The Supplier Behind Your Supplier
Australia asks large buyers seven questions about their supply chains every year, and only one and a half of them are questions a system can answer from its own records. The rest is prose a named person signs — which makes the interesting question not what your software reports, but where its knowledge of your suppliers stops.
Your purchasing system knows who you pay. It knows the company name, the country on the record, what you ordered, what it cost and what is still owed. That is a genuinely useful body of fact, and under the Modern Slavery Act 2018 it answers one of seven statutory criteria and about half of a second.
This is not a criticism of purchasing systems. It is a structural observation about a whole class of obligation that has arrived in the last few years and does not behave like the ones finance software was built for. A tax return is arithmetic over records you already hold. A modern slavery statement is a description, approved by a board and signed by a person, of things most of which were never written down anywhere in the first place.
What the Act actually says
Worth reading the sections rather than a summary of them, because the boundary is precise. Section 5 makes an entity a reporting entity for a period if it has consolidated revenue of at least $100 million for that period and either is an Australian entity at any time in the period, or carries on business in Australia at any time in it. The second limb is the one that surprises people: an overseas group with Australian operations can be caught without an Australian parent anywhere in it.
A small thing worth noticing, since we are being careful about wording: the Act's own plain-English outline in section 3 says "more than $100 million" and the operative provision in section 5 says "at least". One word, and it only matters to an entity sitting exactly on the figure. We have printed section 5's version, because that is the one that operates — and if your group is anywhere near the line, that is a question for your accountants rather than for a blog post.
The statement goes to the Minister within six months after the end of the reporting period. It must be approved by the principal governing body and signed by a responsible member — and the details of that approval go inside the statement itself. Statements are then kept in a public repository, the Modern Slavery Statements Register.
Seven criteria, sorted by where the answer comes from
Here are the section 16 criteria against the only question that matters when you are choosing tooling: who or what produces the answer.
Section 16(1), by source of the answer
| Criterion | A system can supply it | A document can supply it | A person must write it |
|---|---|---|---|
| (a) Identify the reporting entity | Yes | Yes | No |
| (b) Describe the structure, operations and supply chains | Partly — configurable by you | No | Yes |
| (c) Describe the risks of modern slavery practices in them | No | No | Yes |
| (d) Describe actions to assess and address those risks | No | Partly — configurable by you | Yes |
| (e) Describe how you assess the effectiveness of those actions | No | No | Yes |
| (f) Describe the consultation with entities you own or control | No | No | Yes |
| (g) Any other information you consider relevant | No | No | Yes |
Built and maintained Configurable by you, not maintained by us Not built
The single "part" in the left column is the whole commercial question. Criterion (b) asks you to describe your supply chains, and a purchasing system holds the first name in every one of them.
Read that column downwards and the shape of the obligation is clear. It is not a reporting problem with a governance wrapper. It is a governance problem with one reporting input — and the input is the part everybody already has.
The register stops at the company you pay
Ours is a flat list, and it is worth saying exactly how flat. A vendor record carries a name, a company, an email, a phone number, a country, an address and a set of coordinates. It relates to the quotations that vendor sent, the orders you placed with them, and the people at that vendor who have a login. It does not relate to another vendor. There is no parent, no subcontractor, no second tier — the register describes counterparties, and a counterparty is by definition one step away from you.
Criterion (b) does not stop there. A supply chain is a chain, and the phrase is used in the plural throughout the section. So the honest description of what a purchasing register contributes is: the first link, completely and accurately, with a country on each one.
Where the register ends and the statement begins
On this side, your system already knows
Facts, dated, exportable, and the same next year
- Every company you raised a purchase order with, in a period
- The country recorded against each of them
- What you spent with each, what you paid and what is outstanding
- Which of them were prequalified, by whom, and against which documents
- Which of them you have marked inactive, preferred or blacklisted
On that side, somebody has to find out
None of this is a query
- Who supplies your suppliers, and from where
- Which stages of production sit in which jurisdiction
- Where labour is hired through an intermediary rather than directly
- Which risks you concluded were material, and on what basis
- Whether last year's actions changed anything at all
A vendor is where your commercial relationship ends and where the statute's interest starts. That is not a gap in anybody's software so much as the reason the criteria are worded as descriptions rather than as figures.
A document that exists is not a document anybody read
The second place this gets interesting is prequalification, because it is where a buyer usually believes the checking happens. Our own form collects registration and tax identifiers, years in business, a category, an address, and up to four attachments: a certificate of incorporation, a tax compliance certificate, bank details, and a portfolio of past experience. Every one of those is about commercial and legal standing. Not one is about how anybody at that company is employed.
What our own scoring assistant is told about its own limits
The prequalification score is produced by an advisory analyst that a human then overrides or accepts, and the instruction it is given includes this sentence, near-verbatim: it cannot see the contents of uploaded documents, only whether each type was supplied. That is exactly right and it is worth reading twice, because it is the assumption most document checklists never state. The facts it receives are two lists of document names — supplied and missing. A certificate that is present, expired and for the wrong entity is indistinguishable, at that layer, from a valid one.
A checklist proves that a file was uploaded. Reading is a separate act, it is done by a person, and it either happened or it did not.
There is one genuinely useful move available here today, and it does not require anything to be built. The prequalification form takes tenant-defined questions, and those questions render on the public application form a supplier fills in without a login — so their answers arrive in writing, attributed, dated and stored against the application. If you want a written answer from every new supplier about how their workforce is engaged and who they subcontract to, you can have it this afternoon. It will not be verification. It will be a dated statement from the supplier, which is a materially better starting point than an assumption.
Criterion (e), and why it is the hard one
Criterion (d) asks what you did, including due diligence and remediation. Criterion (e) asks how you assess whether it worked. Those are not the same question, and the second one has no natural home in an operational system at all — not in ours and not, in our experience, in the ones we are usually compared against.
The reason is that effectiveness is a claim about counterfactuals. A system can record that a policy was issued, that eighty people completed a training module, that a clause was added to a contract template. None of those is evidence that a risk fell. Anybody who tells you their software answers criterion (e) is describing an activity log and calling it an outcome.
What happens if the statement does not arrive
Section 16A is worth knowing about because the mechanism is unusual. Where the Minister is reasonably satisfied an entity has failed to comply, the Minister may make a written request for an explanation, or for specified remedial action, or both, with a period of at least twenty-eight days to respond — extendable, before or after it expires. If the request itself is not complied with, the Minister may publish on the register the entity's identity, when the request was made, what was asked for, and the reasons the Minister considers it was not met. That publication decision can be taken to the Administrative Review Tribunal.
So the register that holds the statements is also the register that holds the record of not having filed one. The Act now also establishes an Australian Anti-Slavery Commissioner, which is a signal about direction of travel even before anybody characterises the office.
What AWRA OpsHub does today
- A supplier register with a country on every record, so the counterparties behind a period of purchase orders are a list you can produce rather than a memory.
- Vendor spend for a date range grouped by vendor, with the order count, the total, what has been paid and what is outstanding, exportable to a spreadsheet or a PDF.
- A prequalification application with documents attached to it, reviewed by a named person, scored with an advisory assistant that states its own limits, and stamped with a validity date that expires on its own.
- Tenant-defined questions on the public application form, rendered to a supplier who has no login, with the answers stored against the application and dated.
- Vendors marked inactive, preferred or blacklisted, so a decision about a counterparty survives the person who made it.
More we can add to your workspace
- A link from a vendor to that vendor's own suppliers, so a chain can be walked past the company on your purchase order and a second tier becomes part of the register rather than a separate spreadsheet.
- Spend rolled up by the country a vendor sits in, as a report you run for a period. The country is already on the record; the grouping is the build.
- A reading of what an attached document says, so a certificate contributes its contents and its expiry to a score rather than only its presence.
- A measure of whether an action changed anything, which is criterion (e) of section 16 and the one we would want to argue with you about before quoting for it.
Where we point you to a specialist
- We will not tell you whether the Act reaches your group. Section 5 turns on consolidated revenue for the reporting period, and on whether an entity is Australian or carries on business in Australia at any time in it. Those are determinations your accountants and your counsel make about your own structure, and a vendor guessing at them is worse than useless.
- We will not draft the statement. Four of the seven criteria are descriptions of process, approved by a principal governing body and signed by a responsible member — and software that generated that prose would be manufacturing the very assurance the signature exists to carry. We will help you assemble the facts underneath it and stop at the point where somebody has to put their name on a judgement.
All four of the middle column are builds we would quote for, and the first two are the ones that change what a statement can actually say: a second tier on the register and a country roll-up are ordinary schema and reporting work, and together they turn a spend export into the factual spine of a section 16(1)(b) description rather than a list of names.
What we can build for your market on top of the standard product
Everything listed above as something we can add describes what ships in the standard product today — it is a starting point for your market, not a limit on what AWRA OpsHub can do there. Kenya's eTIMS integration and its maintained payroll engine are in the product because Kenyan clients needed them and commissioned them; neither appeared by itself. The same door is open here. If a local payroll engine, a rate with a date on it, a bank or mobile money feed, a statutory return format, a rule specific to how your operation runs, or a link to a system you already have is what stands between you and a decision, tell us and we will scope it as a build — written spec, timeline and price — before you commit to anything.
Dated rates and the periods your obligations actually use
Effective-dated tax rates, so a document raised about a past period is computed against the rate that applied then rather than the rate that applies now, and a credit note that carries the tax split of the supply it reverses. Where a jurisdiction operates a sales-monitoring or fiscalisation scheme, data produced in the published format alongside the approved equipment rather than in place of it.
Banks, payments and pay periods that are not months
Bank statement feeds and local payment rails wired into the Payments Register, and a payroll period that matches your statutory pay cycle rather than the calendar month our schema assumes today. The second is a data-model change and we would quote it as one.
The operational work, which is what most commissions actually are
An extra approval stage in a chain that does not match the standard one, a custom field set on employees or assets that only your sector needs, an expiry that has to block an order rather than send an email, a report your board asks for in a shape nothing produces, or a scanner or weighbridge feeding the goods-in door. These are the commissions we are asked for most often and the smallest ones we quote — and unlike a revenue-authority pipeline, none of them waits on a regulator.
Payroll and statutory returns
Income tax, superannuation or provident fund contributions computed on live employee records against your own pay cycle, with the returns produced in the layout your authority expects.
Systems you already run
The accounting package, CRM, online store or custom database you intend to keep — connected through our API so a fact is entered once and appears everywhere it is needed.
How it works: you describe the requirement, we return a written scope, timeline and cost, and once agreed it is built into your environment and maintained as part of the product. No roadmap slide, and no pretending in a demo that something exists when it does not.
Tell us what you need integratedThe short version
A modern slavery statement is not a report you can run, and any vendor who implies otherwise has not read section 16. Six of the seven criteria are prose a person writes and a board approves. The seventh — describe your structure, operations and supply chains — is the one where a purchasing system earns its place, and it earns it by producing the first link in every chain, with a country attached, the same way every year. Buy tooling for that job and treat the rest as what it is: work, done by people, that arrives at a deadline six months after your year ends.
Four questions for whoever is selling you supply chain software
Can a supplier record point at that supplier's own suppliers?
What you will probably hear
Often a description of a custom field where you could type a name.
How to read it
A text field is not a relationship — you cannot report across it, and nothing keeps it current. Ask whether the second tier is an entity in its own right. Ours is not, and we say so.
When your system checks a document, does it read the document?
What you will probably hear
A pause, and then a distinction between upload and review.
How to read it
This is a fair answer and the pause is the useful part. A checklist confirms a file exists. Ask specifically whether an expiry date inside the document is captured, because that is the difference between a folder and a control.
Show me what you produce for criterion (e).
What you will probably hear
A dashboard of training completions, policies issued, or suppliers assessed.
How to read it
Those are activities, not effects. There is nothing wrong with tracking them and they are not an effectiveness assessment. A vendor who says plainly that this criterion is yours to argue is being straight with you.
Can you group my spend by the country a supplier is in?
What you will probably hear
Usually yes, and usually true.
How to read it
Cheapest question on the list and the most diagnostic, because it is a five-second demonstration. If a system holds a country and cannot group by it, ask what else it holds and cannot group by.
See the procurement module
A supplier register with country and status on every record, prequalification with attached documents and a validity date, and vendor spend for any period grouped by vendor.
Explore procurementFrequently asked questions
Does your system produce a modern slavery statement?
No, and we would be cautious about anybody who says theirs does. Six of the seven mandatory criteria in section 16 are descriptions of structure, risk, action, effectiveness and consultation, approved by a principal governing body and signed by a responsible member. What a purchasing system contributes is the factual part of criterion (b): who you bought from in the period, in which country, for how much. We produce that, and we are explicit that it is the first link in each chain rather than the chain.
Can we record our suppliers' suppliers today?
Not as records in their own right. A vendor in our register relates to quotations, purchase orders and its own portal users, and it does not relate to another vendor — there is no parent or subcontractor link, so a second tier cannot be reported across. What you can do today is ask about it: the prequalification form takes questions you define, they render on the public application form a supplier completes without a login, and the answers are stored and dated against that application. A written answer from the supplier is not verification, and it is a great deal better than an assumption.
Does the prequalification score check our suppliers' labour practices?
No. The four requestable attachments are a certificate of incorporation, a tax compliance certificate, bank details and a portfolio of past experience, and the score weighs commercial and legal standing — identifiers present, documents supplied, years in business. The scoring assistant is also told, in its own instructions, that it cannot see the contents of a document and knows only whether each type was supplied. We would rather state that plainly than let a green score imply a check nobody performed.
What is the deadline, and what happens if it is missed?
The statement goes to the Minister within six months after the end of the reporting period. Under section 16A the Minister may request an explanation or specified remedial action, with at least twenty-eight days to respond and the possibility of an extension; if that request is not met, the Minister may publish the entity's identity and the details on the public register, and that publication decision is reviewable by the Administrative Review Tribunal. Read section 16A yourself rather than relying on this paragraph — we have summarised one section, not the Act.
We are not an Australian company. Can this still apply to us?
Possibly, and that is exactly why it is worth reading section 5 rather than a summary. An entity is caught if it has consolidated revenue of at least $100 million for the reporting period and either is an Australian entity at any time in the period or carries on business in Australia at any time in it — the second limb by reference to the Corporations Act. Whether your group meets either test is a determination for your accountants and your counsel, and we will not offer a view on it.
