.png)
TL;DR:
- EU regulations now demand Romanian companies produce verifiable, traceable supply chain sustainability evidence for compliance. Effective audits require risk-based prioritization, comprehensive checklist preparation, on-site engagement, and traceability of corrective actions, supported by continuous improvement efforts. A holistic supply chain management system, incorporating complaints and KPIs, is essential for genuine risk mitigation and CSRD assurance readiness.
EU regulations are no longer a distant concern for Romanian companies. If you are a sustainability or compliance manager at a mid-size or large firm, the question of how to audit supply chain sustainability is almost certainly on your desk right now. The Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) together demand that you move beyond good intentions and produce traceable, verifiable evidence of what your suppliers are actually doing. This guide walks you through every stage, from scoping your risk exposure to preparing for external assurance, with enough specificity to be genuinely useful.
Table of Contents
- Understanding your audit scope and risk-based prioritization
- Preparing a comprehensive audit checklist and evidence collection plan
- Conducting the on-site audit and engaging suppliers effectively
- Ensuring audit evidence traceability and managing corrective actions
- Preparing for CSRD and EU assurance: audit-ready reporting and continuous improvement
- Why a holistic approach beats audit checklists alone in supply chain sustainability
- Empower your supply chain sustainability audit with ECONOS ESG consulting
- Frequently asked questions
Key Takeaways
| Point | Details |
|---|---|
| Risk-based approach | Focus your audit on the most severe and likely adverse sustainability impacts for effective compliance. |
| Comprehensive evidence | Collect traceable, source-linked documents and combine audit findings with complaints and KPIs. |
| Corrective action plans | Use CAPs with root cause analysis and verification to ensure supplier improvements. |
| Assurance readiness | Prepare consistent methodologies and data lineage for CSRD external assurance requirements. |
| Holistic system | Integrate audits, complaint channels, and monitoring for robust supply chain sustainability management. |
Understanding your audit scope and risk-based prioritization
Having outlined the importance of auditing supply chains under EU regulations, you need to begin by defining where to focus your audit resources effectively. Not every supplier carries equal risk, and spreading your audit effort evenly across all of them is one of the most common and costly mistakes we see.
CSDDD requires companies to prioritize the most severe and likely adverse impacts for risk-based due diligence audits. In practice, this means building a risk map before you schedule a single site visit. Your map should factor in:
- Country risk: Suppliers operating in countries with weak labor protections or high deforestation rates score higher.
- Sector risk: Raw material extraction, textile manufacturing, and chemical processing carry different baseline risks than logistics providers.
- Spend and volume: High-volume or high-value relationships generally warrant closer scrutiny.
- Incident history: Prior non-conformances, complaints, or reported violations are strong predictors of future issues.
- Product type: Understanding EU sustainability compliance processes helps you recognize which product categories trigger specific regulatory obligations.
The risk map is not a one-time exercise. Suppliers change ownership, add new production lines, or subcontract without telling you. Build a cadence, at minimum annually, for updating your map. You should also review it immediately after any significant incident, a recall, a media report, or a worker complaint.
Pro Tip: Use a simple scoring matrix (likelihood x severity = risk score) to rank suppliers into tiers. Tier 1 suppliers get full on-site audits; Tier 2 get desk-based reviews or questionnaires; Tier 3 get periodic monitoring. This alone makes your audit program defensible under CSDDD scrutiny and keeps your budget realistic.
Pairing your internal data with external tools, such as sector-specific sustainability assessment strategies or country-level risk databases, sharpens your prioritization considerably. The goal is not to audit everything. It is to audit the right things, deeply enough to matter.
Preparing a comprehensive audit checklist and evidence collection plan
Once you have scoped your audit, the next step is to prepare detailed tools and documents to enable thorough evidence collection and evaluation. This preparation phase determines whether your audit produces defensible results or just a snapshot that looks good on paper.
Effective supplier audits require pre-audit documentation review, structured on-site assessment, and corrective action plans, not just pass/fail scoring. Start your preparation with a pre-audit document request. Send this to your supplier at least two to three weeks before the visit.
Pre-audit document request: what to ask for
- Environmental permits, licenses, and waste disposal records
- Energy consumption data and utility bills for at least the past 12 months
- Certifications held (ISO 14001, ISO 45001, SA8000, or equivalents)
- Previous audit reports and any open non-conformance records
- Employment contracts, payroll records, and working hours logs
- Health and safety incident logs and training records
- Subcontractor lists and any second-tier supplier disclosures
Once documents arrive, review them before you travel. Flag discrepancies, missing data, or expired certifications. These become your interview questions on-site.
Core checklist categories for on-site assessment
| Area | Key questions | Evidence type |
|---|---|---|
| Environmental | Water and energy use vs. benchmarks? Waste disposal compliant? | Meter readings, disposal manifests |
| Social and labor | Working hours within legal limits? Wages at or above minimum? | Payroll, time sheets, contracts |
| Health and safety | PPE use visible? Emergency exits clear? Incident rates tracked? | Observation, incident logs |
| Governance and compliance | Grievance mechanisms in place? Anti-corruption policy communicated? | Policy documents, training records |
| Packaging and circularity | Packaging materials documented? Reduction targets set? | Material specs, supplier declarations |
Auditing packaging sustainability deserves special attention under the EU Packaging and Packaging Waste Regulation. Ask specifically for material composition data and end-of-life treatment documentation.
Pro Tip: Build your checklist against a recognized framework such as the EcoVadis supplier checklist or the UN Guiding Principles on Business and Human Rights. Doing so not only improves audit quality but also means your findings map directly to disclosure requirements you will face under ESRS S2 (own workforce in the value chain).
A corrective action plan (CAP) template should be part of your toolkit before you arrive on-site. When you find a non-conformance, you want to capture root cause, required action, responsible person, and verification date, not just the symptom. That structured approach is what ESG compliance guidance consistently points to as the difference between an audit that drives change and one that collects dust.
Conducting the on-site audit and engaging suppliers effectively
With your tools ready, you can now execute the audit on-site, gathering evidence through observation and engagement to validate supplier sustainability. The audit day itself is where preparation either pays off or falls apart.
A defensible supplier audit involves a combination of document review, physical observation, worker interviews, management interviews, and a closing meeting. Here is how to structure the day:
- Opening meeting: Set the tone. Clarify the audit scope, the methodology, and what happens with findings. Reassure management this is a collaborative process, not a punitive inspection.
- Document verification: Cross-reference what was submitted pre-audit against originals on-site. Look for inconsistencies in dates, signatures, or data formatting. These are often the first signal of document manipulation.
- Site walkthrough: Walk the factory floor with fresh eyes. Is the reality consistent with the documented procedures? Common discrepancies include blocked emergency exits, unlabeled chemical storage, and overtime records that do not match shift patterns you observe.
- Worker interviews: This is the most underused and most valuable part of the audit. Conduct these privately, away from management, and in the worker’s preferred language if at all possible. Ask open questions: “Can you tell me about a normal workday?” rather than “Are your working hours legal?”
- Management closing meeting: Share preliminary findings without issuing final scores. Agree on CAP timelines and next contact dates before you leave the building.
Practical tips for better on-site engagement:
- Bring a local language speaker or hire a local auditor for suppliers outside Romania.
- Cross-check utility bills against production records. Energy consumption that does not correlate with output volumes is a red flag for unreported subcontracting.
- Photograph non-conformances with your audit report reference visible. This makes evidence traceable and harder to dispute later.
Pro Tip: Use the ESG compliance strategies relevant to your industry sector to calibrate what “normal” looks like before you arrive. A textile factory in a high-risk country should be benchmarked differently from a packaging supplier in Poland. Context is everything when you are trying to assess supply chain impact fairly.
The goal is not to catch suppliers failing. It is to understand the real situation well enough to support genuine improvement. That mindset shift, from inspector to partner, also tends to produce more honest conversations and better data.
Ensuring audit evidence traceability and managing corrective actions
Having completed your on-site audit, the critical next phase is to ensure your audit evidence and corrective actions are traceable and effectively managed for compliance assurance. An audit that cannot be reconstructed by a third-party reviewer is not an audit. It is a document with a date on it.
Compliance audit readiness requires traceable evidence from source documents and formal corrective action plan verification, not just pass/fail results. For supply chain carbon audits specifically, this means your Scope 3 emissions calculations must reference the original supplier activity data, with methodology choices documented and deviations explained.
What good evidence traceability looks like in practice:
- Each finding in your audit report links to a specific document, photograph, or interview note with a unique reference code.
- Emission calculations reference the source record (utility bill, freight invoice, production data) and the emission factor used, with its database source and version noted.
- CAP entries include the original finding reference, root cause analysis, agreed action, responsible person, deadline, and a verification record confirming closure.
| Weak audit documentation | Strong audit documentation |
|---|---|
| “Supplier has some waste management issues.” | “Finding #07: Hazardous waste storage unlabeled, ref. photo W-07-003, EU Directive 2008/98/EC violation.” |
| “Emissions data provided by supplier.” | “Scope 3 Cat. 1 data: supplier invoice #INV-2024-1156, 4.2 tonnes CO2e, EF: ecoinvent v3.9.1.” |
| “CAP sent to supplier.” | “CAP #07 closed 14 Feb 2025, verified via updated disposal contract and re-inspection photos.” |
Feed your CAP learnings back into your risk map. A supplier that needed three rounds of follow-up to close a single finding is telling you something about their management system maturity. That should influence their next audit tier.
Pro Tip: Track carbon footprint data and audit findings in the same system if possible. When your CSRD assurance provider arrives, they will want to see that your sustainability data and your supplier risk evidence come from an integrated, controlled process, not separate spreadsheets maintained by different teams.
Preparing for CSRD and EU assurance: audit-ready reporting and continuous improvement
Once your audits generate traceable evidence, focus shifts to preparing that data and processes for CSRD assurance and continuous compliance improvement. This is the stage where many companies realize, sometimes painfully, that their data is solid but their documentation of how they got there is not.
CSRD requires external assurance with traceable sustainability data and documented methodologies, transitioning from limited to reasonable assurance by 2028. That transition is not trivial. Limited assurance allows some reliance on management representations. Reasonable assurance demands evidence chains that an external auditor can independently verify.
Steps to build audit-ready reporting:
- Engage your assurance provider early. Do not wait until the reporting deadline. Ask them what evidence they expect for each material disclosure and work backwards from there.
- Apply internal controls to sustainability data. Treat your supply chain emissions data with the same rigor as financial data: access controls, version history, sign-off procedures, and change logs.
- Document your materiality assessment process. The ESRS double materiality assessment is itself subject to assurance. Keep records of who was consulted, what sources were used, and how impact, risk, and opportunity scores were assigned.
- Create a source-to-report audit trail. For every material KPI in your sustainability report, you should be able to trace back through: the reported figure, the aggregation logic, the underlying data, and the original source document.
- Plan your improvement roadmap explicitly. Assurance providers respond well to companies that acknowledge current limitations and show a credible plan to address them. This is not weakness. It is accountability.
Continuous improvement means your audit findings this year inform your supplier development program next year. Some sustainability report preparation frameworks now explicitly require companies to describe how prior-year findings influenced current-year practices. That feedback loop is also the core logic of the CSDDD’s management system approach.
Why a holistic approach beats audit checklists alone in supply chain sustainability
Here is something we have observed working with companies across Romania and beyond: a well-executed audit program can actually create a false sense of security. Companies complete their annual supplier visits, issue CAPs, close findings, and declare their supply chain managed. Then a labor violation surfaces in a factory that passed its audit six months earlier.
Audits alone are insufficient; companies need a closed-loop system including complaints channels and monitoring to truly manage supply chain risks. The audit captures a moment. Your supply chain operates every day.
The CSDDD’s framework reflects this reality explicitly. It expects companies to maintain confidential complaints and grievance mechanisms accessible to workers and communities, not just to your procurement team. A worker who cannot safely report a violation to your company will not do so in an auditor’s interview either.
Sustainable supply chain metrics need to include leading indicators, not just audit scores. Track the rate of supplier self-reported incidents (a sign of trust and openness), response times on grievance submissions, and the recurrence rate of the same finding across audit cycles. These numbers tell you more about systemic health than a pass/fail count.
We would also argue that treating supply chain risk management strategies as a management system function, rather than a procurement or CSR side activity, changes what is possible. When audit evidence, complaints data, and KPI monitoring feed into a single governance process with executive ownership, you can actually detect and remediate issues before they become regulatory violations or reputational crises. That is the standard CSDDD is pointing toward. Spot checks cannot get you there alone.
Empower your supply chain sustainability audit with ECONOS ESG consulting
Knowing the steps is one thing. Building the internal capacity to execute them, consistently, across dozens of suppliers, and in a way that will satisfy an external assurance provider, is another challenge entirely.
At ECONOS, we help mid-size and large Romanian companies design and run supply chain sustainability audit programs that are built for EU compliance from the ground up. Our work covers risk-based carbon footprint assessments, structured ESG reporting services, EcoVadis certification preparation, and full readiness for EU law compliance under CSRD, CSDDD, and CBAM. We do not just deliver reports. We build the internal knowledge and processes so your team can run these audits independently over time. If you want to turn your supply chain sustainability audit into a repeatable, defensible, and genuinely useful system, we are ready to work alongside you.
Frequently asked questions
What is the first step in auditing supply chain sustainability under EU rules?
Begin with a risk-based assessment to identify and prioritize the most severe and likely sustainability impacts in your supply chain. CSDDD prioritizes highest severity and likelihood impacts in supply chain due diligence, so your audit scope must reflect that logic before any site visits occur.
How can I ensure my supply chain emissions data is audit-ready?
Thoroughly document your emission calculation methods, maintain traceability to source records, and disclose quantified exclusions with justified assumptions. Audit-ready emissions data requires documented methodology choices and traceable evidence chains back to source documents.
Why are corrective action plans important in supplier audits?
They ensure that identified non-conformances are properly addressed, with root causes analyzed and remediation verified to prevent recurrence. Corrective action plans with verification are essential for defensible supplier audits and sustainable improvement over time.
What does CSRD assurance require from companies?
External assurance with traceable, consistent data, documented methodologies, and a credible path toward reasonable assurance by 2028. CSRD mandates external limited assurance starting from the first reporting year, with the transition to reasonable assurance expected by 2028.
How can companies supplement audits to manage supply chain risks effectively?
By integrating confidential complaints mechanisms, monitoring KPIs, and combining multiple data sources to detect and remediate risks that audits alone cannot surface. Complaints channels and monitoring are critical complements to audits for effective supply chain risk management under CSDDD.