How Large Companies Should Redesign Supplier ESG Questionnaires Around the Value Chain Cap

Many large organisations operate several supplier-data systems at once: a sustainability reporting workbook, procurement portal, human-rights questionnaire, climate survey, product-compliance form and bank or rating template. Each system may ask for the same employee, emissions or policy information in different words. Suppliers experience the combined burden, while the reporting undertaking often cannot explain which answer supports which disclosure.

The value chain cap requires a different design discipline. The legal question is not whether a questionnaire appears “proportionate” in general. It is whether a specific reporting-purpose request from a protected undertaking exceeds the Annex II datapoints for the relevant employee band. The commercial and governance question goes further: is each requested item actually necessary, or can the reporting undertaking use existing information, a less detailed datapoint or an estimate?

Figure 1. Seven design gates produce a shorter, purpose-labelled questionnaire with fewer duplicates and a defensible request record. London Reporting Academy learning visual.

Every question needs a purpose field. For the cap analysis, the critical label is whether the information is sought for sustainability reporting required by the Accounting Directive. Other purpose labels may include due diligence, risk management, procurement qualification, product regulation, sustainable finance, customer commitments or voluntary supplier development.

Purpose should describe actual intended use, not serve as a drafting convenience. If the same answer supports two purposes, record both and apply the relevant controls separately. A mixed portal can remain operationally convenient while still displaying purpose at field or section level.

The requester should collect only the information needed to determine the applicable path. A protected-undertaking self-declaration can state the supplier legal entity, value-chain relationship, average employee number during the preceding financial year, basis and period, authorised signatory and expiry. The Directive permits reliance without routine verification unless the requester knows, or can reasonably be expected to know, that the declaration is manifestly incorrect.

Within protected undertakings, Annex II distinguishes those with 10 employees or fewer from those with more than 10 employees. The questionnaire engine should therefore branch before environmental and Comprehensive Module questions are presented.

A topic map is insufficient. Store the disclosure reference, paragraph, subpoint, employee-band inclusion, requested unit, period, boundary and evidence expectation. If a question combines several elements, split it. For example, “Provide emissions and your detailed decarbonisation plan” combines a potential B3 datapoint with information that is not necessarily in Annex II.

Annex II design map

Annex II is a ceiling, not a default questionnaire. The adopted text stresses that reporting undertakings should request information only insofar as needed and should request less than the standard set where they do not need all of it. A necessity test converts that principle into a reviewable decision.

A question that has no identified reporting use, no owner and no consequence when unanswered is a strong candidate for deletion. Analytics should track response rate and actual downstream use; low-use questions should not survive merely because they have always been asked.

Mixed-purpose questionnaires are not prohibited, but they must be transparent. Use visible section labels or field-level metadata showing which questions support reporting, due diligence, risk management, procurement or another purpose. Explain any separate obligation or commercial consequence for non-reporting questions.

Where a reporting undertaking requests information above the voluntary standards for the reporting purpose, it must ensure that protected undertakings are informed which information exceeds the standard and of their statutory right to decline. The notice should therefore be specific and visible before submission, not hidden in a general terms page.

The interface should allow the supplier to decline the identified excess without triggering validation errors that block the whole submission. Where an answer is voluntary, the interface should say so. Where another legal or contractual basis applies, identify it accurately rather than describing every question as mandatory.

A disclosure datapoint and its supporting evidence are not the same request. Asking for an accident number does not automatically justify every incident file; asking for an emissions value does not automatically justify every invoice. Define a tiered evidence policy: no evidence for routine low-risk fields, methodology or public link for moderate-risk fields, sample or redacted evidence for selected fields, and secure access only where genuinely necessary.

The Directive recognises that value-chain information can be met through direct supplier information or estimates as appropriate. A requester should therefore document when an estimate, proxy, sector average or model is acceptable and avoid shifting all uncertainty and calculation cost to the supplier. The final report should explain the method and limitations where required.

The requester should operate a central question library and supplier response store. Business functions may consume the same approved answer for different purposes, but the system must preserve purpose, access and version. Suppliers should not be asked to re-enter the same legal entity name, employee band, policy link or annual metric in several portals.

Canonical question ID: one concept independent of portal wording.

Data owner: responsible internal function for the question and downstream use.

Supplier profile reuse: entity, period and protected-status information collected once.

Duplicate rule: blocks new questions that map to an existing concept unless a genuine difference is documented.

Expiry logic: asks for refresh only when the answer or reporting period has expired.

Recipient view: supplier can see prior responses and what has changed.

A supplier questionnaire should be approved like a reporting control, not like a marketing survey. The governance owner should include sustainability reporting, procurement, legal, data governance and, where relevant, due diligence and risk functions. Internal audit or assurance teams should be able to trace a sample question from the supplier interface to the reporting requirement, necessity decision, response, transformation and published disclosure.

Context. Orion Industrial Group uses four questionnaires: annual sustainability reporting, procurement onboarding, human-rights due diligence and climate-risk assessment. Its 3,000 suppliers receive overlapping requests from different teams, and the reporting team cannot show which responses are actually used.

Redesign. Orion creates a common supplier profile and accepts a protected-undertaking self-declaration. It maps reporting fields to exact Annex II datapoints and branches the questionnaire for 10-or-fewer and more-than-10 employee bands. It removes reporting questions with no identified disclosure use, introduces estimates for low-risk non-response and separates due-diligence case questions into a risk-triggered module.

Rights and duplicates. Above-cap reporting-purpose fields are visibly marked and include the right-to-decline notice. The system detects duplicate employee, emissions and policy questions across procurement and sustainability modules. Supplier answers are reused internally with purpose and access metadata.

Outcome. The average protected supplier sees 34 questions instead of 117. Orion retains a question-level audit trail and can explain to its assurer which supplier datapoints, estimates and limitations support the final report. Procurement still receives needed information, but no longer presents its entire programme as a mandatory reporting request.

Supplier status: Protected Undertaking Self-Declaration: What Suppliers and Requesters Should Document.

Supplier response: How to Respond to an Above-Cap Sustainability Data Request Without Damaging the Customer Relationship.

Response operations: How to Answer Customer and Bank ESG Questionnaires Using the EU Voluntary Standard.

Publication channels: Must an EU Voluntary Sustainability Report Be Public?