Traceability

Effective traceability systems typically include the following interconnected functions:

• Supply chain mapping: Identifies suppliers and the relationships among them. Mapping often begins with direct suppliers, which can then be engaged to provide information on indirect suppliers further upstream.  
• Chain of custody (CoC): Includes processes for tracking and managing materials as they move through the supply chain, including when they are transferred, aggregated, processed, or otherwise transformed. These processes help maintain the link between materials and their associated origin and other relevant information.
• Information transfer: Enables relevant information about product origins, suppliers, attributes, and movements to be reliably recorded, maintained, and communicated between supply chain actors. These functions are often embedded within CoC systems but may also operate through complementary tools and platforms such as supplier reporting or product tracking systems.

When designing, selecting, or evaluating traceability systems, companies should consider whether they demonstrate the following characteristics:

• Accuracy and reliability: Provides information that is sufficiently accurate, current, and complete for its intended purpose.
• Integrity: Includes measures to prevent and detect fraud, double-counting, contamination, undocumented product movement, and other irregularities, as well as mechanisms to investigate and address concerns about system integrity.
• Transparency: Clearly documents the system’s scope, methodology, assumptions, and limitations so users understand what the information does – and does not – demonstrate.
• Data governance: Protects data ownership, privacy, security, quality, and appropriate access in accordance with applicable legal and ethical requirements.
• Interoperability: Uses or aligns with common data standards and exchange protocols so information can be shared and used across companies, commodities, jurisdictions, and traceability systems.
• Equity and inclusion: Supports participation by smallholders and other potentially marginalised producers without creating unnecessary barriers, and enables producers to access and benefit from relevant information where appropriate.
• Verification: Includes mechanisms to check the accuracy and reliability of information and the effectiveness of the system, including through internal controls and, where appropriate, independent verification.

Traceability is complemented by two additional supply chain functions: assessment and control. Together, they enable companies to implement and achieve responsible sourcing. Understanding these three distinct but related activities helps companies design more effective systems, identify gaps, and target improvements.

Supply chain assessment evaluates the attributes of product origins, supply chain volumes, or suppliers. Depending on the level of traceability and objectives of the company, assessment may include one or more of three types of analysis:

• Risk assessment identifies the likelihood that adverse environmental or human rights impacts are present or could arise within a company’s current or future supply chains.
• Compliance assessment determines whether specific product volumes comply with company commitments and other obligations.
• Performance assessment evaluates conditions or progress relative to environmental or human rights objectives. Unlike compliance assessment, it is typically not binary.

These three forms of assessment serve different purposes and are not interchangeable. Risk assessment alone is generally not sufficient to determine product volume compliance. Rather, it helps companies prioritise and guide actions, such as where additional traceability, due diligence, supplier engagement, monitoring, or other risk mitigation measures are needed. Conversely, compliance assessment alone is typically not sufficient to identify or manage future or ongoing risks. Effective due diligence therefore requires both forms of assessment.

Section 2 of the Operational Guidance on Supply Chain Traceability, Assessment, and Control provides detailed recommendations and good practices for conducting credible environmental and human rights risks assessments.

Supply chain control is the ability to manage and regulate presence, movement, and attributes of materials in line with company commitments and other obligations. It combines information about product origins, results of supply chain assessment, and management actions such as purchase controls, supplier engagement, and corrective actions. Supply chain control allows companies to achieve and demonstrate compliance, respond to identified risks and non-compliance, and support continuous improvement.

Supply chain control does not mean that all materials sourced by a company are compliant at any given time. Rather, it means that a company has sufficient information and systems to determine the compliance status of product volumes and act on that information appropriately.

Together, these functions support a cycle of responsible supply chain management. Traceability establishes where materials originate; assessment provides information about environmental and human rights conditions, risk, performance, and compliance; and control uses that information to guide sourcing decisions and actions.

Supply chain control depends on having sufficient traceability to understand where materials originate, together with appropriate assessment and management measures to determine and manage their compliance status. How companies achieve supply chain control depends on their role in the supply chain and the way in which they assess and managed sourced materials.  

• Buyers purchasing directly from producers or operating at the first point of aggregation or processing should establish traceability to individual production units and achieve control directly through their sourcing processes and producer engagement. Because these companies are closest to production origins, they are also best positioned to collect and provide the information needed to support supply chain control further downstream.
• Buyers further downstream should establish sufficient traceability to assess and control for compliance across their entire supply base. This may be achieved through any of four different approaches.  

These four approaches differ in:

• the scale at which control is established (production unit or sourcing area): and
• who implements the control functions (the buyer, a certification system, or a supplier)

Approach 1: Production unit-level control implemented by the buyer

The buyer establishes traceability directly to production units of origin and implements the associated assessment and control processes using its own systems, supported as appropriate by external partners, service providers, and data sources.

Compliance is determined based on assessment of the entire production unit in line with company commitments and other obligations.

Approach 2: Sourcing area-level control implemented by the buyer

The buyer traces materials to a defined sourcing area and implements the associated assessment and control processes at this scale. Sourcing areas may be defined by either a single geographic boundary (such as a jurisdiction or landscape) or by a producer list comprising all production units that supply, or may supply, a particular buyer or supply chain intermediary.

Where sourcing area-level approaches provide sufficient evidence to determine product volume compliance with a high degree of confidence, companies may demonstrate compliance without traceability to individual production units.

Companies using this approach may also need to implement additional control measures to ensure that the full scope of their environmental and human rights commitments is addressed. For human rights in particular, area-level assessment is generally not sufficient on its own and should be supplemented with additional measures such as targeted human rights due diligence, engagement with local rightsholders, grievance mechanisms, and partnerships with local organisations.

Even where sourcing area-level approaches cannot, on their own, demonstrate product volume compliance, they remain valuable for due diligence and supply chain management, for instance by helping companies understand patterns of environmental and human rights risk, prioritise supplier engagement, and target investment in area-level interventions that address systemic risks and drivers extending beyond individual production units.

Approach 3: Use of certification systems

Under this approach, the buyer relies on a credible certification system to provide traceability, assessment, chain of custody, and control functions. The extent to which certification can fulfil these functions depends on three broad considerations: the certification standard’s requirements for production units, the chain of custody model, and the integrity of the certification programme overall.  

Chain of custody (CoC) is particularly important because it determines whether, and how, certified product volumes remain linked to information about the origins and compliance attributes. Where production-level requirements and system integrity are robust, physical CoC models (such as identity preserved, segregated, and controlled mass balance) can generally provide sufficient control to support product volume compliance. By contrast, non-physical CoC models (such as mass balance, controlled blending, and book and claim) generally do not, on their own, enable buyers to determine the origins or compliance status of the specific product volumes they purchase.

Detailed guidance on evaluating certification systems is provided in the AFi’s Working Draft on Uses of Certification in Responsible Sourcing.

Approach 4: Use of supplier control systems

Under this approach, the buyer relies on suppliers and their control systems to carry out some or all functions related to traceability, assessment, and control. Supplier control systems may themselves incorporate one or more of the other three approaches described above.

Reliance on supplier control systems does not eliminate the buyer’s responsibility for supply chain control. Rather, the buyer’s role shifts from directly implementing these functions to assessing, overseeing, and supporting (where needed) supplier systems to ensure that they are adequate to fulfil their intended purpose. This requires the buyer also to have robust systems for communicating expectations to suppliers, ongoing review of supplier information, monitoring of supplier control system effectiveness, and additional due diligence or corrective action where needed.

Buyers can assess supplier control systems across six key areas: 1) alignment with buyer commitments; 2) traceability, assessment, and chain of custody systems; 3 control effectiveness; 4) information management and transparency; 5) verification and assurance; and 6) broader governance and management systems. Together, these elements help determine whether a supplier control system can provide effective supply chain control and, where appropriate, demonstrate product volume compliance with a high degree of confidence.

Where supplier control systems are not sufficient to support product volume compliance, they may still provide valuable information for traceability, risk assessment, or performance assessment, and other aspects of due diligence.

Many companies face traceability gaps in their supply chains. Indirect sourcing, material aggregation and mixing, limited information sharing, and immature systems can make it difficult to ascertain product origins. Where traceability is insufficient, companies should set and communicate time-bound plans improve it, prioritising action in supply chains with the greatest environmental and human rights risks.

To support implementation and transparent reporting, companies should measure and disclose, for each commodity, the proportion of total (100%) sourced volumes that is:

• traceable to the production unit
• traceable to the sourcing area
• traceable to the country of origin
• of unknown origin

This key performance indicator (KPI) helps companies to measure progress towards sufficient traceability. It also aligns with established corporate disclosure systems and assessment methodologies, including CDP.

Shared systems for traceability, assessment, and/or control can help companies scale responsible sourcing beyond their individual supply chains. By working collaboratively, companies can improve consistency, interoperability, efficiency, and accessibility whilst reducing reporting burdens for producers and suppliers. 

Companies should use credible shared systems where available and appropriate. In doing so, companies remain responsible for ensuring these systems provide reliable traceability data, and also support the supply chain controls or compliance assessment they depend on.