Compliance packs are ready-made sets of questions for particular kinds of supplier or particular laws. Switch a pack on and it becomes one of your onboarding forms, sent to the suppliers it applies to. Packs save you writing your own questionnaires for things like the Modern Slavery Act, insurance and health and safety, or IR35.
Where to find them
Setup → Modules & forms, under Compliance packs. All packs are off until you switch them on, either by hand or through the setup questions in Answer what you buy.
Switch a pack on
- Go to Setup → Modules & forms and find the pack.
- Switch it on. It's added to your onboarding forms.
- Use Which suppliers need it to choose the tiers and areas it applies to. The defaults are shown in the table below.
- Click Edit the N questions to add, remove or reword questions.
- Decide whether it should block go-live. Packs don't block go-live unless you turn that on.
From then on, new and existing suppliers in scope show the pack under their forms. You can send it to the supplier through the supplier portal, where they can answer, mark questions not applicable, upload certificates or point you to their own trust centre.
The ten packs
| Pack | Applies to by default | Completed by → approved by | What it asks |
|---|---|---|---|
| Modern slavery and ethical sourcing | Facilities, People & HR | Supplier → Procurement | Modern Slavery Act 2015: whether they publish a statement and the link, whether they audit their own suppliers for forced or child labour, and the countries their main suppliers operate in. |
| Anti-bribery, fraud and tax evasion | All suppliers | Supplier → Legal | Bribery Act 2010, the failure to prevent fraud offence (in force since September 2025 for large organisations) and the Criminal Finances Act 2017: policies, training, fraud procedures, tax evasion policy, whistleblowing, politically exposed persons, investigations in the last 5 years. |
| Carbon reduction and ESG | All suppliers | Supplier → Procurement | Net-zero year, carbon reduction plan, Scope 1 and 2 reporting, ISO 14001. |
| Facilities and on-site contractors | Facilities | Supplier → Facilities | Public and employer's liability insurance and expiry, health and safety policy, accreditation (SafeContractor, CHAS, Constructionline, SMAS Worksafe or other SSIP) and expiry, RAMS, RIDDOR; work on your premises (COSHH, asbestos, CDM, permits); trade registrations (Gas Safe, NICEIC/NAPIT, F-gas, SIA, waste carrier, food hygiene, allergens); staff (right to work, DBS, TUPE, Living Wage, energy broker fees). |
| People and HR suppliers | People & HR | Supplier → HR | Agencies (Conduct Regulations 2003, Agency Workers Regulations, right to work, auto-enrolment, umbrella companies and the rules in force since 6 April 2026, accreditation); a Contractors and IR35 section completed by HR; payroll and pensions (BACS bureau, ISAE 3402 / SOC 1, The Pensions Regulator, payday contingency). |
| Marketing, agencies and media | Marketing | Supplier → Marketing | Who owns the work, third-party material and usage rights; CAP/BCAP codes, influencer labelling, customer data and PECR consent, generative AI; media rebates, audit rights, principal buying, professional indemnity. |
| Technology and software | Technology | Supplier → IT | Cyber Essentials, ISO 27001 and SOC 2 with dates, last pen test; data location, sub-processors, SLA and credits, support hours, getting your data back at exit, escrow, WCAG 2.2 AA accessibility. |
| Professional and advisory services | Other | Supplier → Procurement | Regulator and number, professional indemnity cover and expiry, conflicts, auditor independence, named people, own limited company (IR35), anti-money-laundering ID. |
| Material outsourcing (FCA-regulated firms) | T1 and T2 | Business owner → Compliance | Whether it's material or critical, exit plan, audit and access rights, sub-outsourcing without consent, concentration risk. Records answers only; not regulatory advice. |
| Financial stability | T1 and T2 | Finance → Finance | Latest accounts reviewed, turnover, your spend as a percentage of their turnover (above 25% means they may depend on you), concerns. |
Which setup answers switch packs on
| If you say you buy or are… | These packs are switched on |
|---|---|
| Technology | Technology and software |
| On-site contractors | Facilities and on-site contractors |
| Agencies or temporary staff, or outsourced payroll | People and HR suppliers |
| Creative or media agencies | Marketing, agencies and media |
| Lawyers or accountants | Professional and advisory services |
| Turnover of £36m or more, or more than 250 staff | Modern slavery, Anti-bribery and Financial stability |
| Regulated by the FCA or PRA | Material outsourcing |
Carbon reduction and ESG is never switched on by the questions. Switch it on yourself if you need it.
Certificate dates feed tracking
Date fields in packs that are certificates, such as insurance, accreditation, Gas Safe, SIA, waste carrier, Cyber Essentials, ISO 27001, SOC 2 and controls reports, appear on the TPRM page's certificate list and turn amber within 45 days of expiry. In the supplier portal these fields have an Upload certificate button so the supplier can attach proof.
Which plan includes it
Compliance packs are included from the Professional plan. On Essentials they show as locked.
Good to know
- The Material outsourcing pack only applies where the Assurance and regulatory records section applies (when you've ticked FCA or PRA in Settings → What you need to evidence).
- Questions marked as required must be answered (or marked not applicable with a reason) before the supplier can submit.
- Edits to pack questions apply to your organisation only.