Supplier risk · due diligence · evidence
Supply chain risk software: test the evidence chain
Supply-chain risk management software can support supplier discovery, mapping, monitoring and due-diligence workflows.
It does not replace a company’s own assessment of its legal duties.
For specific UK and EU regimes, see the UK deforestation due-diligence guide, the EU Deforestation Regulation guide and Modern Slavery Act reporting requirements.
Define the workflow
What should a buyer mean by supply-chain risk software?
Before comparing products, separate supplier identity and tier mapping from risk signals, questionnaires, audits, corrective actions and disclosure records.
A system may cover some of these steps; the label alone does not establish coverage or accuracy.
Use a defined responsible-business-conduct framework such as the OECD’s due-diligence guidance to set process questions.
Regime-specific requirements remain distinct: for example, the UK Modern Slavery Act statement and the EU CSDDD are not interchangeable.
Vendor statements
How to read a product description
Exiger describes multi-tier supplier identification and monitoring; Intertek describes supplier mapping, risk assessment, verification and corrective-action functions in Inlight; LRQA describes EiQ as a supply-chain risk and due-diligence platform.
These are the vendors’ own descriptions, not independently tested findings or endorsements.
Do not infer that a product guarantees legal compliance, identifies every risk or produces a complete supply-chain view.
Ask what data sources, geographies, tiers, refresh intervals and limitations apply.
The demonstration
Test one supplier and one risk scenario
Choose a representative supplier and a concrete issue.
Trace the source record, relationship and tier, signal or questionnaire, review decision, follow-up and export.
Check whether uncertainty and missing data remain visible.
Software demo · evidence check
Supplier-risk demo coverage
Tick a test only when the vendor has demonstrated it with a representative record and shown the evidence or export.
0 of 4 tests demonstrated (0%). This is a checklist result, not a score for the vendor.
Still to test: Trace supplier identity and tier relationship to source data; Show risk signal, data source, date and coverage limits; Demonstrate questionnaire, review and corrective-action workflow; Export supplier evidence, decision history and unresolved gaps.
Illustrative buyer case
How might a UK buyer reviewing a multi-tier supplier test a software claim?
Illustrative only: a procurement team needs to investigate a supplier risk raised by a customer.
It tests whether the platform exposes the supplier relationship, source and date of the signal, review decision, remediation record and export, including any unknowns.
One record, checked end to end
Source
One record, checked end to end
Method
One record, checked end to end
Review
One record, checked end to end
Output
Order of work
What should happen before a software decision?
Buyer sequence
1. Define the risk scenario and relevant regime
Buyer sequence
2. Select a representative supplier record
Buyer sequence
3. Test evidence, alerts and reviewer decisions
Buyer sequence
4. Export the record and document gaps
Decision points
What should the buyer carry into the decision?
- Risk signals are not findings until reviewed against evidence.:Risk signals are not findings until reviewed against evidence.
- Vendor product descriptions are owner claims: test coverage and limits.
- Software does not determine legal scope or prove compliance.:Software does not determine legal scope or prove compliance.
Ask each vendor to reproduce one supplier-risk decision from source record to reviewer-approved export, including data gaps.
Frequently asked
Questions people ask
What is supply chain risk management software?
The label covers different workflows, including supplier identification, tier mapping, risk monitoring, questionnaires, audit records and corrective actions.
Confirm which data and process a particular product supports.
Does a platform make a company compliant with CSDDD or UK law?
No software label establishes legal compliance.
Scope, applicable duties, implementation and evidence depend on the entity and facts; check the current legal sources and obtain appropriate advice.
Is supplier due diligence software a separate category?
It overlaps with supply-chain risk tools but can refer to a narrower workflow.
This guide treats due diligence as one part of the wider risk and evidence process.
How should vendor claims be compared?
Use the same suppliers, risk scenario and evidence sample in each demonstration.
Ask vendors to show source, coverage, update date, decision logic and export.
Sources
Primary sources
Every figure, date and status on this page traces to the instrument’s owner.
Secondary commentary is never the source for a number.
- OECDDue Diligence Guidance for Responsible Business Conduct
- OECDGuidelines for Multinational Enterprises on Responsible Business Conduct
- UN OHCHRGuiding Principles on Business and Human Rights
- UK GovernmentModern Slavery Act 2015, section 54
- Home OfficeTransparency in supply chains: guidance
- LegislationEnvironment Act 2021, Schedule 17
- UK GovernmentUK timber regulations: due diligence
- UK GovernmentUK sanctions list
- European CommissionCorporate Sustainability Due Diligence Directive
- EUR-LexDirective (EU) 2024/1760
- European CommissionEU Deforestation Regulation
- European CommissionEUDR guidance and implementation
- ExigerSupply Chain Risk Management
- IntertekInlight
- LRQAEiQ supply-chain risk platform