Ethical Sourcing Guidelines

𝐑𝐞𝐟𝐥𝐞𝐜𝐭𝐢𝐧𝐠 𝐨𝐧 𝐚𝐥𝐥 𝐭𝐡𝐞 𝐬𝐮𝐩𝐩𝐥𝐢𝐞𝐫𝐬 𝐈’𝐯𝐞 𝐬𝐨𝐮𝐫𝐜𝐞𝐝, 𝐨𝐧𝐞 𝐭𝐡𝐢𝐧𝐠 𝐢𝐬 𝐜𝐥𝐞𝐚𝐫: 𝐩𝐫𝐨𝐜𝐞𝐬𝐬 𝐦𝐚𝐭𝐭𝐞𝐫𝐬. Taking shortcuts can lead to wasted money and a world of headaches downstream. (𝘙𝘢𝘪𝘴𝘦 𝘺𝘰𝘶𝘳 𝘩𝘢𝘯𝘥 𝘪𝘧 𝘺𝘰𝘶'𝘷𝘦 𝘦𝘷𝘦𝘳 𝘣𝘦𝘦𝘯 𝘢𝘴𝘬𝘦𝘥 𝘵𝘰 𝘧𝘢𝘴𝘵-𝘵𝘳𝘢𝘤𝘬 𝘙𝘍𝘗 𝘳𝘦𝘲𝘶𝘪𝘳𝘦𝘮𝘦𝘯𝘵𝘴, 𝘰𝘳 𝘩𝘢𝘥 𝘭𝘦𝘢𝘥𝘦𝘳𝘴 𝘱𝘶𝘴𝘩 𝘧𝘰𝘳 𝘤𝘦𝘳𝘵𝘢𝘪𝘯 𝘴𝘶𝘱𝘱𝘭𝘪𝘦𝘳𝘴, 𝘪𝘨𝘯𝘰𝘳𝘪𝘯𝘨 𝘮𝘢𝘵𝘦𝘳𝘪𝘢𝘭 𝘳𝘪𝘴𝘬𝘴?!) 𝐖𝐡𝐚𝐭 𝐈'𝐯𝐞 𝐥𝐞𝐚𝐫𝐧𝐞𝐝: 💡 𝙁𝙤𝙘𝙪𝙨 𝙛𝙞𝙧𝙨𝙩: Be specific about your needs in RFx docs. If you’re unclear, suppliers will be, too. Before going to RFP, always have quantifiable evaluation criteria finalized and approved by the Spend Owner. 💡 𝙄𝙩’𝙨 𝙣𝙤𝙩 𝙟𝙪𝙨𝙩 𝙥𝙧𝙞𝙘𝙚: The cheapest option often costs the most in the long run. Prioritize value over price. Suppliers who price things materially lower than benchmark norms usually cut corners somewhere to meet margins. 💡 𝘾𝙝𝙚𝙘𝙠 𝙧𝙚𝙛𝙚𝙧𝙚𝙣𝙘𝙚𝙨 𝙩𝙝𝙤𝙧𝙤𝙪𝙜𝙝𝙡𝙮: Source independent references via your network. Past performance tells the real story. Ask the right questions and listen closely to the answers.  💡 𝙏𝙝𝙞𝙣𝙠 𝙖𝙝𝙚𝙖𝙙: Can the supplier grow and evolve with your business? Are they innovative and flexible? Does their company culture and ways of working align with yours?  💡 𝙆𝙣𝙤𝙬 𝙩𝙝𝙚 𝙧𝙞𝙨𝙠𝙨: Most suppliers come with some level of risk, the key is understanding and managing it. Conduct due diligence on short-listed suppliers. Outputs should inform the down-selection process, with material deficiency action items included in the contract. 💡 𝘾𝙝𝙤𝙤𝙨𝙚 𝙥𝙖𝙧𝙩𝙣𝙚𝙧𝙨, 𝙣𝙤𝙩 𝙫𝙚𝙣𝙙𝙤𝙧𝙨: The best suppliers care about your long-term success and aligning with your goals.  Look at proposals holistically, thinking beyond the transaction and into value creation. 𝐇𝐞𝐫𝐞’𝐬 𝐭𝐡𝐞 𝐭𝐡𝐢𝐧𝐠: Looking back, I’ve been at firms in seasons where costs were prioritized over total value, often leading to short-term gains but long-term challenges. There were times I should’ve taken a firmer stance about material supplier risks identified and bias in the selection process.  As procurement peeps, we provide recommendations based on long-term value, risk management, and partnership potential. This includes having the courage to speak up with informed and actionable guidance when things don't pass muster. The goal is to ensure sourcing outcomes build a foundation for success, not just a quick win. 📢 𝙋.𝙎. 𝙒𝙝𝙖𝙩 “𝙨𝙘𝙝𝙤𝙤𝙡 𝙤𝙛 𝙝𝙖𝙧𝙙 𝙠𝙣𝙤𝙘𝙠𝙨” 𝙨𝙤𝙪𝙧𝙘𝙞𝙣𝙜 𝙡𝙚𝙨𝙨𝙤𝙣𝙨 𝙬𝙤𝙪𝙡𝙙 𝙮𝙤𝙪 𝙨𝙝𝙖𝙧𝙚 𝙬𝙞𝙩𝙝 𝙮𝙤𝙪𝙧 𝙮𝙤𝙪𝙣𝙜𝙚𝙧 𝙥𝙧𝙤𝙘𝙪𝙧𝙚𝙢𝙚𝙣𝙩 𝙨𝙚𝙡𝙛?

'the data reveals that artisanal mining for cobalt is a very hazardous vocation undertaken for basic survival, involving long hours, subsistence wages, and severe health impacts. The data further reveals that within the surveyed respondents, there is a high rate of forced labour and an almost 10% rate of child labour' Rights Lab, University of Nottingham recent report, Blood Batteries, The #humanrights and #environmental impacts of cobalt mining in the Democratic Republic of the Congo demonstrates the continued issues with cobalt mining. '- 36.8% of respondents met the project’s conservative criteria for forced labour - 9.2% of respondents met the project’s conservative criteria for child labour - 27.7% of respondents began working in artisanal mining as a minor - Not a single respondent was a member of a trade union, as none exist - Not a single respondent had a written agreement for their work . For those #supplychain and #procurement professionals who are able to trace cobalt to source there are potential steps to be taken: 1. Ethical and Responsible Sourcing Ensure traceability from artisanal and industrial mining sites in the DRC to final product, especially for cobalt used in EVs and electronics. Demand transparency from suppliers, require disclosure of sourcing practices, human rights due diligence, and environmental impact assessments. Prioritise suppliers who can demonstrate compliance with international labour standards and reject those linked to exploitative practices. 2. Environmental Stewardship Incorporate geospatial and water toxicity data into supplier evaluations to avoid contributing to ecological degradation. Promote circular economy principles such as battery recycling, reuse, and alternative materials to reduce dependence on high-impact cobalt mining. 3. Compliance and Governance Align with UK Modern Slavery Act, ensure supply chain mapping and annual transparency statements reflect risks in high-impact regions like the DRC. Embed environmental, social, and governance standards into tendering and contract management processes. 4. Practical Procurement Measures Use multi-quote and business case procedures to ensure value for money and ethical sourcing, as outlined in UK finance and procurement policies. Establish KPIs related to ethical sourcing, labour conditions, and environmental impact. Anticipate changes from the Procurement Act 2025 and EU Critical Raw Materials Act that may affect sourcing obligations. For the majority of buying organisations or as consumers this is a very difficult area, but as the report recommends Government's could do a lot more to reduce exploitation: 'Strengthen supply chain transparency and due diligence requirements of consumer-facing tech and EV companies with more robust legislation; laws should include strict and severe penalties as opposed to simple reporting requirements, including a potential import ban;'

The IIA has released the Third-Party Topical Requirement. It sets a clear baseline for how internal auditors must assess risks linked to vendors, suppliers, contractors, and even downstream partners. Why does this matter? Because working with third parties always comes with risks: strategic, operational, reputational, financial, legal, cyber, and even sustainability. When they fail, your organization suffers. The key reminder: Outsourcing the work does not mean outsourcing accountability. The primary organization always owns the risk. The requirement covers three big areas: ↳ Governance: Is there a formal approach, clear roles, policies, and timely reporting on third-party performance and risks? ↳ Risk management: Are risks identified, prioritized, and reviewed regularly with proper responses and escalation processes? ↳ Controls: Is there due diligence, strong contracts, onboarding, ongoing monitoring, incident management, and structured offboarding? Actionable Insights: ↳ Treat third-party risks as part of your risk universe. ↳ Don’t just rely on contracts. Test how effective monitoring and escalation processes really are. ↳ Keep an updated inventory of all third-party relationships. It sounds basic, but many organizations miss this. ↳ Make sure third-party offboarding includes revoking access and securing sensitive data. Reference: Third -Party Topical Requirement. 2025. The Institute of Internal Auditors, Inc (link to download in the comments) #internalaudit #ITaudit #digitaltransformation

Struggling to select the right supplier? Then try my simple 5-step process: Recently, a client threw me a total curveball They asked me to find and select several suppliers …for some very technical materials …only found in Asia …in just 10 days …when they’d spent months looking without success I fell back on my tried and tested process …and nailed it …in 10 days :) Here are the steps I went through: Step 1 – Define Selection Criteria → Define what matters to you and your business → Rank items and tag knockout factors (red flags) → Translate criteria into demands and wishes → Align criteria with stakeholders Step 2 – High Level Supplier Search → Identify potential suppliers → Conduct high level screening → Use software as appropriate* → Use selection criteria to narrow search *I’ve had a lot of success with Forestreet 👉 Create a shortlist list of ~10-15 suppliers   Step 3 – Detailed Supplier Appraisal → Define critical questions and assessment areas → Judge how well suppliers respond → Balance RFIs with calls 👉 narrow shortlist down to ~5 Step 4 – In Depth Due Diligence → Assess chemistry, communication, responsiveness → Go deeper: who’s really on the project team? → Check specs and capacity for your project → Run financial/solvency checks → Pressure-test expertise → Ask for references & testimonials → Cross-check against original objectives 👉 narrow shortlist down to ~3   Step 5 – Final Selection → Run your sourcing activity (RFQ, RFP, RFS) → Create a final supplier benchmark → Balance logic with instinct* → Discuss with key stakeholders → Pressure-test assumptions → Sleep on it – then be decisive (*eg if all quotes were equal, who would you choose?) 👉 select the supplier (s) There is no perfect supplier – there are always shades of grey But a structured funnel will maximise your chances of finding and selecting the most suitable one The process isn’t complicated What matters is how well you execute it 👇 What would you add? 🔔 Follow Simon Frost for more on supplier search & selection ♻️ Repost to help others to find the right suppliers Frost Procurement Adventurer

🌍 Transforming Gold Sourcing for a More Responsible Electronics Industry Proud to share more about our visit to Geita, Tanzania, where we’re evaluating the Responsible Gold Credit System—an initiative designed to address the challenges of ethical gold sourcing in the electronics industry. At Fairphone, we’ve always prioritized ethical sourcing for materials like gold, tungsten, tantalum, and tin—minerals that often come from regions facing social and environmental challenges. This new system supports artisanal and small-scale miners (ASM) by offering gold credits for every gram of gold they produce responsibly. These credits finance improvement projects at the mines, even when physical traceability isn’t feasible across our extensive supply chain. Why this matters: 🔑 Artisanal mining supports over 45 million livelihoods worldwide and provides 20% of the world’s gold. Properly managed, it can be a force for good, driving economic growth and strengthening communities. 📋 Our mission is to ensure the Responsible Gold Credit System is robust and scalable, creating a replicable model for ethical gold sourcing in the electronics sector. 🤝 Collaboration with our partners—Solidaridad Network, Solidaridad East and Central Africa, The Impact Facility and Netherlands Enterprise Agency (RVO) | Partner in Sustainable Development—is central to this work, as we visit pilot mines like Nsangano and Mgusu to understand how best to support ASM practices. Being on the ground has given us a deeper appreciation of the daily realities these miners face, as well as insights into how responsible mining can empower communities and improve lives. Curious to learn more about this transformative initiative? Read the full blog here: https://lnkd.in/eUhSw-En Winifrida Kanwa Lisa Minère Kari-Anne Sandness Mary Mkonyi Stephen Kithuka Lewis Temple Calvin Laing Godwin Zimba Aron Vijzelman Gebre Marloes Philippo #ResponsibleMining #EthicalSourcing #Fairphone #Sustainability #CircularEconomy

SUPPLIER QUALITY AUDIT CHECKLIST: 1.Quality Management System 1.Verify if the supplier is certified to ISO 9001 or IATF 16949. 2.Check for the presence of a documented Quality Policy and measurable objectives. 3.Confirm that roles, responsibilities, and authorities are clearly defined. 4.Ensure quality manuals and procedures are up-to-date and controlled. 2.Incoming Material Control 1.Review procedures for inspecting incoming materials. 2.Check whether Certificates of Conformance (CoC) or test reports are verified. 3.Confirm that non-conforming incoming materials are recorded and managed appropriately. 3.Process Control 1.Verify that work instructions are available and followed at each workstation. 2.Identify whether critical processes are controlled with defined parameters. 3.Check if in-process inspection is conducted systematically. 4.Look for the use of Statistical Process Control (SPC) tools like control charts or histograms for key operations. 4.Final Inspection and Testing 1.Ensure there is a procedure for final product inspection and testing. 2.Confirm that inspection records are maintained. 3.Check if outgoing products are verified against customer requirements. 4.Verify traceability systems for finished goods. 5.Equipment Calibration and Maintenance 1.Review the calibration schedule for measuring instruments. 2.Check if all gauges and instruments are calibrated with valid certificates. 3.Ensure preventive maintenance plans are in place and followed. 6.Non-Conformance and Corrective Action 1.Examine how internal and customer-related non-conformances are handled. 2.Check if root cause analysis methods like 5Why or Fishbone diagrams are used. 3.Ensure corrective and preventive actions are tracked to closure with effectiveness verification. 7.Document and Record Control 1.Confirm that records are retained as per defined retention policies. 2.Check whether document revisions are controlled and updated systematically. 8.Supplier/Sub-supplier Management 1.Verify if sub-suppliers are evaluated periodically. 2.Ensure the supplier has defined quality expectations and requirements for their own suppliers. 9.Training and Competency 1.Check whether employees are trained and competent for their assigned tasks. 2.Ensure training records are maintained and effectiveness is evaluated. 10.Continuous Improvement 1.Look for evidence of continuous improvement initiatives such as Kaizen, 5S, or Six Sigma. 2.Check whether improvement goals are set, monitored, and reviewed regularly. 11.Environment, Health & Safety (EHS) 1.Ensure that safety measures, signage, and personal protective equipment (PPE) are available and used. 2.Verify the implementation of 5S principles in the workplace. 3.Check for compliance with environmental and legal regulations. 12.Customer Satisfaction and Support 1.Review how customer feedback and complaints are collected and analyzed. 2.Check whether timely and effective actions are taken in response to customer issues.

✅ "My Suppliers Are Certified, I Am Safe" Have you ever rested easy, thinking your supply chain was bulletproof because your suppliers were certified? This confidence is common among medical device manufacturers in the European Union, especially when dealing with suppliers boasting certifications like ISO 13485. But here’s the twist: Certifications alone might not be the safeguard you think they are. In general, we can differentiate between three levels of suppliers: ❗ Suppliers without any certificates might pose quality risks. 📜 Suppliers with general certificates like ISO 9001 offer some reassurance. 🏆 Suppliers with highly compatible certificates like ISO 13485 are seen as the gold standard. Choosing the third option often gives manufacturers a false sense of security, leading some to skip audits on these suppliers. However, the reality is starkly different. Even certified suppliers can have significant quality issues, expired certificates, prepare only for audit days, or misrepresent facts. 🚫 Here are some approaches how to dodge these pitfalls: 🔍 Continuous Monitoring: Don’t rely solely on certificates. Implement a system for ongoing supplier evaluation, beyond the initial certification check. This proactive approach helps catch any slip in quality or certification status in real time. 🕵️ Detailed Contractual Agreements: Implement comprehensive contractual agreements that specify quality and compliance expectations, along with the rights to conduct scheduled audits, review quality records, and enforce corrective actions as needed. ✔️ Cross-Verification: Don’t take their word for it; verify the validity of their certificates independently. This can involve checking with the issuing bodies or using third-party services specialized in supplier verification. The lesson here? Certifications are a starting point, not a finish line. In my personal experience, I had great suppliers and terrible ones. The last ones faked documents, lied about project progression, used forbidden materials during manufacturing and had no idea what production validation meant. Have you experienced challenges with certified suppliers? How do you ensure your supply chain remains robust and compliant? #medicaldevice #regulatoryaffairs #mdr #medicaldevices #eumdr #medtech

This procurement choice made me unpopular. But I’d do it again in a heartbeat. We were sourcing branded merchandise from a factory in China. The quote ticked all the right ESG boxes: recycled materials FSC packaging ethical practices But it didn’t hold up. The FSC code they listed registered their logistics provider. They claimed “100% recycled” but it turned out to mean the product could be recycled, not that it was. And when I asked for proper audit reports they sent me a glossy PDF full of "stock images". So I suggested we walk away. Yes it delayed the project. It also annoyed a few stakeholders. But I wasn’t willing to back a claim I couldn’t verify. And I’m not alone. A recent EU review found 42% of green claims were exaggerated, false or deceptive. In the supply chain space, 70% of ESG statements go unverified. And big brands get caught in this all the effin time. Here are 3 real signs of greenwashing I’ve seen in supplier deals and what to do about them: 1️⃣ Borrowed credentials Suppliers list certifications they don’t actually hold. One factory used another company’s FSC code to look compliant. ♻️What to do: Cross-check certificates on official registers. If the name doesn’t match the supplier’s legal entity it's a huge red flag. 2️⃣ Buzzwords over substance "Eco-friendly”, “green-certified”, “sustainable packaging” but no hard data. A Changing Markets Foundation report found 60%+ of fashion brands rely on vague ESG language without evidence. ♻️ What to do: Ask for LCAs or raw material breakdowns. If it’s just buzzwords, assume it’s fluff. 3️⃣ PowerPoint proof When asked for ESG evidence, some suppliers send marketing decks. One even shared a “sustainability video” instead of an audit. ♻️What to do: Ask for third-party audit results. If they avoid it twice, move on. Greenwashing is getting smarter. Procurement needs to get bolder. We’re canot forget that we must protecting brands, values, and compliance. Would you have also walked away too? Or tried to make it work?

Do your audit rights actually work, or are they just words on paper? 📝 Most organizations assume that having “audit rights” in a vendor contract is enough. In 2025, that assumption could put you at real risk. Here’s what risk professionals must know right now: Why audit rights are back in the spotlight → DORA (EU) – Now live. Contracts with ICT providers must include real, exercisable audit and information rights, including on-site inspections. → UK PRA updates – Explicitly require audit rights that extend to subcontractors and regulators. → NIS2 Directive – Expands accountability across 18 critical sectors. Strong oversight clauses aren’t optional. → SEC Cyber Disclosure Rule (US) – Four-day incident reporting means you need fast, direct access to vendor evidence. ⚠️ The pain points we see daily → Vendors pushing for “certificates only” instead of real access. → Cloud providers offering pooled audits, but still limiting individual on-site checks. → Missing flow-down rights, your vendor’s subcontractors escape your oversight. → No clause giving direct regulator access to providers (a non-starter under DORA/PRA). 3 things you can act on immediately 1) Review your top 20 vendor contracts – Do they include on-site, regulator, and subcontractor audit rights? If not, flag them for remediation. 2) Tier your audit model – Critical vendors = on-site rights; mid-tier = pooled audits + supplemental evidence; lower-tier = independent reports. 3) Pre-agree evidence menus – Define what you can ask for (SOC 2, vulnerability scans, BCP/DR tests, incident logs) and set SLAs for delivery. 📌 Takeaway: Regulators don’t care what’s in your contract if you can’t actually exercise it. 2025 is the year to test your audit rights, not just file them away. #ThirdPartyRisk #AuditRights #RiskManagement #VendorRisk #tprm #OperationalResilience #ComplianceMatters #CyberRisk #Governance #FinancialServices #RegulatoryCompliance

How to Evaluate New Suppliers: A Practical Procurement Framework Evaluating a new supplier isn’t just about finding the lowest price—it’s about selecting a partner who can consistently deliver Quality, Cost, Delivery, Innovation, and Sustainability. 1. Define Your Requirements Start by clearly identifying: * Product specifications * Annual demand and forecast * Quality standards * Delivery expectations * Compliance requirements * Target cost 2. Supplier Pre-Qualification Verify basic eligibility: * Company profile * Manufacturing capability * Years in business * Financial stability * Certifications (ISO 9001, IATF 16949, ISO 14001, etc.) * Customer references 3. Technical Capability Assessment Evaluate whether the supplier can meet technical needs: * Manufacturing process * Machinery and technology * Production capacity * Engineering support * R&D capability * Tooling expertise 4. Quality Assessment Review: * Quality management system * PPM performance * Process controls * Inspection methods * Traceability system * Corrective Action (CAPA) * PPAP/APQP capability (Automotive) 5. Commercial Evaluation Compare: * Unit price * Tooling cost * Payment terms * Incoterms * Cost breakdown * Total Cost of Ownership (TCO) 6. Supply Chain & Logistics Assess: * Lead time * Delivery performance * Inventory management * Packaging standards * Logistics network * Business continuity plan 7. Risk Assessment Identify risks such as: * Single-source dependency * Financial risk * Capacity constraints * Geographic risk * Political/environmental risk * Cybersecurity (if applicable) 8. ESG & Compliance Verify: * Environmental compliance * Labor practices * Ethical sourcing * Anti-bribery policy * Sustainability initiatives 9. Supplier Audit Conduct an on-site or virtual audit covering: * Production * Quality * Warehouse * Maintenance * Safety * Documentation * Process discipline 10. Sample Validation Before approval: * Sample inspection * Functional testing * Reliability testing * Trial production * PPAP approval (where applicable) 11. Supplier Scorecard Use a weighted evaluation model: Criteria. Weight Quality. 30% Cost. 20% Delivery. 20% Technical Capability. 15% Financial Stability. 5% ESG & Compliance. 5% Innovation & Service. 5% 12. Final Approval Approve suppliers based on: * Overall score * Risk level * Audit findings * Sample approval * Commercial agreement * Cross-functional team approval (Procurement, Quality, Engineering, Production) Best Practices * Never evaluate suppliers on price alone. * Use a cross-functional evaluation team. * Perform regular supplier performance reviews after onboarding. * Maintain an Approved Supplier List (ASL). * Encourage continuous improvement through supplier development programs. Key takeaway: The best supplier is not the cheapest supplier—it’s the one that consistently delivers the best value across quality, cost, delivery, risk, and long-term partnership.