, escalate to probation, and pause new orders if milestones are missed. Reserve exit for absolute findings or failure to remediate.

High influence, low risk: light touch

Standard terms, the code, and an annual check that the risk rating is still right. Do not spend audit budget here because it is easy to spend.

The one thing worth doing: apply your payment behavior standards. A small supplier in a low-risk category can still be destroyed by extended terms and late invoice queries, and this is the segment where that happens most.

Require: standard terms and the code, including payment expectations. Fund: avoid a dedicated audit or remediation budget unless new evidence changes the risk; pay invoices on agreed terms. Verify: review payment timing and invoice-query records, and check the risk rating annually. On a finding: require correction, escalating to probation or a pause on new orders if the issue recurs or remains unresolved.

Low influence, high risk: the hard corner

Acting alone, you cannot impose requirements and the harm potential is real. Three honest options, and the program is choosing between them rather than pretending the code applies.

Aggregate. Join with other buyers of the same supplier. Collective influence is the only route to influence you do not individually have.

Change what you buy. Move to a supplier where you matter, or to a material or process with a different risk profile. This is the option most often available and least often considered, because it sits with a different team.

Buy anyway and say so honestly. Sometimes the alternatives are worse for the people involved. If you take this route, record the reasoning and do not describe the supplier as covered by a program, because it is not.

Require: use requirements agreed with other buyers only when they can be verified; otherwise, do not claim the supplier is covered. Fund: pool buyer contributions for shared worker access or remediation where possible. Verify: use shared evidence and worker access, not a supplier signature alone. On a finding: pursue collective corrective action; exit responsibly for absolute findings or harm that cannot be addressed.

For UK businesses, the Modern Slavery Act 2015 and the Home Office's Transparency in supply chains: a practical guide address modern slavery statements. For UK government supply chains, the Cabinet Office's Procurement Policy Note 02/23, Tackling Modern Slavery in Government Supply Chains, provides related guidance on modern slavery and human trafficking. That guidance is written around finding and addressing risk, and it reads very differently once you accept that a signature is not a finding.

Low influence, low risk: ignore, honestly

Standard terms and no program. Say so internally. A register that claims coverage of every supplier is a register nobody believes, including the people maintaining it.

Require: standard terms and the code only. Fund: no supplier-specific program investment. Verify: revisit the risk rating annually or after a material change. On a finding: reassess the rating and, if the finding is substantiated, pause new orders while deciding whether to move the supplier into a higher-risk segment or exit responsibly.

Step three: fix your own buying first

Track three measures for each supplier in the top-right segment: (1) the frequency and size of forecast changes after the supplier has planned capacity; (2) the time between order confirmation and required delivery, compared with the supplier's stated production needs; and (3) the frequency of orders changed, expedited, or canceled after confirmation.

Each of these forces overtime, agency labor, or subcontracting. Your code prohibits these practices.

This step comes before any supplier-facing activity, because a program that ignores it asks suppliers to absorb your planning's consequences.

The general pattern, that rules lose to whatever the purchase order rewards, is the same one set out in leadership ethics about incentives inside a company.

Step four: the finding rule, written before you look

Decide now, in writing, and get it signed off:

The reason to write it early is that every one of these decisions is harder when a shipment is waiting and a finding is on the table. The structure of that decision, a choice between harms rather than a compliance question, is set out in ethical dilemmas.

Step five: the reporting that means something

Report three numbers internally: (1) the rate of findings per unannounced visit compared with announced visits at the same sites; (2) the recurrence rate—the share of closed findings that reappear at follow-up; and (3) substantiated grievances per thousand workers. Define the populations and reporting period consistently.

Coverage counts are inputs and they tell you what you spent. The preference for evidence that a program operates over evidence that it exists is the standard applied in guidance for prosecutors evaluating compliance programs, and it transfers directly. How honestly the results get described outside the company belongs to corporate responsibility.

What this framework will not do

It will not give you a clean chain. It will tell you which suppliers you can actually affect, what it would cost to affect them, and where you are buying from people whose conduct you cannot influence and should stop describing as managed. The underlying argument about what a buyer can require, fund and see is in supplier ethics.

Common questions

How often should the segmentation be redone?

Annually, and whenever a supplier's share of your spend or your share of their revenue moves materially. Suppliers move between segments more often than programs notice.

What if procurement will not share the influence data?

That is the finding. Your share of a supplier's revenue is knowable, roughly, from what you buy and what the supplier publishes or tells you, and a program designed without it is designed on hope.

Is a code of conduct still worth having?

Yes, as the place the requirements live and as the thing contracts point at. What it cannot do is create influence you do not have, which is why the segment decides the playbook rather than the document.