ESG due diligence across a supply chain is a repeating management cycle in which an organisation embeds policy, scopes and assesses adverse impacts, acts on them, tracks results, communicates and remediates, then starts again. The OECD sets out six steps in that order. The steps overlap in practice rather than running strictly in sequence.
Supply chain due diligence is often procured as an audit: a supplier list, a questionnaire round, a report, a file closed. The OECD Due Diligence Guidance for Responsible Business Conduct presents its process as ongoing and iterative rather than strictly sequential, and the UN Guiding Principles state that it should be ongoing, since risks change as operations and operating context evolve.
The six steps of the OECD cycle
1. Embed responsible business conduct into policies and management systems. 2. Identify and assess actual and potential adverse impacts of operations, products or services. 3. Cease, prevent and mitigate adverse impacts. 4. Track implementation and results. 5. Communicate how impacts are addressed. 6. Provide for or cooperate in remediation when appropriate.
Step two runs in two stages. A broad scoping exercise identifies the areas across operations and business relationships, including supply chains, where risks are most likely and most significant. Increasingly in-depth assessments then follow on the prioritised operations and suppliers. Step four requires periodic re-checking of business relationships, to verify that mitigation measures are being pursued or that adverse impacts have actually been prevented. The EU due diligence directive, as amended in February 2026, takes the same shape: scoping first, then in-depth assessment where impacts are most likely and most severe.
Why the shape is a cycle and not an audit
| Dimension | One-off audit | Due diligence cycle |
|---|---|---|
| Trigger | A date in the calendar | A change in operations or operating context |
| Coverage | A fixed supplier sample | Scoping first, depth where risk is greatest |
| Close | The report is filed | Findings feed the next scoping round |
The Guidance states that the process is not static but ongoing, responsive and changing, with feedback loops so an enterprise learns from what worked and what did not. Two constraints keep the loop honest. Responsibility does not travel along the chain: each enterprise in a business relationship has its own responsibility to identify and address adverse impacts. And enquiry does not stop at direct suppliers: the Guidance directs enterprises to obtain, where appropriate and feasible, information about relationships beyond contractual ones, including sub-suppliers beyond tier 1.
Preparing the evidence behind such a cycle, the segmentation, scoping record, assessment file and tracking data, is a distinct activity from verifying it. Under the EU due diligence directive, verification is carried out by an independent third party who must be objective, completely independent of the company and free from conflicts of interest.
Sources: OECD Due Diligence Guidance for Responsible Business Conduct, UN Guiding Principles on Business and Human Rights, EU due diligence directive, consolidated text
ESG solutions covers the evidence file behind a due diligence cycle. The ESG guide sets out how supply chain findings feed the wider ESG programme.