Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

Structure (7 sections)

1. 1. Supplier tiering and questionnaire applicability rules

   Set the tiering rule before the questionnaire depth. Score on four dimensions: does the supplier touch customer data or personal information; does it support a critical or important business function; is it located in a geopolitically or labour-risky region; and what is the annual spend and substitutability. That yields three tiers: full questionnaire plus on-site or remote verification (compute and data labelling vendors), standard questionnaire plus document checks (common SaaS), and a simplified declaration (low-risk office procurement). Write the tiering and reassessment cycle into the procurement policy and hold the tier as a field in supplier master data. Note that the EU supply chain due diligence rules have been amended repeatedly: Directive (EU) 2024/1760 (CSDDD) was amended by the Omnibus I Directive (EU) 2026/470, which raised the turnover threshold from EUR 450 000 000 to EUR 1 500 000 000 and the employee threshold from 1 000 to 5 000. Some EU customers who imposed diligence duties on you on the grounds that "we are covered by the CSDDD" may therefore no longer be in scope — when a clause list arrives, first check whether the customer still meets the amended thresholds, then decide how far to commit. Remember too that even where the customer is in scope, the Directive itself (recital 66) states that the mere use of contractual assurances cannot on its own satisfy its due diligence standard: they will want verifiable evidence of execution, not just your signature — and, conversely, you should not assume that signing a supplier code of conduct discharges your own layer of diligence. Calibrate questionnaire depth to the amended text and to what your customer contracts actually require, rather than copying an old clause list.

   Evidence to attach

   • · Supplier tiering rule and scoring sheet
   • · Tier field and reassessment cycle configured in supplier master data
   • · Questionnaire templates per tier with their applicability
   • · List of suppliers assessed this period and coverage statistics

   Common pitfalls

   • · Sending one long questionnaire to every supplier, producing low response rates while the critical suppliers go unexamined
   • · Tiering done once and never revisited when a supplier’s role changes (from tool vendor to data processor, say)
   • · Reducing diligence to a signed undertaking with no verification at all

2. 2. Entity information, ownership structure and affiliates

   Collect: full legal entity name and place of registration, actual place of operations, group structure and ultimate beneficial owners, major shareholders and control relationships, whether any affiliate is connected to a restricted list, and whether the performing entity is the same as the contracting entity. For suppliers involving data or technology transfer, also establish who can access that data and technology (including the locations of its parent, affiliates and outsourcing partners). The purpose is not to duplicate a background-check firm but to let you answer within an hour when a customer or regulator asks whether a particular party is in your supply chain, instead of launching a company-wide search.

   Evidence to attach

   • · Supplier entity data sheet with business licence or registration certificate
   • · Ownership chart and ultimate beneficial owner declaration
   • · Restricted list screening record (date, lists used, conclusion)
   • · Confirmation that the performing entity matches the contracting entity
   • · List of parties with access to data and technology, including their locations

   Common pitfalls

   • · Checking only the contracting entity when delivery is actually performed by an undisclosed overseas affiliate
   • · Screening once and never re-screening, so exposure after a list update goes unnoticed
   • · Missing ultimate beneficial owner information, leaving a customer’s question unanswerable

3. 3. Labour and human rights: employment model, hours and pay, and grievance mechanisms

   For data labelling, content moderation and contract manufacturing suppliers, this is the section that matters most. Ask about: the employment model (direct hire, agency, crowdsourced, student workers), the minimum age and how identity is verified, working hours and overtime management, the piece-rate or hourly pay structure benchmarked against minimum wage, social insurance contributions, measures against forced and bonded labour, the grievance channel and its independence, and mental health support for content moderation roles. State the verification approach: what evidence is accepted (payroll sampling, third-party audit reports, interviews with union or worker representatives) and when an on-site check is required. Note that the questionnaire itself collects personal data, so design it around aggregated or de-identified responses rather than pulling a supplier’s employee personal information into your own systems at scale.

   Evidence to attach

   • · Employment model and workforce composition (aggregated)
   • · Working hours and pay policy documents with a minimum wage benchmark note
   • · Third-party labour audit reports or social responsibility certifications where held
   • · Grievance channel description and aggregated statistics for the previous year
   • · Mental health support measures for content moderation roles
   • · On-site verification records where performed

   Common pitfalls

   • · Treating a signed "no child or forced labour" undertaking as the whole of due diligence
   • · Asking for employee name lists and ID numbers, creating a personal data compliance risk of your own
   • · Terminating rather than remediating on finding a problem, which pushes the risk to a less transparent supplier further down

4. 4. Environment and carbon: energy, emissions and data provision capability

   Your direct reason for collecting carbon data from suppliers is your own Scope 3, especially Category 1 purchased goods and services and Category 2 capital goods. Design the questions so the answers can go straight into your inventory: does the supplier account for and disclose its own Scope 1 and 2, can it allocate data to your purchase volume, what method and factors does it use, is the data assured by a third party, and can it deliver on your reporting timetable. Also ask about environmental permits and compliance records (discharge, energy, hazardous waste), and for hardware suppliers about product-level energy efficiency and materials information. The key practical step: write "provide carbon data on the agreed basis and timetable" into the contract rather than chasing by email each year — without the data you fall back to spend-based estimates, and customers notice the drop in precision.

   Evidence to attach

   • · Supplier carbon data capability questionnaire and the data actually supplied
   • · Supplier methodology and factor note, plus any third-party assurance report
   • · Text of the carbon data provision clause in the contract
   • · Environmental permits and compliance records (discharge, energy, hazardous waste)
   • · Product energy efficiency and materials information for hardware where applicable

   Common pitfalls

   • · No data provision obligation in the contract, discovered only after period end when a key supplier declines
   • · Supplier carbon data on a different consolidation basis being added directly to your own, producing an error
   • · Requesting data from tier-1 suppliers only, so hardware and mineral-stage emissions stay missing and undisclosed

5. 5. Information security and data protection: controls, certifications and incident duties

   Align the questions with what you promise customers — whatever you commit to them, require from your suppliers, or the chain of commitments breaks in the middle. Core questions: certifications and reports held (certificate number, scope, validity, or SOC 2 report type and coverage period); access control and encryption; where data is stored and the geographic distribution of those who can access it; sub-processing management and notification; vulnerability management and remediation deadlines; incident notification deadlines and recipients; and data return and deletion on exit. For suppliers providing software or components, add the software bill of materials and vulnerability disclosure arrangements. For suppliers touching personal information, execute a data processing agreement and obtain the documents for whichever transfer mechanism applies.

   Evidence to attach

   • · Supplier certificates and audit reports with scope and validity verification records
   • · Executed data processing agreement and security addendum
   • · Sub-processor list and change notification clauses
   • · Incident notification clauses and any exercise or historical incident records
   • · Software bill of materials and vulnerability disclosure arrangements for software and component suppliers
   • · Agreed data return and deletion on exit, and how it is verified

   Common pitfalls

   • · Promising customers 24-hour incident notification while the supplier contract says only "promptly"
   • · Filing a certificate on receipt without checking that its scope covers the service you buy
   • · No sub-processor change notification, so a silent cloud provider switch changes where data lands

6. 6. AI supplier specifics: additional questions for model, data and compute providers

   Foundation model and API providers: model versions and change notification, use and redistribution restrictions in the terms, whether your inputs are used for their training, ownership of and indemnity for outputs, the technical information and evaluation results available to you, and the migration arrangements if the service ends or the model is withdrawn. Data providers: provenance and how the data was obtained, the chain of rights and the scope of sublicensing, whether it contains personal or sensitive information, and labelling quality and process. Compute and cloud providers: regions and availability zones, the geographic distribution of operations access, energy and carbon data, and hardware supply chain information. The output of this section determines directly what you can promise your own customers — any external commitment beyond the authorisation and information your supplier gives you is exposure you carry yourself.

   Evidence to attach

   • · Extracts of third-party model terms with the use and redistribution restrictions
   • · Agreed model version and change notification mechanism
   • · Data supplier rights chain documents and confirmation of sublicensing scope
   • · Compute provider regions, geographic distribution of operations access, and carbon data
   • · Migration and transition clauses for service termination or model withdrawal

   Common pitfalls

   • · Telling customers the model may be used in any commercial scenario while the third-party terms expressly prohibit certain industries
   • · A data supplier offering only a verbal assurance of lawful acquisition, with no rights chain documentation
   • · A silent model upgrade changing product behaviour, with the absence of a change notification clause discovered only after customer complaints

7. 7. Verification, remediation and ongoing monitoring

   The value of diligence lies in verification, not in collecting forms. Set the verification method by tier: document checks (certificates, reports, policies), remote interviews, sample testing (asking for evidence that a specific control ran), and on-site verification. When problems surface, prefer remediation over immediate termination — record the issue, agree measures and deadlines, track closure, and suspend new business if necessary. Establish ongoing monitoring as well: periodic reassessment, list and adverse media monitoring, contractual audit rights and information update duties, and a duty to notify material changes proactively (ownership change, loss of key personnel, major security incident, listing on a restricted list). Keep these records: when your customer reviews how you manage your supply chain, this is the most direct answer you can give.

   Evidence to attach

   • · Verification methods and execution records by supplier tier
   • · Issue list and remediation tracker (measure, owner, deadline, closure evidence)
   • · Contractual audit rights, information update and material change notification clauses
   • · Ongoing monitoring records (reassessment dates, list screening, adverse media alerts)
   • · Supplier exit and alternative sourcing assessment

   Common pitfalls

   • · Questionnaires collected but never read, so risk signals stay buried in attachments
   • · Remediation commitments with no deadline or owner, unchanged a year later
   • · No audit rights in the contract, so you cannot enter when a customer asks you to verify a supplier
   • · Treating supply chain diligence as a one-off project and not noticing when a supplier changes