Reading supplier ethics trends with a cool head

Three things in this subject have genuinely changed. Two more are presented as new every year and are not. Sorting them matters, because effort spent on the second group is the main reason programs stay busy and find nothing.

Each item below can be checked against your own supplier file. The test is not whether a trend is interesting but whether it changes a decision you make.

What to take away

Genuinely different

Diligence has to be evidenced, not asserted

The expectation, from customers and counterparties before any regulator, has moved from stating coverage to showing what was done and what it turned up. A statement that every tier one supplier is covered by a code invites the obvious question of what the code found.

What to do: change what you report internally first. Replace coverage counts with three items: findings from short-notice visits set against announced ones, recurrence of the same finding at the next visit, and grievances received per thousand workers by source.

Duty now has names. California's Transparency in Supply Chains Act requires larger retailers and manufacturers doing business in the state to disclose their efforts on forced labor. Germany's Supply Chain Due Diligence Act and the EU's Corporate Sustainability Due Diligence Directive push the same way in Europe. For goods entering the United States, the Uyghur Forced Labor Prevention Act lets U.S. Customs and Border Protection detain a shipment unless the importer can show it was not made with forced labor.

Where you publish externally, whether anything is legally required of you depends on where you operate and your size. The best-known duty is the UK's Modern Slavery Act 2015, under which large companies must publish an annual statement, supported by Home Office statutory guidance and a government registry where statements are published; a published modern slavery statement shows the shape of the document. Counsel decides what applies to you; the internal change does not wait for that answer.

The buyer's own conduct is in scope

The contradiction between what responsible sourcing asks of a supplier and what procurement asks of the same supplier is no longer treated as an internal awkwardness. It is increasingly the first thing an informed reviewer looks at, because it explains most findings.

The clearest case of buyers accepting that obligation is the Bangladesh Accord on Fire and Building Safety, signed by global brands and global unions after the Rana Plaza collapse. It made safety remediation something brands paid for rather than something suppliers were asked to absorb.

What to do: measure three things about your own behavior per supplier, from records you already hold. How late confirmed orders arrive against the production window. How often specifications change after confirmation. How far volumes move month to month.

Then ask whether your unit price supports compliance with your own code at your volumes. Home Office guidance under the Modern Slavery Act 2015 is written around finding and addressing risk rather than documenting coverage. It reads very differently once you accept that some of the risk is created by your purchase orders.

Reaching workers is now affordable

A channel that reaches workers without passing through their employer used to require scale. It no longer does, and its absence is becoming harder to explain.

Worker-voice platforms make that practical: Ulula and Laborlink run surveys and grievance lines by mobile phone, in the workforce's own language and outside the employer's system.

What to do: build the smallest version that works. Track a number in the workforce's language. Someone with authority to act monitors it, stating a response time.

Expect reports to rise when it works. Decide in advance this shows the mechanism succeeding, not conditions worsening. A program that reads the rise as failure will suppress the channel it built.

Presented as new, and not

Traceability technology as assurance

Platforms that map chains and collect supplier declarations — Sourcemap, Circulor, Sedex and Trase among them — are useful for narrowing where to look. They cannot see below the tier that answers them, and what they collect is self-declared.

The claim worth resisting is that a mapped chain is a verified one. Ask a vendor what the product does when a supplier's own answers are internally inconsistent, because that is the only finding you are actually buying.

Certification as a substitute for looking

Audit and certification schemes appear regularly; SMETA, SA8000 and amfori BSCI are the ones buyers most often require. Each inherits the limits of the audit underneath it: announced timing, a sampling window too short to see episodic practices, and interviews conducted where the interviewee has to keep working afterwards.

Certificates remain worth having as one input. The failure is reporting a pass as a state rather than as a snapshot of a prepared site, which is the same error whichever scheme issued it.

What has not moved

Each row has been true for years and each is still the thing that decides whether a program finds anything. The detail behind them is in supplier ethics.

What to do this quarter

Pick the three suppliers where a problem would embarrass you most, ranked by risk rather than by spend. For each, run the capacity arithmetic against your own receipts, measure your own order stability, and ask one question you have not asked before.

Write the exit rule before any of that produces an answer. What you will do about a serious finding is a choice between harms. It goes badly when made in the week you make it, the general case set out in ethical dilemmas.

Who is placed to make that decision without a conflict is the subject of leadership ethics. How honestly the result gets described afterward belongs to corporate responsibility.

Common questions

Is any of this legally required of us?

That depends on your size, sector and where you operate, and it changes. Ask counsel to separate what is required from what is expected by customers and counterparties. Both matter and only the first one is their department.

We have limited resources. Which single change?

Measure your own order stability. It uses data you already have, it costs a day, and it addresses the cause of a large share of the practices your code prohibits.

Should we publish what we find?

Publishing one honest finding and what you did about it is more credible than a coverage table, and it is also harder, because it requires having found something. Start by reporting it internally and see whether the organization can handle that first.