Guidance auditors
Document review
During an office audit, it is important to assess both the content and quality of the documents referenced by the supplier. Pay particular attention to the following:
Request documents in advance: If the supplier has not attached relevant documents in the self-assessment, ask them to submit the documents prior to the audit.
Check document validity: Ensure that documents are dated and up to date. Governing documents should have been revised within the last 1–2 years to show that the work is actively maintained.
Assess relevance: Documents must be relevant to human rights and environmental due diligence and clearly linked to the supplier’s own operations or supply chain. Generic documents require follow-up.
Verify that documents support the claims made: If the supplier states, for example, that they conduct risk assessments, there should be documentation showing how this is done in practice.
Accept various document formats: These may include policies, procedures, templates, reports, emails, Excel or Word files, PowerPoints, PDFs, screenshots, system printouts or photos. What matters is that the documents are up to date, relevant, and support the supplier’s claims.
Interviews
Interviews should primarily focus on the supplier’s personnel responsible for due diligence in their own operations and supply chain. To assess whether rights-holder consultations in the supplier’s own operations are meaningful, it may also be relevant to pose questions to worker representatives, such as union representatives or health and safety officers. Pay particular attention to the following:
Plan interviews in advance: Ensure that the right people are scheduled. This should always include those responsible for sustainability or procurement related to due diligence, but may also include HR personnel and others.
Create a safe environment: Clarify the purpose of the interview and how the information will be used. If worker representatives such as union or health and safety delegates participate, emphasize that they are free to speak openly without risk of negative consequences.
Ask open and specific questions: Avoid yes/no questions. For example, ask: "Can you give examples of how workers have been involved in risk assessments related to work environment and discrimination?", "What is included in your supply chain risk assessments?", or
"How do you follow up on action plans for the supply chain?"
Confirm or challenge the documentation: Use the interview to understand how well procedures work in practice. If a document states that consultations take place, ask how, when, with whom, and how the results are used.
Document responses in a structured way: Take notes during or immediately after the interview, ideally using a template prepared in advance. Keep these notes separate from other audit documentation.
Allow sufficient time and agree on format: Set aside 30–60 minutes per interview. If several participants are involved—especially where there are power dynamics—individual interviews may be preferable.
Sample products
The implementation of policies and processes is assessed based on sample products. The selection is made by the contracting organisation and is based on the risk of adverse impacts, volume, and/or turnover.
If the supplier has a process for identifying risk suppliers or prioritised purchasing categories that meets the requirements (see Process requirement 2), this shall be accepted even if the sample product falls outside their prioritisation. In such cases, you shall ask the contracting organisation for a new sample product. To ensure that the new sample product aligns with the supplier’s prioritisation, the decision should be made in dialogue with the supplier.
Templates
The audit shall be documented, and for this purpose, there is an office audit template and a deviation management template, to be used during follow-up audits.
These templates are based on the seven process requirements in the contract clause. In the templates, you shall:
-
Assess compliance with the process requirements
-
Note any risk of severe deviations
-
Propose improvement measures based on this guidance
At the end of the templates, the supplier shall prepare an action plan, which shall be approved by you. The action plan shall specify:
-
How the supplier intends to address the deviations
-
The deadline for implementation
-
The person responsible at the supplier for carrying out the corrective action
Enabling audits
The supplier shall confirm that it can grant access to its own facilities for auditing. The supplier shall also have contractual clauses or agreements in place that grant both the supplier and the contracting organisation the right to conduct audits at their first tier suppliers.
The ability to enable audits shall be noted in the audit templates, although this requirement is not part of the formal process requirements.
Process requirements
For guidance on how to interpret the process requirements, see Supplier's Due Diligence. Read the process requirements with a legal lens—assess exactly what is written, no more and no less.
The guidance includes suggestions for verifications as well as what does and does not fulfil each requirement. The aim is to enable a standardised assessment. We have also compiled these examples into a checklist to support you during the audit. Download and print the checklist, and use it as a reference during the audit. Circle the appropriate answers and make notes directly in the checklist as needed.
The checklist provides guidance but is not exhaustive—there may be other examples that also fulfil the requirements. Conditions may also vary between sectors. The most important thing is to assess suppliers within the same framework agreement or procurement category consistently, in line with the principle of equal treatment. Use your professional judgment and contact the contracting organisation if in doubt.
-
Record one non-compliance per process requirement.
-
Keep your assessments brief.
-
Feel free to use the suggested wording in the checklist.
Always provide clear, concrete improvement suggestions and refer to the guidance and its templates.
Quality control
To ensure that the deviations are easy to understand for both contracting organisations and suppliers—and to correct spelling and grammatical errors—we encourage you to use AI tools to improve the language before finalising your report. A simple way to quality-check your text is to ask: “Can you improve and shorten this paragraph?” Make sure not to include the company name in the question.