The ESG Supply Chain Is Breaking Why Supplier Audits Are No Longer Enough ? by Sharmilaa Thakur
For years, companies have told stakeholders that their supply chains are responsible.
They have supplier codes of conduct.
They conduct audits.
They ask vendors to sign compliance declarations.
They publish sustainability commitments.
They report ESG progress.
And yet one uncomfortable question remains:
How much does a company actually know about what is happening beyond its direct suppliers?
That question is becoming increasingly important for CEOs, CXOs and Boards.
The global ESG conversation is moving from commitment and disclosure toward due diligence, evidence, remediation and accountability across the value chain. The OECD's 2026 Responsible Business Outlook makes the gap particularly visible: while responsible-business commitments are widespread among large listed companies, reported implementation of supplier environmental and social risk assessment remains much less common.
The implication is significant:
Supplier compliance is not the same thing as supply-chain accountability.
And that distinction could become one of the defining ESG governance issues of the next few years.
The Audit Paradox
Supplier audits were supposed to provide assurance.
But an audit is fundamentally a snapshot.
It tells an organisation what was observed at a particular supplier, at a particular location, at a particular point in time.
That may be useful.
It may even be necessary.
But it does not necessarily tell the company what is happening across the entire value chain.
The OECD's 2026 analysis of the world's 10,000 largest listed companies provides a striking picture.
Although responsible-business commitments are widespread, implementation is significantly weaker. The OECD finds that fewer than one in five companies report evaluating supplier environmental and social risks, while only a small minority report mechanisms for meaningful stakeholder engagement and remedy.
So we have an ESG paradox:
Companies are getting better at documenting expectations than at detecting reality.
That should concern Boards.
The Question Is No Longer “Did the Supplier Pass?”
Traditional supplier management tends to ask:
Did the supplier pass the audit?
Modern ESG due diligence asks a much harder question:
What adverse environmental, social and human-rights impacts could exist in our value chain, how significant are they, what are we doing about them, and what happens when we discover a problem?
That is a fundamental shift.
The OECD's responsible-business framework emphasises risk-based due diligence across operations, supply chains and business relationships, including identifying impacts, preventing or mitigating them, tracking responses, communicating outcomes and addressing harm where appropriate.
The difference is subtle but profound.
Compliance asks:
“Does the supplier meet our requirements?”
Due diligence asks:
“Do we understand our exposure and are we managing the consequences?”
Why This Matters Now
The regulatory direction is also changing the stakes.
The European Union's Forced Labour Regulation will apply from 14 December 2027. It will prohibit products made with forced labour from being placed on or exported from the EU market. The European Commission launched its preparedness package and Single Portal in June 2026, meaning preparation is already underway.
This changes the conversation.
The question is no longer simply:
“Do we have a supplier code of conduct?”
It becomes:
“Can we identify, assess and respond to forced-labour risk in the relevant parts of our value chain?”
And the limitations of traditional audit models are increasingly being questioned.
A recent Reuters investigation highlighted concerns that voluntary supply-chain audits have failed to eliminate forced labour, particularly where the underlying commercial practices—such as purchasing pressure, production targets and pricing—can themselves contribute to poor labour conditions.
That is a much bigger governance issue than an audit score.
The Tier-1 Illusion
This is where many organisations have a blind spot.
A company may have:
Supplier A
and excellent visibility into Supplier A.
But Supplier A may depend upon:
Supplier B → Supplier C → labour contractor → recruitment intermediary → worker
Or:
Technology provider → hardware manufacturer → component supplier → raw-material source
The ESG risk may therefore sit several layers below the relationship visible in the procurement system.
Around 70% of companies with available data report social-audit coverage of at least some Tier-1 suppliers, while only around 35% report coverage of Tier-2 or Tier-3 suppliers.
Tier 1 may be relatively visible, while Tier 2 and Tier 3 can contain materially greater hidden environmental, social and governance exposure.
This leads to a critical Board question:
How much of our material value-chain risk can we actually see?
Not:
How many suppliers have we audited?
But:
What proportion of our material ESG exposure is covered by meaningful due diligence?
That is a very different KPI.
And This Is Not Just a Manufacturing Problem
A common assumption is that supply-chain human-rights risk is primarily a manufacturing issue.
For global technology companies, Systems Integrators and GCC ecosystems, that assumption can be dangerous.
Consider the extended technology ecosystem:
Cloud and data-centre providers
Hardware and network-equipment suppliers
Semiconductor and component ecosystems
Facilities-management providers
Security and housekeeping contractors
Logistics providers
Staffing and recruitment agencies
Contingent workforce suppliers
IT subcontractors
BPO and service partners
Professional-services vendors
Software and platform providers
A technology organisation may therefore have a comparatively light physical footprint while still having a complex human, environmental and governance footprint across its extended value chain.
The OECD specifically identifies electronics and vehicle manufacturing as sectors where forced labour, child labour and unsafe working conditions can create significant supply-chain risks.
For technology organisations, this creates an important strategic question:
Have we defined our supply chain too narrowly because our own business model is asset-light?
ESG Is Not Just Environmental
Another common mistake is to treat supply-chain ESG primarily as a carbon exercise.
A mature value-chain risk framework needs all three dimensions.
Environmental
Carbon emissions
Water
Pollution
Waste
Resource depletion
Biodiversity
Deforestation
Social
Forced labour
Child labour
Worker safety
Excessive working hours
Wages
Discrimination
Migrant-worker vulnerability
Worker voice
Grievance mechanisms
Governance
Bribery and corruption
Transparency
Conflicts of interest
Data privacy
Financial misconduct
Ethical procurement
Reporting integrity
These are not separate risks operating in separate departments.
They can reinforce one another.
A supplier with weak governance may also have weak labour controls.
A procurement model driven exclusively by price may create pressure on working conditions.
A lack of supply-chain visibility may conceal both environmental and social risks.
ESG supply-chain similarly frames environmental, social and governance risks as interconnected rather than isolated categories.
The CHRO's Role Is Bigger Than It Looks
This is where the supply-chain conversation intersects with the people agenda—but it should not become another “future of the CHRO” article.
The issue is extended workforce accountability.
Consider contract workers supporting:
facilities
security
catering
logistics
technology operations
customer support
maintenance
project delivery
They may not sit on the organisation's employee headcount.
But they can still be exposed to working conditions, wage practices, excessive working hours, recruitment risks or inadequate grievance mechanisms associated with the organisation's operating ecosystem.
The answer cannot simply be:
“They aren't our employees.”
From an ESG and stakeholder perspective, that is increasingly an inadequate risk-management position.
This is why the CHRO, CPO, CRO, General Counsel, CFO, Sustainability leadership and business heads increasingly need a shared view of extended workforce and value-chain risk.
Not shared ownership of everything.
Shared visibility of material risk.
The Supplier Audit Is Not Dead
This is an important distinction.
Supplier audits still matter.
The problem is treating them as the entire ESG control system.
Think of the progression:
Stage 1 — Supplier Compliance
Do they have the required policies?
↓
Stage 2 — Supplier Auditing
Do they meet our requirements?
↓
Stage 3 — Risk-Based Due Diligence
Where are our highest-risk relationships and impacts?
↓
Stage 4 — Continuous Monitoring
What is changing?
↓
Stage 5 — Worker Voice & Remediation
What happens when people or the environment are adversely affected?
↓
Stage 6 — Strategic Value-Chain Resilience
Can our supplier ecosystem strengthen rather than weaken enterprise value?
That is the maturity journey.
Supply-chain management beyond mapping and auditing toward supplier engagement, sustainable sourcing and resilience.
The Procurement Blind Spot
Here is perhaps the most uncomfortable question for the C-suite:
Can you demand responsible behaviour from suppliers while rewarding purchasing behaviour that makes responsible behaviour economically difficult?
Suppose Procurement is measured primarily on:
Lower price + faster delivery + tighter margins.
At the same time, Sustainability asks suppliers to invest in:
better wages + safer facilities + lower emissions + responsible materials + better worker protections.
There may be a structural contradiction.
Responsible supply-chain management therefore cannot sit exclusively within Sustainability or Procurement.
It requires the commercial model itself to be examined.
Your supply-chain framework makes this point through sustainable sourcing: ESG criteria need to become part of procurement decisions rather than remaining an additional scorecard after commercial decisions have already been made.
That is a Board-level issue.
What Should the Board Ask?
Instead of asking for another supplier-audit percentage, I would put these questions on the Board or Risk Committee agenda.
1. How much of our material supply-chain exposure is actually visible?
Not the number of suppliers.
The percentage of material risk covered.
2. What happens beyond Tier 1?
Which Tier 2 and Tier 3 relationships could create significant environmental, social or governance exposure?
3. What happens when an audit finds a problem?
Do we:
remediate?
investigate?
engage affected stakeholders?
change purchasing practices?
escalate to the Board?
terminate the relationship?
Or do we simply close the audit finding?
4. Can employees raise concerns safely?
A supplier code is not a grievance mechanism.
5. Are Procurement incentives contributing to ESG risk?
This may be one of the most important questions management can ask.
6. Can management demonstrate remediation?
A mature ESG system should not necessarily produce a perfect dashboard.
It should produce evidence that the organisation:
identifies → prioritises → responds → remediates → learns.
What Would a Better Supplier Dashboard Look Like?
The next-generation supplier dashboard should move beyond:
Supplier | Spend | SLA | Audit Score
toward:
Traditional View | Emerging ESG View |
Supplier count | Material-risk exposure |
Audit score | Risk + evidence |
Tier 1 visibility | Relevant Tier 1–3 visibility |
Policy compliance | Actual due-diligence outcomes |
Annual audit | Continuous risk assessment |
Supplier declaration | Independent / corroborating evidence |
Cost | Total value + ESG risk |
Non-compliance | Remediation status |
Contract status | Resilience + dependency |
Procurement performance | ESG + commercial performance |
The objective is not to create another enormous ESG dashboard.
It is to give the Board decision-worthy information.
From ESG Compliance to Enterprise Resilience
This is where the conversation becomes bigger than ESG.
A hidden supply-chain problem can become:
Human-rights issue
→ reputational issue
→ customer issue
→ regulatory issue
→ contract issue
→ financial issue
→ enterprise-value issue
The same is true of environmental disruption, corruption, cyber incidents, resource constraints or critical supplier concentration.
That is why supply-chain ESG increasingly belongs inside the broader enterprise risk architecture.
ESG should be linked to revenue, cost, risk mitigation, capital access and long-term value creation rather than treated as a standalone reporting exercise.
The New Question for CEOs and Boards
The old question was:
“Are our suppliers compliant?”
The better question is:
“Do we know where our material ESG risks sit across our value chain?”
And the next question is even more important:
“If we discover a serious problem tomorrow, do we have the governance, information, relationships and decision rights to do something about it?”
That is the difference between supplier management and value-chain governance.
The Bottom Line
The future of ESG supply-chain management will not be won by the company with the largest supplier questionnaire.
Nor by the company with the highest percentage of suppliers marked “compliant.”
It will be won by organisations that can demonstrate four things:
Visibility
We know where material risk exists.
Evidence
We can substantiate what we report.
Voice
We can hear from people and stakeholders affected by our value chain.
Action
We have the governance and commercial mechanisms to remediate problems when they emerge.
Because ultimately:
The supplier audit tells you what you found.
Due diligence tells you what you may be missing.
Governance determines what you do about it.
And that may be the real evolution of ESG:
from reporting what the organisation does, to being accountable for what its value chain enables.
About the Author
Sharmilaa Thakur is a senior Global HR & People Transformation Leader, CHRO/EVP HR and strategic advisor with 25+ years of experience across technology, SaaS, telecom, financial services, healthcare, FMCG/manufacturing and Global Capability Centre environments across India, APAC, the Middle East, Europe and North America.
Her work sits at the intersection of People, Business Transformation, ESG, Future of Work, AI, Governance and Leadership. She writes and speaks on the evolving role of CHROs and business leaders in navigating technology disruption, workforce transformation, organisational resilience and responsible business.
She also advises and writes on the intersection of People, Governance, Sustainability and Enterprise Transformation, with a growing focus on Board-level oversight, Responsible Business and Long-term Organisational Resilience.
Sources & Further Reading
OECD — Responsible Business Outlook 2026
The global evidence base on how large listed companies are moving from responsible-business commitments toward actual due diligence and implementation.
OECD Responsible Business Outlook 2026
OECD — Due Diligence for Responsible Business Conduct
Framework covering risk-based due diligence across operations, supply chains and business relationships.
European Commission — EU Forced Labour Regulation
Regulation and implementation resources, including the 14 December 2027 application date and the EU Forced Labour Single Portal.
European Commission — Corporate Sustainability Due Diligence
Background on the EU's due-diligence framework for human-rights and environmental impacts across operations, subsidiaries and value chains.
Corporate Sustainability Due Diligence — European Commission
Reuters — Forced labour: Will the EU's threat of product bans succeed where supply-chain audits failed?
Current reporting on the limitations of traditional voluntary audits and the move toward stronger supply-chain due diligence and accountability.
Reuters — Indian electronics firm investigating child labour findings at supplier
Recent India example illustrating how labour issues at suppliers can rapidly become a corporate, regulatory and reputational issue for downstream companies.
Comments