Quick Read
SPK CSMS1000:2026 requires organisations to move beyond supplier codes of conduct to implement systematic supply chain due diligence—identifying, assessing, and mitigating human rights and environmental risks across multiple supply chain tiers through three integrated clauses covering control frameworks, human rights content aligned with UNGPs and OECD Guidelines, and operational management of supplier relationships. The foundation is a supply chain risk assessment that maps the supply base by commodity category, geography, and tier to prioritise due diligence resources toward high-risk suppliers and sub-suppliers, rather than applying uniform scrutiny across the entire supply base.
Executive Summary
Supply chain sustainability is the area where the gap between stated commitment and actual management is widest for most organisations. Supplier codes of conduct are nearly universal. Genuine supply chain due diligence programmes — systematic identification, assessment, and mitigation of human rights and environmental risks across multiple supply chain tiers — are far less common. SPK CSMS1000:2026 requires the latter.
This paper covers the three clauses most relevant to supply chain sustainability management — the supply chain controls requirement (10.4), the social responsibility and human rights due diligence requirement (10.10), and the control of externally provided processes requirement (10.14) — and explains how they work together as an integrated supply chain sustainability management framework.
A supplier code of conduct is the starting point, not the destination. It describes what the organisation expects. Due diligence is the process of understanding what is actually happening in the supply chain, engaging suppliers to improve, and taking action when the gap between expectation and reality is material.
1. The Three-Clause Framework
Supply chain sustainability in SPK CSMS1000:2026 is addressed through three clauses that operate in concert.
Clause 10.4 (Supply chain controls element) establishes the control framework requirements: supply chain risk assessment, due diligence programme, supplier audit programme, and remediation process. These are the structural controls.
Clause 10.10 (Social responsibility) establishes the content requirements: human rights due diligence aligned with the UNGPs and OECD Guidelines, extended to the value chain. This determines what the due diligence programme must look for.
Clause 10.14 (Control of externally provided processes) addresses the operational dimension: ensuring that sustainability requirements are built into the management of supplier relationships, not just the qualification of new suppliers.
2. The Supply Chain Risk Assessment
The foundation of the entire supply chain sustainability framework is the supply chain risk assessment — the systematic identification of which parts of the supply chain carry the highest human rights and environmental sustainability risk. Without it, due diligence cannot be prioritised, and resources will be applied to low-risk suppliers while high-risk ones remain unassessed.
The risk assessment should map the supply base across three dimensions: category (what is being bought — commodity categories with known human rights or environmental risk profiles); geography (where suppliers and their supply chains operate — country and regional risk data for labour standards, environmental regulation, and conflict); and tier (direct suppliers vs. sub-suppliers — the deepest risk often sits in lower supply chain tiers not visible to direct procurement relationships).
Risk assessment outputs should categorise suppliers or supply categories as high, medium, or low risk. High-risk categories receive intensive due diligence. Medium-risk categories receive proportionate attention. Low-risk categories may be addressed through questionnaire and code of conduct alone. This proportionality is both a practical necessity and a standard requirement — due diligence must be proportionate to identified risk.
3. Building the Due Diligence Programme
The due diligence programme is the practical implementation of the risk assessment. For each risk tier, the programme defines what due diligence is conducted, at what frequency, by whom, and with what follow-up process.
Risk tier | Typical due diligence approach |
|---|---|
High risk | Pre-qualification: full sustainability questionnaire and documentary evidence review. Annual: on-site social audit by qualified third-party auditor. Ongoing: incident monitoring, grievance mechanism access for workers. Escalation: defined process for critical findings including remediation timeline and exit trigger. |
Medium risk | Pre-qualification: sustainability questionnaire. Bi-annual: desk-based documentary review or third-party audit on rotation. Ongoing: annual self-assessment questionnaire. |
Low risk | Pre-qualification: code of conduct sign-off. Periodic: self-assessment questionnaire on a three-year cycle. |
4. Supplier Audit Quality
Social audits are only as good as the auditors conducting them and the methodology applied. Audits that are announced in advance, conducted by auditors without local language capability, and that rely primarily on management interviews are known to underdetect non-compliance. The audit industry has documented weaknesses — including collusion, document falsification, and coaching of workers before audits — that make low-quality audit programmes a false assurance mechanism rather than a genuine control.
For the highest-risk suppliers, the organisation should consider: unannounced or semi-announced audits; worker interviews conducted privately and in the workers' local language; use of credible third-party audit schemes with independent oversight (such as those operated by sector initiatives); and triangulation of audit findings with data from worker surveys, NGO reporting, and media monitoring.
5. Remediation and the Escalation Process
The remediation process is the element most often missing from supply chain sustainability programmes. When an audit finds critical non-compliance — forced labour indicators, safety violations, wage theft — what happens next? The standard requires a documented escalation and remediation process with defined timelines and, where remediation is not achieved within those timelines, a defined exit process.
Remediation must be constructive where possible. Immediately exiting a supplier where critical non-compliance is found may deprive workers of income without improving conditions. Responsible exit — where warranted — considers the impact on workers and does not simply transfer the problem to another buyer. These are complex judgements that require engagement with the UNGPs and sector-specific remediation guidance.
The corrective action process (Clause 14.2) applies when remediation fails — the organisation must assess whether its own sourcing decisions or procurement practices contributed to the non-compliance, and adjust them accordingly.
6. Clause 10.14 — Ongoing Management of Supplier Relationships
Beyond the qualification and due diligence framework, Clause 10.14 requires that sustainability considerations are embedded in the ongoing management of supplier relationships. Sustainability criteria must appear in supplier performance reviews, not just in initial qualification. Material sustainability failures by suppliers must trigger the escalation process. And ESG requirements must be embedded in the commercial relationship — in contracts, not just codes.
Speeki Meridian™ — Auditor Expectations
Supply chain is one of the most extensively tested areas in a Speeki Meridian™ Stage 2. Assessors will request: the supply chain risk assessment with the methodology and data sources used; the due diligence programme documentation; a sample of supplier assessment records (at minimum five high-risk suppliers); audit reports for the most recent audit cycle; and evidence of the corrective action process for suppliers with identified non-compliance. Assessors will test depth: does the due diligence extend beyond first-tier suppliers for high-risk commodity categories? Do audits use worker interview methodology? Is there evidence of remediation follow-up where findings were identified? The most common major finding: supply chain due diligence exists at first-tier level but does not extend to sub-suppliers for high-risk commodities (agricultural products, garments, electronics). This is a structural gap that cannot be remediated through a corrective action — it requires a programme redesign.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.
For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.
speeki.com | © Speeki Pte Ltd 2026