The decision
Supplier due diligence needs a clear link between risk assessment and decisions. The map is drawn, the heat is colour-coded, and nothing changes in how a supplier is contracted, visited or paid. The decision is the step that names which suppliers get which requirements, and who signs that off.
Approve which suppliers can continue under agreed conditions, which need additional controls, and which decisions require escalation.
Why it matters
Treat the supplier decision as a commercial choice as well as a control. Consider delivery continuity, the cost of additional visits or testing, and the evidence a customer may request. We recommend comparing these consequences before committing further orders or accepting a corrective-action plan.
Options and trade-offs
We recommend comparing two routes. Where identified risks can be managed through credible corrective action, continue with explicit conditions, monitoring and a review date. Account for the resources needed for follow-up.
Where the evidence or supplier response is insufficient, assess pausing new orders while the gaps are addressed. Weigh the exposure against delivery disruption and the time needed to qualify an alternative supplier. Escalate material trade-offs for a recorded decision.
What to do next
Write it as a decision file: the suppliers in scope, the requirement set each tier receives, the conditions attached, and the date the decision will be reviewed. Keep the decision concise, link to the supporting evidence and record the approval.
Keep one corrective-action log for all suppliers, with a due date, an owner on the supplier side and an owner on yours. Review it monthly. The log gives your team and your customers’ auditors a shared view of actions, evidence and outstanding gaps.
Prepare the first review pack: outstanding findings, evidence received, overdue actions and any proposed change to orders. Record what the decision-maker must approve.
Ownership and oversight
Procurement should own the decision, because procurement holds the levers: contract terms, order allocation, site visits. Sustainability and legal advise. The DPO is consulted where worker data is processed. Where a committee approves the decision, name the person responsible for follow-up.
Name a person, not a function, in the file. Give them the budget for follow-up visits and the authority to pause orders. Without both, corrective action becomes a letter.
Evidence and review
A finding from a SMETA or amfori BSCI audit is not closed by a corrective-action plan. It is closed by evidence that the plan worked. Overtime records for the following quarter. Payslips. A second visit, announced or not.
The record is what remains when the people change. The decision file, the requirement set, the corrective-action log and the visit reports, filed where a customer audit, a CSDDD review or a journalist’s question can be answered in a day.
Records help show how risks were assessed, decisions made and actions followed up. Keep them up to date as the work progresses.
Bring the review forward if a serious new finding or missed milestone changes the assessment.
The template
Evidence register template
Sources, versions, control owners and explicit gaps. Excel, three sheets.