Beyond the Certificate: A Six-Point Supplier Evidence Drill for 2026

Procurement teams often receive a supplier file that looks complete: a tabbed PDF, a few certificates and a policy signed by someone. The trouble is that a file can be complete without being reliable. In 2026, regulators and buyers are less impressed by the presence of a document than by whether it is current, specific to the contract and capable of being defended if challenged. The following six-point drill is designed to test supplier compliance evidence before onboarding, during annual review or in response to a regulator's request. It is not a box-ticking exercise. It is a way to separate evidence from decoration.

1. Modern slavery statements: dated, approved and specific

For UK suppliers with a turnover of £36 million or more, the Modern Slavery Act statement must be published, board-approved and signed. Ask for the statement covering the most recent financial year, the board approval date, the signature and the URL. A statement that is undated, unsigned or written in generic language about human rights is a red flag. Check whether it names the supplier's own entity and describes due diligence in its supply chain. If the supplier claims to be out of scope, ask for the turnover test and the basis for the conclusion. Evidence should be a document plus a route to verify it, not a screenshot with no source.

2. Sanctions screening: a process, not a PDF

Sanctions screening evidence is frequently a screenshot of a name check. That is weak. Ask for the screening policy, the list sources used, the frequency of screening, the date of the last full re-screen and the process for handling a potential match. For higher-risk contracts, ask for evidence that beneficial owners and subcontractors are screened, not just the contracting entity. A current screenshot without a list version, date or match-handling record is decorative. The Office of Financial Sanctions Implementation expects firms to have proportionate controls; a supplier should be able to explain its approach without producing a fresh document for the occasion.

3. Subcontractor controls: names, flow-down and audit rights

Many suppliers rely on subcontractors but present a single compliance certificate. Ask for a list of subcontractors involved in the contract, the due diligence performed on each and evidence that compliance obligations flow down in writing. Check whether the supplier has a right to audit subcontractors and whether it has exercised that right. Red flags include phrases such as we only use vetted partners without names, no flow-down clauses and an inability to say who performs the work. If the supplier cannot identify its subcontractors, it cannot assure the buyer that their controls are adequate.

4. Insurance: current, adequate and relevant

Insurance certificates are easy to file and easy to ignore. Check the policy period, the insured entity, the limits and the exclusions. Professional indemnity, public liability, employers' liability and cyber cover may each be relevant depending on the contract. An expired certificate, a limit below the contract value or an exclusion that removes the very risk being managed are red flags. Ask for confirmation that the policy is current as of the date of the review, not just a PDF from a previous year. If the supplier self-insures or uses a captive, ask for the basis and the evidence of financial capacity.

5. Training records: role-specific and recent

Training evidence should show who was trained, on what, when and with what result. A generic induction slide deck is not enough for staff in high-risk roles. Ask for completion dates, assessment results and refresher frequency. For suppliers handling personal data, payments or customer onboarding, check that training covers the specific risks in the contract. Undated slides, a list of names without dates and training that has not been refreshed since the supplier's last policy update are signs that the file is for show. Training is a control only if it changes behaviour; evidence should show that it has been delivered and tested.

6. Incident reporting: proof that the system works

A supplier that has never had an incident may be lucky, well controlled or simply not reporting. Ask for the incident reporting procedure, the escalation route, the log or a sample of recent incidents, redacted where necessary, and evidence of remediation. Check whether the supplier has notified regulators or customers when required. A blank incident log with no explanation is not reassuring. Neither is a policy that describes reporting but no evidence of use. The test is whether the supplier can show that incidents are captured, escalated and learned from.

Red flags that the file is decorative

Across the six areas, certain patterns recur. Undated documents, generic policies, unsigned statements, no named owner, no version control and no link to the actual contract are all warning signs. A file that is made up of certificates but no process is a filing exercise. A file that cannot be verified at source is a risk. A supplier that becomes defensive when asked for the underlying evidence is telling you something about its control environment.

Running the drill

Sample rather than boil the ocean. Pick the highest-risk contracts and request evidence at source. Interview the person responsible, not just the account manager. Test one or two claims: call the insurer, check the modern slavery statement on the register, ask for a redacted incident record. Record the date of the review, the evidence seen and any gaps. Set remediation dates and re-test. Keep the record, because the point of the drill is not only to improve the supplier but to create a defensible trail that shows the buyer asked, checked and acted.

Supplier evidence is not a procurement formality. It is part of the buyer's own control environment. A six-point drill, repeated at onboarding and annual review, turns a decorative file into a live assurance process. In 2026, that is the difference between a supplier file that can be produced and one that can be defended.