- How to Write an RFP: Step-by-Step Process - August 3, 2026
- Supplier Code of Conduct: What to Include (Template) - August 3, 2026
- Procurement Policy Template for Small Business - August 3, 2026
A supplier code of conduct states the minimum standards an organization expects from vendors and relevant subcontractors. It normally addresses law, ethics, labor and human rights, health and safety, environment, information protection, reporting, and cooperation with due diligence.
The code is most useful when it is connected to supplier qualification, contracts, training, risk assessment, monitoring, corrective action, and renewal. A document posted online without defined scope, evidence, ownership, and consequences may communicate values but will not manage supplier conduct by itself.
What is a supplier code of conduct?
A supplier code of conduct is a written set of behavioral, legal, social, environmental, and governance expectations for suppliers. It tells vendors what standards apply to their own operations and, where relevant, to subcontractors or upstream supply chains involved in delivering the buyer's products and services.
Definition
The code translates enterprise values and risk requirements into supplier-facing rules. It can cover compliance with law, anti-bribery, conflicts, fair competition, labor rights, forced and child labor, discrimination, freedom of association, wages and working time, health and safety, environmental management, product integrity, cybersecurity, privacy, confidential information, records, reporting, and remediation.
Scope must be explicit. The code may apply to the contracting entity, its affiliates, workers, agents, subcontractors, and suppliers supporting the buyer. Flow-down requirements should be proportionate and contractually clear. A Tier 1 supplier cannot guarantee every act in a distant supply chain, but it may be required to conduct risk-based due diligence, communicate standards, preserve traceability, and address identified harm.
Why companies require it
A consistent code reduces fragmented expectations across business units and contracts. It supports supplier onboarding, sourcing, due diligence, training, audits, incident response, and corrective action. It also gives suppliers a common reference before they accept an order or agreement.
The OECD guidance on responsible business conduct due diligence emphasizes identifying and addressing actual and potential adverse impacts in operations, supply chains, and business relationships. A code is one component of that process, not a substitute for risk assessment or remediation.
Technology suppliers may require additional provisions. NIST SP 800-161 Rev. 1 addresses cybersecurity supply chain risk across acquisition and supplier management, including contract requirements, monitoring, vulnerabilities, incident reporting, provenance, and resilience. These topics can appear in a general code at a high level and in detailed security schedules where the supplier's access or product risk warrants it.
What it is not
A supplier code is not automatically a contract. Its legal effect depends on how it is issued, accepted, incorporated, and enforced under applicable law. A web page or PDF may state expectations, but procurement should not assume it modifies an existing agreement.
| Instrument | Main purpose | Typical legal role |
|---|---|---|
| Supplier code of conduct | State common supplier standards | Policy or incorporated obligation |
| Contract | Create enforceable commercial obligations | Signed agreement |
| Supplier questionnaire | Collect representations and evidence | Due diligence input |
| Audit protocol | Define review method and access | Contract-linked control |
| Corrective-action plan | Resolve a specific gap | Time-bound remediation record |
| Supplier scorecard | Track performance and compliance | Governance and decision support |
Legal counsel should determine incorporation language, precedence, change control, audit rights, remedies, termination, and jurisdiction. The code should not contradict the main agreement or create obligations the buyer cannot administer consistently.
What does a supplier code of conduct example or sample look like?
A supplier code of conduct example usually opens with purpose and scope, states core standards by topic, explains reporting and verification, and closes with acknowledgment and consequences. A concise code can be effective if requirements are clear and supported by detailed contracts or standards.
Typical sections
| Section | Core content | Evidence or control |
|---|---|---|
| Purpose and scope | Who and what the code covers | Supplier acknowledgment and contract reference |
| Legal compliance | Applicable laws, licenses, sanctions, trade | Registration, licenses, screening, records |
| Ethics | Bribery, conflicts, gifts, competition, fraud | Policies, training, disclosures, investigations |
| Labor and human rights | Forced labor, child labor, discrimination, association, wages, hours | Workforce records, grievance process, assessments |
| Health and safety | Safe workplace, hazards, incidents, emergency planning | Safety system, training, incident records |
| Environment | Permits, pollution, resources, waste, emissions | Permits, metrics, improvement plans |
| Information and product integrity | Privacy, security, confidentiality, quality, counterfeit prevention | Assessments, controls, traceability, incident reporting |
| Supply-chain management | Flow-down and risk-based due diligence | Supplier mapping, screening, corrective actions |
| Monitoring and remediation | Evidence, audits, reporting, cooperation | Review record and action plan |
| Consequences | Escalation, suspension, termination, remedy | Contract and governance decision |
The ILO fundamental principles and rights at work cover freedom of association and collective bargaining, elimination of forced labor, abolition of child labor, elimination of employment discrimination, and a safe and healthy working environment. These principles provide a credible foundation for labor provisions, while applicable law and sector risk determine detailed requirements.
Sample language
The following clauses illustrate structure and need legal and operational adaptation:
Compliance: "Supplier will comply with laws and regulations applicable to its performance and maintain licenses, permits, and records required for that work."
Ethics: "Supplier will not offer, authorize, request, or accept improper payments or benefits and will disclose actual or potential conflicts related to the buyer's business."
Labor: "Supplier will not use forced, trafficked, or prohibited child labor and will maintain working conditions consistent with applicable wage, hour, nondiscrimination, freedom-of-association, and health-and-safety requirements."
Environment: "Supplier will comply with applicable environmental requirements, control material impacts associated with its performance, and provide agreed data using the specified method and reporting period."
Reporting: "Supplier will promptly report suspected material violations affecting the buyer's products, services, workers, information, or reputation through the designated channel and will cooperate with appropriate investigation and remediation."
These examples avoid absolute claims the supplier cannot support. Terms such as "all international standards" or "zero environmental impact" are difficult to interpret and verify.
Common variations by industry
Manufacturing codes may emphasize materials, traceability, quality, counterfeit prevention, worker safety, and environmental permits. Technology codes add secure development, vulnerabilities, access, privacy, incident notification, and subprocessor controls. Logistics codes address safety, labor, emissions, cargo integrity, and subcontracted carriers. Staffing codes address worker classification, recruitment fees, wages, background checks, and data.
Use official PDF resources as references, not unexamined copies. The UN Supplier Code of Conduct resource provides a public example. The OECD and NIST publications provide due diligence and cybersecurity context. An organization's final code must match its operations, jurisdictions, supplier population, risk, and contracts.
Where can you get a supplier or vendor code of conduct template?
A supplier or vendor code of conduct template can be built in Word from a controlled outline, adapted from credible public examples, or prepared with legal and subject-matter support. A free template is a starting structure; it is not evidence that the resulting policy is complete or enforceable.
Template structure
Use a Word document with:
- Document owner, version, approval date, and effective date.
- Purpose and relationship to enterprise policies.
- Defined supplier, worker, affiliate, agent, and subcontractor scope.
- Applicable-law and contract-precedence statement.
- Topic-specific standards.
- Supplier due diligence and flow-down expectations.
- Records, information, and reporting requirements.
- Monitoring, audit, and cooperation.
- Corrective action and remediation.
- Escalation, suspension, and termination.
- Questions and reporting channels.
- Acknowledgment and authorized signature.
| Template field | Required detail | Owner |
|---|---|---|
| Scope | Entities, activities, geographies, and supply-chain tiers | Legal and procurement |
| Standard | Clear expected or prohibited conduct | Subject-matter owner |
| Applicability | Universal, risk-based, or category-specific | Procurement and risk |
| Evidence | Records, data, certification, assessment, or audit | Control owner |
| Reporting | Event, method, timing, and contact | Compliance or incident owner |
| Remediation | Action, owner, due date, validation | Procurement and control owner |
| Consequence | Escalation and contractual response | Legal and business authority |
| Review | Version, change, supplier acknowledgment, renewal | Document owner |
Word format
Use real headings, short paragraphs, controlled lists, defined terms, and a separate acknowledgment page or form. Add a contents table for a longer code. Do not place detailed questionnaires inside the policy; keep assessments and evidence requests in separate tools that can change without rewriting the core code.
Version control matters. Identify which code applies to each supplier and contract. When the code changes, follow the contract's notice and change mechanism rather than assuming a website update automatically binds existing suppliers.
Adapting for your industry
Start with risk mapping. Identify jurisdictions, worker populations, materials, environmental impacts, data, systems, intellectual property, product safety, licenses, intermediaries, government interactions, and sub-tier dependencies. Add detailed provisions only where the organization has a clear objective, evidence method, owner, and response.
For technology, align code-level expectations with the more precise security schedule. NIST 800-161 supports a lifecycle view of supplier risk and emphasizes acquisition, monitoring, incident information, and verification. For labor-intensive categories, use ILO principles and risk-based due diligence. For sustainability, connect data to category metrics and contract methods.
Do not promise anonymity, audit coverage, or remediation the organization cannot deliver. Reporting channels need an owner, confidentiality rules, anti-retaliation controls where applicable, triage, investigation, and response.
Hubzone Depot's vendor sourcing strategy can support qualification and market evaluation before a supplier enters the relationship. The code then communicates minimum conduct expectations across the approved base.
Before release, run legal, compliance, labor, environmental, information-security, privacy, procurement, and operational review as applicable. Pilot the acknowledgment process and confirm that vendor records can store version, date, signer, and exceptions.
What should a supplier code of conduct policy cover, including sustainability?
A supplier code of conduct policy should cover the behaviors and controls that protect people, environment, information, product integrity, lawful commerce, and the buyer's legitimate interests. Sustainability provisions belong inside the same governance model: clear requirement, material scope, evidence, monitoring, and remediation.
Labor and ethics standards
Labor provisions commonly address forced labor and trafficking, child labor, recruitment fees, working time, wages and benefits, nondiscrimination, harassment, freedom of association, collective bargaining, grievance mechanisms, and safe working conditions. Requirements should reflect applicable law and recognized principles without implying that one clause resolves every jurisdictional issue.
Ethics provisions may cover bribery, facilitation payments, gifts, conflicts, fraud, money laundering, fair competition, confidential information, insider information, sanctions, export controls, books and records, and reporting. State whether prior disclosure or written approval is required for specific conflicts, gifts, agents, or government interactions.
Environmental standards
Environmental provisions may require applicable permits, pollution prevention, responsible chemicals management, waste control, resource efficiency, energy and emissions data, water stewardship, packaging, recycling, biodiversity, and incident reporting. Match the level of detail to the category.
The code can set a general duty, while contracts define product-specific standards, baselines, targets, calculation methods, and data frequency. A broad requirement to "reduce emissions" is difficult to enforce without a boundary and measure.
Sustainability reporting expectations
| Reporting area | Minimum definition | Example evidence |
|---|---|---|
| Labor and safety | Covered workers, locations, period, incident definitions | Workforce and safety records |
| Energy and emissions | Boundary, units, method, period, allocation | Meter data, inventory, calculation |
| Materials | Product scope and composition method | Declaration, certification, test |
| Waste and circularity | Weight, destination, recovery method | Carrier or facility record |
| Supplier diversity | Certification scope, direct or Tier 2 spend, period | Valid certification and spend file |
| Due diligence | Risk scope, findings, actions, closure | Assessment and corrective-action record |
Require accurate, complete, and timely data and preservation of supporting records. Define whether estimates are allowed and how they are labeled. Suppliers should correct material errors and notify the buyer when assumptions or boundaries change.
The OECD due diligence framework includes embedding policy, identifying and assessing impacts, ceasing or mitigating harm, tracking results, communicating, and enabling remediation. A code aligned to that sequence moves beyond declarations by connecting expectations to action.
Sustainability terms should also consider the buyer's own practices. Unrealistic lead times, unstable forecasts, last-minute changes, and unsustainable price pressure can undermine supplier compliance. OECD guidance specifically recognizes that purchasing practices and commercial incentives may create barriers to responsible conduct.
For cybersecurity and resilience, include risk-based expectations for secure products, vulnerabilities, incident notification, continuity, access, and subcontractors. Detailed control requirements belong in agreements and technical schedules that can be tested.
Avoid claiming every supplier has identical impact. Apply universal ethical minimums, then use category and risk modules for labor, environmental, security, quality, and regulatory depth.
What best practices make a supplier code of conduct enforceable, not just symbolic?
A supplier code becomes operational when suppliers acknowledge it, contracts establish its role, controls test compliance, findings produce corrective action, and serious or repeated violations lead to proportionate consequences. Enforcement depends on consistent process, not aggressive wording alone.
Acknowledgment and sign-off
Require an authorized supplier representative to acknowledge the current version before onboarding, award, or renewal according to policy. Record supplier legal name, signer, authority, version, date, exceptions, and related contract.
Incorporate the code by reference or attach it where legal counsel determines appropriate. Define precedence if the code conflicts with the contract, and define how future changes apply. A supplier should not be asked to accept obligations that can be changed unilaterally without the agreed process.
Provide a channel for questions and disclosed gaps. Conditional approval with a time-bound plan may create more improvement than forcing an inaccurate representation.
Monitoring and audits
Use risk-based monitoring. Inputs can include self-assessments, certifications, data, screening, incident reports, grievances, worker feedback, site assessments, product testing, document review, and audits. Independent audit may be appropriate for high-risk situations, but an audit is a sample at a point in time and does not transfer accountability.
The OECD recommends prioritizing the most significant impacts rather than expecting perfect coverage everywhere at once. This helps organizations focus audits and remediation on severity and likelihood instead of sending the same extensive questionnaire to every supplier.
NIST's supply chain guidance similarly connects requirements, monitoring, verification, vulnerability information, and incident processes for ICT and operational technology. The lesson is that the contract and monitoring plan must fit the actual product or service.
Escalation for violations
| Finding level | Example | Typical response |
|---|---|---|
| Administrative | Missing acknowledgment or expired record | Request correction and set due date |
| Moderate | Repeated reporting failure or control weakness | Corrective action and increased monitoring |
| Serious | Material safety, labor, ethics, security, or environmental breach | Executive and control-function escalation |
| Critical | Prohibited conduct, severe harm, deliberate concealment, or legal restriction | Suspend activity, investigate, notify, remediate, or terminate as authorized |
Corrective actions need root cause, owner, action, due date, interim protection, evidence, validation, and closure authority. Do not treat termination as the only response. Abrupt exit can worsen harm to workers or communities in some situations; legal, compliance, and responsible-business specialists should determine an appropriate remedy.
Measure effectiveness through recurrence, time to close significant findings, verified improvement, incident severity, supplier coverage, data reliability, and remediation outcomes. Counting signed codes shows reach, not impact.
Enforcement must be consistent and documented. Similar violations should follow comparable decision rules, while severity, supplier leverage, legal duties, business continuity, cooperation, and remediation affect the response. Exceptions require authority and expiration.
The code also needs internal accountability. Procurement, business owners, compliance, sustainability, security, quality, legal, and audit functions must know who receives reports, who decides consequences, and who verifies closure.
What should you do first before rolling out a supplier code of conduct?
Before rollout, map the code to supplier risks, existing contracts, onboarding controls, data systems, and decision owners. The first operational action is to identify which suppliers need acknowledgment, when it will be collected, and what happens if a supplier raises an exception.
Establish scope and baseline
Inventory active suppliers, categories, locations, criticality, contract dates, existing clauses, current codes, risk assessments, and known findings. Segment suppliers by risk and renewal timing. Do not begin with a mass signature campaign if the organization cannot store or act on responses.
Compare the draft code with applicable laws, enterprise policies, customer obligations, recognized standards, and existing supplier requirements. Resolve conflicts and duplication. Define universal requirements and category-specific additions.
Design the enforcement workflow
Assign:
- Policy owner and approver.
- Supplier communication owner.
- Legal interpretation and contract owner.
- Labor, ethics, environmental, security, privacy, quality, and compliance reviewers.
- Reporting-channel and investigation owner.
- Corrective-action owner.
- Exception and consequence authority.
- Recordkeeping and renewal owner.
Test four scenarios: full acceptance, requested exception, suspected violation, and refusal to acknowledge. The workflow should produce a consistent decision and record in each case.
Plan phased rollout
Start with new suppliers and upcoming renewals, then address active high-risk suppliers. Provide communication explaining purpose, scope, effective date, acknowledgment method, support, and deadlines. Offer training or guidance where requirements are complex.
| Rollout element | Required decision | Completion evidence |
|---|---|---|
| Scope | Which suppliers and tiers are covered? | Approved segmentation |
| Legal effect | How is the code incorporated? | Contract and precedence language |
| Acknowledgment | Who signs, when, and where is it stored? | Controlled record |
| Evidence | Which controls apply by risk? | Due diligence matrix |
| Monitoring | What data, assessments, and audits occur? | Monitoring plan |
| Violation response | Who triages, investigates, and decides? | Escalation procedure |
| Remediation | How are actions validated? | Corrective-action method |
| Review | When do code and acknowledgments renew? | Version and renewal calendar |
Require signed acknowledgment before the next renewal cycle where policy and contract strategy permit, but do not wait to address critical risk. New supplier onboarding can apply the current code immediately, while active contracts follow their agreed change mechanisms.
The ILO provides labor-rights foundations, the OECD provides a risk-based due diligence process, and NIST provides cybersecurity supply chain practices. Use each source for its relevant domain and have qualified professionals interpret legal or sector-specific obligations.
The rollout is ready when the organization can answer five questions for every covered supplier: which version applies, who accepted it, what evidence is required, who monitors it, and what happens when a material violation occurs. That turns a statement of values into a managed supplier standard.
