Supplier code of conduct: what to include and how it is enforced

What a supplier code of conduct is

A supplier code of conduct is a written statement of the minimum standards a customer expects its suppliers to meet on labour, safety, environment, ethics and related issues. It is usually short, written in plain language and applies to every supplier, with more detailed requirements for higher-risk categories handled through contracts, questionnaires and audits.

The code does two jobs. For the buyer, it is the reference point for supplier due diligence: the standard against which suppliers are assessed and, if necessary, challenged. For the supplier, it is a clear statement of what the customer cares about, which makes it easier to prioritise.

A code also supports the buyer's own legal obligations. A business in scope of the Modern Slavery Act 2015 must publish an annual statement on the steps it has taken to ensure slavery and human trafficking are not taking place in its supply chains, and the statement may describe its policies and due diligence^[1]. A supplier code is often the first of those policies.

What to include

Most codes cover the same core areas. The wording should be specific enough to check and short enough that suppliers actually read it.

Labour and human rights. No forced, bonded or trafficked labour; no child labour; freedom for workers to leave employment; no recruitment fees charged to workers; no retention of identity documents; wages that meet at least the legal minimum; working hours within legal limits; freedom of association; and no discrimination or harassment.

Health and safety. A safe working environment that meets local law, with risk assessment, suitable protective equipment, fire safety, emergency procedures and, where workers are housed, safe and clean accommodation.

Environment. Compliance with environmental permits and law; management of waste, emissions and hazardous substances; and, increasingly, a willingness to share energy and emissions data so the customer can report its own supply chain footprint.

Anti-bribery and business ethics. No bribes, facilitation payments or improper gifts; accurate records; declared conflicts of interest; and fair competition. This matters to UK buyers because a commercial organisation can commit an offence if a person associated with it bribes another person to obtain or retain business for it^[2]. An associated person is someone who performs services for or on behalf of the organisation, which can include suppliers acting for it^[3]. It is a defence for the organisation to show it had adequate procedures designed to prevent such conduct^[2], and a supplier code with checks behind it forms part of those procedures.

Data protection and information security. Protection of customer data and confidential information, secure systems, prompt notification of breaches, and use of data only for the agreed purpose. Where a supplier processes personal data for the buyer, UK GDPR requires the buyer to use only processors that provide sufficient guarantees of appropriate technical and organisational measures, and to have a contract in place covering the processing^[4].

Subcontracting. No subcontracting of the customer's work without approval; the same standards passed down to subcontractors; and transparency about the sites and agencies used. Many problems in supply chains arise below the first tier, so this clause matters more than its length suggests.

Reporting and remedy. A way for workers and others to raise concerns without retaliation, a duty to tell the customer about serious breaches, and a commitment to put right problems that are found.

How buyers enforce a supplier code of conduct

A code that nobody checks is a statement of hope. Buyers that take it seriously usually combine several measures:

• Contract terms that make compliance an obligation, with rights to audit, request information and terminate for serious breaches.
• Risk-based questionnaires sent to suppliers in higher-risk categories and countries.
• Audits and site visits, announced or unannounced, carried out by the buyer or an independent auditor.
• Third-party ratings, such as an EcoVadis assessment, to compare suppliers on a common basis.
• Corrective action plans with dates and follow-up when problems are found.

The aim is usually improvement rather than exit. Ending a relationship at the first problem can leave workers worse off and removes the buyer's influence. Exit is kept for serious breaches or suppliers that refuse to fix problems.

For buyers, checks need to be proportionate. A low-risk office supplier does not need the same scrutiny as a garment or electronics factory. Map suppliers by category and country first, then focus questionnaires and audits where the risk is highest.

How suppliers should respond

When a customer sends you their supplier code of conduct to sign, treat it as a contract document, not a formality.

• Read it against what you actually do. Note any requirement you do not currently meet.
• Check what you are passing down. Many codes require you to apply the same standards to your own suppliers. Make sure you can.
• Raise exceptions before signing. Explain the gap and what you plan to do. Most buyers accept a clear, honest exception.
• Keep evidence ready. Policies, training records, permits and audit reports make questionnaires and audits quicker.
• Consider your own code. If several customers send similar codes, a code of your own, aligned with theirs, gives you one consistent position and a basis for checking your suppliers.

Signing a code you cannot meet is a commercial risk. If a later audit finds a gap you did not disclose, the conversation is about trust, not just the gap.

Writing your own supplier code of conduct

A practical code for a small or medium-sized business can fit on two or three pages. Start with the areas above, keep each requirement to one or two sentences, and set out how suppliers should raise concerns and what happens if the code is breached. Align the wording with what your largest customers ask of you, so the standards you pass down are consistent with those you are held to. Then decide how you will check it, because a code is only as good as the work behind it.

A simple structure for a supplier code

• Purpose and scope: who the code applies to, including subcontractors and agencies
• Legal compliance: a commitment to follow the law in every country of operation
• Labour and human rights
• Health and safety
• Environment
• Anti-bribery and business ethics
• Data protection and information security
• Subcontracting and supply chain transparency
• Raising concerns and protection from retaliation
• Monitoring, audits and corrective action
• Consequences of breach
• Acknowledgement and signature

Keep the code separate from detailed technical requirements, which can sit in product specifications or category-specific annexes. That keeps the code short enough to apply to every supplier, while still allowing stricter rules where they are needed.

Frequently asked questions

For help writing or responding to a code, see our carbon reduction plans and Modern Slavery statements service, which also covers supplier codes. To check that suppliers meet the standards they sign up to, see our supplier audit service.