Responsible Sourcing: From Policy to PO

By Jonathan Oh, CEO – SupplyCart / ADAM-Procure

Moving from price to impact in Malaysian procurement.

Most organisations today can produce a respectable responsible sourcing policy. The document looks good, the language is modern, and the ESG commitments read well in an annual report.

But if you follow the trail from that policy down to an actual purchase order, the connection often disappears. Suppliers may sign a code of conduct, yet onboarding forms don’t capture structured ESG data. Tenders may mention ESG, but it rarely has a meaningful impact on scoring. POs and invoices flow through with little visibility of whether the chosen vendor actually aligns with the policy.

That gap between the PDF and the PO is where risk lives—ESG, reputational, regulatory, and operational. It’s also where a great deal of untapped value sits.

This explainer looks at how to move responsible sourcing from “nice words” to everyday procurement practice. It draws on what a bank like Maybank has been building in responsible sourcing—treating governance, ESG, supplier enablement and digital scoring as one system—and shows how a platform like ADAM-Procure can operationalise the same ideas.

Why policy isn’t enough

Most responsible sourcing programmes start the same way: a supplier code of conduct is drafted, ESG commitments are added to the sustainability section of the annual report, and a high-level risk statement on modern slavery, climate or diversity is approved by the board.

The breakdown usually happens when those ideas meet day-to-day processes.

At onboarding, suppliers are often asked to sign the policy, but the forms and systems don’t capture ESG information in a structured, comparable way. It’s hard to report on coverage, almost impossible to benchmark vendors against one another, and difficult to see where the biggest risks actually sit.

During selection and award, ESG tends to be mentioned but not scored in a systematic way. Commercial and technical criteria dominate; impact is treated as a “nice to have” and quickly fades into the background when timelines get tight.

Once the contract is signed, POs and invoices move through with little connection back to ESG expectations. There is no easy way to see, by vendor or category, whether your supply base is improving, stagnating or deteriorating from an ESG perspective.

The result is a split reality. Policy speaks the language of impact; systems and processes still speak the language of price only. When boards, regulators or the public ask, “How is responsible sourcing actually working here?”, the answers tend to be anecdotal.

Closing that gap requires four shifts.

1. Governance that reaches the transaction level

Responsible sourcing starts as a governance question—what do we expect from suppliers, and what are we prepared to accept?—but it only becomes real when it shows up in vendor records, sourcing events and individual POs.

That means having a single view of each supplier which brings together legal details, licences, certifications, ESG attributes and risk indicators instead of scattering them across different systems. It means RFx templates that embed ESG requirements and questions alongside commercial and technical ones, rather than treating them as an optional attachment. It means approval rules that take risk and ESG into account when awarding contracts, not just price and payment terms.

Just as importantly, it means being able to show, for a specific tender, why Supplier A was chosen over Supplier B, and which ESG considerations were part of that call.

In ADAM-Procure, this governance layer is built directly into the platform. Vendor Management provides structured fields for ESG and risk. RFx modules allow criteria and weightings, including ESG, to be defined and locked before responses come in. Approval workflows can trigger additional sign-off when thresholds or risk scores are breached. And full audit trails mean internal audit or regulators can see who decided what, and on the basis of which data.

The central question shifts from “Do we have a policy?” to “Can we show, for this specific event and this specific PO, that our policy was actually applied?”

2. Measurable ESG alignment, not vague intentions

Maybank’s responsible sourcing journey is a useful north star because it treats ESG as data and process, not just narrative.

In programmes like this, ESG screening is built into onboarding and recertification so that a large majority of active suppliers are covered, not just a select few. ESG is broken into dimensions that matter to the organisation—labour practices, environmental management, governance, local community impact—and translated into answerable questions and required evidence. That data then feeds into simple coverage metrics: the percentage of active suppliers that have been ESG-screened, the percentage of spend that sits with ESG-screened suppliers, the number of high-risk vendors and where they are in remediation.

Once those numbers exist, they can move over time. Leadership can see coverage improving, high-risk suppliers shrinking, or lagging areas that need attention. Responsible sourcing becomes something that shows up in regular dashboards, not just in an annual report.

ADAM-Procure supports this approach by capturing ESG attributes in the vendor record—certifications held, assessments completed, codes signed—and by allowing ESG scores or flags to be referenced directly in RFx scoring and vendor segmentation. Dashboards can then surface ESG coverage by category, country or spend band.

The practical question becomes, “How many of our critical suppliers meet our ESG criteria today—and which ones need a plan?” rather than “Do we have a policy document somewhere?”

3. Supplier enablement instead of blunt exclusion

A key lesson from more mature programmes is that responsible sourcing isn’t only about cutting off suppliers who fall short. It is also about helping the supply base improve, particularly local SMEs who may not yet meet every standard but are important to the business and the broader economy.

This is especially relevant in Malaysia, where organisations are expected to support local and Bumiputera businesses while also raising ESG performance.

Leading teams tend to start by segmenting suppliers: those who are fully aligned and can be treated as trusted partners; those who are partially aligned and have the capability to improve with support; and those who are truly high-risk, where remediation or exit is necessary.

For the middle group, enablement is essential. This might involve providing templates and guidance on ESG basics, running short training sessions or webinars, and being explicit about which requirements are “must meet now” and which will phase in over the next one to three years. With strategic vendors, it can extend to joint improvement plans—perhaps on carbon reduction, labour standards, or community programmes—where both parties invest and benefit.

In a digital platform, this approach appears as clear segmentation fields (local versus foreign, SME versus large, strategic versus tail), statuses reflecting ESG journey stage (“baseline”, “in progress”, “aligned”), and a recorded history of improvement actions linked to each vendor. ADAM-Procure can hold this structure, which makes it realistic to manage enablement at scale instead of relying on a few individuals’ memory and spreadsheets.

The outcome is a supply base that becomes more aligned over time, rather than a shrinking pool of “perfect” suppliers and a long tail of risk.

4. Digital scoring and transparent decisions

The final, visible piece of responsible sourcing is how you make decisions in competitive events. If ESG doesn’t appear in the scoring model, it rarely influences the outcome.

Embedding responsible sourcing in RFx means giving ESG a defined weight in the evaluation, rather than treating it as a simple pass/fail gate. It requires questions and scoring rubrics that can distinguish between genuine ESG performance and marketing language. Where possible, it means masking vendor identities during evaluation so that ESG and quality answers are judged on content, not brand familiarity.

A typical structure might allocate 40% of the score to price, 30% to technical and quality factors, 20% to service and delivery, and 10% to ESG and risk. Within that 10%, scores might be broken across environmental practices, labour and social standards, governance and compliance, and local community or local supplier impact. The exact split will vary by category, but the crucial point is that ESG is explicitly part of the scoring.

ADAM-Procure’s RFx modules are built for this kind of multi-criteria evaluation. Scoring models can be defined once and reused; evaluators score within the system; comments and ratings are stored for later review. ESG becomes visible in the scorecards used with stakeholders, a factor in who wins and loses, and traceable in reporting—so you can see how often ESG scores materially affected award decisions.

That is the difference between saying “we consider ESG” and being able to show, “In this percentage of our sourcing events, ESG scores contributed to the outcome.”

A practical path: 90 days to move from policy to PO

Transforming responsible sourcing doesn’t have to mean a multi-year project before anything changes. A lot can be achieved in the first 90 days if you focus on connecting policy to data and process.

In the first few weeks, map your existing responsible sourcing policy and supplier code of conduct to concrete data. Identify which statements translate into vendor fields—such as certifications held, policies in place, training completed—and which should become structured questions in RFx. Configure those fields in your vendor master and RFx templates in ADAM-Procure so you can start capturing information consistently.

Over the next couple of weeks, design a simple ESG scoring model. Agree on the ESG dimensions that matter most, decide how much weight they should carry in relevant categories, and draft rubrics so evaluators know what a “1” versus a “5” looks like. Test this on a low- to mid-risk RFx to refine the questions and check they are practical.

In parallel, update onboarding forms and recertification workflows to capture key ESG data. Start with strategic and high-spend suppliers; once the approach is stable, extend it to others. Use dashboards to track how many key suppliers now have ESG information in their profiles so you can see coverage growing.

Finally, communicate and enable. Let suppliers know about the new requirements, why they matter, and how the data will be used. A short guidance pack or webinar can make expectations much clearer and reduce anxiety. Internally, bring category managers and evaluators into the design so they understand the scoring model and see it as an enabler, not extra admin.

By the end of this 90-day cycle, responsible sourcing will no longer live only in a policy document. It will appear in vendor records, in RFx templates, in evaluation scorecards, and in dashboards used by leadership.

Next step: use an ESG scoring template instead of starting from zero

It is much easier to make this shift with a structured starting point than with a blank spreadsheet.

An ESG Scoring Template for Vendor Onboarding (Excel) can give you a core question bank for onboarding and recertification, suggested 1–5 scoring rubrics for each ESG dimension, example weightings by category (services, logistics, manufacturing, etc.), and columns aligned to ADAM-Procure’s vendor and RFx data model so it can be configured directly.

You can use it to translate your responsible sourcing policy into concrete data fields and scores, run your first ESG-enabled onboarding wave with strategic vendors, and build dashboards that show coverage, risk and improvement over time.

👉 If you’d like to schedule a session, get in touch and we’ll find a time that works.

https://adam-procure.com/contact-us/

The shift is already underway. Malaysian CPOs are stepping into a bigger mandate, one built on visibility, accountability, and value creation. With the right foundations in place, procurement doesn’t just protect the bottom line; it helps grow the business.