EcoVadis Assessment: How to Organise Documents and Evidence Before Completing the Questionnaire

Preparing for an EcoVadis assessment is not about collecting as many policies, reports and registers as possible. The organisation needs to demonstrate a consistent link between the assessment scope, its commitments, day-to-day practices, records of implementation and measurable results. If documents relate to different legal entities, data cover inconsistent reporting periods, or process owners interpret the same indicators differently, even an extensive set of attachments will not provide a credible picture of actual practice. Preparation should therefore begin by confirming the entity being assessed and allocating responsibilities. The next steps are to build an evidence chain and an evidence register; only then should the questionnaire be completed.

Define the scope before collecting documents

EcoVadis assesses a company’s practices using information and evidence relevant to a defined scope. The first step is therefore to verify the entity identified on the platform and confirm the locations, activities, employee numbers, ownership structure and organisational relationships covered by the assessment. Group-level, site-level and local evidence should not be used interchangeably unless the organisation can demonstrate that it applies to the entity being assessed and reflects its actual practices.

A key project decision is to establish the organisational boundaries of the assessment: does it cover the entire group, a specific Polish legal entity or a single site? The relationship between head-office documentation and the operating practices of the Polish entity must also be clarified, including the authority of local management and responsibility for implementing commitments. The organisation’s profile affects the relevance of individual questions. Reusing an evidence pack from another company or a previous assessment can therefore leave gaps or create inconsistencies between the declared position and the actual scope of operations.

Preparation should begin with a short meeting involving a management representative and the owners of the environment, labour and human rights, ethics, and sustainable procurement areas. The meeting should:

• approve the organisational scope of the assessment,
• appoint a preparation coordinator,
• assign responsibility for responses and supporting evidence,
• agree how the final review of materials will be performed.

The coordinator is responsible for the timetable and overall consistency but does not replace process owners in confirming facts. The relevant area owner should determine whether the stated practice is genuinely in operation and whether the proposed evidence documents it appropriately.

A group environmental policy may set an appropriate direction, but on its own it does not demonstrate implementation within the Polish entity. The entity should be able to show that the policy applies to it, has been communicated, has a locally assigned owner, and is translated into action and measurable results. Only a clear sequence connecting commitment, accountability, implementation, measurement and evidence distinguishes adequate documentation from a formal attachment that does not substantiate actual practice.

Most effort is generated at departmental interfaces

The main difficulty is usually not the absence of documentation but its distribution across HR, occupational health and safety, environmental management, procurement, finance, quality, compliance and senior management. The workload increases when it is unclear who owns the activity, who holds the data and who is authorised to confirm its accuracy. Further complications arise from inconsistent reporting periods, differing indicator definitions, undated or unapproved documents, records stored only in employees’ email accounts, and discrepancies between policy commitments and operational practice.

Roles should be separated deliberately. The activity owner is accountable for how the process operates; the data owner is responsible for the source, completeness and calculation method; the document author prepares the material; and the response approver decides whether the statement and supporting evidence are consistent with the assessment scope. One person may perform several roles, but this should not be assumed. Cross-functional questions require a central coordinator to manage deadlines and consistency. They may also require a cross-functional team where the conclusion depends on input from several process owners.

The responsibility matrix should cover every question, or each coherent group of questions, as well as the deadline for submitting evidence, the quality-control step and the decision on whether the evidence will be used. If one item supports several areas, it should remain under the control of one data owner, while the owners of the relevant activities confirm its suitability for their respective responses. Disputes concerning an indicator definition, reporting period or source reliability should be resolved by the designated approver, not by the person compiling attachments.

This allocation of roles also supports control of documented information by establishing the current version, cut-off date, applicability and approval status. The principles of cross-functional accountability are discussed in more detail in How to organise responsibilities when quality depends on several departments at the same time. In EcoVadis preparation, the practical benefits are shorter approval routes and a lower risk of presenting data that are formally correct but mutually inconsistent.

Build an evidence chain

Each item should be assessed as part of a four-level evidence chain: the commitment stated in a policy, the implementation method defined by a process, the record confirming execution, and the result measured through an indicator. A policy sets direction but does not prove implementation. A procedure, instruction, decision criterion or control mechanism shows how the commitment has been translated into action. Registers, minutes, reports, training results, supplier assessments and environmental data demonstrate that the mechanism is being applied. The indicator then allows the organisation to evaluate the scale, continuity and outcome of the activity.

Evidence should be checked for its relevance to the specific question, the correct entity and the reporting period covered by the response. Source traceability, issue or review date, approval, legibility and consistency between the document and the questionnaire statement are also important. Performance data should identify the period, source and method of consolidation, while record samples should reflect the scope and frequency of the process.

A partially relevant document should only be used for the point it genuinely substantiates. Its meaning should not be extended through explanatory wording in the response. One document may support several answers provided that it remains relevant to each one and clearly identifies the activity being evidenced.

A supplier code demonstrates that expectations have been established, but it does not by itself show that sustainable procurement is operating effectively. Additional evidence may include qualification criteria addressing environmental, labour or ethical risks, assessment results, purchasing decision records, and actions taken in response to nonconformities or elevated risk. The supplier qualification process, from request for quotation to approval – how to reduce procurement risk, should leave an audit trail linking the requirement, assessment, decision and subsequent monitoring. The existence of an assessment form is insufficient if it is unclear which supplier it covered, when it was used and how it affected the decision.

Evidence should not be created solely for the questionnaire. Where the review identifies a genuine gap, the organisation should design an implementation mechanism, allocate responsibility and begin generating records from actual activity. A new policy without implementation remains a declaration, while a retrospectively created document undermines the credibility of the overall evidence pack.

Sensitive information may be anonymised, provided this does not remove the elements necessary to identify the entity, date, course and outcome of the activity. The value of evidence depends primarily on a coherent documentation hierarchy and traceable records, not on the number of attachments.

Use an evidence repository, not just a folder of attachments

Materials for an EcoVadis assessment should be controlled through an evidence register rather than simply stored in folders. The register links each question and draft response to the relevant document, owner, period, scope of application and verification status. It shows which statements are substantiated, where gaps remain and who is responsible for resolving them. A file directory does not provide this level of traceability, however detailed its folder structure may be.

Each register entry should include, as a minimum, the document title, topic, entity and location, version number, approval date, validity period or data period, owner, confidentiality level and language. The fields should be adapted to the organisation’s complexity but should not be reduced to the point where the currency and suitability of the evidence can no longer be assessed.

The source version should be kept separate from the copy prepared for submission, especially where anonymisation, translation, page extraction or highlighting of relevant passages is required. This preserves the integrity of the source while allowing only the material needed to substantiate the response to be shared.

Document status should reflect an assessment of usability, not merely the fact that a file has been found. A practical classification includes:

• ready,
• verification required,
• not relevant,
• out of date,
• evidence missing,
• remedial action in progress.

An environmental report may be current and approved but still unsuitable if it covers a different company or site from the one being assessed. The number of items in each status category and the completeness of metadata can be used to monitor internal preparation. They are not, however, a measure of the likely assessment result.

The repository needs a defined storage location, version-control rules and access permissions. Duplicates, drafts, and scans without a date, owner or source identifier should be removed or clearly labelled. Before information is shared, the organisation should check whether it contains personal data, trade secrets or contractually protected information. Anonymisation should protect that information while retaining the elements needed to assess the evidence. Access to source versions may be more restricted than access to copies prepared for submission.

Repository consistency also depends on standardised names for processes, roles and metrics. The same indicator should not appear under different names where this makes period-on-period comparison or source identification difficult. The principles explained in How to organise a company’s quality terminology so everyone understands the same thing help reduce discrepancies between questionnaire responses, controlled documentation and operational records.

Conduct a dry run before completing the questionnaire

Before entering information on the platform, the organisation should perform a question-by-question readiness review. Each response and its assigned evidence should be assessed by someone who did not prepare the material. This may be a representative of another function, an internal auditor or an independent external expert. The appropriate choice depends on organisational complexity, available competence and the degree of impartiality that can be achieved internally.

The reviewer’s role is not to edit the wording. It is to challenge the author’s assumptions and determine whether the chain connecting the commitment, action, metric and evidence is understandable without the contextual knowledge held by company personnel.

Each response should be subjected to five tests:

• does it relate to the correct entity and assessment scope,
• does the attached document genuinely substantiate the stated activity,
• does the data period match the period stated in the response,
• do any other responses or materials contain contradictory information,
• will an external reviewer understand the significance of the evidence without additional verbal explanation?

The output of this review should be a register of discrepancies between responses, documents and data sources, not merely a general readiness rating. It is also useful to review a sample of documents and records selected according to internally defined criteria and covering different periods, locations or types of operation.

Numerical data require particular scrutiny. Figures relating to employment, resource consumption, emissions, incident rates or procurement may appear simultaneously in environmental, HR, financial and group reports while covering different periods, units or companies. Before use, each figure should be agreed with the data owner, with the source, calculation method and consolidation scope clearly identified.

For example, the employee headcount reported by HR at year-end may not match the average workforce figure used in group reporting. Identical indicator names alone are therefore insufficient to establish data comparability.

An identified gap must not be concealed by declaring a practice that the organisation cannot substantiate. The organisation should assess the risk, assign an action owner and set a deadline, then decide whether the gap prevents submission or can be managed through an improvement plan. The decision should be based on the gap’s significance to the reliability of the response, not on how easily a document can be produced at short notice. Improvement of the organisation’s actual practices should also remain distinct from the technical task of completing the questionnaire.

This type of readiness review is methodologically similar to the approach described in ISO 9001 gap assessment – how to evaluate organisational readiness reliably without unnecessary cost, although the scope and assessment criteria are different.

The final control should cover every attachment: file name, identification of the entity and period, legibility, confidentiality level, correct version and an unambiguous link to the relevant response. After anonymisation or page extraction, the document must still retain enough information to establish its origin and meaning. The decision to start entering information on the platform should be based on the closure of critical discrepancies and formal acceptance of any remaining gaps, with owners and deadlines assigned.

Treat the assessment as part of the management cycle

Organised EcoVadis preparation does not mean producing more policies, procedures and spreadsheets. The objective is consistency between the scope of the assessed organisation, assigned accountability, actual operations, records demonstrating implementation and achieved results. The questionnaire should use information generated by operating processes rather than trigger the ad hoc creation of evidence. This reduces the risk of applying different indicator definitions, reporting periods or consolidation scopes during the next assessment.

The evidence review should be integrated into the existing management calendar. The organisation should set its own review dates for policies, risks, objectives, actions, indicators, training and procurement practices, taking account of the frequency of change and data availability. Between assessments, it should maintain the environmental, social, ethical and procurement metrics for which definitions, sources and owners have been clearly established. A trend is meaningful only when successive values remain comparable.

Results can be discussed during management review or an equivalent decision-making forum, without creating a separate governance process solely for EcoVadis. Senior management approves commitments, resolves cross-functional gaps, provides resources and reviews results. The coordinator maintains the timetable, evidence register and consistency of responses but does not replace the process owners accountable for HR, environment, procurement, ethics or compliance.

Supplier requirements should be visible in qualification criteria, contracts, periodic assessments and decisions on corrective action. A practical expansion of this approach is provided in the article Supplier qualification process, from request for quotation to approval – how to reduce procurement risk. For higher-risk suppliers, this may be supplemented by Supplier audit before contract signature – how to reduce quality and delivery risk.

EcoVadis preparation can be aligned with existing management systems, risk reviews, compliance controls, internal audits and supplier assessments. This integration reduces duplicate records and makes it easier to demonstrate continuity of action. However, an EcoVadis assessment should not be treated as equivalent to management system certification or a compliance audit, because the purpose, criteria and method of reporting results are different.

A mature cycle does not end when the questionnaire is submitted. It should lead to decisions on identified gaps, updates to actions and a further check that the organisation’s commitments are delivering measurable results. Preparation for the next assessment can then rely on evidence generated through routine management rather than requiring the documentation to be reconstructed from the beginning.