Supplier ESG assessment

Supplier ESG assessment operates on two levels that are often conflated in practice: an abstract view of portfolio risk and a concrete evaluation of individual business partners. At the abstract level, the sourcing portfolio is screened for country, sector and commodity risks using sources such as the ITUC Global Rights Index, the Corruption Perceptions Index, child and forced labour indices, or water-stress tools. At the concrete level come self-assessment questionnaires, supporting documents and certificates, ratings from external platforms, and on-site or remote audits following recognised protocols. Data quality decides everything: without clean supplier master data and a mapping of spend, product categories and actual production sites, any score is guesswork, because a group headquarters address rarely reflects the risk present at the factory where goods are made.

The legal anchor in Germany is the Supply Chain Due Diligence Act. Section 5 LkSG requires an appropriate risk analysis in which identified risks are weighted and prioritised; it must be repeated annually and whenever there is a specific trigger, such as new products, sourcing markets or suppliers. Section 3(2) LkSG supplies the weighting criteria: the nature and scope of business activities, the ability to influence the party causing the risk, the typically expected severity and irreversibility of a violation, the likelihood of occurrence, and the nature of the company's own contribution. The results drive the measures: risk-based control measures at direct suppliers under section 6(4) no. 4, remedial action under section 7, and, where the company gains substantiated knowledge of a possible violation, trigger-based obligations towards indirect suppliers under section 9(3). At EU level, Directive (EU) 2024/1760 (CSDDD) foresees comparable risk-based identification and verification, but neither its timeline nor its substance is settled: the stop-the-clock Directive (EU) 2025/794 postponed deadlines, and the substantive changes of the EU Omnibus package were still moving through the legislative process. German law is likewise in flux, since the LkSG is to be aligned with the European framework.

A defensible methodology separates the risk score from the performance score and makes both auditable: weightings, data sources, thresholds and escalation stages should be documented, because appropriateness may have to be justified to the supervisory authority BAFA. Assessment results must feed back into procurement through approvals, contract clauses and supplier development rather than reflexive termination, which usually leaves affected workers worse off. The same data set also serves reporting: ESRS S2 calls for disclosures on workers in the value chain, ESRS G1-2 on supplier relationships and payment practices, and Scope 3 accounting under ESRS E1 improves mainly through primary supplier data. Proportionality matters for smaller suppliers: EFRAG's voluntary VSME standard has become the reference scope for data requests, and the Omnibus process aims to cap what large companies may demand from SMEs outside the reporting scope. External ESG ratings can complement an assessment but never replace it; since the ESG Rating Regulation (EU) 2024/3005 became applicable, their providers are subject to their own transparency requirements.