Supplier sustainability assessment: what to ask, review and follow up

What is a supplier sustainability assessment?

The phrase is used loosely. In practice four different things get called by it, and mixing them up is how teams end up with a spreadsheet of answers and no decisions.

None of these is wrong to use. They answer different questions, and a questionnaire response does not become an audit or a rating because it has been collected carefully.

A practical workflow

1. Segment suppliers. Decide which suppliers and which risks matter first, by category, spend, geography and contractual importance.
2. Request a proportionate baseline. Ask each segment for information it can realistically produce, in one consistent format.
3. Review the response. Check completeness, freshness, consistency, method, reporting period and the evidence offered.
4. Ask targeted follow-up questions. Follow up on specific gaps and inconsistencies rather than re-sending the whole questionnaire.
5. Document gaps and decisions. Record what is missing, what you asked, what you accepted and why.
6. Refresh periodically. Re-request or re-confirm the data on a cycle that matches the supplier's importance, so the record does not go stale.

The sections below take the steps in turn.

Which suppliers should you assess first?

Not all of them at once, and not all to the same depth. Reasonable starting points are the supplier's size, sector, the countries it operates in, how much you spend with it, how hard it would be to replace, and any environmental or social risk attached to what it supplies. Whether it has already reported ESG information is relevant too: a supplier that already holds a report can often hand it over, and one that has never measured anything needs a gentler first request.

The segmentation is your judgement. EcoDiligence does not rank suppliers by risk or decide which ones to prioritise.

What should you ask suppliers for?

For a small supplier, start with the same short baseline each time: company details and reporting period, electricity and fuel use, any Scope 1 and 2 emissions already calculated, waste, workforce basics, one health and safety indicator, whether the main policies exist, the certifications actually held, and any targets with what backs them. The minimum ESG data set to request from an SME supplier sets out the twelve fields and what to leave for a later round.

Be careful about asking for more by default. Full Scope 3 by category, EU Taxonomy mapping, third-party assurance, a library of policy documents, product-level footprints and detailed CSRD-style disclosures are legitimate asks where your use case requires them. Asked of every small supplier in round one, they tend to produce guesses and silence. If you need a question set to start from, see the sustainable procurement supplier questionnaire or the vendor risk questionnaire template.

How to review a supplier response

This is the step most programmes skip. A few minutes of structured review per response is where an assessment actually happens.

These are checks you make, or build into your own process. An oddity found this way is a reason to ask, not proof of anything: supplier-reported data that looks reasonable has still not been verified.

When should you follow up?

• Information material to this supplier's risk is missing.
• Figures cover different periods and cannot be read together.
• A claim has no supporting detail — a target without a baseline, a policy without a date.
• The data is old enough that it may no longer describe the supplier.
• An emissions figure arrives with no method or boundary.
• A stated policy sits uneasily with other things the supplier has told you.
• A certification the supplier lists appears to have lapsed or does not cover the sites in question.

Keep follow-ups narrow: one specific question per gap, with the reason you are asking. Whether a gap is acceptable, or amounts to a legal or contractual problem, is a decision for your own team and advisers. This guide does not make that call.

Do you need a supplier sustainability score?

Sometimes. A score can help a mature programme triage a large supplier base, provided the method is documented, the inputs are comparable and the people using it know what it cannot see. The risk with scoring a first-round questionnaire is that the number looks more precise than the data behind it, and it rewards suppliers that are good at filling in forms.

A useful middle path is to record, for each supplier, what was provided, what is missing, how recent it is and what you intend to do next. EcoDiligence does not score or rate suppliers. If your organisation scores suppliers, that remains your method and your judgement.

How often should supplier data be refreshed?

There is no universal interval. Annual confirmation is one option for suppliers that matter, with a lighter cycle for the rest. Whatever you choose, the thing to avoid is not knowing: a figure from eighteen months ago looks the same in a spreadsheet as one from last week. Record the reporting period and the date each response was last confirmed, and review the oldest first.

Spreadsheet assessment vs a reusable supplier record

The spreadsheet route runs like this: the buyer sends a form, the supplier answers, the buyer files a snapshot, the data ages, and the next request starts from a blank form. Every buyer a supplier has repeats the exercise, and every cycle you rebuild comparability by hand.

The alternative is a structured record the supplier maintains. You ask for it, they share it, and a later cycle becomes a confirmation or an update rather than starting from a blank form. It does not remove the need to assess, but it reduces repeated collection and manual chasing.

How EcoDiligence fits

EcoDiligence provides the structured data layer used within an assessment process. Suppliers answer a guided questionnaire once and keep it up to date, in a format structured for VSME with IFRS S2 climate inputs. With the Supplier Network plan you can:

• invite suppliers one at a time or by CSV;
• send automatic reminder emails to suppliers who have not responded;
• track who has started and who has completed;
• see when a supplier's data was last confirmed, where it has been;
• export your supplier list and their data as CSV.

Everything a supplier provides is self-reported and not independently audited. EcoDiligence does not rate, score, audit, certify or approve suppliers, does not provide assurance, and does not replace your own judgement or legal due diligence. What counts as adequate, what needs follow-up and whether a supplier presents acceptable risk stay with you. See how supplier data collection works.

Are you the supplier who has received a request like this? See how to answer a supplier ESG questionnaire.

Frequently asked questions

General orientation for procurement teams, not legal advice. It does not discharge any statutory due-diligence duty. Data prepared with EcoDiligence is self-reported and is not a third-party rating or assurance.