Standards and reporting
Supply Chain Risk Software
Supply-chain risk management software should connect supplier identity, supported evidence, investigation and response decisions in a reviewable record (UN Guiding Principles; OECD guidance).
Which risk problem should the buyer define?
The UNGPs and OECD Guidelines describe due diligence concerned with impacts and responses, not merely a purchasing score Principle 17 due-diligence measures.
Module 01 / 04
Identity
Know the entity and site.
Module 02 / 04
Impact
Identify who or what is affected.
Module 03 / 04
Evidence
Keep the basis of the concern.
Module 04 / 04
Action
Define the decision to be supported.
Read the detailed guidance and evidence
Our fictional pilot follows Hawthorn Components, which buys metal parts through an agent and receives a concern about recruitment practices at a subcontractor site.
The procurement director needs to establish the supply relationship, investigate the concern and decide how to respond without treating an unverified allegation as a final finding.
The UNGP commentary explains that human-rights due diligence goes beyond risks to the company itself to include risks to rights-holders Principle 17 commentary.
The OHCHR publication identifies the UNGP framework and its endorsement; it is not a UK software mandate UNGP publication.
The standards homepage and ESG governance guide help connect the investigation to wider responsibilities without replacing the actual case.
Which questions belong in the risk brief?
Define the relationship, concern, decision and evidence before selecting a risk model.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Relationship | Agent, supplier and subcontractor map | How is the concerned site connected to the buyer? |
| Concern | Source, date and affected people | What is known and what is alleged? |
| Decision | Investigation or protective action | Who can authorise the next response? |
| Evidence | Supporting records and uncertainty | Can the reviewer challenge the basis? |
Read the detailed guidance and evidence
Hawthorn’s first acceptance test is an incomplete relationship map with one uncertain site identity.
The supplier must keep that uncertainty visible rather than present a precise score based on a guessed match.
How should supplier identity and tiers be modelled?
The OECD Guidelines recognise relationships beyond the immediate contractual tier, making the relationship model more useful than a flat vendor list business relationships.
Module 01 / 04
Entity
Separate legal organisations.
Module 02 / 04
Site
Retain the operating location.
Module 03 / 04
Link
Explain the business relationship.
Module 04 / 04
Confidence
Show uncertain identity matches.
Read the detailed guidance and evidence
Hawthorn’s purchasing system contains an agent name, while the concern names a factory in another jurisdiction, so the pilot asks the supplier to connect them with evidence.
A similar trading name is not accepted as proof that the entities are identical, and a group-level assessment is not automatically assigned to every site.
The OECD publication page identifies the 2023 Guidelines as government recommendations to enterprises, rather than a compulsory technology specification Guidelines status.
The buyer asks for relationship history, source references and a way to correct an erroneous match without losing the original investigation trail.
This is an editorial data-quality test and does not prescribe a universal supplier-tier depth.
What should an identity export contain?
Export the supported entity, site, relationship and unresolved identity questions.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Entity | Legal or otherwise supported identity | Is the organisation actually identified? |
| Location | Site and source reference | Does the concern relate to this operation? |
| Relationship | Agent-to-factory link and basis | How is the buyer connected? |
| Uncertainty | Unconfirmed match and reviewer | What still needs investigation? |
Read the detailed guidance and evidence
The fictional test deliberately includes a second factory with a similar name.
The buyer checks whether a reviewer can correct the match before it affects the case or purchasing decision.
How should automated signals be investigated?
The due-diligence framework links assessment with action, tracking and communication, rather than ending at a generated risk label Principle 17 process six measures.
Module 01 / 04
Signal
Preserve the original source.
Module 02 / 04
Assessment
Separate allegation and finding.
Module 03 / 04
Review
Seek appropriate context.
Module 04 / 04
Response
Record the reasoned next step.
Read the detailed guidance and evidence
Hawthorn’s pilot introduces a report about recruitment fees alongside a supplier response disputing the allegation, asking the system to preserve both sources.
The case reviewer needs dates, source identity, affected location and an explicit confidence assessment rather than a merged summary that removes disagreement.
UNGP Principle 18 includes meaningful consultation with potentially affected groups and relevant stakeholders Principle 18.
The buyer therefore asks how an investigation can record appropriate stakeholder information while restricting access to sensitive personal material.
The demonstration does not establish a particular legal finding or suggest that software should decide whether an allegation is true.
Which case states should remain distinct?
Keep the signal, assessment, response and outcome as distinguishable stages.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Signal | Unverified source and concern | What has been received? |
| Assessment | Evidence, context and uncertainty | What can currently be concluded? |
| Action | Protective or investigative decision | Why is this response appropriate? |
| Outcome | Evidence of the response and remaining risk | What changed for the affected people? |
Read the detailed guidance and evidence
Hawthorn rejects a workflow that marks the concern resolved merely because a supplier uploaded a policy.
The reviewer needs an explanation of the response and its evidence before changing the case status.
Where does CSDDD fit in the purchasing brief?
The amended directive has its own scope and future application provisions, so a buyer should not commission a generic current-compliance claim consolidated directive 2026 amendments.
Module 01 / 04
Applicability
Resolve the company’s actual position.
Module 02 / 04
Version
Use the amended source basis.
Module 03 / 04
Workstream
Define supporting evidence tasks.
Module 04 / 04
Judgement
Keep legal conclusions separate.
Read the detailed guidance and evidence
The CSDDD application framework was changed by Directive 2026/470, including the removal of Article 22’s climate-transition-plan duty Article 4 amendments.
The consolidated directive identifies the relevant scope and application provisions; a supplier’s old checklist should not be accepted as the current legal basis Articles 2 and 37.
Hawthorn’s fictional procurement brief asks for evidence and case-management support that could be mapped to an approved due-diligence programme, not an assertion that buying software makes the company CSDDD compliant.
The CSDDD guide owns the legal explanation, and this guide incorporates the software buyer task without creating a separate CSDDD-software synonym page.
The supplier must show how a changed source mapping is reviewed and approved rather than silently applied to every open supplier case.
What should a CSDDD-related demonstration show?
Show the approved directive basis and programme task before configuring a CSDDD-related map.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Basis | Named amended directive and interpretation owner | Is the mapping current and approved? |
| Programme | Actual scoped due-diligence work | What task is the platform supporting? |
| Change | Old and revised mapping record | Can a reviewer explain the amendment’s effect? |
| Claim | Technical support versus legal conclusion | Who remains responsible for applicability? |
Read the detailed guidance and evidence
The fictional buyer asks the legal reviewer to approve the mapping before the implementation supplier configures it.
This separates a technology deliverable from an uncatalogued promise about legal compliance.
How should actions and remediation be tracked?
The OECD measures include tracking and remediation, while the UNGP framework connects findings with response and communication due-diligence measures response process.
Module 01 / 04
Action
Name the intended change.
Module 02 / 04
Owner
Assign a responsible decision-maker.
Module 03 / 04
Evidence
Review what actually happened.
Module 04 / 04
Closure
Explain remaining uncertainty.
Read the detailed guidance and evidence
Hawthorn’s fictional case sets an investigation action and a supplier engagement action separately so that a completed meeting is not confused with a resolved impact.
The buyer asks the software supplier to demonstrate a missed action, a revised deadline and an evidence-based closure review.
The case should preserve why a response changed and which questions remain open, with sensitive records accessible only to appropriate users.
The Modern Slavery Act section 54 statement is a distinct statutory output and should not be replaced by an internal case dashboard section 54.
The ESG questionnaire guide addresses requested answers, while this purchasing brief follows the investigation and response behind them.
What should an action export distinguish?
Separate an agreed action from its delivery, observed effect and closure decision.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Commitment | Agreed action and responsible party | What was supposed to happen? |
| Delivery | Evidence of the actual response | Was the action carried out? |
| Effect | Review of the resulting position | Did the response address the concern? |
| Closure | Reason, reviewer and open issues | Why is the case being closed or retained? |
Read the detailed guidance and evidence
Hawthorn’s pilot keeps the supplier’s policy upload as one piece of evidence rather than treating it as a complete outcome.
The reviewer can leave the case open when the evidence does not yet support closure.
How should product claims be compared?
Owner product descriptions illustrate the category’s mapping, assessment and monitoring vocabulary, but do not independently establish accuracy or legal fulfilment Exiger description Intertek description LRQA description.
Module 01 / 04
Claim
Identify what the owner actually says.
Module 02 / 04
Evidence
Request a working demonstration.
Module 03 / 04
Limit
Separate descriptions from proven results.
Module 04 / 04
Fit
Compare with the buyer’s own task.
Read the detailed guidance and evidence
Exiger, Intertek and LRQA describe their own supply-chain products in terms that include mapping, risk information and due-diligence workflows owner description owner description owner description.
These references are category examples, not a shortlist, feature guarantee, comparative score or recommendation to purchase one of them.
Hawthorn turns each relevant claim into a pilot question using its uncertain factory identity, disputed concern and incomplete action evidence.
The team asks what data sources are licensed, how a source change is explained and which outputs can be retained after the contract ends.
No independent market ranking, provider price or promised reduction in business risk is invented.
Which claims should be converted into tests?
Convert mapping, monitoring, workflow and export descriptions into the same fictional case tests.
| Decision | Evidence to examine | Useful review question |
|---|---|---|
| Mapping | Uncertain agent-to-factory relationship | Can a human challenge the match? |
| Monitoring | New source concerning an existing case | Is the new information linked without erasing history? |
| Workflow | Missed action and disputed closure | Can the reviewer retain an open issue? |
| Export | Case, sources and decision history | Can the organisation continue the investigation elsewhere? |
Read the detailed guidance and evidence
The same fictional case is used for each supplier demonstration so that the buyer compares outputs against one clear brief.
The comparison remains task-specific rather than presenting a universal ranking of platforms.
What should the implementation handover preserve?
Due diligence remains an ongoing process of assessment, response and tracking rather than a one-off database installation ongoing process risk-based measures.
Module 01 / 04
Ownership
Name case and method reviewers.
Module 02 / 04
Configuration
Document approved source mappings.
Module 03 / 04
Portability
Export evidence and decisions.
Module 04 / 04
Support
Define changes and unresolved work.
Read the detailed guidance and evidence
Hawthorn’s acceptance schedule requires the implementation team to leave usable identity records, case evidence, access settings and the actual reasons for decisions.
The contract separates configuration and migration from specialist investigation, stakeholder engagement and legal interpretation, with dependencies stated explicitly.
The software RFP and software-versus-consultant guide provide broader purchasing structures for that allocation.
The final exit test asks a different reviewer to reconstruct the factory concern and explain why the case remains open without access to the live dashboard.
The useful result is a team able to investigate and act on supported information, not a supplier list decorated with an unexplained green status.
How can the team put this into practice?
This nine-step editorial workflow is a suggested sequence for the fictional case, rather than an additional regulatory timetable.
- 101
Define the concern
Identify the relationship, affected people and decision the buyer needs to support. - 202
Resolve identity
Separate entities and sites and preserve uncertain matches. - 303
Select the source basis
Distinguish voluntary frameworks, current law and future application. - 404
Prepare the pilot
Use a disputed concern, similar factory name and incomplete action evidence. - 505
Configure access
Protect sensitive information and assign appropriate reviewers. - 606
Test investigation
Preserve competing sources and the reasoning behind the assessment. - 707
Test response
Track actual actions and require evidence before closure. - 808
Reconstruct the case
Export sources, relationships and decision history for another reviewer. - 909
Accept ownership
Leave method, case and technical responsibilities clearly allocated.
Can you download an editable working resource?
This original preparation resource supports evidence and review and does not establish reporting conformity.
| Step | Review |
|---|---|
| Adapt | Set the actual reporting basis, boundary, period and selected requirements |
| Retain evidence | Connect source records and judgements to each answer |
| Review | Resolve open issues before making the final reporting claim |
Frequently asked
Questions people ask
Does software make UNGPs mandatory UK law?
No, the UNGP publication is an internationally endorsed framework rather than a UK software obligation.
Is supplier risk only financial risk to the buyer?
The UNGP commentary explicitly includes risks to rights-holders beyond risks to the company itself.
Can a score settle an allegation?
Use the original sources, context and competent review rather than treating an automated label as a finding.
Should CSDDD software have a separate page?
This guide includes the buyer task while the legal guide retains the amended directive’s scope and status.
Are the named product descriptions recommendations?
No, each owner describes its own product, and the buyer still needs to test fit, outputs and limits.
What should the exit export contain?
Retain the supplier relationship, source evidence, assessment reasoning, action history and unresolved questions needed to continue the case.
Sources
Primary sources
Primary provisions and official owner guidance checked on 26 October 2026; historical and draft resources are labelled in the guide.
- OHCHRUN Guiding Principles: Principles 17–18
- OHCHRUNGP publication and endorsement
- OECDOECD responsible business conduct guidelines
- OECDOECD Guidelines 2023 text
- Official JournalConsolidated CSDDD, March 2026
- Official JournalDirective 2026/470 amendments
- UK legislationModern Slavery Act section 54
- ExigerSupply-chain product description
- IntertekInlight product description
- LRQAEiQ product description