Building compliance you can prove: where to focus when the rules keep changing

The last couple of years have been unsettling for responsible sourcing teams. European due diligence and reporting requirements have been reopened and pared back, deadlines moved, thresholds moved, and some rules were rewritten before they ever applied. Most teams have stopped asking whether to postpone; the harder question is what to work on next.

In this episode, EiQ Content Manager Jenna Thompson speaks with Meghan Quinlan, Principal, Responsible Sourcing, and Jaime Rúa Tavira, Head of Client Solutions. They discuss why delaying a programme costs more time than it saves, and why the suppliers you have never assessed are the ones holding the risk. They also look at what a finding of nothing really tells you, how supplier information ends up split across six teams who never compare it, and why the test of a programme is answering the questions you were not expecting rather than the ones you prepared for.

Episode length: 33 minutes

Full transcript

Jenna: If you work in responsible sourcing, the last couple of years have been strange. The deadlines kept moving, the scope kept changing, and some of the rules got rewritten before they even came in. And it's left a lot of teams unsure whether to keep going or just wait and see. So rather than go through the regulation itself, today we wanted to look at what we're actually seeing inside real programmes and why some teams have stayed calm through all of this, while others are really struggling.

So I'm here with Jaime and Meghan from EiQ and from LRQA. So would you like to start by introducing yourselves? Jaime, would you like to go first?

Jaime: Of course. So hi, I'm Jaime. I lead the client solutions team. My role sits between the product team, sales and client team. And I mostly spend most of the time speaking with clients, understanding their challenges and helping them to solve it, which is now with other regulations and how they're all changing. This is why I was looking forward to having this podcast.

Jenna: Lovely, and Meghan?

Meghan: Yeah, great. I'm Meghan Quinlan. I'm a principal in responsible sourcing. So basically I've been working with companies for about 20 years to help them design programmes, understand the programmes, responsible sourcing, human rights. So I'd say what interests me most is how we can make programmes more effective in practice, what is actually working, but also where programmes or connections tend to break, and what we can do to achieve the best outcomes. Especially in the dynamic world that we live in, it's always changing.

Jenna: Okay, great. So let's start with the question everyone's asking. Does the fact that so much of this has moved change what teams should be working on now?

Jaime: I'd say the answer is no. And let me ask you, so the question that we're getting most of it, with all these changes, people are wondering if they should postpone the implementation of the programmes. And the answer is, in most of the cases, no.

The implementation of the different actions of the responsive sourcing programmes, the due diligence actions that they need to implement in order to face and comply with all these regulatory landscapes takes time to be built, takes time to be implemented. And I'm not speaking about the technology, the programmes, the data side of it. I'm speaking about the interaction of different teams, the collaboration, the agreements, the alignment, the processes that they need to implement, and of course, the data part of it, it's also important. We'll speak later about the fragmentation, but getting the right data into the right system so that they can use it to produce all those type of reports and analysis is key, and it's very, very important.

The only exception that I would flag is for those companies who have very mature responsible sourcing programmes. They've been doing this for four years. Their programmes are robust or solid or comprehensive. For those of them, these changes, they often require a few changes, but they are only minor adjustments that they need to produce. They don't have to reshape their whole programme to face this type of regulations.

Jenna: Okay, yeah.

Jaime: Are you seeing it differently?

Meghan: I mean, I see it pretty similar, right? I mean, does anything need to- should you stop or slow down? Absolutely not. I don't think I'm seeing as much of questions of “should we do that”. It's more just paralysis by “what do we do next” right?

But what I think is helpful is to think of it in two layers, right? So the things that are moving, right, what checklist, what reporting, what are the deadlines, what are the thresholds? Those move, right? They move. They're going to keep moving. That's, you know, kind of that old adage of the only chain, only, what is it? The only constant is change? Yes, yeah, that one. But in any case, I think. But if you think of the second layer, right, the foundational layer is, do you understand your supply chain? Right? That's actually what we're asking is, do you understand your supply chain? Do you know, how are you making decisions, what's the evidence behind it and how are you prioritising? That is what across the board is not changing, is are you able to demonstrate and understand your supply chain?

So as things shift, as the deadlines shift, as new regulations come out, you know, we want it to be where we're just micro-adjusting our programmes, right? We don't want to do a reconstruction. And so I think if we're just focusing on the foundational layer, then no, absolutely not. But the challenge is, to Jaime's point, it's harder, it's more complex, and it takes more time. Right? So that's what we need to be focused on.

Jenna: Okay, yeah, that makes sense.

Let's talk about risk. So when a company sits down to actually design a programme, what should they be building it around?

Jaime: So that's the first step that every regulation is asking. So they require you to take a look at what are those risks that you're facing. So one of the key things that we see is that people build the responsible sourcing programmes, their actions, based on what they see, what they know, the suppliers that they know, the sourcing markets that they already know. And what that happens is they start or they continue assessing what the suppliers that they already know instead of taking a look at where they don't have any type of visibility or. Yeah, I'd say that the parts of their supply chain which is less transparent, where they have less knowledge, those are the parts that tend to not get included in the programme and those are the ones that would get a higher level of scrutiny in the future. Those are probably the places where most of the risk would be concentrated.

Jenna: So they're missing out the most important piece then, really?

Jaime: In many cases they do. It's also, to be fair, the part which is of course the hardest to, to analyse and to, and to understand, otherwise everyone would be doing it.

Jenna: Makes sense. So Meghan, how do you design then for something that you can't see?

Meghan: Sure. Well, I think a durable programme is built on comprehensive management systems, management system approach, right? So similar to the last question, the regulation is not the architecture, the regulation is the driver. So you have, you know, your first layer is, you know, as I said, do you understand your supply chain? Right? And the second part of it is making sure that where you have uncertainty that that is visible. Right? And I don't mean visible like go put it on your website, right? We're not taking that approach. We're just saying visible internally and visible to your decision making.

Because if you, let's take an example. Right. So you know, you have, there's a lack of findings. Right. Right now that kind of generally shows up as like one cell. Yep. No findings, that's one thing. Right? But no findings, there's a lot of things that could be right? It could be because it just wasn't in scope. It could be because if it's from an audit, the auditor didn't have time. It could be because there was no smoking gun. The auditor wrote in the notes: “workers were coached for my belief, but you know, I can't capture it”. You know, there's, there's a lot of different things that, that could be, right? And, or it could be it was a self-assessment. And so, you know, the site said, “yep, I've got that, no problem”, you know, but so there's a lot of different things that no finding means. But right now we treat them all the same.

So I think we really need to move into a world of two dimensions where you have both what is your risk and what is your knowledge. Right? And the confidence and the knowledge. Because if you have high risk and high confidence of that risk, right, you're going to be doing a certain intervention. Right? Might be start an investigation, you might engage more stakeholders, you might do some kind of remediation or recruitment fee repayment. If you're high risk but low confidence, that's a different thing. Right. And same thing for if you're low risk but high confidence, then you just want to move with more monitoring so you have different interventions based on the level of confidence that you have in the data. So it's a critical part, it just needs to be built in, similar to what you were saying.

Jaime: And I would add to that that it changes based on the type of assessment that you do. Like for example, it's not the same to not find any findings during an audit than to not have any type of issues raised. For example, in a grievance mechanism. On the audit finding you have someone visiting the factory. But on a grievance mechanism, and I am putting that because I think it's the most extreme example. You don't know if it's because people don't have access to actually the grievance mechanism, so they can't raise the issues or is it because there are no issues at all and everything is fine? So it's hard to evaluate in those cases if that absence of issues, it's positive or it's just a lack of transparency.

Meghan: Yeah, it’s the age old question, what's the right KPI for a grievance mechanism? Right. A lot of grievances or none. What do we want?

I guess another thing to kind of, back on the theme of regulations is, you know, fundamentally or not fundamentally, but you know, as administrations change, as prioritisation of administrations change. Right. Enforcement changes, regulation changes, we know that. So even if you look at within, for example enforcement within the US within the last 18 months. Right. And what kind of human rights or due diligence looks like for vulnerable workforces, for child labour, for that type of thing, the- what hasn't changed is that there's still risk, right? And it's still being addressed through the administration. We can look at the country, we can even look at the state, the geography and we can look at the sector for more risk.

But what's back to your question on visibility and gaps. What people don't know, right, where the risk really is, is do those sites have labour agents, do they have night shifts, do they have kind of management systems on these different pieces? And so that's really where the gaps are coming in to the back to the point on visibility. And then the enforcement ebbs and flows a little bit, but the risk is still there.

Jenna: Okay. So it's not just about knowing your risks, but it's about knowing where your blind spots are as well?

Meghan: Exactly.

Jenna: Yeah. Okay.

Jaime: And also including like the context, right? You were saying the labour agents, the demographics, everything which is around those findings, understanding the situation, the context, where they're operating, to really put in context the findings and really understand them properly.

Meghan: Yeah. Which I think is, that's a whole other ball of wax. Maybe you'll be getting to that, right? But how do, what is the role of people in this fast-changing world? But I won't take us on a side trip.

Jenna: So for a long time the default's been to send the same questionnaire to the same supplier. So that's shifted now. So what does good practice look like today?

Jaime: So as you were saying, it has been the standard for a long time and in some cases it still is, but every time it's a bit less. So historically what we've seen is that companies, in order to evaluate more of their suppliers or the components of their supply chain, what have been doing is sending the self-assessment questionnaire to all the entities in the supply chain, which maximises the coverage of those, of your assessment in your supply chain. That yes, will probably get you to analyse more entities, but will get you a lower... I don't know if I would frame as quality, but the information that you get or the level of understanding that you get of those entities is going to be probably lower.

So what regulations are changing is the way that these mechanisms are deployed in your supply chain. So what they are asking or what they are making companies do is to adapt the mechanisms that you implement based on the risk that has been identified. So first understand, as we were saying at the beginning, understand what are those issues that your company is facing, that your suppliers are facing? And once you have understood that you will be able to design: what are the mechanisms? And when I say mechanism, this can be, as you were saying, questionnaires, it can be grievances, you were discussing that. It can be audits, it can be anything that you can then implement. But again, once you have identified them. So there's not a tool which is good or bad. Of course we want to have a higher level of verified data, probably. But what we would want is to adapt the tool that we use to the circumstances and the situation of those suppliers.

Meghan: Yeah, and what I'd say is, you know, it's not that all of a sudden a line was drawn in the sand and everything shifted. Right. Like if you look back, you know, even 20 years ago, right, like the leaders were already segmenting, prioritising their programme. It was based on brand reputation, right?

Then we had a shift as regulations come in, where it's based on salient risk instead. Right. Really think of the rights holders within the supply chains or within the own operations. And that really completely was coming to a crescendo. And that's pretty standard at this point, I'd say.

But then what we have to layer in next, and this is where it's constantly changing and evolving, right? So then what we began to layer in was, okay, it's not just our tier ones. We're actually looking at our service providers, we're looking at our operations, we're looking at upstream. So it's kind of like what are we folding into scope and then how does that fit into our new segmentation overall? Right. And then now what we're beginning to see is how do we make it more dynamic, right? Because now we're seeing like an update- you know, I'd say five years ago people would update their segmentation or prioritisation every somewhere between one and three years. Right. Whereas now it's kind of accepted, that's not quite good enough. But how do we build bridges to get to the next. So it's always going to be evolving. So it starts with, it started with, let's say, reputational risk, it went to salient risk, it expanded the scope. Now we need to be more dynamic. But one thing that again is the constant is: how did you make your decisions and how can you evidence your decisions? And that has not changed, that's not going to change. And that's also true within kind of, when you're defending your kind of due diligence approach. If it's for regulations, for example, that is what you need to demonstrate. And so I think again, it's going to continue to evolve. That's just where we are as an industry. It's still a relatively new industry. But this element of making sure you have clearly documented evidence, decision making and it's consistent is critical.

Jaime: So regardless of the decisions that you've made, like knowing exactly why you did anything at each of the steps and having like a strong justification for each of those.

Meghan: Yeah, exactly. Or one challenge that we're now running into just, I'd say in the industry that we haven't figured out yet, if I'm honest, is. So yes, we're doing all those things I just mentioned, you know, and then managing how dynamic it is, is one of the big challenges. But the other challenge is, you know, we've moved to a world of kind of mutual recognition to reduce audit fatigue. And that's great, right? There's been a lot of energy put into it. There's a lot of benefits of that. But then what might be a, you know, a low risk supplier, so you're like, yes, I will accept your scheme audit over here. For this, you know, other company that's, you know, medium to high risk based on their leverage, based on their exposure, based on, you know, the forced labour risks, etc. just looks different in their, in their supply chain. So for them it's high risk. So they're like, oh well, I want to level on, layer on a worker survey, or I want to layer on something about recruitment fees or I want to layer on these other things.

So then all of a sudden this whole world we moved into in mutual recognition isn't quite working anymore. And I don't think we figured that out. But I think how we will figure it out is, you know, circling back to that interconnectedness, bringing the different data together from different sources, whether it's within your company or more collaboratively as an industry.

Jaime: Very good point. And I will also add.

Meghan: Ooh! Ooh!

Jaime: The speed of that information. So you were saying that previously the segmentations were being done every one to three years, and right now you get that, you get new information, new insights, new ratings, new data from the ground, like way quicker than you used to. So how fast should you react? And that's probably one of the pieces where companies struggle like, to understand how quick should they adapt to those new informations, which ones should they understand? Should they pay more attention? Anyway, that's a whole different discussion. But the speed of the update of the data is also a key factor.

Meghan: Yeah, that dynamic piece is, can't be understated.

Jenna: Supply chain transparency is the thing that everyone says is hard. So if you look at why it's hard, what's actually in the way for people?

Jaime: That's probably the key question. There are multiple factors in here. So one, it's how you actually get the data and really how confident you are on that data. If you think that- so you were speaking about the questionnaires. How confident are you that the information that you're getting about that questionnaire is, is true? Like, what's the risk of a supplier potentially not wanting, I'm not saying giving you the wrong information, but instead of disclosing something that they don't want, just directly not giving you or not answering that questionnaire or how confident you are that the data, the result of the audit that you've conducted is the correct one and not just one snapshot, at one point in time with, without the issues that you were trying to capture, if they were happening.

So that is one of the key things that we see on the issues of transparency. And then it's not only transparency, but you were saying the fragmentation. So if then we move into the client side, clients tend to struggle then to have a clear visibility. That would be another level of. That wouldn't probably be transparency, but it would be how can clients have a clear picture of: these are my suppliers, this is all the information that we have. And really how would they mix all the insights and have a clear and probably transparent picture of the situation of that site or supplier? And probably the, the issue that we see is that the clients have that type of data very fragmented in different places. So they will have six different teams managing six different types of information. Audits within the sustainability team, screenings with the compliance team. They will have the supplier master list with sourcing. So every single one of them will be managing their pieces of information, and in very few cases that will be connected, which will what- this is what will allow clients to then have that broad picture and really understand the information that we have about their supply chains.

Jenna: Is this where you get a lot of duplication, where different teams are working on different things but they're collecting a lot of the same information?

Jaime: Could be, could be the case. What we, for example, see in many cases is that different teams will be reaching out to the same supplier. Most of the cases, instead of duplicating what they will be is each of them trying to collect the data that they want. So sourcing will be sending them a question about the capacity and anything they need for sourcing. Quality teams will be sending the requirements for that. Environmental teams will be asking about the carbon emissions. The social or the human rights team will be asking them about their own issues.

So they get different requests in different directions. And what ends up happening is instead of streamlining the requests in one and then not only how you ask for it, but then how you group that information and how you process it, store it and generate a comprehensive supplier view. You will have it in different places and you won't have that type of visibility that you would want to have.

Jenna: Yeah. Plus then the supplier’s getting bombarded with different requests all the time from different teams.

Jaime: Exactly.

Jenna: Yeah.

Meghan: And I'd argue it's not just about, I mean I think fragmentation is the key challenge, but I'd argue it's not just about data. Right. That's definitely a key part of it, right? You have your climate data here, you have your quality or food safety data here, you've got your, you know, responsible sourcing, human rights data here. But you also have procurement that is, you know, likely owning the supplier relationship, you've got legal that's owning the contract. You've got these other teams that are owning different kind of policies and this different outreach, right? But what is missing is just one comprehensive view overall.

And you're not going to be able to have a comprehensive view without clear definitions, without clear kind of levels of consistency across the organisation, right? Even within your different functions, without kind of consistent evidence. Providence, let's say, right? So these are the types of things that in order to build a truly comprehensive view, you need to have these other pieces as well.

I think a really good example to build on your earlier example of grievance mechanisms is, you know, within one organisation, if they have a really mature human rights responsible sourcing programme, they likely have multiple grievance mechanisms, right? Because some work for some contexts, some work for some business units, some work for some types of workers or types of supply chains, different types of suppliers, etc. So you have all these kind of different incoming pieces. And there's been a lot of work over the last 20 years to build that, right? It's aligned with the UNGPs. It has, you know, how you get accessibility, how you get trust, all these really key principles that we built this on. So if now we're to say, okay, we need this all together, right, that doesn't work. But we don't want, we don't want to throw the baby out with the bath water. So instead it's not- it's how do we bring those systems together, right? In this example, right, it's not just creating one platform or one system, it's how do we actually bring it together.

And it's not just technology that that's part of, right? Because you have a lot of governance questions you have, okay, again, on this example, who owns the worker data? Who is going to be responsible for the investigation? Who is going to fund the remedy, right? These are all the questions that come out of it that are part of the overall governance structure that accompanies a system such as this, right? And then you take grievance, which again, is in all the regulations, it has kind of- it's more the forefront of people's mind than it ever has been in the past. And if it's this complex of just an organisation, it's probably one of the most complex areas across industries, right? It's an area where we have, I don't know how many pilots across how many geographies, across how many sectors. And I'd say there's very few really scalable, long-term grievance solutions that have emerged over the last 20 years.

But I think, at least in my hopeful world, with this introduction of technology and all these different ways we can use our different opportunities, data, etc. and begin to not have such a fragmented view. This is where we can actually create change and more effective outcomes.

Jaime: And I'm going to link this to the first answer that we gave or the first question that you asked, which was about delaying or postponing this, like with every time these regulations are postponed, if companies can afford to just delay and start working on this later. You just gave a great example of why does it take so much time to just implement these programmes. Because not only, so it wouldn't be only about data implementation, the processes, the government, it's about the alignment of all those different teams that each of them manage. A key part of these relationships, how you bring them all together into one initiative.

Meghan: 100%.

Jenna: So it's not about lack of information, it's about the fact that it's spread across systems, across teams, and those are not necessarily designed to talk to each other at this point.

Meghan: Exactly. Yeah, exactly. Both the data and even just the definitions, you know.

Jaime: Yes, totally agree. So it's probably not anymore a matter of lack of data. It's just where is it stored, where is it, how can you use that? It's something that should take you three minutes, probably takes you three weeks. That's the key issue.

Meghan: And how do you make everything so it’s apples to apples, not apples to oranges. Right?

Jenna: Yeah

Jaime: That's a whole new topic that we could be speaking here.

Meghan: Next week.

Jaime: For ages.

Jenna: It's kind of an organisation problem, it seems like.

Jaime: Yes.

Meghan: Yeah.

Jenna: Producing the actual reporting has got a lot easier, but a lot of teams now are using AI to draft it. So does that solve the problem?

Meghan: So I think AI makes the production of an answer more efficient, faster. Right. You can get an answer really quickly. That's great. We're not- people don't need to spend time transferring information from one spreadsheet to another, etc. But the question immediately becomes, where did that data come from? What source is it from? How old is it? Is it credible? Right? And so that actually becomes then the job of the humans. Right? It's understanding where there's ambiguity and figuring that out. It's, you know, giving context, identifying the context, etc. It's doing any additional investigation that's necessary. And it's also a lot on engagement, stakeholder engagement, whether that's with peers, whether that's with, you know, the sites, you know, whatever. It's with the reporting. That's where the change is, I think.

Jenna: Okay.

Jaime: So it has helped. Yes, 100% it has helped a lot, especially with all the, all the reporting and all that explanation of what has been done. But I think also there's a risk here, which is producing really confident, yeah, really confident reports with a very thin layer of evidence. You were saying now how that comes together. So I think that's the key risk. You need to have all the different steps and things that we've been discussing today about the fragmentation, like getting those evidences, get the thinking, the justifications for everything that you've been doing in order to produce a good report. So yeah, it has helped, but there are still some risks that should be taken into account.

Meghan: Yeah. In short, I'd agree with you. I think the question just becomes not how quickly you can get the report, but how quickly can you produce the evidence that backs up that report? Right. Make that evidence trail thick, a thick line, in your words.

Jaime: Exactly. And there was something…

Meghan: Which might be a Spanish expression, I wonder.

Jaime: It could be.

Which is that companies shouldn't be able to just generate quickly answers that they are- from questions that they are expecting. They should be able to answer quickly questions that they are not expecting. So that they have all that level of evidence, structure and data accessibility that allows them to produce different reports, but not only the ones that they've been preparing for.

Jenna: Okay. So they shouldn't be seduced by just speed alone. It's also to do with the quality and depth of the answers that you're…

Jaime: Of course.

Jenna: Lovely.

You've seen a lot of these programmes. So what do the ones that are working have in common?

Meghan: Yeah, I think everybody's a work in progress. I think everybody would say that their own programme is a work in progress, some further along the journey than others. But I think there's three things we really need to keep in mind, right? Especially as we move into this dynamic world with shifting kind of first layer, right?

And the first one is the leadership and governance ownership. So it's what are we trying to achieve and who owns the decisions on it. Right. That that needs to be clearly in place. And I think we see that a lot, actually. Companies are hiring new governance positions, re-elevating their governance positions. It's something we've seen a lot of in the last couple years, but say, especially within the last nine months.

Another piece is this coherent evidence trail. Right. So you have your due diligence. You have to back up that you're doing what you're saying you're doing. It's our own management system, right. We audit others on it, what is ours?

And then the third piece is that you are able to apply appropriate and adaptive interventions. Right. So they're fit for purpose, but also you can change quickly based on what's needed, based on that feedback loop. And I think that feedback loop, very few companies have that at the moment. Right. And so you know, when you're, when you have a site with continuous CAP issues, when you have a site with kind of a new grievance, when you have a site that's been acquired or has kind of a merger acquisition, these are the pieces that influence. Or when you have new visibility to a site like, oh, they are using labour agents. I didn't realise that, right? And so how do we be more dynamic, more quickly, in addition to assigning the appropriate intervention based on that?

Jaime: I think those points are super important. And I think one of the key ones is the governance and the understanding of what each company needs to do and what each company is actually doing. So no one, or almost no one, none of the companies that right now are implementing all those things correctly started their journey with that already enabled. But what is important is to have the right foundations, the right governance and, and the right principles so that whenever you evolve your programme, you're able to just be able to produce all the level of reporting, of analysis and understanding that we've been discussing.

Jenna: So it's having the right foundations and then it's also being able to be adaptive as well as things change in the way that they constantly do.

Meghan: Yep, exactly.

Jenna: Okay, so before we finish, then, if people remember, if people take away just one thing from this episode, what do you think that thing should be?

Jaime: So from my side, I think that regulations are going to change over time. That's almost for sure. But if companies really have those strong foundations and have those strong programmes in place, the changes that- so they will need to adapt, yes. But the changes won't be huge. So they will be able to adapt much quicker than a company who doesn't have those strong foundations.

Meghan: Yeah, exactly. I'd say things are changing. Right? Things will always change. This industry will change. The one thing you need to do is understand your supply chain. That includes understanding where you have blind spots, where you don't have visibility. To get visibility or to cover your blind spots you bring together different data pieces, you can do that quicker. But then you need human judgment, so. But it all comes back to know your supply chain and you'll be headed in the right direction. It's just a big problem to solve. Big challenge, not a problem. Big challenge.

Jenna: It's a challenge.

Meghan: Yeah.

Jenna: Great. Okay. That is all of my questions. Thank you both so much for being here.

Meghan: Thank you.

Jaime: Thank you.

Jenna: Thank you so much for listening to this episode. If you found it interesting, we have many more on a range of different subjects, so go ahead and take a look at those on our website and on our YouTube, and be sure to follow us on LinkedIn as well. And we'll see you again very soon.