Recent audit results from Sweden’s regions revealed that twelve of eighteen audited suppliers could not demonstrate a continuous process for identifying and addressing risks to human rights and the environment.
The suppliers operated across sectors including medical products, surgical instruments and food. While the figures relate to public procurement, the findings raise a broader question: how prepared are companies in practice to identify and manage risks in their value chains?
The answer matters because due diligence is ultimately not about compliance systems, reporting requirements or audit results. It is about people.
When companies fail to identify risks, workers may continue to face unsafe working conditions, excessive working hours, recruitment-related exploitation or other human rights impacts. Communities may continue to be exposed to environmental harm. The purpose of due diligence is to ensure that these risks are understood early enough for companies to prevent or mitigate them.
The most common gap: understanding risk
According to the audit summary, the most common deficiency was the absence of a systematic risk analysis process.
This finding is significant. Risk analysis is the foundation of human rights and environmental due diligence. Without a structured process to identify where risks are most likely to occur and who may be affected, companies struggle to prioritise actions, engage relevant stakeholders or demonstrate that their efforts are targeted where they matter most.
In many cases, companies have policies, supplier requirements and contractual clauses in place. But these measures alone do not necessarily provide visibility into what is happening in practice.
The challenge is often not a lack of commitment. It is a lack of insight.
Who are the workers producing the goods? How were they recruited? Are vulnerable groups disproportionately exposed to risks? Are there environmental impacts affecting local communities? Which parts of the value chain present the greatest likelihood of severe harm?
These are the questions effective due diligence seeks to answer.
Public procurement as a driver of responsible business conduct
The audit results also highlight the increasingly important role of public procurement.
Public procurement exists first and foremost to secure the goods and services needed to deliver essential public services. Yet it also represents a powerful mechanism for promoting responsible business conduct.
By integrating due diligence expectations into procurement requirements and contract management processes, public buyers can create incentives for companies to identify and address risks in their operations and supply chains.
Importantly, this does not need to increase administrative burden. Harmonised requirements, common methodologies and coordinated follow-up can create greater predictability for suppliers while reducing duplication of effort. This is particularly important for small and medium-sized enterprises, which often have limited resources but play a significant role in public supply chains.
A recently published European Commission report on responsible business conduct in public procurement similarly highlights the potential of public purchasing to strengthen due diligence practices and promote more responsible business conduct across the EU.
A changing regulatory landscape does not remove expectations
At the same time, many companies are navigating uncertainty following recent changes to the EU sustainability regulatory framework.
While discussions around CSRD, ESRS and CSDDD continue to evolve, the underlying expectation that companies understand and manage their impacts on people and the environment has not disappeared.
In practice, many organisations are asking the same questions:
- What due diligence expectations remain?
- What information will customers and public buyers request?
- How can companies build processes that create value regardless of regulatory developments?
The Swedish audit results suggest that these questions remain highly relevant.
The challenge facing many organisations today is not whether due diligence matters. It is how to make it work in practice.
Moving from requirements to implementation
The findings from Sweden’s regions offer an important reminder that responsible business conduct depends on more than policies and commitments. It requires companies to understand where risks exist, whose rights may be affected and what actions are needed to prevent harm.
For organisations that succeed, due diligence becomes more than a compliance exercise. It becomes a way to strengthen relationships with workers, suppliers, communities and customers while building more resilient and responsible value chains.
Related webinar
On 9 June, Enact will host a webinar together with representatives from Sweden’s regions and public procurement experts from across the Nordics to discuss what these developments mean for suppliers and public buyers in practice. Register here