Supplier selection based on ISO 20400
Domain 6 is supplier selection within Clause 9.4 and the award. The tested skill is due diligence: how much evidence, from whom, and what you do with a finding.
Proportionate due diligence
Not every supplier needs an audit. Tier the approach: self-declaration for low risk, desk review of certificates for medium risk, third-party audit or site visit for high risk. Evidence must be current, relevant to the specific site or product, and traceable to a credible source.
Sources of evidence
- Self-assessment questionnaires: cheap, weak, useful for screening and raising awareness.
- Third-party certification and labels: strong only if the scheme is independent, covers the issue you care about, and the certificate is valid and in scope.
- Audits and site visits: strong, costly, point-in-time.
- Public records, grievance data and NGO reporting: useful red flags.
- Sub-tier disclosure: essential in high-risk chains.
Handling findings
A nonconformity normally triggers a corrective action plan with a deadline and verification, not automatic exclusion. Exclusion is reserved for serious breaches or refusal to remediate.
Worked example
A retailer sources 200 000 cotton T-shirts. Screening flags two factories. Factory A holds a valid social audit certificate but cannot name its fabric dyehouse. Factory B holds no certificate, discloses all three tiers, and has an open grievance log with one unresolved wage issue. The buyer requests the dyehouse audit from A and a 90-day corrective action plan from B, then scores both on total risk rather than certificate count. B wins on traceability. A's certificate never covered wet processing, which is where the risk actually sits.
Traps
- Treating a certificate as proof of compliance.
- Applying the same questionnaire to a small and a strategic supplier.
- Excluding on a finding instead of managing it through improvement.
- Not checking certificate scope, site and expiry date.
- Ignoring subcontractors and raw-material tiers where impacts concentrate.