Sedex SAQ Questionnaire: How to Gather Data and Prepare Answers That Reflect Actual Practice

The Sedex SAQ questionnaire should not be completed by one department using procedures and previous declarations alone. Answers must reflect how the specific entity or site actually operates and remain consistent with documented evidence, operational data and employee practice. Preparation should therefore begin by defining the scope, assigning data owners and establishing evidence rules. Only then should the organisation collect information, resolve discrepancies, approve its answers and plan how identified gaps will be closed.

The SAQ as a reflection of how the organisation operates

The Sedex SAQ is an organisational self-assessment, not a certificate or standalone evidence of conformity. It presents the declared practices of a specific entity or site. Recipients may compare the answers with documents, operational data, employee interviews and social audit findings. The value of the SAQ does not depend on the number of positive answers, but on alignment between the declaration, supporting evidence and actual practice.

Work should begin by confirming the business purpose, the intended recipients of the answers and their requirements. The organisation must determine whether the scope covers a legal entity, an individual site or a group of locations, and then verify the current version of the questionnaire and the date on which it was made available in the system. The form and customer expectations may change, so copying previous answers without reassessing the scope can result in inconsistent declarations. One coordinator should oversee the process, but the underlying data must come from the relevant process owners.

The SAQ is cross-functional. Its questions may address employment conditions, occupational health and safety, environmental impacts and ethics. The required information should therefore come, as appropriate, from HR, health and safety, operations, procurement and those responsible for environmental management, finance and compliance. The quality function may oversee the methodology and consistency of the answers, but it should not replace process owners or independently interpret practices for which it is not accountable.

A declaration concerning employee training requires three distinct situations to be considered. If training is delivered and supported by current records, the answer has a sound basis. If the practice is in place but records are incomplete, the organisation should report the actual situation and bring the records under control. If the arrangement has not been implemented, it cannot be replaced by a policy or plan. A management decision is needed to define the corrective action, deadline and accountability. This approach supports supply-chain due diligence and preparation for customer assessments, including the broader context described in How to prepare a team for a customer audit involving APQP, PPAP and root cause analysis.

Scope, roles and response rules

Before allocating questions, the reporting unit must be formally defined: the company, plant, warehouse, office or other location covered by the SAQ profile. The scope should also identify the groups of people and forms of employment included. Corporate data may provide supporting information, but it does not replace data from the site under assessment. A common reporting period should also be established for numerical values, together with a cut-off date for assessing whether documents, training records, risk assessments and corrective actions remain current.

Responsibilities should be divided among the SAQ coordinator, subject-matter owners, reviewers and the person authorised to approve publication. The coordinator is accountable for the questionnaire’s completeness and consistency, but should not produce answers on behalf of HR, health and safety, procurement or operations. Coordination may be centralised, while confirmation of practices and data should remain as close as possible to the site being assessed.

Evidence rules should be agreed before data collection begins. Source records and transactional data should take precedence over manually prepared summaries, while actual practice should take precedence over statements contained in policies. Every exception requires a defined scope and reason. Any estimate should have a documented method, an owner and an approver. A “not applicable” answer requires justification based on the scope of the organisation’s activities; missing documents or unavailable data do not make a question inapplicable.

Uncertainties should be recorded in an open-issues and discrepancies register. For each issue, the register should identify the owner, deadline, evidence, decision and decision-maker. This prevents key conclusions from remaining solely in emails or conversations. Management approval is particularly important where an answer confirms a policy, an organisational commitment, a significant exception or an accepted estimate. These principles can also be incorporated into the induction of new process owners, as discussed in How to design an onboarding process for a new quality engineer or ISO management system representative.

Data and evidence mapping

The SAQ evidence pack should be built from a question map, not by collecting every document available in the organisation. For each question, define the information required, unit of measurement, primary source, data owner and currency date. The evidence register should link the question identifier to the draft answer, organisational scope, reporting period, verification date and any identified gap. This establishes data provenance and reduces repeated manual transcription of the same values.

The map should distinguish between policies, procedures, implementation records and observable practice. A policy confirms that a principle has been adopted, a procedure describes how an activity should be performed, a record demonstrates that an activity took place, and actual practice shows whether the arrangement works in operation. A document stating a prohibition, obligation or commitment does not by itself demonstrate implementation. Depending on the question, relevant evidence may include HR and payroll data, working-time records, health and safety registers, risk assessments, training records, environmental permits and monitoring results, grievance registers, investigation and follow-up records, and supplier information.

Definitions must be agreed before datasets are combined. “Headcount” may mean the number of people on a specified date, an average over a period or the number of full-time equivalents. “External worker” may include agency workers, subcontractors or only people permanently present at the site. HR, health and safety, and operations may also classify an accident, grievance or completed training differently. A reported number of trained employees will not be reliable if one department counts attendance alone while another requires a confirmed result or formal authorisation. The definition, reference date and qualification rule should be documented before data is extracted.

Where sources conflict, priority should be given to the authoritative source that is maintained under control and is closest to the event. Differences between the HR system, a local list and a manual spreadsheet require investigation, not averaging. Estimated data should be used only where the form and the nature of the question allow it. The calculation method, assumptions and approval must then be retained. Gaps should be managed as problems requiring cause analysis and action, following the logic described in A3 problem solving: how to prepare a one-page report that guides the team towards a solution.

Sufficient evidence does not necessarily mean providing complete copies of personnel files, payroll records or investigation documentation. The SAQ evidence pack should contain only what is needed to substantiate the answer, with appropriate access controls and anonymisation of personal and sensitive information where identifying individuals is unnecessary. The register should identify where records are stored and the applicable retention rules without duplicating the source datasets. Before documents are disclosed, the organisation should ensure that anonymisation has not removed information needed to assess the date, location, completion or outcome of the activity.

Checking the consistency of SAQ answers

The SAQ review should cover four dimensions: logical consistency between answers, reconciliation of values with source documents, continuity of data between reporting periods, and alignment between declarations and actual practice at the site. Checking whether every field has been completed is not enough. An answer may be present but still conflict with another part of the questionnaire, be out of date or apply to only part of the organisation. The most significant discrepancies usually concern scope, the groups of people covered by a process and the stage of implementation, because these affect the meaning of multiple answers at once.

Verification should be based on an audit trail from each SAQ field to a specific source, data owner and calculation method. For numerical values, retain evidence of reconciliation with the source system. For narrative answers, identify the supporting document, record or observed practice. The number of questions without an assigned owner, source or confirmation may be used as an internal readiness indicator. Discrepancies should be entered in a register together with the decision, rationale and approver, rather than being concealed through revised wording without addressing the cause.

Conflicts often become visible only when information from different functions is compared. A policy may formally cover all workers, while training records show that only part of the workforce has been informed. A grievance mechanism may be described in a procedure, but employees may not know where to find it or whether they can use it confidentially. Headcount may not reconcile with working-time, health and safety training or accident data, particularly where agency workers or subcontracted personnel have been omitted. Such cases require the correct scope of the answer to be established, rather than the more favourable figure being selected.

The SAQ can be checked without conducting a full internal audit by using cross-functional review and limited audit sampling. A person independent of the source area should trace selected answers from the questionnaire back to the records, compare data from two independent sources and test it against a small sample of documents and employee interviews. Sampling should cover different employment arrangements, shifts, locations and higher-risk periods. Reviewer independence has practical value: process owners understand the intended design of their process, but may overlook departures from it that are visible to someone outside the function. The same discipline in preparing an evidence trail applies to the area discussed in ISO 22163 in the rail sector: how long IRIS implementation takes and how to prepare an organisation for audit.

The final stage is a language review. Statements such as “all”, “always” and “at every location” are justified only where evidence covers the entire declared scope. If a process has exceptions, the answer should disclose them and explain how they are managed. An approved plan, an implementation in progress or training that has been ordered must not be presented as a fully operating arrangement. Distinguishing achieved status from planned action protects the integrity of the SAQ and makes subsequent progress verifiable.

Gaps, risks and conditional answers

A gap identified during the SAQ review should be classified because not every deficiency represents the same type of issue. Distinguish between:

• missing data,
• inconsistent records,
• a formally established rule that has not been implemented,
• an actual operational nonconformity,
• an issue requiring legal or contractual interpretation.

The gap register should record the date identified, the affected people, processes or locations, the owner, action deadline and the evidence required for closure. Where the conclusion depends on applicable law, employment terms or customer commitments, legal or contractual advice is needed rather than an internally agreed interpretation selected for convenience.

Priority should be based on the potential impact on people, the environment, conformity with requirements and the organisation’s credibility with its customer. Ease of correction may influence scheduling, but should not determine the significance of the issue. A gap should prevent submission of the SAQ where it makes a reliable answer impossible, concerns a significant risk or would make the declaration misleading. In other cases, management may accept temporary risk, provided that the basis for the decision and the limitations of the answer are transparently documented.

An incomplete status should be reported as it exists on the date the questionnaire is approved. Planned or ongoing action should be described separately, with its owner, deadline and method for verifying effectiveness. Status categories should distinguish between planned, started, implemented and verified. The evidence trail must not be supplemented with backdated documents, and answers should not rely solely on a manager’s assurance that a practice is followed. Missing evidence remains an issue requiring resolution, not an editorial problem. This reflects corrective-action principles and is consistent with How to connect data from complaints, audits, SPC and FMEA within one improvement framework.

For example, an organisation may declare that its grievance channel is available to everyone performing work for it. The review confirms that a procedure exists, but there is no evidence that agency workers have been informed about how to raise a grievance, confidentiality arrangements or protection against retaliation. The declaration of universal access should not be maintained in that situation. The SAQ answer must be corrected, the omitted group must receive the relevant information, and interviews or sample records should be used to verify whether the mechanism is genuinely accessible and understood. The gap is closed only after effectiveness has been confirmed, not when the communication is issued.

Approving and maintaining the SAQ

Before the SAQ is published, it should undergo a formal review covering the completeness and currency of answers, their internal consistency, the resolution of exceptions and alignment with the organisational and information scope required by the customer. The organisation should also establish whether the disclosed data is subject to restrictions relating to information protection, personal data or contractual obligations. Management approval should not be reduced to authorisation to submit the form. The approver should understand the material gaps, accepted risks and outstanding actions.

After publication, retain the approved version of the answers, the register of sources used, the approval date and the basis of key calculations. The retained record should also include the version number, next review date and list of open actions, together with their status and the expected evidence of effectiveness. This audit trail makes it possible to reconstruct the basis of each declaration during an audit and reduces the risk of data being calculated using different assumptions at the next update.

The person responsible for maintaining the SAQ should keep a register of changes that may affect published answers. A periodic review is not sufficient if the organisation’s activity profile, workforce structure, location, significant customer requirements or permit scope changes earlier, or if a serious operational incident occurs. The opening of a new site or a significant increase in the proportion of agency workers requires the data scope and declared practices to be reassessed even if the scheduled review date has not yet arrived.

Gaps identified through the SAQ should be incorporated into the organisation’s existing change management, corrective-action and management review processes rather than maintained on a separate list used only for Sedex. Priorities should be risk-based, and action closure should require verification of effectiveness rather than confirmation that a task was completed. A useful planning structure is discussed in How to prepare a quality improvement plan for 3, 6 and 12 months. This approach keeps the questionnaire as a controlled record of the organisation’s current position rather than a historical snapshot that was accurate only on the submission date.