Supplier Due Diligence for Indian Manufacturers: A Practical Risk-Based Process

Supplier due diligence for Indian manufacturers is not a once-a-year exercise in collecting declarations, certificates and policy documents. It is an ongoing process for identifying where people may be harmed, deciding which suppliers require closer review, acting on findings and checking whether those actions work.

The process should be risk-based. A company with 300 suppliers does not need to audit all 300 in the same way. It does need a documented basis for deciding which relationships require a questionnaire, a document review, worker-level validation, a site assessment or immediate escalation.

The practical sequence is:

1. define the scope and map the supplier base;
2. screen suppliers using relevant risk indicators;
3. segment suppliers into risk tiers;
4. choose an assessment route for each tier;
5. prevent, mitigate and remediate identified harm;
6. track whether controls remain effective; and
7. report the results to the people who can make commercial and operational decisions.

This reflects the OECD’s due-diligence framework, which treats due diligence as a continuing process across a company’s operations, supply chains and business relationships.[1]

Supplier due diligence is not the same as auditing every supplier.

Supplier due diligence is the management system through which a company identifies and addresses actual or potential adverse impacts connected to its suppliers and other business relationships.

An audit may form part of that system, but it is only one assessment method. Other methods include onboarding questions, document review, management interviews, worker interviews, site observation, grievance information, corrective-action tracking and external risk intelligence.

The UN Guiding Principles on Business and Human Rights describe human-rights due diligence as a process for assessing impacts, integrating and acting on findings, tracking responses and communicating how impacts are addressed.[2] The purpose is not simply to prove that a supplier signed a code. It is to understand whether the expected controls operate in practice.

SVEGA’s earlier guide to supplier social risk in India explains the main areas of exposure. This guide takes the next step by showing how a manufacturer can organise the operating workflow.

A complete supplier map should be built before risk scores are assigned.

A business cannot screen relationships it cannot see. Begin with one controlled list covering the suppliers, subcontractors, job workers and labour-intensive service providers included in the programme.

The initial map should record:

• legal entity and operating name;
• manufacturing or service location;
• product, material or activity supplied;
• annual spend and operational criticality;
• direct supplier, subcontractor or job-worker status;
• known sub-tier or outsourced activity;
• workforce size and worker categories, where available;
• use of contract, migrant, temporary, seasonal or piece-rate labour;
• hazardous processes or materials;
• previous audit findings, complaints or legal concerns;
• buyer, market or contractual requirements connected to the supplier;
• current certificates, assessments and expiry dates; and
• internal relationship owner.

Spend is useful for deciding commercial coverage, but it does not measure the severity of workforce risk. A low-spend job worker using temporary labour and hazardous machinery may require more attention than a high-spend supplier of standard office materials.

This distinction matters because due diligence focuses on risks to people and the environment, not only risks to the purchasing company.[1]

Supplier screening should identify where adverse impacts may be most significant.

The first screen should be quick enough to apply across the whole in-scope base. Its purpose is to identify where deeper assessment is justified.

The OECD recommends considering sector, product, geography and enterprise-level risk factors. It also explains that prioritisation should be based on the severity and likelihood of adverse impact. For human-rights risks, severity receives particular weight.[1][3]

For an Indian manufacturer, a practical screen can include the following dimensions.

Risk dimension	Questions to ask during screening
Sector and process	Is the activity labour-intensive, hazardous, informal or associated with known workforce risks?
Workforce profile	Does the supplier rely heavily on contract, migrant, seasonal, temporary, home-based or piece-rate workers?
Subcontracting	Can work be passed to another site, job worker or homeworking network without prior approval?
Location and context	Are there location-specific concerns involving recruitment, labour availability, enforcement, vulnerable groups or access to remedy?
Product or material	Does production involve hazardous substances, high-risk raw materials or processes that are difficult to trace?
Previous performance	Are there repeat audit findings, unresolved corrective actions, complaints, incidents or unexplained data changes?
Management capability	Can the supplier identify owners, produce current records and explain how concerns are escalated?
Worker access	Can all worker categories access safety information and a grievance mechanism without retaliation?
Buyer or regulatory exposure	Is the supplier connected to a customer request, export market, product restriction or reporting requirement?

A missing answer is itself useful information. It may indicate that the supplier needs further assessment before the risk can be classified with confidence.

A documented segmentation method turns screening information into proportionate action.

Risk segmentation is valuable only when it changes what the company does next. The scoring method should therefore be simple enough to explain and consistent enough to repeat.

The following model is a starting point developed for practical implementation. It is not a statutory formula or certification standard. The weights should be adjusted to the company’s sector, products, workforce exposure and buyer requirements.

Sample weighted supplier-risk segmentation matrix

Dimension	Suggested weight	Rating guide
Sector and production-process risk	20%	1 = limited exposure; 5 = labour-intensive, hazardous or informally structured activity
Workforce vulnerability	20%	1 = mainly stable direct employment; 5 = extensive contract, migrant, seasonal, temporary or piece-rate labour
Subcontracting and traceability	15%	1 = fully visible and controlled; 5 = complex, unauthorised or poorly mapped outsourcing
Previous findings and incidents	15%	1 = no material concerns identified; 5 = severe, repeated or overdue issues
Geographic and recruitment context	10%	1 = lower contextual exposure; 5 = significant recruitment, migration, vulnerability or remedy concerns
Management system and evidence	10%	1 = clear ownership and reliable records; 5 = weak ownership, stale evidence or contradictory records
Buyer, market and contractual exposure	10%	1 = limited external requirement; 5 = direct buyer, product or market scrutiny
Total	100%	Calculate the weighted result after rating each dimension from 1 to 5.

One workable starting threshold is:

• Higher priority: 70 to 100
• Moderate priority: 40 to 69
• Lower priority: below 40

The score must not be allowed to hide a severe issue. Credible indicators of forced labour, child labour, immediate danger, retaliation, serious wage withholding or another severe impact should trigger escalation regardless of the total score. The OECD framework similarly places particular emphasis on the severity of human-rights impacts when priorities must be set.[1] The ILO’s forced-labour guidance can support the identification of indicators that require deeper review rather than being reduced to a routine questionnaire score.[5]

Document the reason for each rating. A score without supporting information becomes difficult to defend when procurement personnel change or a buyer asks how the classification was reached.

Each supplier tier should lead to a defined assessment route.

The company should decide in advance what each tier means. Assessment depth, evidence requirements, approval authority and review frequency should follow from the classification.

Supplier tier	Possible assessment route	Possible control response
Higher priority	Detailed questionnaire, document review, management discussion, worker input and site assessment where appropriate	Senior approval, time-bound corrective action, closer monitoring and escalation rules
Moderate priority	Targeted questionnaire and evidence review focused on the identified risk areas	Conditional approval, periodic validation and follow-up on selected controls
Lower priority	Basic onboarding screen, contractual requirements and scheduled information refresh	Routine monitoring and escalation if new information changes the risk profile

The method should match the risk. The OECD notes that supplier self-assessments, document reviews, inspections, audits, worker interviews and focus groups serve different purposes. Site inspection may be appropriate for physical safety, while worker interviews may be necessary to understand issues that records cannot establish.[1]

A social-audit report or certification should therefore not be treated as universal proof. It may cover a different site, period, workforce group or scope. If a buyer has named a specific programme, use SVEGA’s comparison of SMETA, amfori BSCI and SA8000 to clarify what the requested route produces and what it does not.

Procurement, HR, EHS, operations and management need defined due-diligence roles.

Supplier due diligence often fails when it is described as a procurement responsibility but depends on information and action from several functions.

Procurement may own the commercial relationship and supplier onboarding. HR or compliance may understand labour and grievance requirements. EHS may assess safety controls. Operations may know where subcontracting or production pressure occurs. Finance may hold payment and invoice evidence. Management decides whether a serious issue requires resources, escalation or a change in the commercial relationship.

The programme should name:

• the accountable executive;
• the supplier relationship owner;
• the person responsible for risk screening;
• the technical reviewers for workforce, safety and other relevant risks;
• the corrective-action owner;
• the authority that approves high-risk suppliers or exceptions; and
• the review forum that receives overdue or severe matters.

ILO discussions on responsible business conduct in India have similarly highlighted the need to integrate human-rights clauses into purchasing, train procurement teams, use worker interviews and establish grievance mechanisms.[4]

SVEGA’s practical guide to social compliance roles and responsibilities provides a cross-functional ownership structure that can be adapted for supplier due diligence.

Supplier evidence should be reconciled before it is accepted.

A complete folder does not necessarily demonstrate a controlled system. Records can be current and still contradict one another.

For labour-intensive suppliers, cross-check:

• worker deployment against attendance;
• attendance against wage and overtime calculations;
• wage sheets against bank-transfer evidence;
• contractor invoices against deployed headcount;
• training records against the workers and shifts actually covered;
• statutory-payment evidence against worker identity and reporting period;
• grievance records against the channels workers say they can use; and
• authorised production locations against invoices, transport records and output volumes.

The same principle applies to safety, recruitment, subcontracting and working conditions. Evidence should support the specific claim, site, worker population and reporting period under review.

SVEGA’s guide to contract labour governance provides a more detailed worker-record reconciliation process for manufacturers using labour contractors.

Findings should lead to prevention, corrective action and verified improvement.

When due diligence identifies a concern, the response should reflect the nature of the company’s connection to the impact and the seriousness of the harm.

A controlled response normally records:

1. the issue and affected people;
2. the immediate containment or protection required;
3. the root cause;
4. the corrective and preventive action;
5. the accountable owner;
6. the completion deadline;
7. the evidence required for closure;
8. the method and date for effectiveness verification; and
9. the commercial escalation route if action is delayed or ineffective.

The answer is not always immediate termination. A company may be able to use commercial leverage, technical support, deadlines and closer monitoring to prevent or mitigate harm. Disengagement may become necessary in some circumstances, but it should be considered responsibly because an unmanaged exit can create additional harm for workers.[1][2]

The company’s response should also distinguish between a temporary correction and a system change. A photograph may show that an obstruction was removed on one day. It does not prove that storage, inspection and escalation controls now prevent recurrence.

Manufacturers that need to build this workflow can use SVEGA’s Supplier Compliance and Export Readiness service to structure risk segmentation, assessment, corrective action, ownership and evidence controls around the actual business context.

Supplier monitoring should test whether the risk and the control have changed.

Monitoring should not consist only of requesting the latest certificate before it expires. The review should ask whether:

• new sites, products or processes have entered the relationship;
• the workforce profile or contractor dependence has changed;
• subcontracting has increased;
• production pressure or seasonal demand has altered working conditions;
• severe incidents, grievances or legal concerns have arisen;
• corrective actions were completed and verified;
• previously reliable records have become stale or inconsistent; and
• buyer or market requirements have changed.

Risk classification is therefore not permanent. A lower-priority supplier may move upward after a serious incident, unauthorised subcontracting or an unexplained workforce change. A higher-priority supplier may demonstrate sustained improvement, although severe inherent risks may still justify continued scrutiny.

Leadership should review coverage, findings and remediation, not just audit counts.

A useful management view should answer whether the programme is reaching the right suppliers and whether identified harm is being addressed.

Possible measures include:

• percentage of active suppliers screened;
• percentage of spend and critical production covered;
• number of higher-priority suppliers awaiting assessment;
• number of severe findings requiring immediate escalation;
• corrective actions overdue by more than 30, 60 or 90 days;
• recurrence rate for previously closed findings;
• percentage of high-priority suppliers with current assessment evidence;
• number of unauthorised subcontracting cases;
• supplier grievances or worker concerns received and resolved; and
• suppliers whose risk tier changed during the period.

The purpose is not to produce a reassuring green dashboard. It is to show where management action is needed. SVEGA’s guide to the social compliance dashboard explains how leadership metrics should connect to thresholds, ownership and action.

A 90-day implementation plan can establish the first working cycle.

The first version does not need to cover every supplier in equal depth. It should create a repeatable process and apply it first to the most significant risks.

Days 1 to 15: Define scope and ownership

• approve the programme boundary;
• appoint the accountable executive and working owners;
• combine supplier, contractor and job-worker records;
• agree the minimum information required; and
• identify immediate legal, buyer or product triggers.

Days 16 to 30: Screen the supplier base

• collect the first-pass risk information;
• record data gaps rather than guessing;
• identify severe red flags requiring immediate escalation; and
• prepare the suppliers that need deeper assessment.

Days 31 to 45: Assign risk tiers and assessment routes

• apply the approved scoring method;
• document the reason for each tier;
• override scores where severe harm indicators justify it; and
• assign questionnaire, desk-review or site-assessment routes.

Days 46 to 60: Assess the first priority group

• begin with the highest-risk or most exposed relationships;
• reconcile evidence rather than accepting isolated documents;
• use worker input where the risk cannot be understood from management records; and
• record actual and potential impacts separately.

Days 61 to 75: Agree corrective action and escalation

• contain urgent harm;
• establish causes and preventive controls;
• agree owners, deadlines and closure evidence;
• define the consequences of delay or recurrence; and
• obtain management decisions where commercial leverage is required.

Days 76 to 90: Establish monitoring and reporting

• verify the first completed actions;
• approve reassessment triggers and cadence;
• create the management dashboard;
• update onboarding and contract controls; and
• schedule the next supplier group.

Buyer questionnaires and BRSR-linked requests should reuse the same controlled data.

Supplier due diligence should reduce repeated data chases. The same supplier inventory, ownership matrix, risk classification, assessment records and corrective-action tracker can support buyer questionnaires, sourcing reviews and value-chain information requests.

SEBI’s March 2025 framework states that ESG disclosures for the value chain are voluntary for the top 250 listed entities from FY 2025-26. SEBI’s subsequent FAQ confirms that position.[6][7] This does not make BRSR directly applicable to every unlisted supplier. A listed customer may nevertheless request information from its suppliers for reporting, procurement, risk-management or contractual purposes.

Similarly, the EU Forced Labour Regulation prohibits products made with forced labour from being placed on or exported from the EU market and applies from 14 December 2027.[8] An Indian supplier’s precise legal position depends on the supply arrangement, but EU customers may strengthen traceability and due-diligence requests before that date.

When a customer request arrives, first confirm the entity, site, period, definition and evidence expected. SVEGA’s guide to answering a buyer ESG questionnaire explains how to control that response. If the deadline is immediate and evidence is spread across teams, the Supplier Evidence Sprint provides a focused route for organising the response without pretending that missing controls already exist.

Supplier due diligence should become a purchasing system, not a periodic compliance project.

A supplier code, questionnaire or audit cannot manage risk by itself. The operating system sits in the decisions around those documents: which suppliers receive deeper scrutiny, what evidence is tested, how workers can raise concerns, who owns corrective action, when management intervenes and how the company learns from repeat findings.

The strongest starting point is not to audit the entire supplier base. It is to create a transparent method, apply it to the relationships where harm may be most severe and use the results to improve purchasing and supplier-management decisions.

Build a risk-based supplier due-diligence system.
SVEGA helps Indian manufacturers map supplier exposure, establish defensible risk tiers, choose proportionate assessment routes and build corrective-action, evidence and management-review controls. Explore Supplier Compliance and Export Readiness or discuss the specific buyer, supplier or export requirement driving the review.

Frequently asked questions about supplier due diligence for Indian manufacturers

The following references support the factual claims in this article.

[1] Organisation for Economic Co-operation and Development. OECD Due Diligence Guidance for Responsible Business Conduct. 2018. https://www.oecd.org/en/publications/oecd-due-diligence-guidance-for-responsible-business-conduct_15f5f4b3-en.html. Accessed 20 October 2026.

[2] Office of the United Nations High Commissioner for Human Rights. Guiding Principles on Business and Human Rights. 2011. https://www.ohchr.org/sites/default/files/documents/publications/guidingprinciplesbusinesshr_en.pdf. Accessed 20 October 2026.

[3] Organisation for Economic Co-operation and Development. Due Diligence Policy Mapping. https://www.oecd.org/en/data/tools/due-diligence-policy-mapping.html. Accessed 20 October 2026.

[4] International Labour Organization. Advancing Responsible Business Conduct in India: Key Insights from the Capacity-Building Workshop. 2026. https://www.ilo.org/resource/news/advancing-responsible-business-conduct-india-key-insights-capacity-building. Accessed 20 October 2026.

[5] International Labour Organization. Combating Forced Labour: A Handbook for Employers and Business. 2025. https://www.ilo.org/publications/combating-forced-labour-handbook-employers-and-business-1. Accessed 20 October 2026.

[6] Securities and Exchange Board of India. Measures to Facilitate Ease of Doing Business With Respect to Framework for Assurance or Assessment, ESG Disclosures for Value Chain, and Introduction of Voluntary Disclosure on Green Credits. Circular No. SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42. 28 March 2025. https://www.sebi.gov.in/legal/circulars/mar-2025/measures-to-facilitate-ease-of-doing-business-with-respect-to-framework-for-assurance-or-assessment-esg-disclosures-for-value-chain-and-introduction-of-voluntary-disclosure-on-green-credits_93102.html. Accessed 20 October 2026.

[7] Securities and Exchange Board of India. FAQs for LODR Regulations. 23 April 2025. https://www.sebi.gov.in/sebi_data/faqfiles/apr-2025/1745399101865.pdf. Accessed 20 October 2026.

[8] European Parliament and Council of the European Union. Regulation (EU) 2024/3015 of 27 November 2024 on Prohibiting Products Made With Forced Labour on the Union Market. https://eur-lex.europa.eu/eli/reg/2024/3015/oj/eng. Accessed 20 October 2026.