Guide · Governance
Supplier code of conduct: what a small business actually needs
Someone asked whether you have one — or sent you theirs to sign. Before you buy a template, it is worth knowing which of three different documents is being discussed, and that the disclosure behind the question is usually a yes/no gate rather than a request for twenty pages.
Practical orientation for SMEs, not legal advice. Take proper advice before agreeing to contractual commitments.
- Three different documents share this name. Work out which one you are being asked about before doing anything else.
- In a questionnaire it is almost always a yes/no existence question, not a request to submit the document.
- Two to four pages is a complete code for an SME. Length is not the quality signal — enforcement is.
- If a customer sent you theirs, the work is reading it, not writing yours. Six things to check below.
- Asking for a proportionate version is normal and usually granted.
First: which document is this?
The phrase points in two directions at once, and a third document with a similar name gets pulled in alongside it. Almost all of the confusion on this topic — and a fair amount of unnecessary spending — comes from not separating them.
Your customer's code, sent to you
A buyer's supplier code of conduct arrives with a request to sign, acknowledge, or confirm compliance. It binds you to the buyer's standards, and it is usually the version that arrives with a deadline.
You are the signatory
Your own code, for your suppliers
The same document pointed the other way: the standards you require of the businesses you buy from. This is what a questionnaire means when it asks whether you cascade requirements down your chain.
You are the issuer
Your internal code of ethics
How your own people are expected to behave — anti-bribery, harassment, conflicts of interest. A different document with a similar name, and the one most disclosure frameworks are actually asking about.
It governs your staff
What the questionnaire question is actually asking
When a buyer form asks “do you have a supplier code of conduct?”, the field next to it is a checkbox. The disclosure is about whether standards are in force — not about the document's length, formatting, or authorship. The same is true of the policy disclosures in SME-scale frameworks: the VSME policy fields ask whether a code of ethics, an anti-corruption policy, and an anti-harassment policy exist. Existence, in force, yes or no.
This matters commercially. The topic is often sold as though the deliverable is a substantial legal document, and for a large manufacturer with a complex supply base it may be. For a fifteen-person business answering a buyer questionnaire, a genuine two-page code that staff and suppliers have actually seen answers the question completely — and answers it better than a long document produced for the form and never applied. Buyers who read these can tell, and the section they check is enforcement.
What belongs in a short one
If you do want your own — because you have suppliers of your own, or because a buyer asked whether you cascade requirements — six sections cover it.
Legal compliance
A statement that suppliers comply with applicable law in the jurisdictions where they operate. One paragraph; it is the backstop the rest hangs from.
Labour and human rights
No forced labour, no child labour, freedom of association, non-discrimination, and wages meeting the applicable statutory minimum. These are the clauses buyers reliably look for.
Health and safety
A safe working environment, appropriate training and equipment, and reporting of work-related incidents.
Business conduct
No bribery, kickbacks, or facilitation payments; conflicts of interest declared; competition law respected; confidential information protected.
Environment
Compliance with environmental law, sensible handling of waste and hazardous materials, and — where relevant — willingness to provide energy or emissions data on request.
How it is applied
How a supplier raises a concern, what happens when the code is breached, and whether suppliers must pass the requirements to their own suppliers. Short, but the part that turns a statement into a policy.
The last one is the section people skip and buyers look for. A list of principles is a statement; a statement plus how a concern is raised and what happens on breach is a policy. That difference is most of what separates a code that survives scrutiny from one that does not.
If your customer sent you theirs
Then you do not need to write anything — the task is to read what arrived, which is the half of this topic nobody writes about. Signing is usually the right outcome; going in with your eyes open is what makes it the right outcome.
Does it flow down to your own suppliers?
Many codes require you to impose equivalent terms on your subcontractors and suppliers. That is a real operational commitment, not a formality — check whether you can actually deliver it before you agree to it.
What audit or inspection rights does it grant?
Look for rights of access to your premises, records, or staff, whether they extend to third-party auditors, how much notice is required, and who pays. On-site social audits are a meaningful cost.
Is it incorporated into the contract?
A code referenced in a purchase order can carry contractual force, which changes what a breach means. Whether it is a standalone acknowledgement or an incorporated term is worth establishing early.
Can it change unilaterally?
Some codes reserve the right to update the standards at any time, with continued supply treated as acceptance. Worth knowing you have agreed to a moving target.
Are the obligations proportionate to your size?
Requirements written for a 5,000-person manufacturer sometimes arrive unedited at a 15-person consultancy. Asking for a proportionate version is normal and is usually granted — buyers would rather have an honest signature than a nominal one.
Does it demand data you do not hold?
Codes increasingly bundle in reporting commitments. If a clause commits you to producing something you have no way to produce, raise it now rather than defaulting into non-compliance later.
To be clear about the limits of that list: it tells you what to look for, not how any particular clause will operate for your business. Where a code is incorporated into a contract, grants audit rights, or creates indemnities, that is a legal and commercial question — take proper advice rather than a checklist.
Cascading it to your own suppliers
If you issue a code downward, keep the same proportionality you would want applied to you. Requiring a sole trader to accept audit rights and quarterly reporting produces a signature and nothing else. In practice the useful version is a short code, sent once, acknowledged in your onboarding, with a genuine escalation route — which is exactly what a buyer asking about your supply chain wants to hear you describe. The vendor questionnaire guide covers how to ask about this without producing theatre, and the VSME value-chain cap sets the ceiling on what an EU buyer can require of an SME in the first place.
Where this shows up, and where we fit
Plainly: EcoDiligence does not draft, host, or review codes of conduct. There is no template behind this page and nothing to buy. What a Passport does is hold the answers the disclosure asks for, consistently, in one place — so that the next questionnaire is a copy exercise rather than a hunt through the shared drive.
The policy gates
Whether a code of ethics, an anti-corruption policy and an anti-harassment policy are in force — the VSME-aligned governance fields.
Your own supply chain
Whether you request ESG information from your suppliers, and roughly how many you have — the cascade question, answered.
Answered once
A shareable link and PDF, so the same answers go to every buyer without being retyped or drifting between forms.
If the code arrived as part of a wider request, the named-request triage guide covers where the rest of it goes, and the questionnaire template shows the governance section this question normally sits in.
Frequently asked questions
This page is practical orientation for SMEs and is not legal advice. It does not assess any particular code of conduct, and nothing here should be relied on when agreeing contractual commitments — obtain professional advice for that. EcoDiligence does not draft, host or review codes of conduct. Data prepared with EcoDiligence is self-reported and is not a third-party rating or assurance.
Answer the governance questions once
Policies in force, supply-chain practice, and your emissions figure — in one profile you send to every buyer who asks.