ESG Supplier Due Diligence

ESG Supplier Due Diligence is a risk-based process for examining environmental, social and governance factors in the supply chain and deciding what follow-up is needed. Depending on the organization, supplier category and applicable requirements, the assessment may cover emissions, waste, resource use, responsible sourcing, labor practices, human rights, occupational health and safety, ethics, governance controls and the quality of sustainability evidence.

The process should be proportionate. A supplier of a critical material, a supplier operating in a higher-risk sourcing context and a low-impact service provider may require different levels of review. Due diligence becomes more useful when resources are focused on the suppliers, impacts and information gaps that are most relevant to the organization.

The EU Corporate Sustainability Due Diligence Directive, as amended through 2026, requires companies within its scope to identify and address actual and potential adverse human-rights and environmental impacts in their own operations, subsidiaries and chains of activities. The European Commission states that the amended framework allows companies to focus on areas where impacts are most likely and most severe, based on reasonably available information.

Supplier ESG information often originates outside the organization. Teams must decide what to ask, which supplier should answer, which products or materials are in scope, what evidence is acceptable and how incomplete or conflicting information should affect the supplier assessment.

Without a structured process, organizations may request the same information repeatedly, store supplier answers separately from the items they concern, collect documentation without reviewing it against defined criteria, or assign risk levels that are difficult to explain. A controlled process creates a stronger basis for distinguishing between missing information, weak evidence, actual risk concerns and lower-priority gaps that can be managed through routine monitoring.

The assessment should reflect the organization’s sourcing model and applicable obligations rather than using one generic checklist for every supplier.

The important principle is that supplier claims should be linked to the scope they support and reviewed before they are relied on for a risk decision.

1. Define the Scope Before Sending Questionnaires

Identify which suppliers, products, components, materials and factories are relevant. Define the ESG topics that matter and determine whether the assessment is supplier-level, item-level, site-level or linked to a specific requirement. Clear scope reduces unnecessary requests and improves reporting.

2. Prioritize Suppliers Using a Risk-Based Approach

Do not treat every supplier as equally exposed. Segment suppliers using relevant factors such as supplied material, product criticality, manufacturing location, sourcing complexity, known compliance gaps or previous responses. Higher-priority suppliers may justify more detailed questions, stronger evidence or closer review.

3. Connect Supplier Information to Items and Factories

Linking suppliers to products, components, materials and factories helps teams understand the operational impact of an ESG concern. It also prevents a broad supplier-level statement from being applied automatically to items or sites that were not covered by the evidence.

4. Build Structured ESG Questionnaires

Use repeatable question groups rather than unmanaged email requests. Organize questions by topic, requirement or supplier category and use consistent formats so responses can be compared. Ask for measurable answers, dates, scope details or evidence where these provide a clearer result than broad narrative statements.

5. Request and Review Supporting Evidence

A completed questionnaire is not always sufficient. Define which answers require supporting files and what type of evidence is appropriate. Review whether submissions are complete, internally consistent, current and relevant to the requested scope. Record limitations where evidence applies only to specific facilities, products, periods or legal entities.

6. Use Transparent Risk Criteria

Define how responses affect supplier risk. Scoring rules and thresholds should be understandable, documented and applied consistently. Where a single answer can create a high-risk result, make that rule explicit. Risk scoring should support prioritization and follow-up, not replace professional review.

7. Convert Findings Into Follow-Up

A risk classification should lead to a defined next step. Depending on the issue, this may include requesting additional evidence, clarifying a response, repeating part of the assessment or escalating the review internally. Keep follow-up connected to the original finding so teams can see what changed and why the supplier status was updated.

8. Keep Due Diligence Current

Supplier conditions change. New factories, materials, policies, documentation, regulations or questionnaire responses can affect the assessment. Use scheduled reviews and event-based reassessment triggers, and retain prior submissions so reviewers can understand changes over time.

9. Report by Supplier, Item and Requirement

Management reporting should show more than a single ESG score. Useful views include supplier status, open information gaps, supplier-and-item status, relevant requirements and the distribution of risk levels across the supplier base. This helps teams focus follow-up where it is most needed.

A practical workflow can follow a clear sequence:

1. define supplier, item and site scope;
2. select relevant ESG topics and requirements;
3. send structured questionnaires;
4. collect responses and supporting evidence;
5. review and approve supplier answers;
6. apply documented risk criteria;
7. request clarification or additional evidence where needed;
8. reassess when information changes;
9. report current supplier and item status.

This creates a continuous process rather than a one-time survey and keeps the assessment explainable by linking risk results to supplier responses, evidence and review decisions.

ComplyMarket provides dedicated Supplier Due-Diligence Questionnaire Management with question groups, questionnaire packages and company-defined criteria. Question groups can contain multiple pages and questions, packages can combine multiple groups for supplier distribution, and companies can define points and ranges for High, Middle and Low supplier risk.

Supplier Response Approval supports the review of completed questionnaires. The platform records completion progress and answer history, and supports automatic judgments configured for questionnaire responses as well as reviewer changes to a selected judgment when needed. This creates a controlled stage between supplier submission and risk classification.

ComplyMarket also provides supplier response status tracking and Supplier Risk Assessment views that classify suppliers as High, Middle or Low based on answers and approved judgments. The documented risk logic includes automatic recalculation when relevant question or response-option settings change.

For ESG-oriented workflows, Sustainability Compliance Management includes structured Sustainability Question Groups and Questionnaire Packages for supplier data collection. Supplier records can also be connected with factories and items, helping organizations maintain a clearer relationship between the supplier, its operational context and the products or materials it supplies.

Reporting supports views by supplier and by supplier and item. ComplyMarket’s Product Compliance Management environment also consolidates Supplier Due-Diligence, Supplier Risk Assessment and Sustainability Compliance with other compliance modules.

By connecting questionnaires, supplier responses, review decisions, risk criteria, sustainability information and reporting, ComplyMarket can support a repeatable ESG supplier due diligence process that helps teams identify information gaps, prioritize supplier follow-up and maintain a more traceable basis for sustainability and compliance decisions.