A supplier passes due diligence, signs the code of conduct and completes the first audit. Six months later, a customer order doubles. The supplier adds a night shift through a labour broker, sends finishing work to an unapproved site and promises the same unit price on a shorter lead time. The legal supplier hasn’t changed, but the workforce system behind the product has.

That is where annual supplier reviews fail. They capture a company at approval or at one point in the year, while labour risk often enters through change. HR, Procurement and Legal need an event-driven control that reopens due diligence when the operating facts change.

HR doesn’t need to monitor every purchase order. It should help define the commercial and workforce signals that matter, the evidence required at each risk level, and the worker-centred response when a signal is confirmed. That moves ethical sourcing from an annual statement to a working management system.

The risk often enters through change

A supplier can have acceptable policies and still develop serious workforce problems under production pressure. Additional workers may be recruited quickly through unfamiliar agencies. Overtime can become effectively compulsory. Wage records may be split across contractors. Managers may move work to a site that wasn’t assessed. None of those changes necessarily appears in the original contract or annual questionnaire.

Canada’s 2025 reporting data points to the visibility problem. Among entities that had started identifying risks, 20.1 percent selected tier-two suppliers as a risk area, 16.8 percent selected outsourced, contracted or subcontracted labour, and 11.1 percent selected migrant labour. Those percentages don’t measure how common the underlying risks are. They show what reporting entities said they had identified, and may also reflect how difficult these workforce models are to see.

The same federal report found that 84.1 percent of entities had policies and due diligence processes, while only 51.2 percent had processes to assess effectiveness. Across all reporting organizations, just 29.3 percent reported tracking implementation and results. Supplier approval is relatively mature. Continuous assurance is less so.

Bill C-35 increases the value of current evidence

As of September 15, 2026, Bill C-35, the proposed Ban on Importing Goods Made with Forced Labour Act, was at second reading in the House of Commons. It isn’t law. If enacted, it would allow the federal government to establish a public list of goods for which there are reasonable grounds to suspect forced labour, identified by producer, country or region, or a combination of them.

The proposed framework would also permit prescribed information requests to importers. A failure to provide the information could cause listed goods to be deemed prohibited, and the bill would create cost liability in certain cases of non-compliance. The government’s 2026 consultation identifies supplier documentation, transaction records, production traceability and worker welfare assessments as possible forms of evidence.

The final rules could change as the bill moves through Parliament and regulations are developed. The practical lesson is still immediate. A company that discovers its records only after a shipment is questioned has already lost time. HR data on recruitment, labour brokers, working time, grievances and remediation will need to connect with Procurement’s product and supplier records.

Define the events that reopen due diligence

The trigger should be a change that could alter how work is staffed, paid, controlled or heard. The organization can tailor thresholds by product, sector and supplier risk. The following signals are a useful starting point.

Change signal	Why it can raise people risk	Immediate question
Production surge or shorter lead time	Rapid hiring and overtime can increase reliance on labour brokers, coercive scheduling or undeclared subcontracting.	Where will the extra capacity come from and who will recruit it?
New site or subcontractor	The approved supplier may move work to a location with different management, controls and workforce practices.	Has the site been disclosed, mapped and assessed before production starts?
New labour broker or migrant workforce	Workers may face recruitment fees, debt, document retention, tied housing or language barriers.	Who paid for recruitment and can workers leave the job freely?
Unexpected price reduction	A price below a plausible labour cost can shift pressure to wages, hours, housing or unauthorized production.	What changed operationally to support the lower price?
Workforce anomaly	Turnover, absenteeism, injury, wage or grievance patterns may signal stress or hidden harm.	What changed in the workforce and what do workers say caused it?
Delayed or inconsistent evidence	Obstruction, duplicate records or changing explanations can indicate weak control or concealment.	Should purchasing pause while the discrepancy is investigated?

 

A signal isn’t proof of forced labour. It is a reason to ask better questions before the organization adds volume, approves a site or repeats a public claim. The strongest trigger system combines Procurement’s commercial data with HR’s workforce indicators and Legal’s escalation rules.

Build a human risk trigger system

The system can be simple. Procurement records the event when a material order, site, subcontractor, recruiter or price changes. HR reviews the people-risk implications and requests the evidence needed to understand them. Legal determines whether a purchasing hold, investigation, disclosure review or protected legal process is required. The decision and supporting facts are then added to the supplier file.

A risk score can help triage cases, but it shouldn’t be treated as a finding. The score should reflect observable practices and evidence quality, not stereotypes about a workforce or country. A severe indicator, such as confinement or threats, should override the numerical result and trigger immediate action.

Assessment area	Suggested weight	What the review examines
Recruitment and labour brokers	25	Fees, contracts, deceptive terms, recruiter oversight and repayment.
Freedom and document control	20	Ability to leave, identity documents, movement, threats and deposits.
Pay and working time	20	Wage accuracy, deductions, overtime choice, breaks and days off.
Worker voice and remedy	15	Language access, grievance trust, retaliation controls and worker outcomes.
Subcontracting and traceability	10	Approved sites, flow-down controls, material origin and record consistency.
Commercial change pressure	10	Volume, lead time, price and payment changes that may affect labour practices.

An organization might use a low score for routine annual review, a moderate score for targeted documents and worker sampling, and a high score for an independent assessment, purchasing hold and executive review. The exact thresholds matter less than consistent escalation and a written reason for exceptions.

Replace the static supplier code with a workforce covenant

A supplier code states expectations. A workforce covenant turns the highest-risk expectations into continuing duties, evidence rights and remedies. Legal should adapt the language to the contract, jurisdiction and bargaining power. HR should define the workforce substance, while Procurement makes sure the obligations flow into supplier management.

• Require advance disclosure and approval of production sites, subcontractors, labour brokers and material changes in workforce composition.
• Prohibit worker-paid recruitment fees and require prompt repayment when a fee is found, including fees charged by an upstream recruiter.
• Confirm that workers retain control of original identity documents and can leave employment subject only to lawful notice requirements.
• Require accurate wage and working-time records, lawful deductions, voluntary overtime and access to contracts in a language workers understand.
• Provide confidential worker grievance channels, non-retaliation protection and notice of serious allegations or government action.
• Give the buyer proportionate access to records, independent worker interviews and follow-up verification while protecting personal information.
• Set corrective-action deadlines, worker-remedy expectations, cost allocation and rights to pause orders, suspend work or terminate for serious or repeated breaches.
• Require the supplier to flow relevant obligations to recruiters and subcontractors rather than stopping the control at tier one.

A covenant won’t prevent every abuse, and a buyer can’t contract away its own role in creating pressure. It does create the access and leverage needed to investigate, remediate and document. Without those rights, the organization may learn that evidence is unavailable only when it needs it most.

Use worker voice without creating surveillance

Workers can explain conditions that don’t appear in an audit file, but worker engagement can create risk if it is intrusive or poorly protected. The organization should collect the minimum personal information needed, use secure channels, explain confidentiality limits and avoid sharing identifiable comments with supplier managers unless a safe response plan exists.

Questions should focus on work experience. Did the worker pay anyone to get the job? Is the worker paid the amount and at the time promised? Can overtime be refused? Does the worker control personal documents? Can the worker leave the workplace and housing? Is there a complaint route the worker trusts? Has anyone faced retaliation?

The sample should include people whose experience may differ from management’s view, including agency, temporary, migrant, recently hired and recently departed workers where lawful and feasible. HR can set the interview protocol and interpret employment records. Legal can address privacy, privilege and local-law limits. Procurement can require cooperation and act on repeated obstruction.

Use technology as a lead generator

Technology can connect supplier changes, late documents, audit findings, public allegations and commercial data. Artificial intelligence can help screen large volumes of public information or identify inconsistencies for human review. It shouldn’t decide that forced labour exists, produce a supplier blacklist from an opaque score, or replace direct engagement with workers.

Every automated alert should retain its source, date and confidence level. A qualified person should test the underlying evidence and give the supplier a fair opportunity to respond where appropriate. HR and Legal should also prevent the use of biometric monitoring, covert worker surveillance or sensitive personal data that isn’t necessary for the assessment. A tool that creates a new worker-rights problem isn’t an ethical sourcing control.

Plan for remedy before deciding to exit

The fastest commercial response to a serious allegation is often to stop buying. Sometimes that is necessary, especially when harm is severe, continuing or concealed. In other cases, an immediate exit can remove income from the same workers the program is meant to protect and can push production to a less visible buyer.

The escalation plan should separate four decisions. First, protect workers from immediate harm. Second, preserve evidence and prevent retaliation. Third, determine whether the supplier has the ability and willingness to correct the cause. Fourth, decide whether orders can continue, pause or end while remediation is verified.

HR should define the worker outcome the organization expects. That may include recruitment-fee repayment, back pay, document return, safe housing, schedule correction, reinstatement or access to another job. Procurement should link commercial consequences to the corrective plan. Legal should assess reporting, contractual and regulatory duties. The organization can then explain why it used its leverage in the way it did.

Price supplier risk into the sourcing decision

A low unit price can be expensive once labour-risk exposure is included. Procurement and Finance can compare suppliers using a risk-adjusted total cost rather than invoice value alone. The calculation can add the expected cost of disruption, investigation, remedy, extra monitoring and switching to the quoted spend.

Cost item	Supplier A	Supplier B
Quoted annual spend	$4,900,000	$5,000,000
Expected labour risk loss	$220,000	$60,000
Incremental control cost	$60,000	$30,000
Risk adjusted total	$5,180,000	$5,090,000

In this illustrative example, Supplier A appears $100,000 cheaper but costs $90,000 more after expected labour risk and controls are included. The values aren’t market benchmarks. Each organization should use its own probability estimates, contribution margin, replacement cost, contract exposure and control budget.

A second calculation helps set the monitoring budget. Divide annual monitoring spend by the plausible cost of one disruption. If a program costs $75,000 and a well-supported event scenario costs $1 million, the program breaks even if it reduces annual probability or impact by 7.5 percentage points. This doesn’t assign a price to worker harm. It stops the business from treating prevention as a cost with no financial return.

Run a short cross functional review

High-risk suppliers don’t need a new committee with a long agenda. A monthly review can focus on six items: material supplier changes, overdue evidence, worker signals, corrective-action status, commercial decisions and disclosure implications. The team should close each item with an owner, deadline and escalation level.

Procurement brings the change feed and contract leverage. HR interprets workforce signals, training and remedy. Legal confirms the claim and response boundaries. Finance can validate the loss assumptions used for major sourcing decisions. Operations or quality joins when production facts are needed.

The annual Supply Chains Act report then becomes a summary of an operating process that already exists. The organization can describe what it tested, what changed, how it responded and how it measured the result. If a customer or importer asks for evidence, the records are current rather than reconstructed.

Questions to test the system

• Which supplier changes automatically reopen workforce due diligence?
• Can Procurement see the use of labour brokers and subcontractors before work begins?
• Can HR obtain safe, independent worker evidence when a trigger is raised?
• Does Legal have clear thresholds for a hold, investigation, disclosure review and executive escalation?
• Do contracts preserve enough leverage to remedy harm without forcing an immediate exit?
• Can the organization trace a finished good to the relevant sites, suppliers and workforce records?
• Does the sourcing decision include expected labour risk and control costs, or only unit price?

The most important supplier risk may arise after the supplier is approved. A change-trigger system gives HR, Procurement and Legal a way to see it while there is still time to investigate and use commercial leverage. That is the next step in ethical sourcing disclosure: fewer annual assurances, more current evidence about how the work is being done.