Supply Chain Compliance: Why Supplier Declarations Are Not Enough for Responsible Sourcing
A supplier signs a code of conduct, submits a declaration of compliance and provides copies of its certificates. The procurement department approves the supplier. But what evidence demonstrates that the supplier’s actual operations meet the organization’s requirements?
This question is becoming increasingly important for manufacturers, exporters, multinational buyers and organizations operating complex supply chains.
Supplier declarations are widely used to communicate commitments relating to product quality, legal compliance, labour practices, environmental responsibility, ethical business conduct and material origin.
These declarations can be useful.
However, they are not necessarily independent evidence that the declared conditions exist or that relevant requirements are consistently fulfilled.
A supplier may acknowledge a code of conduct while lacking effective procedures to implement its commitments.
A manufacturer may provide a material origin declaration without maintaining sufficient records to establish the origin of every relevant batch.
A business may submit a valid management system certificate while the specific product, facility, process or activity being purchased falls outside the certificate’s scope.
These situations highlight an important distinction between collecting supplier documents and establishing effective supplier assurance.
Supply chain compliance requires organizations to determine applicable requirements, assess relevant risks, obtain suitable evidence and evaluate whether suppliers are capable of meeting their obligations.
For organizations seeking to strengthen responsible sourcing, the central issue is not whether suppliers have signed the necessary forms.
It is whether the organization has a credible basis for relying on the information provided.
What Is Supply Chain Compliance?
Supply chain compliance involves meeting applicable requirements across relevant sourcing, procurement, production, logistics and supplier-management activities.
These requirements may arise from legislation, regulatory obligations, contracts, customer specifications, recognized standards or commitments voluntarily adopted by an organization.
Depending on the industry and market, supply chain compliance may involve:
- Product quality and safety
- Material specifications
- Product traceability
- Environmental requirements
- Occupational health and safety
- Labour and human rights expectations
- Ethical business practices
- Anti-bribery and corruption controls
- Restricted substances
- Material origin and sourcing restrictions
- Import and export requirements
- Customer-specific supplier obligations
Not every requirement applies to every supplier.
Organizations should establish which obligations are relevant to their products, jurisdictions, supply chain relationships and contractual commitments.
1. Supplier Declarations Are Statements, Not Automatic Proof
A supplier declaration is a statement made by a supplier about specified facts, conditions or commitments.
For example, a supplier may declare that its products comply with particular technical specifications.
Another may confirm that it follows a buyer’s code of conduct.
A third may declare that materials originate from an identified country or source.
Such declarations can provide useful information and establish contractual or administrative accountability.
However, their reliability depends on the underlying evidence, the supplier’s controls and the nature of the declared requirement.
A declaration may be accurate when issued but become outdated after a change in production location, raw materials, subcontractors or processes.
It may also be incomplete or insufficiently specific.
Organizations should therefore evaluate the level of verification appropriate to the associated risk.
A signed declaration records what a supplier claims. Supplier assurance evaluates whether the claim can reasonably be relied upon.
2. Why Supplier Certificates Need Scope Verification
Certificates can support supplier evaluation when they are relevant, authentic, valid and appropriately scoped.
However, the presence of a certificate does not establish that every activity, product or location associated with the supplier is covered.
For example, a supplier may hold an ISO 9001 certificate for a particular manufacturing facility.
The buyer may be purchasing products manufactured at a different facility.
If the second facility is outside the certified scope, the certificate should not be represented as covering that operation.
Similarly, a management system certificate is not necessarily equivalent to product certification or proof that every shipment meets technical specifications.
Important Certificate Verification Questions
- Is the certificate authentic?
- Is it currently valid?
- Which legal entity is identified?
- Which locations are included?
- What activities fall within the scope?
- Is the certification body appropriate for the certification claimed?
- Is accreditation relevant to the claim being evaluated?
- Does the certificate address the buyer’s actual requirement?
Where appropriate, buyers may verify certification information through the issuing certification body or other relevant official verification mechanisms.
Certificate verification is one part of supplier due diligence, not a complete substitute for it.
3. Responsible Sourcing Requires More Than a Supplier Code of Conduct
Supplier codes of conduct commonly communicate expectations regarding ethical behaviour, labour practices, health and safety, environmental responsibility and legal compliance.
They can help establish a common set of requirements across supplier relationships.
However, asking suppliers to sign a code does not demonstrate that the requirements are implemented.
For example, a supplier may agree to maintain safe working conditions.
However, the buyer may have no evidence of how workplace hazards are identified, assessed or controlled.
Another supplier may commit to responsible environmental management without providing information about relevant environmental permits, operational controls or compliance evaluations.
The level of assurance needed depends on the nature of the requirement and the associated risk.
Organizations may use a combination of supplier assessments, evidence reviews, audits, performance monitoring and other suitable due diligence activities.
4. Risk-Based Supplier Due Diligence
Supplier due diligence should be proportionate to relevant risks.
Applying identical verification activities to every supplier may be inefficient and may fail to direct sufficient attention toward higher-risk relationships.
For example, a supplier providing critical safety-related components may require more extensive technical assurance than a supplier providing routine office consumables.
Similarly, suppliers associated with higher environmental, labour, material-origin or regulatory risks may warrant additional evaluation.
Factors That May Influence Supplier Risk
- Criticality of the purchased product or service
- Potential consequences of nonconformity
- Applicable legal and regulatory requirements
- Supplier location and operating context
- Complexity of manufacturing processes
- Use of subcontractors
- Material origin and traceability challenges
- Previous supplier performance
- Changes in ownership, facilities or operations
- Availability and reliability of verification evidence
Risk assessment methods should reflect the organization’s actual requirements and supply chain characteristics.
5. Supplier Self-Assessment Questionnaires: Useful but Limited
Supplier self-assessment questionnaires are commonly used to gather information about management systems, operational controls and compliance practices.
They may cover quality, environment, health and safety, labour practices and business ethics.
These questionnaires can help organizations identify areas requiring further review.
However, responses are generally provided by the supplier itself.
Therefore, the organization should consider whether the responses require supporting evidence.
For example, a supplier may answer that it conducts internal audits.
Depending on the risk, the buyer may seek relevant information about the audit programme, findings, corrective actions or management review.
Self-assessment should be treated as an information-gathering mechanism rather than automatic confirmation of compliance.
6. Document Review vs Operational Verification
Supplier evaluation may involve several levels of assurance.
Document review can establish whether relevant procedures, certificates, declarations and records exist.
Operational verification can help determine whether those arrangements are implemented in practice.
For example, a supplier may provide a documented incoming inspection procedure.
However, an assessment of actual operations may identify that incoming materials are routinely released before required inspections are completed.
The documented procedure may be adequate in principle, while its implementation is ineffective.
Illustrative Supplier Assurance Comparison
| Assurance Activity | What It Can Establish | Important Limitation |
|---|---|---|
| Supplier declaration | Supplier’s stated commitment or claim | Does not independently verify implementation |
| Certificate review | Relevant certification information | Limited by scope, validity and certification purpose |
| Document review | Existence and content of documented arrangements | May not establish actual implementation |
| Supplier self-assessment | Information reported by the supplier | May require supporting verification |
| Supplier audit | Sample-based evidence about defined requirements | Limited by audit scope, sampling and timing |
| Product testing | Results for specified tested characteristics and samples | Does not establish every aspect of supplier compliance |
| Performance monitoring | Observed supplier performance over time | May not detect every underlying risk |
No single assurance method is universally sufficient for every supplier relationship.
7. Supplier Audits: What Should They Actually Evaluate?
A supplier audit can provide useful evidence when its scope and methodology are appropriate.
However, audits should not become exercises in collecting procedures and checking whether forms are signed.
An effective supplier audit evaluates relevant processes and objective evidence against defined criteria.
Depending on the supplier relationship, areas may include:
- Management of customer requirements
- Incoming material controls
- Production and process controls
- Inspection and testing arrangements
- Product identification and traceability
- Control of nonconforming outputs
- Subcontractor management
- Relevant environmental and safety arrangements
- Corrective-action effectiveness
- Management of changes
Audits should be planned with regard to the nature of the requirements, relevant risks and available resources.
They provide sample-based assurance rather than a guarantee that all supplier activities are compliant.
8. The Hidden Risk of Sub-Tier Suppliers
Many supply chains extend beyond direct suppliers.
A manufacturer may purchase components from a direct supplier that obtains raw materials, coatings, treatments or specialized services from additional organizations.
These sub-tier relationships can affect product quality, material origin, environmental impacts and other compliance requirements.
For example, a direct supplier may manufacture a component but outsource a critical surface treatment process.
If the buyer’s requirements apply to that process, the direct supplier’s declaration alone may not establish that the subcontracted activity meets those requirements.
Organizations should consider the extent of visibility and control appropriate to relevant sub-tier risks.
However, the ability to obtain information from deeper supply chain tiers may vary.
Due diligence arrangements should account for actual contractual relationships, applicable obligations and practical limitations.
9. Material Origin Declarations and Traceability Gaps
Material origin information may be important for product specifications, trade requirements, sourcing commitments or sector-specific obligations.
However, a supplier’s statement about material origin may be difficult to verify if the supplier lacks reliable traceability records.
For example, a manufacturer may receive raw materials from multiple sources.
Materials may be stored together, blended, repacked or transferred between facilities.
If origin information is not preserved through relevant processes, the supplier may be unable to substantiate declarations for particular finished-product batches.
Organizations should determine the traceability arrangements necessary for the origin claims and requirements involved.
Not every material-origin requirement demands identical batch-level traceability.
The appropriate approach depends on applicable rules, contractual obligations and the sourcing system.
10. A Practical Manufacturing Scenario: The Approved Supplier That Changed Its Process
Consider a hypothetical industrial component manufacturer purchasing precision metal parts from an approved supplier.
The supplier was initially evaluated through document review, sample testing and a quality management system assessment.
The buyer approved the supplier based on the available evidence.
Several months later, the supplier changes a critical heat treatment process and transfers the activity to an external subcontractor.
The supplier does not notify the buyer.
Product deliveries continue with the same certificates of conformity and standard documentation.
Later, the buyer identifies inconsistent mechanical properties in received components.
Investigation Findings
- The original supplier approval was based on a different process arrangement.
- The new subcontractor had not been evaluated against relevant requirements.
- Process changes were not communicated as required by the purchasing agreement.
- Certificates of conformity continued to be issued.
- Relevant technical verification was insufficient after the change.
The supplier’s declarations were not necessarily intentionally false.
However, the assurance arrangements did not adequately address process changes affecting product conformity.
The example illustrates why supplier approval should not be treated as a permanent decision independent of changing circumstances.
11. Supplier Change Management
Supplier conditions can change after initial approval.
Relevant changes may include:
- Manufacturing location changes
- New subcontractors
- Changes in raw material sources
- New production equipment
- Modified manufacturing processes
- Changes in legal or regulatory requirements
- Changes in ownership
- Loss or modification of relevant certifications
- Significant performance deterioration
Organizations should determine which changes require notification, review or requalification.
Supplier agreements and purchasing controls may need to address change communication where relevant.
Appropriate follow-up depends on the nature and consequences of the change.
12. ISO 9001 and Control of Externally Provided Processes, Products and Services
ISO 9001:2015 Clause 8.4 addresses the control of externally provided processes, products and services.
Organizations are required to ensure that externally provided processes, products and services conform to requirements.
The standard addresses evaluation, selection, monitoring of performance and re-evaluation of external providers based on their ability to provide conforming outputs.
Organizations must determine appropriate controls for externally provided processes, products and services.
The type and extent of control should consider the potential impact of externally provided outputs on the organization’s ability to meet requirements and the effectiveness of controls applied by external providers.
ISO 9001 does not require every supplier to undergo the same audit programme.
Organizations should establish controls appropriate to their specific circumstances.
13. Responsible Sourcing and Other Management System Standards
Supplier-related risks may also be relevant to other management system frameworks.
ISO 14001
Environmental management may involve considering relevant environmental aspects associated with externally provided processes, products and services, taking account of the organization’s control or influence and a life cycle perspective.
ISO 45001
Occupational health and safety management includes requirements addressing procurement, contractors and outsourcing where applicable.
ISO 20400
ISO 20400 provides guidance on sustainable procurement. It is a guidance standard rather than a certifiable management system requirements standard.
Sector-Specific Requirements
Industries may also be subject to specific product, regulatory, customer or responsible sourcing requirements.
Organizations should verify which standards and obligations are relevant to their activities.
14. How to Build a Risk-Based Supplier Assurance Programme
Step 1: Define Applicable Supplier Requirements
Identify the legal, regulatory, contractual, technical and organizational requirements relevant to each supplier category.
Step 2: Segment Suppliers by Risk
Consider criticality, potential consequences of failure, operating context and available assurance information.
Step 3: Select Appropriate Verification Methods
Determine whether declarations, document reviews, certificates, testing, audits or other activities are appropriate.
Step 4: Verify Relevant Certificates and Claims
Review authenticity, scope, validity and relevance.
Step 5: Evaluate Operational Controls
Assess whether suppliers have appropriate arrangements for meeting relevant requirements.
Step 6: Address Sub-Tier Risks
Consider relevant subcontracted activities and material sources.
Step 7: Establish Change Notification Arrangements
Define relevant changes that suppliers must communicate.
Step 8: Monitor Performance
Review appropriate delivery, quality, compliance and other relevant information.
Step 9: Investigate Supplier Nonconformities
Evaluate causes and necessary corrective actions.
Step 10: Reassess Supplier Assurance
Update supplier evaluations when risk, performance or relevant circumstances change.
15. Supplier Assurance Audit Matrix
| Assessment Area | Potential Evidence | Key Question |
|---|---|---|
| Supplier declarations | Signed declarations and supporting information | Are relevant claims sufficiently supported? |
| Certificates | Certification information and scope | Does the certificate apply to the relevant activity? |
| Product conformity | Inspection and test evidence | Can the supplier demonstrate conformity? |
| Traceability | Material and production records | Can relevant material origins and movements be established? |
| Subcontracting | External provider arrangements | Are relevant subcontracted activities controlled? |
| Change management | Change notifications and evaluations | Are significant supplier changes appropriately managed? |
| Performance | Supplier monitoring records | Are recurring problems identified and addressed? |
| Corrective action | Investigations and effectiveness reviews | Are verified causes of supplier failures addressed? |
This matrix is an illustrative supplier evaluation tool, not a mandatory checklist for every supplier or certification scheme.
16. Common Supplier Compliance Management Mistakes
Mistake 1: Treating Signed Declarations as Independent Verification
A declaration communicates a claim but may require supporting evidence.
Mistake 2: Accepting Certificates Without Checking Scope
A certificate may not cover the relevant product, activity or facility.
Mistake 3: Applying Identical Controls to Every Supplier
Supplier assurance should reflect relevant risks and requirements.
Mistake 4: Ignoring Sub-Tier Suppliers
Subcontracted activities may affect important product or sourcing requirements.
Mistake 5: Relying Exclusively on Self-Assessments
Supplier responses may require additional verification.
Mistake 6: Failing to Monitor Supplier Changes
Changes in processes, materials or facilities may affect previous approval decisions.
Mistake 7: Auditing Documents Without Evaluating Operations
Documented arrangements may not reflect actual implementation.
Mistake 8: Ignoring Material Traceability
Origin and conformity claims may depend on reliable material records.
Mistake 9: Failing to Review Supplier Performance
Initial approval does not guarantee continuing capability.
Mistake 10: Treating Supplier Audits as Guarantees
Audits provide sample-based assurance within defined scope and limitations.
17. Supplier Compliance Readiness Checklist
- Are relevant supplier requirements clearly defined?
- Are suppliers evaluated using appropriate criteria?
- Are supplier declarations supported by suitable evidence where necessary?
- Are relevant certificates verified for scope and validity?
- Are supplier risks assessed and reviewed?
- Are critical products and services subject to appropriate controls?
- Are relevant subcontracted activities considered?
- Are material origin and traceability requirements addressed?
- Are supplier changes appropriately communicated and evaluated?
- Is supplier performance monitored?
- Are supplier nonconformities investigated?
- Are supplier assurance arrangements updated when circumstances change?
Frequently Asked Questions
What is supply chain compliance?
Supply chain compliance involves meeting applicable legal, regulatory, contractual, technical and organizational requirements across relevant sourcing and supply chain activities.
Are supplier declarations sufficient to prove compliance?
Not necessarily. Declarations provide supplier statements, but additional evidence or verification may be appropriate depending on the requirement and associated risk.
What is supplier due diligence?
Supplier due diligence involves identifying and evaluating relevant supplier risks and using suitable measures to obtain assurance about specified requirements.
Does ISO 9001 require supplier audits?
ISO 9001 requires appropriate evaluation, selection, monitoring and re-evaluation of external providers. It does not universally require an on-site audit of every supplier.
Which ISO 9001 clause addresses suppliers?
Clause 8.4 addresses control of externally provided processes, products and services.
Does an ISO 9001 certificate guarantee product conformity?
No. ISO 9001 certification relates to the quality management system within the certified scope and is not a blanket product conformity guarantee.
Why should certificate scope be verified?
Certificate scope identifies relevant activities and locations covered by certification. The certificate may not apply to every operation associated with a supplier.
What is a sub-tier supplier?
A sub-tier supplier is an organization providing materials, components or services through another supplier rather than directly to the purchasing organization.
How often should suppliers be reassessed?
Reassessment frequency should reflect applicable requirements, supplier risks, performance and relevant changes rather than relying on one universal interval.
Can supplier self-assessments replace audits?
Self-assessments can provide useful information, but their suitability as an assurance method depends on the requirements and associated risks.
What is the difference between responsible sourcing and supplier certification?
Responsible sourcing involves managing relevant sourcing impacts and obligations, while supplier certification provides assurance against specified certification requirements within a defined scope.
How Shark Certification Can Support Supplier Management System Improvement
Effective supplier assurance requires organizations to move beyond document collection and evaluate whether externally provided processes, products and services can consistently meet applicable requirements.
Organizations implementing ISO 9001 and related management systems can strengthen supplier evaluation, monitoring, traceability, change management and corrective-action processes.
Shark Certification supports organizations through management system auditing, training and related management system services.
Relevant assessment activities may include reviewing supplier management arrangements, external provider controls, management system implementation and audit readiness.
For more information about supplier management and management system requirements, visit Shark Certification.
Conclusion: Responsible Sourcing Requires Evidence, Not Just Declarations
Supplier declarations, certificates and codes of conduct can provide useful information.
However, their value depends on whether the information is relevant, accurate and supported by suitable assurance arrangements.
Organizations should consider supplier risks, operational controls, material traceability, subcontracting arrangements, performance and changes over time.
Risk-based due diligence helps organizations direct verification activities toward the requirements and supplier relationships that matter most.
Effective supplier management is not achieved simply by collecting more documents.
It is achieved by developing a credible understanding of supplier capability and maintaining appropriate controls over externally provided processes, products and services.
The question is not whether the supplier signed the declaration.
The question is whether the organization has sufficient evidence to trust what the declaration says.
