Supply Chain Due Diligence Software: Can You Produce the Evidence for One Supplier Site?

Why due diligence breaks when it stops being a survey exercise

A compliance lead gets an email from a campaigning organisation naming one of the company's suppliers in relation to forced labour at a specific facility. The board wants an answer by Friday. She opens the file. There is a completed questionnaire from that supplier's head office signed nineteen months ago, a code of conduct acknowledgement, and an audit report the supplier supplied themselves. None of it says anything about the facility named in the email, because the assessment was done at the legal entity level and the entity has eleven sites in four countries. Nobody at the company can say with confidence whether the company buys from that facility at all, because purchase orders are placed against a vendor number, and the vendor number does not know which plant fulfils.

That gap is the whole subject. Statutory due diligence duties, whether under the German supply chain act, the EU corporate sustainability due diligence directive as it lands in member state law, or the import controls that shift the burden of proof onto the importer, are not satisfied by having asked a question. They are satisfied by risk based prioritisation, appropriate action proportionate to the risk, evidence that the action happened, and documentation you can hand to an authority. Every one of those is a data problem before it is a policy problem.

What most companies run today is a subscription to EcoVadis, IntegrityNext, Assent, Sedex or Prewave, plus a survey tool, plus a shared drive. These are real products with real value. EcoVadis gives you a comparable scorecard and a supplier population that already knows the format. Prewave is genuinely useful for adverse signal detection. Sedex carries site level audit data in a way most tools do not. What none of them can do is be your system of record, because your obligation attaches to your purchasing relationships, your risk thresholds, your escalation policy and your evidence, and their models are built to be generic across their entire customer base.

Problem one: your supplier hierarchy is wrong, and everything else inherits that

The single most common failure we find is that due diligence is performed against the vendor master, which is a payment construct. A vendor record is a legal entity with bank details. Risk lives at the site: the factory, the farm, the smelter, the mine. One vendor may supply from six sites with completely different risk profiles, and the site with the problem is rarely the one that signed your code of conduct.

Off the shelf platforms usually let you invite a supplier and collect a response. Some support sites. Almost none reconcile sites against your actual purchase orders, which means you cannot answer the two questions that matter in a crisis: do we buy from this facility, and how much.

What a custom build does: model supplier group, legal entity, site and product or commodity as separate objects, then bind them to your own purchase order and receipt history so exposure is calculated rather than asserted. Once that exists, prioritisation becomes real. You can rank by spend at high risk sites, by sole source dependency, by commodity risk, or by any weighting your policy defines, rather than by whoever has not returned a survey.

Problem two: risk scoring has to be yours, and it has to be defensible

Every platform ships a risk score. It is a blend of country indices, sector risk and whatever the supplier self reported. It is fine as an input and useless as a decision, because it does not know how much commercial influence you actually hold, your contract terms, your purchasing volatility or your board's risk appetite. And when an authority asks why a particular supplier was categorised as low risk and therefore not assessed, pointing at a vendor's proprietary blend is a weak answer.

What a custom build does: implement risk as an explicit model with named factors, weights, thresholds and a version history. Country and sector indices feed in as inputs, and so do your own signals: audit findings, grievance reports, on time delivery collapse, sudden subcontracting, single site dependency. Every score renders as a derivation showing which factors contributed what. When the policy changes, the version changes, and historical decisions still show the model that produced them. This is the difference between a number and a defence.

Problem three: assessment without evidence is theatre

A questionnaire answered yes is not evidence. Regulators, auditors and litigation all want the underlying artefact: the wage register sample, the age verification procedure, the recruitment fee reimbursement policy, the corrective action closure photograph, the third party audit report with its own scope and date, the corrective action plan with an owner and a due date that either passed or did not.

Survey tools collect answers. They do not manage a document with an expiry, a scope and a source. So the evidence sits in email and the questionnaire says the box was ticked.

What a custom build does: make evidence a first class object attached to a control at a site, with a validity period, a source, an uploader and an immutable copy. Assessments reference evidence rather than restating it. When a certificate expires the site's status changes automatically instead of quietly aging. Corrective action plans become tracked items with owners on both sides, escalation timers, and a closure requirement that demands proof rather than a confirmation email. There is one honest use of machine learning here: supplier documents arrive as PDFs and photographs in dozens of languages and layouts, and a document extraction pass can pull issue dates, expiry dates, scope and issuing body, then flag mismatches for a human. That saves a compliance team from reading thousands of documents nobody currently reads at all.

Problem four: beyond tier one is where the risk actually is

Forced labour, child labour and the worst environmental harm rarely sit in your direct supplier. They sit two or three levels down, at the input material, the recruitment agency, the farm, the smelter. Direct suppliers often genuinely do not know their own upstream, and the ones who do may not want to disclose it because it is commercially sensitive.

Platforms approach this with cascading surveys, which have a well known failure mode: response rates collapse at each level and the data you do get is unverifiable. Being honest about that is important. No software solves upstream visibility outright.

What a custom build can realistically do: support multiple partial signals and reason over them together. Declared chains where suppliers will disclose. Chain of custody documents for specific commodities where a scheme exists. Trade and shipment data where you have access. Adverse media and enforcement signals mapped to named facilities. Then present a confidence level rather than a false certainty, and use the gaps to drive commercial action: contract clauses, disclosure requirements at renewal, and targeted verification where exposure is highest. A tool that claims full n tier visibility from a questionnaire is selling you comfort.

Problem five: the reporting pack has to be assembled from all of it

Statutory reports and customer questionnaires ask you to describe your process, your risk analysis, the measures you took and their effectiveness. If your evidence is spread across a subscription platform, a survey tool and email, the report is written by hand each year by a person reading everything, which is why it takes three months and reads like it.

What a custom build does: generate the report from the operational record. Number of sites in each risk band, assessments completed against plan, corrective actions opened and closed with time to closure, grievances received and their outcomes, escalations including any relationship terminated. Every figure links to the underlying records. When the auditor asks how a number was derived, they click it. That is the whole game with assurance: not a better narrative, a traceable one.

What this costs and how long it takes

Across the enterprise compliance work Digital Heroes has delivered, this is the honest shape. A focused first release, meaning supplier group and site hierarchy bound to your purchasing data, your own risk model with versioning, assessment and evidence management, and corrective action workflow, runs $85,000 to $170,000 and ships in 12 to 18 weeks.

A full platform adding grievance channel intake with anonymity and case management, adverse media and sanctions screening, beyond tier one mapping, supplier portal with multi language support, and regulator and assurance reporting packs runs $200,000 to $450,000 phased over 7 to 12 months.

What pushes cost up here specifically: languages, because a supplier portal that Chinese, Turkish, Vietnamese and Portuguese speaking factory staff can actually use is a real localisation programme and not a translation file. Grievance intake, if you want a worker facing channel that meets confidentiality expectations, which raises hosting, access control and retention questions that need answering properly. Integration with a fragmented ERP (Enterprise Resource Planning) estate, since large groups routinely have four purchasing systems. And keeping data from third party subscriptions in sync, because you will keep EcoVadis or Sedex as an input source and their refresh cycles are theirs, not yours.

What keeps cost down: start with the commodity categories and countries your own risk analysis already flags. Covering every supplier in year one is a way to spend money proving that most of your suppliers are boring.

Build versus buy, and when buying is the right call

Buy, and do not call us, if you have a few hundred direct suppliers, mostly in lower risk categories and jurisdictions, and your obligation today is a customer questionnaire rather than a statute. EcoVadis or Sedex subscriptions plus a disciplined process are proportionate, and building would be an expensive way to feel serious.

Build when two or more of these are true. You have a statutory duty with enforcement exposure rather than a voluntary commitment. Your risk sits at site level and your vendor master cannot tell you which site fulfils an order. You operate in commodities with known forced labour exposure where an import can be detained and you carry the burden of proof. You need evidence and corrective action tracking with a defensible audit trail rather than scorecards. Or you are already paying for two or three subscription platforms and still assembling the annual report by hand, which is the clearest signal of all.

Most mature programmes end up hybrid: keep the subscription platforms as data sources for supplier assessment, and build the system of record that holds hierarchy, risk model, evidence, actions and reporting. That is usually the right architecture and the cheapest honest answer.

How to choose a developer for due diligence platforms

Ask them to model your supply base on a whiteboard before you sign anything. If they draw a suppliers table, stop. You need group, legal entity, site, commodity and the purchasing link, and they should ask you within five minutes how you know which site fulfils a purchase order.

Ask how risk scoring will be versioned and how a historical decision will be reproduced under the model that applied at the time. Anyone who treats the score as a mutable column has not built for regulated evidence.

Ask specifically about evidence handling: validity periods, immutable storage, access control, and what happens when a document is superseded. Also ask about data retention and worker confidentiality if a grievance channel is in scope, because that part carries genuine ethical risk and needs someone who takes it seriously rather than treating it as another form.

Ask who owns the code, and get it in writing before kickoff. You should own the repository, the infrastructure accounts and the right to hire anyone else to continue. At Digital Heroes the client owns the code from the first commit. Your due diligence record is legal evidence with a multi year retention expectation, and it must never sit somewhere you cannot take it.