Supplier Due Diligence That Stands Up to Audit

A supplier can be commercially convenient and still create a serious WHS, quality or environmental exposure. If their workers arrive on your site without suitable controls, their materials fail specification, or their practices disrupt your supply chain, the consequences sit with your business too. Effective supplier due diligence gives directors, operations managers and procurement teams a defensible basis for choosing, approving and monitoring suppliers.

For Australian businesses working towards ISO certification, competing for Tier 1 work or managing high-risk operations, this is not a procurement formality. It is evidence that your organisation understands the risks introduced by external providers and has controls that work beyond the desktop.

What supplier due diligence should achieve

Supplier due diligence is the process of assessing whether a supplier is capable, competent and suitable before they are engaged, then reviewing their performance over time. It should cover more than price, delivery dates and an ABN check. The depth of assessment should reflect the risk the supplier brings into your operation.

A stationery provider does not need the same level of scrutiny as a labour-hire company, critical component manufacturer, hazardous chemical supplier or contractor working at height. Applying the same questionnaire to every provider creates unnecessary administration at one end and dangerous gaps at the other.

A practical process helps you answer four commercial questions. Can this supplier meet our requirements? Can they perform the work or provide the product safely and lawfully? What happens to our operation if they fail? Can we demonstrate that our decision was reasonable if a client, regulator or auditor asks?

Those questions align closely with ISO 9001 requirements for control of externally provided processes, products and services. They also support ISO 45001 and ISO 14001, where organisations must control outsourced activities and consider the WHS and environmental impacts associated with suppliers and contractors.

Start with supplier risk, not paperwork

The strongest supplier approval systems are risk-based. Before requesting documents, classify the supplier according to the potential impact of their failure on safety, quality, environment, compliance, business continuity and client commitments.

For example, a subcontractor completing confined-space work, an importer supplying electrical equipment, and a waste contractor handling regulated material all require close assessment. Their work may expose your workers, customers and directors to legal and operational risk. In comparison, a low-value office consumables supplier can be approved through a simpler process.

Risk classification should consider the nature of the product or service, the work location, the use of subcontractors, the level of supervision you retain, and whether the supplier affects a critical customer requirement. It should also account for dependency. A supplier that is easily replaced presents a different continuity risk from one that is the sole source of a critical part.

This approach makes the process proportionate. It directs management time towards the suppliers most likely to cause material harm, while keeping procurement moving for low-risk purchases.

Assess evidence that matters in real operations

Documents are useful, but documents alone do not prove capability. A current certificate of currency, policy or ISO certificate can form part of the assessment, yet each item needs to be relevant to the work being purchased.

For higher-risk suppliers, the assessment will commonly examine insurance, licences and competencies; WHS procedures and risk assessments; incident history and corrective actions; environmental controls; quality controls, testing and traceability; workforce capability; and financial or supply continuity indicators. Where a supplier will work on site, the review should also cover induction requirements, supervision arrangements, plant and equipment controls, and emergency response expectations.

The key is to test whether the evidence matches the service. A generic safe work method statement does little to demonstrate competence for specialist lifting, electrical work or hazardous substances. Similarly, an insurance certificate may be current but carry exclusions that do not suit the contract scope.

Ask targeted questions. How does the supplier verify worker competency? What process do they use when a product is found non-conforming? How are subcontractors approved and supervised? What is their response time if a safety, quality or delivery issue threatens your operation? Their answers, and the quality of the supporting evidence, are often more revealing than a polished policy document.

For critical suppliers, site visits, reference checks, sample inspections or a trial engagement may be justified. These take more effort, but they can expose gaps that a desktop review will miss. The right level of verification depends on the consequence of getting the decision wrong.

Do not confuse approval with risk transfer

Engaging a competent supplier does not remove your duties. Under Australian WHS laws, more than one duty holder may have responsibilities in relation to the same matter. A principal contractor, host employer or business engaging a contractor must still consult, coordinate and cooperate where duties overlap.

Contracts can allocate responsibilities, but they cannot make a legal duty disappear. Your supplier management process should therefore connect to operational controls: contractor induction, permit systems, site rules, supervision, incident reporting, inspections and review meetings. This is where due diligence becomes a working control rather than a procurement record.

Build supplier requirements into the purchase process

Many supplier issues begin because expectations are never clearly communicated. A purchase order that only names a product, quantity and price leaves too much room for interpretation, particularly where safety, quality or environmental requirements are involved.

Supplier requirements should be defined before approval and carried into contracts, scopes of work, purchase orders or technical specifications. This may include required standards, product acceptance criteria, delivery conditions, notification of changes, reporting obligations, waste handling requirements, access rules, verification points and rights to audit.

Where you supply a Tier 1 client or operate under an ISO-certified management system, flow down the requirements that genuinely apply. Do not simply attach your entire management system to every order. Suppliers need clear, relevant obligations they can meet and you can verify.

It is also sensible to state the consequences of non-conformance. If a supplier provides an incorrect component, sends an untrained worker or fails to report an incident, your team should know who can stop work, quarantine goods, reject a delivery, escalate the issue and approve recommencement.

Monitor performance after onboarding

Approval is a point-in-time decision. Performance management determines whether that decision remains valid. Suppliers change staff, subcontract work, experience financial pressure and alter processes. Your organisation can also change its own requirements.

Monitor the indicators that matter to the service being provided. For a critical material supplier, this may include defect rates, batch traceability, lead times and corrective-action closure. For a contractor, it may include pre-start compliance, inspections, incidents, training records and adherence to site controls. For a waste provider, tracking disposal documentation and service reliability may be central.

A useful supplier scorecard is concise and tied to decisions. If performance falls below an agreed threshold, there should be an escalation path: corrective action request, increased oversight, conditional approval, suspension or removal from the approved supplier list. Without a consequence, scorecards become reporting for its own sake.

Review frequency should be risk-based. Critical suppliers may need formal quarterly or annual review, as well as review after any significant incident, major non-conformance, ownership change or scope change. Low-risk suppliers can generally be reviewed less often, provided their performance remains acceptable.

Keep records that can be retrieved under pressure

Auditors, clients and regulators are rarely impressed by a spreadsheet that lists suppliers as approved without explaining why. Keep a clear record of the risk classification, assessment outcome, supporting evidence, approval authority, conditions of approval and review date.

For suppliers with corrective actions, retain the issue, investigation, agreed action, due date and evidence of closure. This demonstrates that your business is not merely collecting documents but actively managing external-provider performance.

The record system does not need to be complicated. A controlled approved supplier register supported by digital folders, assessment forms and performance reviews may be enough for a small or medium-sized business. What matters is that the information is current, accessible and consistently used by the people who purchase, engage and supervise suppliers.

Common gaps that weaken supplier due diligence

Three failures appear repeatedly in audits and incident investigations. The first is applying the same approval process to every supplier, which either overwhelms the business or fails to address high-risk work. The second is accepting certificates without checking their relevance, currency or scope. The third is treating approval as permanent, even after poor performance or a material change.

Another frequent gap is disconnect between procurement and operations. Procurement may approve a contractor, while the site team has no visibility of their conditions, competencies or past issues. A practical system makes supplier status visible where decisions are made and ensures operational teams can raise concerns quickly.

The Safety Hand helps businesses translate ISO and WHS expectations into supplier management processes that suit the way they actually procure, receive goods and manage contractors. That may involve a supplier risk matrix, approval criteria, audit tools, performance measures and corrective-action workflows that are ready for use on site.

Supplier due diligence should make it easier to select dependable partners, identify problems early and show clients that your supply chain is being managed with intent. When the process is proportionate and embedded in daily operations, it protects more than compliance - it protects delivery, reputation and the ability to keep winning work.