The difference between SMETA 2-Pillar and 4-Pillar is not simply the number of questions or the volume of documentation. The 2-Pillar audit focuses on labour standards and health and safety. The 4-Pillar audit covers the same areas and adds environmental practices and business ethics. Extending the scope therefore brings additional processes, data owners and evidence sources into the audit. The required scope should be confirmed before preparation begins, because selecting the wrong option may result in reviewing the wrong areas or exposing gaps that the organisation has insufficient time to address.
Two scopes requiring different decisions
SMETA is an ethical and social audit methodology for supply chains. It is neither a management system standard nor a certification scheme comparable to ISO certification. The audit assesses practices and evidence at a specific site, including employment conditions, work organisation, technical safeguards, operational records and the actual application of established rules. Having a policy or procedure does not determine the outcome, and a positive result does not constitute certification.
| Scope | Pillars and evidence areas | Process owners | When it is used |
|---|---|---|---|
| 2-Pillar | Labour standards and health and safety, together with the additional elements covered by the methodology outside the two main pillars | HR, payroll, health and safety, and operational management | When the customer or supplier programme focuses its assessment on working conditions and health and safety |
| 4-Pillar | The complete 2-Pillar scope, extended to include environmental practices and business ethics | Owners of the 2-Pillar areas, plus those responsible for environmental matters, procurement, finance, compliance and fraud prevention | When this scope is specified in a contract, purchase order, customer portal or supplier programme rules |
A broader audit is not automatically the better option. The decisive factors are the requirements of the customer or supplier programme owner and any contractual provisions. A customer may require 4-Pillar even from a site with relatively low environmental risk if it applies consistent criteria across its entire supplier base. Before preparation begins, confirm the methodology version applicable on the audit date, the required audit option and how the audit is to be managed through the Sedex platform.
A site may have well-maintained personnel files, working-time records and health and safety controls, yet lack consistent evidence on waste, resource consumption, conflicts of interest or whistleblowing. If preparation is handled solely by HR and the health and safety function, only part of the 4-Pillar requirements will be covered. Expanding the audit scope means involving additional process owners and testing actual practice—not merely adding two sections to a procedure.
The organisation must also establish which sites, activities, employee numbers and forms of employment are included, including temporary labour and subcontracting where applicable. Scope should be taken from the purchase order, contract or customer portal rather than defined through internal assumptions. This is particularly important when SMETA is being used as a customer audit. For a broader organisational perspective, see How to prepare a company for a second-party audit of a key supplier.
What a 2-Pillar audit examines
The 2-Pillar scope covers labour standards and health and safety, but it is not limited to reviewing employment rules, procedures and personnel files. In the employment area, the auditor examines whether work is lawful and voluntary, together with working hours, pay, equal treatment, freedom of association, the prohibition of child labour and unacceptable disciplinary practices. The actual organisation of work matters: who performs the work, under what arrangement, during which hours and according to what pay rules.
At a Polish site, particular attention should be paid to working-time records, overtime and rest periods, deductions from pay, leave, civil-law contracts, temporary employment and the legality of employing foreign nationals. HR, payroll and production data should tell the same story. If access records, shift schedules or production output indicate that an employee was present, but this is not reflected in the working-time records, the formal correctness of the HR document does not remove the underlying risk. The organisation should therefore appoint an owner for HR and payroll data and establish how information will be obtained from employment agencies and other labour providers.
The health and safety pillar covers both the organisation of controls and the conditions visible at workstations. The assessment may include the currency and adequacy of occupational risk assessments, machine safeguards, use of personal protective equipment, unobstructed emergency routes, fire safety, first aid, training, and responses to accidents and near misses. Records of safety checks and defect correction also need to be reviewed. Documentation describing effective control loses credibility if the auditor’s site tour reveals bypassed machine guards, blocked exits or failure to use required protective equipment.
The auditor selects document samples and compares them with site observations and employee accounts. Data on working hours, pay, leave and rest periods may be cross-checked against access logs, shift plans or operational data, while training and inspection records may be tested against workplace practice. Discrepancies between sources are a significant risk indicator, particularly where they recur or involve temporary workers, foreign nationals or people supplied through an intermediary. Before the audit, the organisation should also define how the auditor will access records and employees while maintaining confidentiality and data protection.
Preparation for a 2-Pillar audit cannot be assigned solely to the quality manager or management systems representative. It requires cooperation between HR and payroll, health and safety, production, maintenance, security, employment agencies and other organisations supplying labour. Process owners should agree the workforce structure by contractual basis and intermediary, responsibility for data completeness, and the method for investigating discrepancies. Similar coordination is needed when an organisation considers How to prepare a team for a customer audit involving APQP, PPAP and root cause analysis.
What 4-Pillar adds
The 4-Pillar option extends the audit to two distinct areas: environmental management and business ethics. These are not merely additional questions for the management systems representative. They require the involvement of further process owners and access to different evidence sources. Preparation should reflect the site’s activity profile, customer requirements and actual allocation of responsibilities, rather than mechanically extending the document checklist used for a 2-Pillar audit.
The environmental pillar considers how the site identifies requirements and controls its environmental impacts. Depending on the nature of its activities, the assessment may cover consumption of energy, water and other resources; waste management; emissions; wastewater; chemicals; and the response to spills and other environmental incidents. The starting point should be a register of requirements applicable to the location, including decisions, permits, notifications, measurements and reporting obligations.
Possessing documents does not in itself demonstrate conformity. The site must show how it controls the conditions attached to decisions, deadlines, responsibilities and monitoring results, and how it responds when a deviation is identified. The auditor may compare the conditions of a decision with waste records, measurement results or utility-consumption data and establish who investigates exceedances or unusual changes. An implemented environmental management system may help organise these controls, but it does not replace evidence that they operate effectively.
The business ethics pillar likewise goes beyond having a code of conduct. It covers mechanisms for preventing corruption, conflicts of interest, fraud and retaliation, as well as whistleblowing channels, investigation processes and employee awareness. Evidence that these mechanisms operate may include case status records, training, conflict-of-interest declarations and documented investigation activities, presented with due regard for confidentiality. A reporting channel that exists only formally, without a process owner, case-classification rules or protection for reporting persons, remains weak evidence.
The assessment is based on applicable legal requirements and the conditions under which the site operates, but it may also take account of customer expectations and the effectiveness of internal controls. Preparation for 4-Pillar therefore requires the involvement of those responsible for environmental matters, procurement, finance, sales, compliance, case intake and investigations, as well as management responsible for resolving conflicts. The organisation must appoint an owner of the environmental requirements register and an owner of the reporting process, with defined authority, confidentiality rules and escalation arrangements.
Where cost and risk increase
The effort required to prepare for SMETA does not increase in direct proportion to the number of pillars or questions. The greatest costs arise where data is fragmented across departments, accountability is unclear and actual site practice differs from documented procedures. Before selecting an auditor, the organisation should assess not only the volume of documentation but also the number of processes and process owners involved, the completeness and consistency of sampled records, and the time needed to eliminate the causes of discrepancies.
The 4-Pillar option increases dependencies between HR, production, health and safety, environmental management, procurement, finance and compliance. Assigning the entire preparation project to the quality department will typically result in delays or in evidence that appears formally complete but fails to demonstrate that the controls operate in practice.
The gap assessment should distinguish deficiencies that can be resolved by clarifying responsibilities and improving records from problems requiring changes to work organisation or infrastructure. The most demanding issues include systemic overtime caused by capacity planning, payroll inconsistencies, inadequate machine guarding, fire safety deficiencies, improper chemical management and failure to meet the conditions of environmental decisions. Such issues cannot be resolved by adding a procedure or delivering a one-off training session.
Management should decide which gaps must be closed before the audit because of risks to people, legal conformity or customer requirements, and which—where the nature of the requirement and the customer’s position permit—can be addressed through a credible action plan with an owner, deadline and secured funding.
A common problem is not the absence of documents but the integrity of audit data. A site may have a complete set of working-time procedures, while production schedules and line-start records show work that is absent from the time records. In the environmental area, a comparable warning sign is a mismatch between the waste-generation register, on-site storage levels and waste-transfer documentation. The auditor assesses whether the actual process can be reconstructed—not whether the register is attractively presented. Correcting a nonconformity therefore requires analysis of data sources, reconciliation of records across systems and elimination of the mechanism causing the discrepancy.
The preparation budget should be divided between gap assessment, organisational actions, technical modifications, training, completion of records and a contingency for post-audit corrective actions. There is no sound basis for applying one standard price to every 2-Pillar or 4-Pillar audit: technical costs depend on the condition of the facility and its processes, while organisational costs depend on the maturity of controls. Useful indicators include the proportion of sampled records that are both complete and mutually consistent, the time deviations remain unresolved and the number of processes without a clearly assigned owner. A similar approach to structuring expenditure is discussed in How much does NIS2 and uKSC implementation cost? Building a budget for audits, documentation, training and safeguards without expensive mistakes. For SMETA, the same logic should be applied to the site’s actual labour, health and safety, environmental and ethics gaps.
How to select the scope and prepare
Scope selection should begin by confirming the audit objective, the intended recipient of the results, the sites to be assessed and whether 2-Pillar or 4-Pillar is required. The organisation should also establish the applicable methodology version, any additional customer requirements and the rules for sharing results. Only then should it appoint a preparation coordinator, designate owners for each area and define readiness criteria.
If the customer requires 4-Pillar, the organisation’s view that its environmental or ethical risks are limited does not justify narrowing the scope. Where the customer allows the supplier to choose, the decision should reflect the activity profile and the organisation’s actual ability to exercise effective control.
Requirements should then be mapped to processes, locations, data sources and responsible individuals. A matrix may classify each requirement as met, partially met, not met or not applicable, with the last status supported by a substantive justification. The gap assessment must not be limited to a self-assessment questionnaire. It should combine a review of documents and records with site observations and interviews with employees and process owners. This makes it possible to distinguish a missing piece of evidence from ineffective control or practice that conflicts with established rules.
A mock review should reproduce the flow of the actual audit. For a selected employee, the organisation should trace consistency across the contract, working-time record, schedule, payroll record and payment confirmation, and then verify conditions at the employee’s workstation. Under 4-Pillar, a specific environmental aspect or ethical risk should similarly be linked to accountability, the method of control and a record demonstrating operation. Alignment between documents, observations and interviews is more meaningful than procedural completeness alone.
Preparatory actions should be prioritised according to the significance of the risk, the cause of the problem and practical feasibility. Every action should have a deadline, an owner and defined evidence of completion. A document created solely for the audit does not replace implementation or records covering a period of actual use. The time between the gap assessment and the audit must reflect the nature of the required changes: reallocating responsibility requires a different level of effort from redesigning safeguards, changing working-time arrangements or establishing environmental controls.
Actions and evidence should be approved by the relevant process owner and, for matters significant to risk, expenditure or legal conformity, by the appropriate member of management. Preparing for an ISO audit: a step-by-step guide can serve as a useful reference, but SMETA preparation should not be managed as though it were a management system certification project.
Before the audit, the team should test access to data, process-owner responses, arrangements for the site visit and facilities for confidential employee interviews. The readiness criterion should not be “the documentation is complete,” but rather “the requirement operates in practice, the responsible person can explain it, and the records and observations confirm the same practice.” The material How to prepare a company for a second-party audit of a key supplier may also be useful, particularly when assigning responsibility for the visit and the provision of evidence.
The scope must match the requirement and the risk
The 2-Pillar option is appropriate when it meets the customer’s requirement and the purpose of the assessment. This does not mean that environmental obligations or ethical business principles cease to apply to the organisation. They remain subject to separate oversight arising from law, contractual obligations and adopted policies. Conversely, 4-Pillar provides a broader view of supplier risk but requires genuine involvement from environmental, procurement, finance and fraud-prevention processes.
Before commissioning the audit, management should approve the audit option, assessed location, process owners, budget for technical actions, escalation rules and arrangements for monitoring post-audit actions. The decision should be based on three factors:
- customer or supplier programme requirements,
- the site’s operational risk profile,
- the organisation’s ability to demonstrate effective control.
What is a SWOT analysis? may be used as a supporting tool to organise the context, but it is not a substitute for risk assessment or evidence review.
If a site chooses 4-Pillar despite not having assigned responsibility for environmental aspects or corruption risks in procurement, the broader audit does not create the problem; it reveals an existing control gap. Management should then determine which deficiencies must be addressed before the audit, which can be placed under a corrective action plan and which require formal acceptance of residual risk. These decisions should be linked to management review and existing management systems rather than maintained in a separate register with no accountable owners.
A SMETA report presents conformity and practice at a defined location and point in time; it is not a certificate. Its value depends on the quality of evidence, elimination of the causes of nonconformities and the sustainability of improvements. Readiness between audits can be monitored through the number of open actions by significance and due date, the percentage of actions verified for effectiveness, and the recurrence of findings in subsequent assessments. Formal closure of an action does not by itself demonstrate that the risk is under control.
Masz pytania? Porozmawiajmy.
Bezpłatna konsultacja – bez zobowiązań.
