How to Review a Supplier Code Of Conduct: a Clause-by-Clause Checklist

How do you review a supplier code of conduct before you sign up to it? When a customer asks you, as a supplier, to accept its code of conduct, read it as a contract term, because that is what it becomes once your order or contract incorporates it. The questions to ask are: what exactly am I promising, can my business actually meet it, does it reach into my own subcontractors, what happens if I slip, and does it ask me to do anything that conflicts with local law or with my other commitments. The same review helps a company that is adopting or updating its own code, read from the other side. A code of conduct can look like a harmless statement of good intentions and still carry real obligations: open-ended audit rights, a duty to police your own supply chain, broad indemnities, and a right for the customer to change the code at any time. Reviewing it before you accept is far easier than discovering the obligations during an audit. This article is general guidance, not legal advice. Supplier codes touch labour, environmental, anti-corruption and data-protection law, which vary by jurisdiction, so have a qualified professional review one against the laws that apply to you. ## The clause-by-clause review checklist 1. How is it incorporated? Does accepting an order or contract bind you to the code, and is a breach of the code treated as a breach of contract? That link decides how much the code actually matters.

2. What standards are set, and can you meet them? Go through the labour, safety, environmental and ethics standards and check honestly that your operations already comply, or can without disproportionate cost.
3. Does it bind your subcontractors too? A flow-down clause may require you to impose the same standards on your own suppliers and to police them. Check whether you can realistically do that.
4. What are the audit rights? Who can audit, on what notice, how often, and at whose cost? Watch for audits at your cost with no limit, no-notice site visits, or access to information beyond what the relationship needs.
5. What are the consequences of breach? Is there a corrective-action route for fixable issues, or does any breach allow immediate termination? A corrective-action process is fairer and more workable.
6. Is there an indemnity, and how wide is it? Some codes make the supplier indemnify the customer for any breach. Check it is limited to your own acts and does not cover the customer's own failures.
7. Can the customer change the code unilaterally? Many codes say the customer may update the code at any time and that the new version binds you. At least ask for notice, and ideally a right to object to material changes.
8. Does anything conflict with local law or your other contracts? A code drafted for one country may require something unlawful or impractical where you operate, or may clash with another customer's exclusivity or confidentiality terms.
9. What reporting and record-keeping does it demand? Check what records you must keep, what you must self-report, and whether the reporting burden is proportionate.
10. Confidentiality and data. If the code requires you to handle the customer's data or personal data, confirm the security and data-protection obligations match what you can actually deliver. ## Red flags in a supplier code of conduct - Unlimited audit rights, at your cost, with no notice and no cap on frequency.

• Immediate termination for any breach, with no chance to fix a minor or isolated issue.
• A broad indemnity that could cover the customer's own acts or losses it caused.
• A right for the customer to change the code at any time, binding you to terms you have not seen.
• Flow-down obligations you cannot realistically impose on or enforce against your own suppliers.
• Standards that conflict with the law where you operate, leaving you unable to comply with both.
• Vague standards that give the customer wide discretion to declare you in breach. ## How to respond before you accept You do not have to accept a code exactly as presented. Reasonable requests include: a corrective-action period before termination; audit on reasonable notice, at the customer's cost unless a serious breach is found; an indemnity limited to your own conduct; notice of, and a chance to object to, material changes; and a carve-out where the code conflicts with local law, with the stricter of the two to apply. Raising these before signing is normal commercial negotiation, not resistance to doing the right thing. Last verified October 2026. ## A note on jurisdiction What a supplier code can require, and what it cannot, depends on local law. In India the relevant floor includes the Child Labour (Prohibition and Regulation) Act, 1986, the Bonded Labour System (Abolition) Act, 1976, the Minimum Wages Act, 1948, the Factories Act, 1948, the Prevention of Corruption Act, 1988, and the POSH Act, 2013, with the consolidated Labour Codes being brought into force in stages. <!-- [VERIFY: which Labour Codes are in force and their commencement dates] --> A code often also references the ILO core conventions and the UN Guiding Principles on Business and Human Rights. Where you supply customers subject to modern-slavery or supply-chain due-diligence laws, the code may carry those obligations through to you. In the UK, US, Ireland, Singapore and Australia the legal floor differs, so treat "varies by jurisdiction" as the default and check the code against the laws that actually apply to you. ## Where a contract workspace helps Reviewing a supplier code means testing it against your own operations and against the law where you work: what you are promising, whether your subcontractors can meet it, how far the audit and indemnity rights reach, and whether anything clashes with another contract you have already signed. That cross-checking is slow when the code, your other contracts and your compliance records sit in different places. Drafting your own code, reviewing a customer's, tracking the audit and reporting duties it creates, and governing those obligations across your suppliers can belong to one AI workspace tuned to how your company contracts. That one-workspace idea is what Adira is built on.