Guide · For buyers and suppliers
Vendor risk assessment questionnaire template
The 29 questions worth asking a supplier about ESG, workforce, governance and supply chain — each with the reason a buyer asks it and what a proportionate answer looks like from a small vendor. Written to be read from both sides of the request.
I'm sending the questionnaire
Take the question bank below, then collect the answers in one place instead of by email.
Supplier data collectionI received the questionnaire
Prepare these answers once, then reuse them for every customer who asks.
Build a free ESG PassportA practical starting template, not legal advice or a compliance instrument. Adapt it to your sector, jurisdiction, and risk profile.
- A usable vendor questionnaire is roughly 29 questions, all answerable from records the vendor already keeps.
- Ask for method alongside every number — an emissions figure without its emission factor cannot be compared between vendors.
- Governance gates are yes/no. They are the most decision-relevant answers on the form and the cheapest to give.
- Capture data quality explicitly. Self-reported is fine; unlabelled is not.
- What you leave out matters as much as what you ask. See what not to ask.
Why most vendor questionnaires come back useless
Not because suppliers are evasive. Because the form asked for things the supplier has no way to produce, and the supplier — wanting to keep the account — produced them anyway. A 15-person vendor asked for a full Scope 3 inventory will send you a number. It will be a guess, it will land in your aggregate, and nobody will be able to tell which part of your supplier dataset is real.
The fix is not a longer form. It is a form scoped to what the vendor already records — energy bills, payroll, the accident book, the policies in the staff handbook — plus an explicit statement of how good each figure is. That is the template below.
The question bank
Six sections, 29 questions. Copy what fits your risk profile and drop the rest; the point of the “why” note on each question is to make dropping it an informed decision rather than an oversight.
1. Company, scope & reporting period
Boring but load-bearing. Most unusable questionnaire responses are unusable because nobody agreed which legal entity, which sites, and which twelve months are being described.
Legal entity name, registration number, and country of registration.
Why: You need to match the response to the entity on the contract, not to a trading name or a group parent.
Proportionate answer: Straight from the company register. One line.
Which sites or operations does this response cover?
Why: A vendor with one office and a leased warehouse should say so; otherwise you cannot tell whether an emissions figure is partial.
Proportionate answer: A list of locations, or "all operations" for a single-site business.
What twelve-month period does the data cover?
Why: Without a stated period, no figure is comparable — across vendors or across years.
Proportionate answer: A financial year or calendar year. It does not need to match yours.
Total number of employees at period end (headcount or FTE — state which).
Why: Drives proportionality: it tells you what you can fairly expect from this vendor, and it is the denominator for any intensity metric.
Proportionate answer: A number from payroll. Bands are acceptable for very small vendors.
Primary sector or activity (NACE / ISIC / SIC code if you have one).
Why: Sector is the strongest single predictor of where a vendor's material risks actually sit.
Proportionate answer: A code if they know it, a plain description if they do not.
2. Energy & emissions
The section buyers most often get wrong — usually by asking for a number the vendor has no way to produce, and then accepting a guess.
Total electricity consumed in the period (kWh).
Why: It is the input to Scope 2, it is verifiable against bills, and unlike an emissions figure the vendor cannot get it structurally wrong.
Proportionate answer: Add up twelve months of electricity bills. Genuinely achievable for any vendor.
Fuel consumed directly — natural gas, diesel, petrol, LPG (state units).
Why: The input to Scope 1. Company vehicles and on-site heating are usually the whole story for a small vendor.
Proportionate answer: Fuel-card statements and gas bills. If they burn nothing on site, the answer is zero and that is a complete answer.
Scope 1 and Scope 2 emissions (tCO₂e), with the emission factor and source used.
Why: The factor and its source matter as much as the number. A Scope 2 figure without a stated grid factor cannot be compared to another vendor's.
Proportionate answer: Calculated from the two answers above using a published national grid factor. Ask for the source; do not ask for third-party assurance from a small vendor unless you are paying for it.
Which Scope 2 method — location-based, market-based, or both?
Why: The two methods can differ by a wide margin for the same vendor. Mixing them across a supplier base makes the aggregate meaningless.
Proportionate answer: Location-based is the sensible default for a small supplier. Market-based only if they hold contractual instruments.
Do you calculate any Scope 3 categories? If so, which, and by what method?
Why: Phrased as an open question this is answerable. Phrased as "provide your Scope 3" it is not, and you will get a fabricated number.
Proportionate answer: "No" is a legitimate answer from a small vendor. See the Scope 3 guide linked below before you make this mandatory.
Do you have a documented emissions reduction target? Baseline year, target year, and percentage.
Why: Distinguishes a vendor with a plan from one with an aspiration, without requiring either.
Proportionate answer: Yes/no plus three numbers. No target is a valid answer and should not be scored as a failure.
3. Workforce, health & safety
Keep this to facts a vendor already records for payroll and insurance. Anything beyond that turns into an estimate, and an estimated social metric is worse than none.
Employees by gender at period end.
Why: The standard diversity disclosure in most SME frameworks, and it comes straight out of an HR system.
Proportionate answer: Three numbers. Should take minutes.
Number of work-related accidents in the period; days lost; any fatalities.
Why: The single most decision-relevant social metric for a physical-operations vendor, and it is already recorded for insurance.
Proportionate answer: From the accident book. Zero is a common and complete answer.
Percentage of employees covered by a collective bargaining agreement.
Why: A recognised labour-standards indicator — where collective bargaining exists at all.
Proportionate answer: "Not applicable" is correct in many countries and sectors. Accept it without penalty rather than forcing a zero.
Do you pay all employees at or above the applicable statutory minimum wage?
Why: A yes/no gate that catches a genuine risk without demanding a pay-gap analysis from a 12-person company.
Proportionate answer: Yes/no. If the answer is no, that is the finding you were looking for.
Average training hours per employee, if tracked.
Why: Useful signal, low value as a hard requirement.
Proportionate answer: Mark this optional. Most small vendors do not track it, and inventing it teaches them to invent other things.
4. Governance & business conduct
This is where the questionnaire earns its keep. These are yes/no gates, not essays — and a "no" here is far more actionable than a missing emissions decimal.
Do you have a code of ethics or code of conduct in force?
Why: The base governance gate. Existence is the question; a 20-page document is not required.
Proportionate answer: Yes/no, plus the document if you actually intend to read it.
Do you have an anti-corruption / anti-bribery policy?
Why: Directly relevant to your own exposure, and increasingly a contractual requirement passed down the chain.
Proportionate answer: Yes/no. A two-page policy satisfies this for a small vendor.
Do you have an anti-harassment and non-discrimination policy?
Why: Standard workforce-governance gate; also the one most likely to be missing at small vendors.
Proportionate answer: Yes/no.
Have there been convictions or fines for corruption or bribery in the period?
Why: The disclosure that actually changes an onboarding decision.
Proportionate answer: Yes/no with a short note if yes.
Who is accountable for sustainability matters — a named role, not a name?
Why: Tells you whether anyone owns this, and gives you someone to contact next year.
Proportionate answer: "The managing director" is a perfectly good answer at a small vendor and better than a vacant sustainability-manager title.
5. Your vendor's own supply chain
One layer down. Ask whether the vendor passes requirements on — not for a full tier-2 dataset, which no small supplier can give you honestly.
Roughly how many suppliers do you have (band is fine)?
Why: Establishes whether the vendor's own chain is a meaningful risk surface or a handful of local accounts.
Proportionate answer: A band: 1–5, 6–20, 21+.
Do you request ESG or sustainability information from your own suppliers?
Why: Tells you whether requirements actually cascade, which is the mechanism the whole exercise depends on.
Proportionate answer: Yes/no.
Do you require your suppliers to accept a code of conduct?
Why: Distinguishes a policy that exists from one that is contractually live.
Proportionate answer: Yes/no. "No" is common and honest.
Are you aware of any operations in a sector or region with elevated forced-labour risk?
Why: Puts a genuine risk on the record without demanding a due-diligence report a small vendor cannot produce.
Proportionate answer: Yes/no with a short note. If you need more than this, that is an audit engagement, not a questionnaire.
6. Evidence & data quality
The section almost everyone omits, and the one that determines whether you can defend the dataset later.
Is the data in this response self-reported, internally reviewed, or externally assured?
Why: You will eventually be asked how good your supplier data is. This is the answer.
Proportionate answer: Self-reported is the honest answer for most SMEs, and is fine as long as it is labelled.
Which certifications do you hold (ISO 14001, ISO 45001, ISO 9001, sector schemes)?
Why: Where they exist, certifications let you reduce follow-up questions rather than add them.
Proportionate answer: A list plus certificate numbers, or "none".
Which figures are measured and which are estimated?
Why: An estimated figure flagged as estimated is usable. An estimated figure presented as measured is a liability.
Proportionate answer: A short note per section.
When was this information last updated, and who can we contact about it?
Why: Makes next year's refresh a follow-up instead of a fresh start.
Proportionate answer: A date and an email address.
What not to ask
Restraint is the part of questionnaire design that actually improves your data. Each of these produces either a refusal or a fabrication — and a fabrication is the worse outcome, because it looks like data.
A full Scope 3 inventory across all fifteen categories.
Ask which categories, if any, they calculate. A small vendor producing a full Scope 3 inventory on request is producing a guess.
Third-party assurance on the numbers.
Ask them to state the assurance level. If you genuinely need assured figures from a small vendor, expect to fund the assurance.
A bespoke questionnaire in your own format, annually, per buyer.
Accept a standard, reusable profile. Every buyer inventing a format is the single largest source of supplier questionnaire fatigue — and of low-quality answers.
Data outside the standard the vendor's regime actually sets.
For EU value chains, the VSME value-chain cap defines the ceiling on what a CSRD-reporting buyer may require from an SME supplier. Asking past it usually produces refusal or fabrication.
Employee-level or personally identifiable data.
Aggregate counts answer every legitimate question here, and keep both sides out of a data-protection problem.
The fourth one has a formal basis in the EU: the VSME value-chain cap sets a ceiling on what a CSRD-reporting buyer may require from an SME supplier. If you are on either side of that request, the value-chain cap guide sets out what the limit actually is, with ready-to-send replies.
If you are the supplier reading this
You now know what the form is for, which is most of the battle. Two practical points. First, a clear “we do not currently track this” is a better answer than an estimate — buyers can work with a gap, and a wrong number follows you into next year's comparison. Second, answer once. The facts behind every questionnaire you will receive are the same facts; only the form changes. Prepare them in a standards-based profile and the next request becomes a link rather than a project.
Before you start, it is worth knowing which of those two answers each question needs. Paste the form into Coverage Check and it will estimate how much of it a Passport already covers, and flag the questions where “we do not currently track this” is the honest reply. For the step-by-step version from the receiving end, see how to answer a supplier ESG questionnaire.
If your customer named a specific scheme rather than sending their own form, start with the named-request triage guide instead — an EcoVadis assessment and a CDP supply-chain request each go to a different destination. And if section 4 or 5 above is where you got stuck, the supplier code of conduct guide explains what those questions are really asking for — usually far less than people assume.
If you are the buyer reading this
The questionnaire is the easy half. The half that consumes the quarter is chasing responses, normalising twelve spreadsheet formats, and discovering in month three that half your vendors reported different periods. Collecting the answers into one structured, comparable dataset — with the period, the method, and the data-quality label attached to every figure — is what makes the exercise worth running at all. See how supplier data collection works, or how Enterprise Supplier Mode handles a full vendor network.
If your questionnaire is part of implementing the UN Global Compact's sustainable procurement framework, use the sustainable procurement supplier questionnaire instead: it is shorter, and most of its questions name the framework action they serve.
Frequently asked questions
This template is practical orientation for procurement and supplier teams and is not legal advice. It does not discharge any statutory due-diligence obligation and should be adapted to your sector, jurisdiction and risk profile. Data prepared with EcoDiligence is self-reported and is not a third-party rating or assurance.
Stop sending the questionnaire. Start collecting the answers.
Suppliers fill a guided profile once; you get one comparable dataset with the method and data quality attached to every figure.