Supply chain due diligence: auditing a tannery or gold supplier before it becomes a scandal

Analysts increasingly price ESG (Environmental, Social, and Governance) risk into valuation multiples for luxury stocks, because a sourcing scandal can trigger both consumer boycotts and institutional divestment.

The regulatory backbone

Three frameworks matter most for anyone doing sourcing due diligence in 2026:

EU Corporate Sustainability Due Diligence Directive (CSDDD), adopted 2024, entering phased application from 2027 for the largest companies. It requires large EU-operating companies to identify, prevent, and remediate human rights and environmental harms across their value chain, including tier-2 and tier-3 suppliers (the tannery's tannery, the mine behind the gold refiner). Non-compliance carries fines of up to 5% of global net turnover, as set in the directive text. (European Commission summary)

OECD Due Diligence Guidance for Responsible Supply Chains of Minerals, the reference standard for gold, tin, tantalum, and tungsten sourcing from conflict-affected areas. It underpins the EU Conflict Minerals Regulation (2017/821), binding since 2021, which requires EU importers of these minerals above certain volume thresholds to conduct supply chain due diligence and retain audit documentation.

Dodd-Frank Act Section 1502 (US, 2010) originally required SEC (Securities and Exchange Commission) disclosure on conflict minerals from the Democratic Republic of Congo region; enforcement has been scaled back over the past decade but the disclosure architecture and the reputational expectation it created remain the industry benchmark cited by auditors and NGOs.

For leather specifically, there is no single binding global law, but the Leather Working Group (LWG) certification and ISO 14001 (environmental management systems) are the de facto documentation standards insurers and buyers now demand contractually.

The main financial risks, ranked by frequency

1. Traceability gaps. A supplier cannot show chain of custody from raw material to finished component. This is the single most common finding in luxury sourcing audits.

2. Subcontracting without disclosure. The audited factory is compliant; its unlisted subcontractor is not. This is exactly what happened in the Tuscan tannery case.

3. Conflict-mineral exposure. Gold, in particular, passes through refiners who blend sourced and unsourced material, making origin verification a persistent gap even for firms using Responsible Jewellery Council (RJC) certified refiners.

4. Contractual silence. Sourcing contracts lacking audit-right clauses, meaning the buyer has no legal ability to inspect subcontractors even if it suspects a problem.

A 2023 review by the Business & Human Rights Resource Centre found that a majority of major fashion and luxury brands could not demonstrate full tier-2 supplier traceability, a figure widely cited as a benchmark estimate rather than an exact industry-wide count.

The due-diligence checklist finance teams actually run

1. Contract audit

• Confirm the contract includes a right-to-audit clause covering subcontractors, not just the direct supplier.
• Check for indemnification clauses allocating financial liability if a violation is found post-signature.
• Verify termination-for-cause language ties explicitly to labor and sourcing standards, not just quality defects.

2. Traceability certification review

• For leather: LWG certification level (Gold, Silver, Bronze) and its expiry date. Certifications lapse annually and are often cited as current when they are not.
• For gold: RJC Chain of Custody certification, or London Bullion Market Association (LBMA) Good Delivery List status for the refiner.
• Cross-check certificate numbers directly on the issuing body's public registry rather than accepting a PDF from the supplier.

3. Financial exposure modeling

Estimate the balance-sheet impact of a worst-case supplier failure before signing. A simplified worked example:

This is illustrative, not a universal formula, but it is the type of exposure sizing a finance controller should run before onboarding any single-source supplier representing more than roughly 10-15% of a category's input volume.

4. Sanctions and beneficial-ownership screening

Run the supplier's ultimate beneficial owners against OFAC (US Office of Foreign Assets Control) and EU sanctions lists. Common in gold sourcing where refiners can have opaque ownership structures.

5. On-site or third-party audit verification

Confirm whether the compliance certificate was issued after a physical audit or a desk review. Desk reviews are cheaper but materially weaker evidence, and this distinction is now scrutinized by CSDDD-aligned auditors.

Who holds the power in this relationship

In leather, large houses like Hermès and Chanel increasingly own or take equity stakes in tanneries (Hermès owns several through its Manufactures group) precisely to internalize traceability and reduce third-party audit risk. This is a direct financial response to due-diligence cost: vertical integration is expensive up front but reduces contingent liability.

In gold, the picture is different. Refiners sit between thousands of small-scale mines and a handful of major jewelry houses, so buyer leverage is lower and reliance on RJC/LBMA certification is heavier because direct audit access to mine sites is often impractical.

A quick resource for going deeper

The OECD's due diligence guidance PDF is free and is the actual document auditors reference: OECD Due Diligence Guidance for Responsible Mineral Supply Chains.

🎬 [VIDEO: "How Luxury Brands Are Tackling Supply Chain Transparency" - youtube.com - search this title on YouTube for an accessible explainer on traceability technology and certification used by fashion and luxury supply chains]

Key Takeaways

• Supply chain due diligence is a balance-sheet issue: write-downs, contract penalties, and brand-intangible impairment are the direct financial consequences of sourcing failures.
• The CSDDD (EU, phased from 2027) and the EU Conflict Minerals Regulation (binding since 2021) are the two regulations to know cold; both extend liability to tier-2 and tier-3 suppliers.
• The most common real-world failure is not fraud at the audited factory, it's undisclosed subcontracting further down the chain.
• Contracts need right-to-audit and indemnification clauses; certificates (LWG, RJC, LBMA) must be verified against the issuer's registry, not taken at face value.
• Model the financial exposure of single-source suppliers before signing: a simple write-down and remediation estimate turns an ESG conversation into a number a CFO will act on.