Supplier Compliance

A policy sits signed in Procurement, training lists are scattered across emails, and no one can explain the status of individual sites during an audit. The problem is rarely a lack of good intentions. What is missing is an end-to-end connection among risk, contractual expectations, demonstrated capability, and reliable evidence.

• Supplier compliance starts with risk-based segmentation, not the same mandatory course for everyone.
• A code of conduct sets expectations; training translates those expectations into specific actions.
• Suppliers cannot be managed through HR processes and employment-related directives. The contract, Procurement, and the supplier organization fulfill that role.
• A completion record must clearly connect the person or role, supplier company, course version, result, and validity.
• The German Supply Chain Due Diligence Act (LkSG) identifies training at direct suppliers as a potential preventive measure, but it prohibits companies from broadly transferring their own due diligence obligations.
• Audit reporting shows completion rates as well as gaps, exceptions, expiring records, remediation measures, and the effectiveness of the overall process.

Suppliers belong to a separate organization. Your company generally has no employment-related authority to issue instructions, no complete personnel data, and no direct access to internal communication channels. The obligation therefore arises through the supply contract, purchasing terms, code of conduct, or specific security requirements. The supplier, in turn, determines which employees perform an activity and who is responsible for training internally.

For employee training, identities come from the HR system, managers track deadlines, and internal policies apply directly. Customer training focuses primarily on successful use and adoption. Partner training often connects competence with certification, brand standards, or sales objectives. Supplier training follows a different logic: It controls access to contracts, sites, data, or critical processes based on a documented risk.

First, the legal entity always matters alongside the learner: Which supplier company, site, and contract belong to the record? Second, supplier personnel and subcontractors often change without your HR system being notified. Third, the process must work in multiple languages and with limited internal context. Fourth, every requirement needs a contractually defined consequence if evidence is missing or an assessment is not passed.

An Extended Enterprise LMS supports this separation through tenants, external administrators, dedicated roles, and separate reports. This is precisely what distinguishes it from an internal course catalog that has merely been opened to guest users.

There is no general obligation to train every supplier on every compliance topic. Scope and evidence depend on the applicable law, contractual role, activity, and risk. Legally defensible supplier compliance therefore begins with a documented rationale: Why is this specific audience receiving this specific requirement?

The German Supply Chain Due Diligence Act (LkSG) expressly identifies training and professional development as a preventive measure for direct suppliers. This requires a previously identified human rights or environmental risk. The measure is intended to support enforcement of contractual assurances and must be appropriate and effective.

The BAFA guidance on cooperation in the supply chain clarifies this boundary: Obligated companies remain responsible themselves, should align content and audiences with the risk, and may define organization and cost allocation by contract. A blanket transfer of all LkSG obligations to suppliers does not meet this standard.

The GDPR also does not impose blanket data privacy training on every supplier. If a service provider processes personal data on behalf of a controller, Article 28 GDPR requires sufficient guarantees, documented instructions, and an appropriate contract. Training then becomes a useful part of the organizational measures for people with access to data. A raw-material supplier with no data connection does not need a general GDPR course solely because it is a supplier.

For particularly important and important entities, Section 30 BSIG requires documented, proportionate risk management measures. These include supply chain security as well as basic training and awareness. The law does not automatically turn this into an identical training requirement for every supplier employee. The deciding factor remains which providers affect systems, components, data, or critical services.

The code of conduct describes expectations, but it does not replace a risk assessment or implementation controls. First, determine which version applies to each supplier category and how it becomes part of the contract. The acknowledgment must show who agreed on behalf of which company and in what representative capacity. The timestamp, language version, document version, and contract reference belong in the same record.

Procurement, Compliance, and the relevant business unit then translate abstract rules into observable behavior. For example, “ensure information security” becomes incident reporting channels, rules for privileged access, and a binding process for handling vulnerabilities. Human rights expectations become procedures for risk identification, escalation, and the flow-down of relevant requirements to subcontractors.

The acknowledgment must not become a click with no consequences. Contracts need to clarify who registers participants, organizes training, pays the costs, provides evidence, and remediates deviations. Coordinate the content and process with Legal and Data Privacy for the specific situation. Digital compliance training provides the learning and evidence logic; the legal basis is established outside the LMS.

A training matrix connects supplier risk, activity, and target role. An IT service provider with administrator access receives different content from a logistics company, an on-site cleaning company, or a manufacturer in a high-risk country. Within the same supplier, requirements also differ for executive management, compliance officers, local managers, and operational staff.

Common subject areas include human rights and environmental requirements under the LkSG, data privacy, information security, occupational safety, quality, product safety, hygiene, export controls, anti-corruption, and whistleblowing systems. This list does not create an automatic requirement. Every assignment needs a documented trigger such as the risk category, data access, activity, site, contract type, or regulatory scope.

A foundation module explains expectations and reporting channels. Role modules train people to make specific decisions: How should a supplier respond to suspected forced labor? What deadline applies to an IT security incident? Who may access personal data? Scenarios and short knowledge assessments test the ability to act more effectively than a simple acknowledgment that someone opened a PDF.

Effective mandatory training is available in the necessary languages, works on mobile devices, and accommodates low bandwidth. Secure invitations, group registration, or supervised sessions are suitable for employees without their own accounts. The supplier reports role changes and departures; your system uses that information to create new assignments or block access that is no longer required.

A certificate alone answers too few questions in an audit. The record must show why training was required, who completed it in what context, and whether the status was valid at the time of the audit. This requires a traceable chain from the risk record and assignment through the result and any remediation measures.

At a minimum, relevant information includes the supplier ID and legal entity, site or contract, unique person or defined role, course and policy version, language, reason for assignment, start and completion, assessment result, acknowledgment, expiration date, and change log. For externally issued certificates, also document the issuer, assessment criteria, file, and verification status.

There is no universal retention period. To demonstrate fulfillment of LkSG due diligence obligations, Section 10 LkSG requires ongoing internal documentation and retention for at least seven years. At the same time, purpose limitation, data minimization, and storage limitation apply to personal learning data. A deletion and access policy must therefore balance the need for evidence and data privacy for each record.

A good dashboard answers three levels separately: Is the individual record valid? Is the supplier meeting its agreed completion rate and deadline? Does the program effectively cover the prioritized risks? A completion rate alone blends these questions together and can conceal critical gaps even when the status is green.

Filter reports by risk category, supplier, site, contract, role, and requirement. Show open, overdue, and soon-to-expire records, failed assessments, approved exceptions, and ongoing remediation measures. This creates reliable audit-ready training management and shortens preparation for internal and external audits.

Automation begins with events: a new contract, new person, role change, certificate expiration, policy change, incident, or changed risk category. The system assigns the appropriate content and first reminds the individual, then the supplier administrator, and finally Procurement or Compliance. A purchase order block is applied only when the contract, risk assessment, and approval rule support it.

Measure effectiveness as well. Sampling, audit findings, incidents, reports, and remediation times show whether people apply the content. The LkSG requires an annual and event-driven review of the effectiveness of preventive measures. Learning statistics provide one input, but never the sole evidence.

Start with a limited risk area, such as IT service providers with privileged access or direct suppliers in a critical product category. This lets you test governance and technology under real conditions before adding more countries, sites, and supplier categories.

1. Name responsible owners in Procurement, Compliance, Legal, Data Privacy, IT, and the relevant business unit.
2. Segment suppliers by risk, activity, access, site, and contract reference.
3. Assign a legal basis, target role, evidence requirement, and validity period to every requirement.
4. Embed the code of conduct, training, costs, controls, and escalation in the contract.
5. Automate registration, assignment, assessment, certification, and reminders in an external learning environment.
6. Connect learning status with supplier management, approvals, and remediation measures.
7. Review annually and when triggered whether content, target audiences, and controls remain effective.

A pilot needs clear success criteria: complete assignment of critical roles, fewer manual follow-ups, timely recertification, and shorter audit preparation. The learning architecture can then expand to additional external audiences. The article on Extended Enterprise Learning shows how the platform, content, and governance work together.

_{Header image: AI-generated}