Most companies can answer “Did we evaluate this supplier?” Fewer can answer “What did we do about what we found?”
That gap is where supplier risk programs break down. No universal ESG vendor questionnaire or scoring method exists, but a consensus is forming around process. A credible program is risk-based, ongoing, built into procurement, and tied to action.
From Snapshots to Ongoing Due Diligence
For years, the supplier audit was the main tool for managing ESG risk. A supplier got assessed, a report got filed, and the process went quiet until the next review.
That model is giving way to continuous due diligence: identify, assess, act, monitor, and remediate. Audits still play a role, but they capture one moment. New ownership, new geographies, new subcontractors, or new regulations can change a supplier’s risk profile long before the next assessment.
The OECD’s six-step due diligence framework is becoming the common reference point. It sets the logic without prescribing a single questionnaire, so companies can tailor criteria to their own supply chains.
Five Marks of a Strong Program
Segment suppliers by risk. Not every supplier needs the same scrutiny. Direct resources where impacts are most likely, weighing geography, industry, spend, business criticality, and known environmental or social risks.
Use more than a questionnaire. Self-assessments are one input. Pair them with third-party data, certifications, audits, media screening, and grievance information to see where risk sits.
Connect evaluation to procurement. ESG criteria belong in prequalification, RFPs, contracts, performance reviews, and renewal decisions, not in a separate process procurement rarely touches.
Focus on improvement. Finding a risk is not managing it. A material gap should trigger a clear next step: corrective action, training, escalation, remediation, or disengagement.
Monitor between cycles. A supplier that passed an assessment last year is not automatically low risk today. Set monitoring cadence by risk level.
Regulation Is Raising the Stakes
The EU’s Corporate Sustainability Due Diligence Directive requires in-scope companies to address human rights and environmental impacts across their chains of activities. Amended in 2026 through the Omnibus I package, its revised provisions apply from 2029.
Most suppliers won’t face those requirements directly. Their customers will, and those expectations flow down through contracts, information requests, and supplier standards. For many companies, the practical question is not “Am I regulated?” It is “What will my customers require?”
The Gap Is Implementation
Companies know what good looks like, but execution lags. In McKinsey’s 2024 survey of 88 supply chain leaders, 60% reported comprehensive visibility into their tier-one suppliers. Yet only 9% said their supply chains complied with new rules, and nearly a third said they were behind.
Five Questions to Test Your Program
You don’t need a sophisticated platform. You need clear answers to five questions:
- Who are our suppliers, and can we see where material risk may exist?
- Where is the risk, and are we prioritizing by it?
- What are we doing about it?
- Are those actions working?
- Can we demonstrate it with policies, decisions, and outcomes?
If your assessment doesn’t connect to a working system for prioritization, action, and monitoring, it’s a compliance exercise, not a program.
