Contractor and supplier compliance: due diligence, flow-down clauses and ongoing monitoring

Where supplier compliance risk actually lands

Outsourcing a function does not outsource the obligation. In almost every Australian regime, the duty stays with the entity that holds it, and using a supplier simply adds a party whose conduct the entity must now manage.

The clearest statutory expressions of that principle are in work health and safety, where the primary duty under section 19 of the model WHS Act extends to workers whose activities the business influences or directs — covered in the WHS primary duty — and in the heavy vehicle chain of responsibility, where parties across the transport chain each carry a duty regardless of who physically drove. Privacy carries the same logic: disclosing personal information to a service provider does not transfer the entity's obligations under the Australian Privacy Principles.

The consequence for the compliance program is that every material supplier relationship should appear on the obligations register as a control dependency, not as somebody else's problem.

Tiering the supplier base

Applying the same diligence to every supplier is unaffordable and unnecessary. Tier the base on two axes — criticality to the business and compliance exposure created — and set the required diligence per tier.

Two rules keep the tiering honest. First, tier by exposure rather than spend — a low-cost supplier with access to a customer database is critical. Second, re-tier when scope changes, because supplier scope creep is how uncontrolled relationships form.

APRA-regulated entities have a prescribed version of this exercise. CPS 230 operational risk management commenced 1 July 2025 and requires regulated entities to identify material service providers, maintain a register of them, and meet specified contractual requirements; APRA set a transition to July 2026 for existing material service provider contracts and finalised targeted amendments in April 2026 (checked August 2026). See APRA's CPS 230 page.

Pre-contract due diligence

Diligence should collect evidence, not assertions. A questionnaire returned with every box ticked and no attachments has told you nothing.

Core evidence set for a critical supplier:

• Identity and standing. ABN and entity name, company extract, ownership, whether the trading entity is the contracting entity. Insolvency and disqualification checks where the engagement is material.
• Licences and registrations. The specific licences the work requires, verified against the issuing register rather than a supplied certificate. Labour hire is the common trap — see labour hire licensing by state and the labour hire licence check.
• Insurances. Certificates of currency with policy limits, expiry dates and named insured matching the contracting entity.
• Work health and safety. Safety management system evidence, incident history, high risk work licences where relevant.
• Workforce arrangements. Whether the supplier engages employees or subcontractors, and how far down the chain the work is subcontracted. Engagement-model risk is discussed in the employee versus contractor test.
• Information security and privacy. Where the supplier handles personal information or connects to systems: security controls, hosting locations, subprocessors, incident notification capability. The Essential Eight assessment and the ISO 27001 gap assessment provide a structure.
• Modern slavery and ethical sourcing. Where the entity is a reporting entity, supplier responses feed the statement.
• Financial capacity. Proportionate to criticality and contract term.

Record the outcome, including any conditions imposed and the date, in the contract register. Diligence performed and undocumented is diligence you cannot rely on later.

Flow-down clauses that do real work

Most supply contracts contain a general compliance clause requiring the supplier to comply with all applicable laws. That clause is close to worthless on its own: it creates a contractual right but no visibility, no evidence and no ability to act before failure.

Clauses that actually function:

Two clauses matter more than the rest in practice. Notification of non-compliance is what allows your incident register to start its clocks on time — see incident and breach registers. Subcontracting control with flow-down is what stops the terms disappearing one tier down, which is where most supply chain failures are found.

Ongoing monitoring after signature

Diligence at onboarding decays. Monitoring should be proportionate to tier and mostly automatable.

Expiry dates are the highest-value automation in the whole process. Licences, insurances, certifications and contract terms all expire, and the contract register plus the compliance calendar should be driving reminders well before the date rather than after it.

Supplier failures should be logged in your own incident register with the supplier named, so that repeat patterns are visible at renewal.

Regimes that name suppliers explicitly

Several Australian regimes reach into the supply chain directly, and these should be mapped on the obligations register with the supplier dependency noted:

• Modern slavery reporting. Entities with consolidated revenue of at least $100 million must report on modern slavery risks in their operations and supply chains, with statements due within six months of the end of the entity's own financial year (checked August 2026); statements are published on the Modern Slavery Statements Register. See when a modern slavery statement is due and the threshold checker. The Modern Slavery Act 2018 sets out the mandatory criteria.
• Chain of responsibility. Under the Heavy Vehicle National Law, parties across the transport chain — consignors, packers, loaders, schedulers — carry duties for conduct they influence. See chain of responsibility.
• Work health and safety. The primary duty extends to workers whose activities the business influences or directs, and officers carry a due diligence duty that covers contractor arrangements; see Safe Work Australia's model code on managing WHS risks.
• Labour hire licensing. Several states require providers to be licensed and place duties on hosts who engage unlicensed providers.
• Prudential outsourcing and service provider management. Material service provider identification, registers and contractual requirements under APRA standards.
• Privacy. Disclosure to a service provider does not transfer obligations, and cross-border disclosure carries additional requirements; see APP 11 reasonable steps to secure personal information.
• Commonwealth procurement. Suppliers to government carry conditions flowing from the procurement framework; see the Commonwealth Procurement Rules.

Offboarding and the exit file

Termination is where supplier compliance obligations are most often dropped. Build an exit checklist and hold the evidence in a single file:

1. Access revoked — systems, physical access, credentials, and evidence of revocation with a date.
2. Data returned or destroyed — with a certificate of destruction where personal information was involved, and confirmation for subprocessors.
3. Records transferred — anything you are required to retain that sits in the supplier's systems, obtained before the relationship ends.
4. Outstanding compliance matters closed — open incidents, remediation, unresolved audit findings.
5. Surviving obligations identified — confidentiality, retention, insurance run-off, indemnities. These outlive the contract and should be recorded as such.
6. Register updated — supplier status changed, tiering removed, calendar reminders retired.
7. Lessons recorded — where the exit followed a compliance failure, the root cause belongs in the incident register.

The exit file matters most when a regulator asks about conduct that occurred during the relationship, months after it ended. Everything you did not collect at termination is unavailable by then.