Part one of this series laid out why forced labor risk has moved from the sustainability report to the balance sheet: tariffs tied directly to a country’s forced labor record, an import presumption in the United States that can freeze finished goods over a single sub-tier component, and a European regulation that can pull products off shelves entirely. Part two addresses the harder question: what does a company actually need to build to protect itself in this environment, and how does it avoid pouring resources into the wrong places while real risk goes unaddressed?

Stop Grading Suppliers by Zip Code

The most common mistake in forced labor risk management is treating geography as destiny. Companies build supplier risk scores off country-level indices and sector-level generalizations, on the theory that a supplier in a high-risk country is dangerous and a supplier in a low-risk country is safe. This approach feels rigorous because it is quantifiable, but it produces exactly the wrong picture. A well-run facility in a high-risk country, with strong internal labor controls, credible auditing, and a track record of remediation, can present far less actual danger than a poorly monitored subcontractor in a country nobody would think twice about.

The more useful question is not where a supplier is located, but how much genuine control that supplier, and the company relying on it, actually has over the labor conditions in its own operations and in the layers beneath it. That is the difference between inherent risk, the baseline exposure created by geography and industry, and residual risk, what is left over after accounting for the real, tested strength of the controls in place. A due diligence program built around residual risk directs attention and resources toward the relationships that actually present danger, rather than treating every supplier in a given country identically. Two examples illustrate how counterintuitive this can be: a manufacturer might assume a developed-economy supplier carries low risk, without realizing that domestic workers have moved on to better-paying jobs elsewhere and been replaced by migrant labor with far less bargaining power and far more exposure to exploitative recruitment practices. Similarly, a company sourcing from a country known for high-end, artisanal production might overlook the reality that finished goods often pass through several layers of subcontractors, some of them informal and largely unsupervised, before reaching the buyer.

Know the Specific Warning Signs, Not Just the General Category

Forced labor rarely announces itself. It tends to hide inside practices that look, on the surface, like ordinary labor arrangements. Compliance and procurement teams need to train themselves and their supplier-facing staff to recognize the specific mechanics that international labor standards treat as hallmarks of coercion, rather than relying on a generic sense that “forced labor” means visible physical restraint.

Watch for workers who have taken on significant debt to secure their jobs, whether through recruitment fees charged by labor brokers, transportation costs, or visa processing charges, particularly when that debt is structured so that a worker’s earnings are effectively consumed by repayment for months or years. Watch for employers or intermediaries holding onto workers’ passports, permits, or identification documents under the justification of safekeeping, since this is one of the most direct mechanisms for restricting a worker’s ability to leave. Watch for irregular or delayed wage payments and inflated deductions for housing, meals, or equipment that function to keep workers financially dependent. Watch for excessive mandatory overtime enforced through threats, whether of termination, deportation, or loss of accumulated pay. And watch for gaps between what workers were promised during recruitment and what they actually encounter on arrival, a pattern that shows up frequently when a primary supplier quietly shifts production to subcontractors or informal labor agencies that were never part of the original vetting process.

None of these indicators require a forensic investigation to spot. They require asking the right questions, in the right way, of the right people, and building a program that treats the answers as data rather than as a box-checking exercise.

What a Credible Program Actually Looks Like

Regulators evaluating whether a company exercised genuine care are not looking for a polished policy statement. They are looking for a documented, operating system that can produce real evidence on demand. At a minimum, that system needs to accomplish several things simultaneously.

It needs real visibility beyond the first tier of suppliers, extending down to the subcontractors, labor brokers, and raw material sources that most companies never formally map, because that is precisely where the Volkswagen-style single-component failure originates. It needs a risk assessment process that combines baseline geographic and sector data with an honest evaluation of how mature each supplier’s own controls actually are, so that resources go toward the relationships carrying the highest residual risk rather than being spread evenly, and thinly, across an entire supplier base. It needs binding contractual commitments and a defined code of conduct that make labor expectations explicit and enforceable, not aspirational. It needs verification that goes beyond paperwork, combining independent audits, unannounced inspections, and mechanisms that let workers themselves report problems directly. And when problems are found, it needs a structured remediation process aimed at fixing the underlying cause, such as ensuring workers are reimbursed for illegal recruitment fees, rather than defaulting immediately to contract termination, which often just pushes the same vulnerable workers into an even more precarious situation without solving anything.

Governance matters as much as any individual control. Accountability for this system needs to sit clearly with senior leadership, spanning legal, compliance, procurement, and supply chain operations together, because a program housed entirely within one function tends to lose influence exactly when it needs to drive a sourcing decision. And the entire system needs to produce records capable of being handed to a customs official or regulator as concrete evidence that reasonable steps were actually taken, not reconstructed after the fact under investigative pressure.

Start With an Honest Baseline, Not a Perfect Plan

Companies looking at this full picture for the first time can find it overwhelming, and that reaction often leads to paralysis rather than progress. The more productive starting point is a candid, evidence-based assessment of where a company’s program actually stands today, which suppliers and product lines carry the highest concentration of residual risk, and where a limited set of early investments would do the most to protect revenue and market access. That baseline does not need to be comprehensive on day one. It needs to be honest, and it needs to create a prioritized roadmap that treats supply chain due diligence as an ongoing operating discipline rather than a document produced once a year and filed away.

The Bottom Line

The regulatory and trade pressure described in part one of this series is not going to ease. Tariffs tied to country-level forced labor performance, import presumptions that can be triggered by a single sub-tier supplier, and market-wide product bans are now permanent features of the global trade landscape, not temporary enforcement pushes. Companies that continue to manage forced labor risk as a once-a-year reporting exercise are gambling with margin, inventory, and market access all at once. Companies that build a real, residual-risk-driven due diligence system are doing something more valuable than avoiding enforcement. They are building the operational resilience needed to keep sourcing globally in an environment where the cost of not knowing your own supply chain has never been higher.