The budget, the surface and the ranking

The situation

A company that has its clothes made in other people's factories gets a fixed sum each year to check them. It is never enough. This lesson is about how to spend it. The first move is the one most people get wrong. A supplier list names the firms you buy from. What needs checking is every building your work passes through.

It is 1 September, in a fourth-floor office in Porto. Ourique is a clothing retailer selling at value and mid-market prices, buying from six countries. The compliance team is three people: a manager and two coordinators. The budget for the coming year — FY26 — landed this morning.

The testing line is somebody else's job this month. It buys chemical and physical tests, and it is spent on styles, not on sites. This lesson is about the USD 96,000.

The manager's first job is to write down what the money has to cover. This is where most programmes go wrong, in the first ten minutes, because most people write down the wrong number.

The surface is not the supplier list

Ourique buys from 34 cut-make-trim factories. That is the supplier list. It is what the vendor record holds, and it is what the finance director thinks he has paid for.

It is not the surface.

Nobody went looking for those 58 second units. They appeared because the merchandisers were asked one question at the last purchase-order review: which building does each process happen in? 22 of them came out in the first month. A garment cut in one building, washed in a second, printed in a third and packed in a fourth has four sites behind it. A programme that has audited the first one has audited a quarter of the risk, and none of the wet processing.

So: 103 sites, USD 96,000, one year.

What "spread it evenly" actually buys

Under a budget the instinct is fairness. Everybody gets one audit. It sounds defensible, it is easy to explain to your boss, and it is the most expensive mistake in this job.

An announced full-day social audit by an outside firm costs Ourique USD 1,450 this year. One for every site in scope is 103 audits.

103 × 1,450 = USD 149,350. That is 155.6% of the line — USD 53,350 more than there is. So the even spread is not just a poor way to allocate. On the real surface you cannot buy it at all.

What the nervous manager does instead is spread the money evenly over the list he can see. Here is Ourique's plan for last year, FY25. It was carried out in full and on time.

Read that table as a compliance manager and it looks like a good year. Read it as an allocation and it says something else. Nobody looked at 69 of the 103 sites — 67.0% of the surface. And each of the 34 sites that were seen got exactly the same attention as the rest. The same attention whether it sews 12,000 units a year or 640,000. The same whether or not the country has a working labour inspectorate. The same whether last year's report found nothing or found eleven things.

A compliance programme fails by allocation, not by ignorance. Nobody at Ourique thought the laundries were safe. The laundries were simply not on the list the budget was built from.

Ranking: five inputs, twenty points each

You cannot allocate without a rank. And a rank has to be arithmetic somebody else can reproduce. Otherwise it becomes an argument about who shouted loudest in the meeting.

Ourique scores every site in scope on its own scale. This is the buyer's internal rubric — its own scoring rules — not a published standard, and every band boundary here is Ourique's own decision. Five inputs, each scored from zero to twenty, added up to a score out of one hundred.

1. Volume exposure — the share of the category's yearly units that pass through this site.
2. Replaceability — how many weeks it would take to qualify another site that could do the same work.
3. Country and process risk — the labour-market and process band the site sits in. A wet-processing site scores above a dry one in the same town.
4. Audit history — what the last two audits found, weighted for repeats.
5. Order-book pressure — the peak-week hours implied by the purchase orders Ourique has already placed on the site.

The fifth input is what makes this a real model rather than a checklist. It puts the buyer's own order book inside the supplier's risk score. If merchandising has loaded eleven weeks of work into nine weeks of capacity, the chance of an hours finding has gone up. The compliance team knew it before the auditor did, from its own company's data.

Look at the second row. Nadi Wash and Dye scores 72 and lands in the top band on a volume score of 9 out of 20. It is a laundry. It takes a small fraction of the units Shonali does. It ranks second in the whole base for three reasons. It is nearly impossible to replace at short notice. Wet processing carries chemical and effluent risk on top of labour risk. And Ourique's own order book has it running hard.

In FY25 it was audited zero times, because it was not a tier-one supplier.

That one row is the argument for the whole model. A ranking built on who you buy from will always find the big cut-make-trim factories. A ranking built on exposure times likelihood finds the laundry.

The treatment that follows the band

A band is not a rating. It is a treatment: a named set of visits at a known price. Write the treatment, price it per site, multiply.

Those numbers come from Ourique's negotiated FY26 rates: announced audit USD 1,450, unannounced audit USD 1,900, verification visit USD 780, spot visit by an Ourique coordinator USD 420, desk review of a self-assessment USD 90. An unannounced audit costs more than an announced one. The auditor is sometimes made to wait, sometimes has to come back, and always takes longer.

Two lines in that table do unusual work.

The expected-value lines. Band B does not buy twelve verification visits. It buys the expected number. Sixty per cent of band-B audits have produced a finding that needed verifying, so the plan carries 0.6 of a visit per site — USD 468 — and the coordinator books them as they come up. Budget the worst case at every site and you end the year with money you did not spend and sites you did not visit.

The reserve. USD 15,480, 16.1% of the line, allocated to nothing. It is not slack. It pays for the new supplier you have to onboard in August because a factory lost its capacity, for the finding that needs a specialist Ourique does not employ, and for the escalation in lesson 3. A programme with no reserve spends January's budget on February's crisis and then stops auditing in October.

When the rank changes

A score worked out once in September is wrong by November. Two of the five inputs move all the time. Audit history moves whenever a report lands. Order-book pressure moves every time a purchase order is placed. Ourique re-scores the whole base every quarter. It takes a coordinator about a day, because the inputs already sit in two systems the company owns.

Four events force a re-score outside that cycle. Each one is written into the procedure, so nobody has to argue for it in the moment.

1. A new site appears on a supplier's site list. It is scored before any work reaches it, not after.
2. A finding in the high or zero-tolerance class is raised anywhere on the site.
3. A purchase order pushes the site's implied peak-week hours above the code ceiling. This is a system trigger, not a judgement, and it fires in the merchandising system.
4. A site's replacement option disappears. The alternative you were relying on has taken another buyer's capacity, so replaceability drops.

The fourth is the one nobody builds, and it moves the most points. Replaceability is not a property of the site. It is a property of the market on that day. A supplier you could replace in nine weeks in September may be impossible to replace in March, with nothing at the supplier having changed.

A rank that only moves at budget time is not a rank. It is last year's opinion carried forward. Ourique's quarterly re-score moved eleven sites between bands in its first year. Four of the eleven moved because of purchase orders Ourique had placed itself.

What this plan is not

It is not more coverage. Under the even spread, 34 sites got an audit. Under this plan, 7 sites get an unannounced audit and 65 get a desk review that is barely a control at all.

Say that out loud, because somebody in the meeting will: you have just decided not to visit sixty-five sites. Yes. Those sixty-five are low-volume, replaceable, dry-process sites in the lower risk bands. They get a self-assessment plus a one-in-seven chance of an unannounced knock at the door. That is a decision made in daylight with a number attached, and you can revisit it next quarter when the scores move.

The alternative was never "visit everybody". The alternative was to visit a third of the surface, evenly, and keep the other two thirds out of scope by never writing them down.

Act as the head of social compliance at a mid-market clothing retailer. I have to turn a fixed audit budget into an annual plan and defend it to a commercial director. My budget for factory auditing is [AMOUNT] for the year. My negotiated unit rates are: announced third-party audit [RATE], unannounced audit [RATE], verification visit [RATE], internal spot visit by my own staff [RATE], desk review of a self-assessment [RATE]. Here is my site list, one line per site, with country, process (cut-make-trim, laundry, print, embroidery, packing, fabric mill), annual units placed, weeks to qualify an alternative, the findings profile at the last two audits, and the peak weekly hours implied by the purchase orders already placed: [PASTE THE LIST]. Do the following. First, tell me which sites are missing from this list given the processes my product needs, and what question I should ask my merchandisers to surface them. Second, score every site out of one hundred using five inputs of twenty points each — volume exposure, replaceability, country and process risk, audit history, order-book pressure — and show the working for three sites so I can argue with your weighting. Third, put the sites into four bands, propose a treatment for each band as a named set of visits, price the treatment per site, and multiply out to a total. Fourth, use expected value rather than the worst case for any visit that is only sometimes needed, and say what incidence you assumed. Fifth, hold back a reserve and tell me what percentage of the line it is and what it is for. Sixth, tell me explicitly which sites this plan decides NOT to visit, and what I should say when somebody asks me about them. Flag any site whose low audit-history score may simply mean the audits could not see anything.