EU Due Diligence Obligation Supplier Audits: What Auditors Check

Understanding the EU Due Diligence Obligation Supplier Landscape

The European Union has fundamentally reshaped how businesses must approach supplier relationships. With the Corporate Sustainability Due Diligence Directive (CSDDD, also known as CS3D) now in force, companies operating across EU member states face stringent obligations to verify not only the financial health of their suppliers but also their environmental and social practices. For SMEs in construction, cleaning, logistics, and retail, understanding what auditors will scrutinise has become essential to maintaining compliance and avoiding substantial penalties.

The EU due diligence obligation supplier framework requires businesses to establish robust processes for identifying, preventing, and mitigating adverse impacts throughout their supply chains. This represents a significant departure from the traditional approach where companies primarily focused on immediate contractual relationships. Today's regulatory environment demands visibility several tiers deep into the supply chain, creating both compliance challenges and operational opportunities for forward-thinking organisations.

The CSDDD Framework: Scope and Thresholds

The Corporate Sustainability Due Diligence Directive applies to a broad range of companies, though thresholds determine which organisations fall within its scope. Understanding these thresholds is critical for SMEs that may either be directly subject to the rules or find themselves under scrutiny as suppliers to larger entities.

Who Must Comply

The directive establishes a phased approach based on company size and turnover:

• EU companies with more than 500 employees and net worldwide turnover exceeding €150 million
• EU companies with more than 250 employees and net turnover above €40 million, operating in high-impact sectors (textiles, agriculture, mineral extraction)
• Non-EU companies generating turnover in the EU above specified thresholds
• Companies in the supply chains of the above, subject to contractual cascade requirements

Even if your SME falls below these thresholds, you may still face indirect obligations. Large enterprises subject to CSDDD frequently cascade requirements down to their suppliers through contractual terms, meaning a cleaning company serving a major retailer or a logistics firm working with a construction conglomerate will likely need to demonstrate compliance.

Material Scope: What Due Diligence Covers

The EU due diligence obligation supplier requirements extend across three pillars:

• Human rights: forced labour, child labour, workplace safety, freedom of association, adequate wages
• Environmental impact: pollution, biodiversity loss, greenhouse gas emissions, water usage, waste management
• Governance: corruption, bribery, transparency in beneficial ownership

Auditors examining your supplier due diligence processes will verify that you have systems in place to assess risks across all three dimensions, not merely financial solvency.

What Auditors Check: The EU Due Diligence Obligation Supplier Audit Trail

When external or internal auditors review your compliance with supplier due diligence obligations, they follow a systematic approach to verify that your processes meet regulatory standards. Understanding their methodology helps you build the necessary documentation and controls.

Policy and Governance Documentation

Auditors begin by examining your organisation's due diligence policy. They expect to see:

• A board-approved due diligence policy that describes your approach to identifying and addressing adverse impacts
• Clear assignment of responsibility for due diligence implementation, typically at senior management level
• Integration of due diligence into procurement, contracting, and supplier management processes
• Regular review cycles and policy update mechanisms

The policy must be more than a paper exercise. Auditors will trace how policy commitments translate into operational procedures, seeking evidence that due diligence is embedded in day-to-day business activities rather than existing as a standalone compliance function.

Risk Assessment Methodology

A core element of any audit is your risk assessment process. Auditors will verify that you have:

• Mapped your supply chain, identifying direct suppliers and, where appropriate, indirect suppliers in high-risk categories
• Conducted risk assessments based on geography, sector, product type, and supplier characteristics
• Prioritised suppliers for enhanced due diligence based on risk levels
• Documented the criteria and data sources used for risk assessment

For an SME operating across France, Belgium, Ireland, and other EU jurisdictions, this might involve checking suppliers against national registries (Companies House in the UK, the Companies Registration Office in Ireland, the Registre du Commerce et des Sociétés in France, or the Kamer van Koophandel in the Netherlands) to verify basic corporate information, alongside specialised databases for sanctions, adverse media, and ESG ratings.

Supplier Verification and Onboarding Records

Auditors examine the trail of evidence created during supplier onboarding and periodic reviews. They look for:

• Completed due diligence questionnaires or self-assessment forms from suppliers
• Documentary evidence of certifications (ISO standards, industry-specific accreditations)
• Proof of beneficial ownership verification
• Records of site visits or third-party audits for high-risk suppliers
• Financial solvency checks and creditworthiness assessments

The expectation is that higher-risk suppliers receive more intensive scrutiny. A construction SME sourcing materials from a supplier in a jurisdiction with weak labour protections should demonstrate enhanced verification steps compared to a supplier in a well-regulated market.

Ongoing Monitoring Evidence

Due diligence is not a one-time exercise. Auditors will verify that you maintain ongoing monitoring of suppliers through:

• Periodic re-assessment schedules aligned with risk levels
• Alerts or triggers for adverse events (insolvency filings, sanctions listings, negative media coverage, environmental incidents)
• Contractual rights to audit and inspect supplier operations
• Grievance mechanisms that allow workers or third parties to raise concerns

This is where automation becomes invaluable. Manual monitoring of dozens or hundreds of suppliers across multiple jurisdictions is resource-intensive and prone to gaps. VerigoPay enables real-time solvency verification and can form part of a broader automated monitoring framework that creates the continuous audit trail regulators expect.

Remediation and Corrective Action Documentation

When due diligence identifies actual or potential adverse impacts, auditors expect to see evidence of appropriate responses:

• Documented corrective action plans with timelines and responsible parties
• Evidence of engagement with suppliers to address issues
• Decisions to suspend or terminate supplier relationships where risks cannot be mitigated, with supporting rationale
• Escalation procedures for severe violations

The directive requires companies to take appropriate action, which may range from developing an improvement plan with the supplier to ceasing the business relationship if adverse impacts cannot be prevented or mitigated.

Reporting and Disclosure

Finally, auditors verify that your organisation meets reporting obligations:

• Annual public statements describing due diligence processes and findings
• Disclosure of key risks identified and actions taken
• Stakeholder engagement records
• Board-level oversight and review documentation

Sanctions and Enforcement: The Cost of Non-Compliance

Understanding what auditors check is inseparable from understanding the consequences of falling short. The CSDDD establishes a robust enforcement regime that gives teeth to the EU due diligence obligation supplier requirements.

Administrative Penalties

Member states must establish penalties for violations, with the directive setting a minimum standard. Fines can reach up to 5% of a company's net worldwide turnover, a figure that can be existential even for mid-sized enterprises. The exact penalty framework varies by member state, as each has discretion in implementation, but the trend across the EU is towards substantial financial consequences.

Civil Liability

Perhaps more significantly, the directive creates a private right of action. Individuals or organisations harmed by a company's failure to meet due diligence obligations may bring civil claims for damages. This opens companies to potentially substantial liability beyond regulatory fines, particularly in cases involving environmental damage or human rights violations.

Reputational and Commercial Impact

Beyond formal sanctions, non-compliance carries reputational risks. Public reporting requirements mean that deficiencies in due diligence become visible to customers, investors, and the broader market. For SMEs, losing a major contract because you cannot demonstrate adequate supplier due diligence can be as damaging as any regulatory penalty.

How Automation Creates the Audit Trail

The breadth and depth of the EU due diligence obligation supplier requirements create a documentation challenge that manual processes struggle to meet. Automation offers a practical solution that simultaneously improves compliance and reduces administrative burden.

Continuous Real-Time Verification

Traditional due diligence often relies on point-in-time checks during onboarding, with infrequent updates. A supplier that was financially sound six months ago may be in distress today. Automated systems can monitor key indicators continuously, flagging changes in:

• Credit ratings and financial filings
• Insolvency or administration proceedings
• Changes in company structure or beneficial ownership
• Sanctions list additions
• Adverse media and ESG controversies

This continuous monitoring creates a timestamped audit trail showing that you maintained appropriate oversight throughout the supplier relationship, not just at inception.

Centralised Documentation Repository

Automation platforms centralise due diligence documentation, making it readily available for auditors and creating a clear chain of custody. Instead of scattered emails, spreadsheets, and filing cabinets, you have a single source of truth that records:

• When each supplier was assessed
• What data sources were consulted
• What risk factors were identified
• What decisions were made and by whom
• What follow-up actions were taken

Scalability Across Jurisdictions

For SMEs operating across the EU, supplier verification involves navigating multiple national registries, languages, and data formats. Automated solutions can integrate data from Companies House, the Irish CRO, French INPI, Dutch KvK, Belgian Crossroads Bank for Enterprises, and other national sources, creating a consistent verification process regardless of supplier location.

This is particularly valuable for construction firms managing subcontractors across borders, logistics companies with pan-European carrier networks, or retail businesses sourcing from multiple member states.

Defensible Risk-Based Approach

Automation enables a sophisticated, defensible risk-based approach. Rather than applying uniform procedures to all suppliers (inefficient and potentially inadequate for high-risk relationships) or making ad hoc judgements (inconsistent and difficult to defend), automated systems can:

• Assign risk scores based on objective criteria
• Trigger enhanced due diligence workflows for higher-risk suppliers
• Document the rationale for risk classifications
• Demonstrate proportionality in your due diligence efforts

When auditors question why a particular supplier received more or less scrutiny, you can point to a transparent, rules-based system rather than subjective decision-making.

Practical Steps for SMEs

If you are an SME owner, CFO, or accountant grappling with these obligations, consider the following roadmap:

1. Assess your exposure: Determine whether you are directly subject to CSDDD or likely to face cascaded requirements from customers
2. Map your supply chain: Create an inventory of suppliers, categorised by spend, criticality, and risk factors
3. Establish baseline verification: Implement basic checks for all suppliers (corporate registration, beneficial ownership, solvency, sanctions screening)
4. Develop risk-based procedures: Create enhanced due diligence protocols for higher-risk suppliers
5. Implement monitoring: Move from point-in-time checks to ongoing monitoring, leveraging automation where feasible
6. Document everything: Build the audit trail as you go, rather than scrambling to reconstruct it when auditors arrive
7. Review and update: Treat due diligence as a continuous improvement process, not a one-time compliance project

For many SMEs, the resource requirements of comprehensive supplier due diligence seem daunting. However, the combination of clear processes and appropriate technology makes compliance achievable without requiring a large dedicated team. You can see pricing for solutions designed specifically for SME needs and budgets.

Conclusion: Building Resilience Through Compliance

The EU due diligence obligation supplier framework represents a significant shift in regulatory expectations, but it also offers an opportunity. Companies that build robust due diligence processes gain not only compliance but also deeper visibility into their supply chains, earlier warning of potential disruptions, and stronger relationships with reliable, sustainable suppliers.

Auditors will check whether you have moved beyond box-ticking to genuine integration of due diligence into your business operations. They will look for evidence of systematic risk assessment, ongoing monitoring, appropriate responses to issues, and transparent reporting. By understanding what they seek and building the necessary processes and documentation, you can approach audits with confidence rather than anxiety.

The regulatory landscape will continue to evolve, with implementation details still emerging across member states and enforcement practices developing over time. However, the fundamental direction is clear: supplier due diligence is now a core business function, and the audit trail you create today will determine your compliance position tomorrow.