Supplier Code of ConductBinding Standards of Conduct for Suppliers

Distinction from other compliance documents

The SCoC is specifically directed at suppliers and differs from the internal corporate code of conduct (Code of Conduct), which binds only the company's own employees. It also differs from general terms and conditions, as its content covers ethical, social and environmental rather than purely commercial provisions. In practice, it is often combined with a compliance declaration or acknowledgement form that documents the binding consent.

Typical content elements

A practical SCoC typically contains modules on human rights and fair working conditions, occupational health and safety, environmental protection and resource efficiency, business integrity (such as anti-corruption and competition law), data protection, and grievance procedures for affected parties. Depending on the industry, industry-specific requirements are added, such as conflict minerals in electronics or product safety requirements in the automotive industry.

• Human rights and ILO core labour standards
• Occupational health and safety
• Environmental and climate protection requirements
• Anti-corruption, competition law, anti-money-laundering
• Data protection and information security
• Grievance mechanisms and remediation

Embedding in supplier qualification and enquiries

The SCoC is typically already demanded during supplier qualification, for example as a mandatory criterion in the enquiry process alongside technical mandatory and desirable criteria. An established approach is to include it in the tender documents, so that the award decision, on a documented basis, is only made to suppliers who have acknowledged the code. With existing suppliers, introduction often takes place as part of the contract renewal, i.e. at contract renewal, in order to avoid unnecessarily mixing commercial discussions with this topic.

Correct category and supplier structure

Requirements should be differentiated along the material group hierarchy: stricter verification and documentation obligations apply for critical material groups or high-risk countries than for services with low sourcing risk. A consistent spend taxonomy helps to systematically identify risk-relevant spend areas and to define the SCoC reference in each Category Charter. This keeps the effort proportionate and the risk analysis focuses on the areas with the greatest leverage.

Creating contractual binding effect

From a legal perspective, the SCoC takes effect primarily when it is agreed as a contractual component, for example as an annex to the framework agreement or a contract for work. Customary are cross-references, audit and disclosure rights, remediation periods and recourse in the event of contractual penalties. The specific design should be legally reviewed, as the requirements differ depending on the legal situation and contractual arrangement.

Self-assessment and initial evaluation

The first verification level is typically a structured supplier self-assessment in which the supplier confirms compliance with the code requirements and provides evidence such as certifications, working time arrangements or training records. This self-assessment feeds into the supplier evaluation and forms the basis for the further risk analysis. A documented intake and approval process with clear data ownership is important, in which the data owner in procurement or compliance is responsible for the currency and quality of the information provided.

Audits and on-site inspections

Where risk is elevated, audits follow, either as the company's own audit, as part of a joint industry initiative or via recognised standards such as SMETA, amfori BSCI or SA8000. The scope of the audit is guided by country, industry and material risks. Irregularities are documented in the audit report, explained to the supplier as part of a clarification round and bindingly agreed in a corrective action plan with deadlines.

Continuous supervision and monitoring

Between audits, continuous monitoring applies, such as media monitoring, sanctions list screening or reports via grievance channels. In the case of critical incidents, a structured non-conformity management process comes into play, similar to the defined deviation workflow with escalation stages, deadlines and responsibilities used in quality management. In the event of repetition, this can lead to supplier migration, i.e. the systematic transfer of volume to compliant alternative suppliers.

Conformity and coverage rate

The key figure is the proportion of procurement volume transacted with suppliers who have acknowledged the SCoC – usually measured as a percentage of spend in critical categories. In addition, the proportion of suppliers with a completed audit or valid certification is reported. It is important to link this to volume, not just to the number of suppliers, since a few large suppliers usually carry the greatest risk contribution.

Audit and defect metrics

Also useful are the number of audits conducted per year, the proportion of audits with critical findings, and the lead time from finding to confirmed corrective action. These values can be presented well within supplier risk management and an overarching risk analysis. Benchmarking with industry peers or via initiatives helps to put one's own coverage into realistic perspective.

Reporting and target figures

The figures are often aggregated in a supplier compliance dashboard and reported to management quarterly. Typical targets in practice are, for example, coverage of more than 90 per cent of critical spend with an acknowledged SCoC and a complete corrective action plan for all critical audit findings within defined deadlines. Specific target values depend heavily on industry, risk exposure and maturity and should be interpreted as realistic benchmarks, not absolute standards.

Legal classification

In Germany, the Supply Chain Due Diligence Act requires affected companies, among other things, to conduct risk analyses, take preventive and remedial measures and operate grievance procedures within their own supply chain. At EU level, the Corporate Sustainability Due Diligence Directive (CSDDD) will further harmonise and extend due diligence obligations. The SCoC is an important documentation and implementation instrument for this, but it does not replace the entire due diligence process – the specific obligations and deadlines should be legally reviewed on a case-by-case basis.

Sanction and escalation mechanisms

An SCoC should clearly set out what happens in the event of violations. A graduated model has proven effective: immediate containment measures (similar to containment in quality assurance), then a structured root cause analysis with the supplier, in which methods such as 5 Whys help, followed by the corrective action plan with deadlines, and only in the event of a repeat or serious violation, termination of the business relationship. A contingency plan equivalent to a Risk Mitigation Plan secures supply should a supplier fail at short notice.

Typical pitfalls

Common mistakes are purely formal acknowledgement without verification depth, inadequate prioritisation by risk, lack of resources for audit follow-up and unclear responsibilities between procurement, quality and compliance. In addition, an overly complex code can overwhelm small and medium-sized suppliers and reduce market acceptance. Clear alignment with the market model helps: those with few alternatives on tight procurement markets must design deadlines and requirements realistically.

From self-commitment to statutory due diligence

Whereas SCoCs were previously driven primarily by reputation, supply chain laws in Germany and the EU increasingly make evidence of systematic risk assessment mandatory. As a result, the focus is shifting from mere acknowledgement of the code to demonstrating effective preventive and remedial measures. Companies that structured their supply chain topics before regulation show, in practice, lower adaptation costs and better audit results.

Digitalisation of supplier verification

Software-based supplier portals, standardised questionnaires and automated risk screenings considerably reduce manual effort. Interfaces to e-procurement systems, for example via punchout catalogue integration or integration into the procurement platform, ensure that SCoC status and approvals flow directly into transaction processes. The link to quality processes such as incoming goods inspection and complaint handling is also increasingly being mapped digitally in order to recognise systematic irregularities at an early stage.

Industry initiatives and standardisation

To avoid audit fatigue and duplicate audits, a growing number of companies are using joint industry initiatives and mutualised assessments. Standardised codes and mutual audit acceptance reduce the effort on both sides. For medium-sized suppliers, structured advance preparation pays off in practice, for example through a central document repository, named contacts and training records, so that no delays arise during series ramp-up and qualification phases due to open compliance requirements.