Supply Chain Due Diligence Software Problems: The 7 That Break Your Evidence Trail, and How to Avoid Them

Why does due diligence get scoped as a survey campaign?

Most programmes begin with a distribution problem. We need to reach nine hundred suppliers, collect a questionnaire, chase the non responders, and report a completion percentage. So the project gets scoped as a survey engine with a supplier portal attached, and the measure of success becomes response rate.

Response rate is not the obligation. Statutory human rights and environmental due diligence duties, whether under the German supply chain act, the corporate sustainability due diligence directive as it lands in member state law, or import controls that place the burden of proof on the importer, are not satisfied by having asked a question. They are satisfied by risk based prioritisation, action proportionate to the risk, evidence that the action happened, and documentation you can hand to an authority. A completed questionnaire is a claim, and a programme built to collect claims produces a folder nobody can trace to a specific site.

The fix is to change the acceptance test before any form is designed. From a single site identifier, the system must show whether you buy from it and how much, the risk band it sits in and why, the assessments performed with the evidence attached and its validity dates, the corrective actions open and closed with owners, and the escalation history. If the first release can answer that for one site in under a minute, everything else in the programme has something to attach to. If it cannot, the survey engine has bought you completion statistics and no defence.

What goes wrong when supplier hierarchy and assessment history are migrated?

The vendor master is a list of legal entities with bank details, and risk does not live there. It lives at the factory, the farm, the smelter, the mine, the recruitment agency. One vendor may supply from six sites with completely different profiles, and the site with the problem is rarely the one whose head office signed your code of conduct.

Migration exposes this immediately and painfully. Historical assessments are attached to entities, so re-attaching them to sites requires a judgement about which facility was actually assessed, and the audit report often names a plant that appears nowhere in your records. Group structures change over the period you are migrating: acquisitions, divestments, renamed subsidiaries and joint ventures that were once wholly owned. Assessments performed under a superseded methodology have to remain readable under the model that applied at the time.

The fix is to model supplier group, legal entity, site and commodity as separate objects, then bind them to your own purchase order and receipt history so exposure is calculated rather than asserted. During migration, build a site register with alias and address history before attaching anything, and route unresolvable facilities to a review queue rather than to a default parent. Keep effective dates on every relationship so an ownership change does not silently rewrite history. Sites you cannot place are a finding in themselves, because they represent assessments you paid for that describe somewhere you cannot identify.

Why do subscription platform and purchasing integrations break after launch?

You will keep EcoVadis, Sedex, IntegrityNext, Assent or Prewave as data sources, and those feeds drift for structural reasons rather than technical ones. Their refresh cycles are theirs, so a scorecard that looks current may be eighteen months old, and a system that displays it without an as at date invites a decision based on stale information. Their entity resolution is their own, so a supplier your team knows as one group arrives as three unmatched records. Adverse signal feeds match on names, and names in this domain are ambiguous across languages and transliterations.

The purchasing integration breaks differently. Large groups routinely run several purchasing systems after acquisitions, each with its own vendor numbering, and the spend figure that drives prioritisation is assembled from all of them.

The fixes are specific. Stamp every imported record with a source and an as at date, and show both wherever a score is displayed. Keep entity matching as a reviewable process with a queue rather than an automatic merge, because a wrong merge here attaches one site's findings to another company. Reconcile spend per purchasing system on a schedule. Then treat every adverse media hit as a candidate requiring human review, because an automated status change on a false match damages you in both directions.

What happens when evidence validity, grievance intake and reporting are not covered?

Three gaps turn a competent assessment tool into an indefensible one.

Evidence without validity is the first. A questionnaire answered yes is not evidence. The artefact is the wage register sample, the age verification procedure, the recruitment fee reimbursement policy, the third party audit report with its own scope and date, the closure photograph. Survey tools collect answers and do not manage a document with an expiry, a scope and a source, so certificates age quietly and the questionnaire still shows a ticked box.

Grievance intake is the second. Statutory schemes generally expect an accessible complaints procedure, and one bolted on later cannot feed risk rescoring or open a corrective action against the right site.

Reporting is the third. If evidence is spread across a subscription platform, a survey tool and email, the annual report is written by hand by someone reading everything, which is why it takes months and reads like it.

The fix is to make evidence a first class object attached to a control at a site, with a validity period, a source, an uploader and an immutable copy, so an expiring certificate changes the site status automatically. Design the grievance channel with legal from the start, covering anonymity, language accessibility, restricted access, retention and protection against retaliation. Then generate the report from the operational record, with every figure linking to the underlying records so an auditor clicks rather than asks.

Should you build custom or configure what you already own?

Some companies should subscribe and stop. If you have a few hundred direct suppliers, mostly in lower risk categories and jurisdictions, and your obligation today is a customer questionnaire rather than a statute, EcoVadis or Sedex plus a disciplined process is proportionate, and building would be an expensive way to feel serious. Prewave is genuinely useful for adverse signal detection, Assent is strong at collecting declarations and regulatory data at scale, and Sedex carries site level audit data in a way most tools do not.

Configuration is also underused. Many programmes send an identical assessment to every supplier regardless of category risk, which burns the supplier goodwill you will need when you ask for something difficult. Segmenting templates by commodity and country, and switching on corrective action tracking that your existing subscription already includes, removes a real part of the workload before any software is commissioned.

Build when two or more of these are true. You carry a statutory duty with enforcement exposure rather than a voluntary commitment. Your risk sits at site level and your vendor master cannot tell you which site fulfils an order. You operate in commodities with known forced labour exposure where the burden of proof falls on you. You need evidence and corrective action tracking with a defensible audit trail rather than scorecards. Or you already pay for two or three platforms and still assemble the annual report by hand, which is the clearest signal of all.

How do hidden costs get into the quote?

Digital Heroes delivery bands here are $85,000 to $170,000 over 12 to 18 weeks for a first release covering the supplier and site hierarchy bound to purchasing data, your own versioned risk model, assessment with evidence management and corrective action workflow, then $200,000 to $450,000 phased across 7 to 12 months for the full platform. Overruns come from work treated as an assumption.

• Languages. A supplier portal that Chinese, Turkish, Vietnamese and Portuguese speaking factory staff can actually use is a localisation programme, not a translation file.
• Grievance channel design. Confidentiality, access control, retention and hosting decisions need legal input and carry genuine ethical weight.
• Fragmented purchasing systems. Each additional system is its own connector and its own vendor numbering reconciliation.
• Risk methodology workshops. Agreeing factors, weights and thresholds needs sustainability, legal, procurement and often the audit committee in one room, repeatedly.
• Subscription data synchronisation. Their refresh cycles, their entity model, your as at dates.
• Assurance readiness. If an external assurer will review the report, the traceability they expect should be designed in rather than demonstrated afterwards.

Cost falls sharply if you start with the commodity categories and countries your own risk analysis already flags. Covering every supplier in year one is an expensive way to prove that most of your suppliers are boring.

What separates a build that works from one that fails here?

The programmes that hold up version their risk model. Factors, weights and thresholds carry effective dates, so a decision made two years ago renders under the model in force then while today's decisions use the current one. Every score displays as a derivation showing which factors contributed what. That is the difference between a number and a defence, and it is the first question worth asking any prospective developer, because a system that silently recalculates history has destroyed the evidence you built it to produce.

They are also honest about upstream visibility. No software solves beyond tier one outright, and cascading questionnaires fail predictably as response rates collapse at each level and responses remain unverifiable. What works is reasoning over partial signals together: declared chains where suppliers will disclose, chain of custody documents where a scheme exists, trade and shipment data where you have access, and enforcement or media signals mapped to named facilities, presented with a confidence level rather than false certainty. The gaps then drive commercial action, meaning contract clauses, disclosure requirements at renewal, and targeted verification where exposure is highest.

There is one place machine assistance clearly earns its keep, and it should be scoped explicitly: extracting issue dates, expiry dates, scope and issuing body from supplier documents in many languages and layouts, then flagging mismatches against what the supplier claimed. That processes documents nobody currently reads. Every extracted field still needs a human above the confidence threshold, and no model should change a supplier's status by itself.

Settle ownership before kickoff. You should own the repository, the infrastructure accounts and the right to hire anyone else, and at Digital Heroes the client owns the code from the first commit. Your due diligence record is legal evidence with a multi year retention expectation, and it must never sit somewhere you cannot take it.