RBA Code of Conduct Compliance

Ethical Supply Chain & Labor

Responsible Business Alliance Code of Conduct

5 Pillars. 42 Provisions. Hundreds of Suppliers to Assess. Can You Prove RBA Conformance Across Your Entire Supply Chain?

RBA compliance requires evidence of labor rights, health and safety, environmental management, business ethics, and management systems—validated through audits, self-assessments, and corrective action plans across every manufacturing facility. OEM customers demand VAP audit scores. Findings require documented closure within strict timelines.

Certivo automates RBA evidence collection from supplier self-assessment to audit-ready compliance documentation.

5 Pillars covering labor, health & safety, environment, ethics, management systems

200+

VAP score threshold for Platinum recognition

v8.0

Current RBA Code of Conduct version (effective January 2024)

Regulation Overview

Jurisdiction

Global (applicable to all companies participating in or supplying to RBA member supply chains)

Regulatory Body

Responsible Business Alliance (RBA)

Regulation Number

RBA Code of Conduct v8.0

Effective Date

Version 8.0 effective January 1, 2024 (Code originally established 2004 as EICC)

Official Source

https://www.responsiblebusiness.org/code-of-conduct/

Key Threshold

Total supply chain conformance—members must require next-tier suppliers to implement the Code

What is the RBA Code of Conduct?

The RBA Code of Conduct is the global industry standard for social, environmental, and ethical supply chain responsibility and the cornerstone of ethical manufacturing compliance. For supply chain teams, the primary obligation is demonstrating conformance across five pillars—Labor, Health & Safety, Environment, Ethics, and Management Systems—covering provisions that address forced labor, working hours, hazardous substances, anti-corruption, and systematic risk management.

The Code contains 42 provisions verified through the Validated Assessment Program (VAP)—independent third-party audits scoring facilities against RBA requirements. RBA has shifted toward continuous compliance monitoring, with members expected to cascade Code requirements to their next-tier suppliers. Companies supplying to RBA member OEMs must complete self-assessment questionnaires, undergo VAP audits when requested, and remediate all findings within prescribed timelines.

RBA compliance requires facility-level evidence—policies, audit records, corrective action plans, and worker documentation—from every supplier site. When the Code is updated or a customer requests VAP results, your entire supplier base requires reassessment.

Key Components / Sub-Frameworks

Obligation

Zero tolerance for forced labor; compliance with local law or RBA Code, whichever is stricter

Section A: Labor

Freely chosen employment, working hours, wages, humane treatment, non-discrimination, freedom of association

Obligation

Identify, evaluate, and control workplace hazards; documented management systems

Section B: Health & Safety

Occupational safety, emergency preparedness, industrial hygiene, physically demanding work, machine safeguarding

Obligation

Track and report Scope 3 GHG emissions; implement circular packaging principles

Section C: Environment

Environmental permits, pollution prevention, hazardous substances, solid waste, air emissions, water management, energy/GHG

Obligation

Conflict minerals due diligence; whistleblower protection

Section D: Ethics

Business integrity, no improper advantage, disclosure, IP protection, responsible sourcing, privacy, non-retaliation

Obligation

Annual risk assessments; documented management review; supplier cascading

Section E: Management Systems

Company commitment, accountability, risk assessment, corrective action, training, communication, worker feedback, audits

Obligation

Required by member compliance programs; Platinum/Gold/Silver recognition tiers

Validated Assessment Program (VAP)

Independent third-party onsite audit scoring facility conformance across all five pillars

RBA Code v8.0 Is Now the Audit Standard—Are Your Supplier Policies Updated?

Version 8.0 introduced expanded requirements on Scope 3 GHG tracking, circular packaging, and responsible AI use. VAP audits now score against v8.0 provisions. Supplier policies drafted to earlier versions create conformance gaps and audit findings. OEM customers are already requiring v8.0 alignment.

Key Compliance Requirements

Who Must Comply

• RBA member companies and their direct manufacturing facilities

• Suppliers to RBA members across all tiers (cascading requirement)

• Contract manufacturers producing on behalf of RBA member brands

• Non-member companies whose customers require RBA Code conformance

• Companies seeking VAP recognition (Platinum, Gold, Silver) for competitive positioning

• Subcontractors and temporary labor agencies providing workers to in-scope facilities

Key Thresholds

200+ VAP score

Platinum recognition—all Priority, Major, and Minor findings closed

180+ VAP score

Gold recognition—all Priority and Major findings closed

160+ VAP score

Silver recognition—all Priority findings closed

60 working hours/week

Maximum weekly working hours (including overtime), except in emergencies

Core Obligations

1. Self-Assessment Questionnaire (SAQ)
   Complete RBA SAQ benchmarking facility performance against all five pillars
   DEADLINE
   Annual submission via RBA-Online

2. Validated Assessment Program (VAP)
   Independent third-party onsite audit (2–5 days per facility)
   DEADLINE
   Per member compliance program schedule

3. Corrective Action Plan (CAP)
   Document root cause analysis and remediation for all audit findings
   DEADLINE
   Priority findings: immediate action required; Major/Minor: within prescribed timelines

4. Supplier Cascading
   Require next-tier suppliers to acknowledge and implement the RBA Code
   DEADLINE
   Ongoing—at minimum, next-tier must be engaged

5. Annual Reporting
   Report progress on compliance criteria to RBA membership program
   DEADLINE
   Submitted annually via RBA-Online

RBA-Specific Pain Points

The Multi-Customer Audit Overload

Your facility supplies five RBA member OEMs. Each requests VAP results, SAQ completion, and corrective action evidence—but through different portals, in different formats, on different timelines. Your compliance team manages the same data five ways, wasting weeks on redundant documentation instead of actual improvement.

The Corrective Action Spiral

A VAP audit produces 14 findings—3 Priority, 5 Major, 6 Minor. Each requires root cause analysis, corrective actions, preventive measures, and closure evidence. Priority findings demand immediate remediation. You have 90 days to close Major findings. Evidence is scattered across HR, EHS, and operations. The closure audit is in 60 days.

The Cascading Compliance Gap

RBA requires you to cascade the Code to your next-tier suppliers. But your Tier 2 suppliers in Southeast Asia have never seen the RBA Code. They have no SAQ process, no documented management system, and no evidence trail. Your OEM customer asks for sub-tier compliance evidence. You have nothing to share.

The Evidence Fragmentation Problem

Worker timesheets in one system. Environmental permits in a shared drive. Safety training records in a binder. Chemical inventories in Excel. When the VAP auditor requests documentation across all five pillars, your team spends days assembling evidence from a dozen sources—and still finds gaps the morning of the audit.

Certivo In Action

Certivo in Action—RBA Workflow

GET EVIDENCE IN
Collect RBA Compliance Evidence from Every Supplier—Without the Chasing

CORA launches targeted campaigns to collect supplier self-assessments, audit certifications, corrective action evidence, and policy documentation aligned with all five RBA pillars. Automated follow-up in suppliers' native languages.

• Launch RBA compliance campaigns to hundreds of suppliers with one click
• CORA-powered outreach requesting SAQ data, VAP reports, and policy documents
• Accept any format: PDFs, Excel, RBA-Online exports, audit reports, freeform responses
• Track response rates and escalate non-responders automatically

MAKE SENSE OF IT
Know Instantly Which Suppliers Meet RBA Code Requirements—and Where Gaps Exist

CORA parses supplier responses, validates evidence against RBA Code v8.0 provisions, cross-references audit findings, and flags conformance gaps automatically.

• CORA extracts audit scores, finding severities, corrective action status, and policy coverage from supplier documents
• Automatic validation against all 42 RBA Code provisions across five pillars
• Real-time supplier risk scoring based on VAP performance, SAQ results, and evidence gaps
• Gap analysis identifying missing policies, expired certifications, and open findings per facility

⚠️ PROVE COMPLIANCE OUT
Respond to OEM Customer Requests in Hours, Not Weeks

Generate audit-ready RBA compliance packages, corrective action summaries, and supplier cascading evidence instantly from validated data.

• One-click RBA compliance packages aligned with member reporting requirements
• Corrective action closure summaries with root cause documentation and evidence
• Customer-specific supplier compliance reports with full traceability
• Complete audit trail for every validation, finding closure, and supplier response

One Supplier Submission. Validation Across All 5 RBA Pillars. Audit-Ready in Hours.

Certivo collects supplier RBA evidence, extracts audit findings and compliance data, validates against all 42 Code provisions, and generates customer-ready documentation automatically. When the Code is updated or a customer requests compliance evidence, Certivo reassesses your supplier base and alerts you—before the audit notification arrives.

5-Pillar Validation

VAP Evidence Management

Corrective Action Tracking

Supplier Risk Scoring

Multi-Customer Reporting

Features Tabs

Supplier Evidence Collection

Certivo's automated campaigns achieve 95% response rates vs. 20–30% with manual outreach.

• Targeted campaigns by facility, supplier tier, commodity category, or RBA pillar
• Multi-language outreach in suppliers' native languages
• Intelligent follow-up sequences adapting to supplier behavior
• Format-agnostic: PDFs, Excel, RBA-Online exports, audit reports, freeform responses

Compliance Data Extraction

Every supplier document parsed for audit findings, policy coverage, and corrective actions automatically—no manual data entry.

• Deep extraction of VAP scores, finding severities, CAP status, and certification dates
• Parses audit reports, self-assessment questionnaires, and proprietary supplier formats
• Multi-language document processing across all major supplier geographies
• Anomaly detection for inconsistent, expired, or incomplete compliance declarations

RBA Code Monitoring

Always validated against the current RBA Code—not your last audit cycle.

• Automatic sync with RBA Code updates and new version releases
• Provision-level gap mapping against v8.0 requirements
• Proactive alerts when Code changes affect your supplier policies
• Historical tracking of supplier conformance status across audit cycles

Customer Response

Generate OEM compliance packages in hours instead of 4–6 weeks.

• One-click compliance packages aligned with each OEM customer's RBA reporting requirements
• Corrective action summaries with root cause analysis and closure evidence
• Supplier cascading documentation with next-tier engagement proof
• Response tracking for customer compliance request deadlines

Corrective Action Management

Structured CAP workflows turn audit findings from risk into documented improvement.

• Finding categorization by severity (Priority, Major, Minor) with prescribed timelines
• Root cause analysis templates aligned with RBA closure requirements
• Automated reminders and escalations for approaching CAP deadlines
• Closure evidence collection with audit-grade documentation trail

Related Regulations

EU CSDDD

CSDDD mandates supply chain human rights due diligence; RBA Code provides operational framework

Combined Value
RBA evidence satisfies CSDDD due diligence documentation requirements

EU Forced Labour Regulation

EU FLR bans forced-labour products; RBA Section A addresses freely chosen employment

Combined Value
Supplier labour evidence validates both RBA conformance and EU FLR traceability

Conflict Minerals (3TG)

RBA Section D requires responsible mineral sourcing; RMI is an RBA initiative

Combined Value
Unified conflict minerals and ethical sourcing compliance from one platform

UK Modern Slavery Act

UK MSA requires modern slavery statements; RBA labor audits provide supporting evidence

Combined Value
RBA audit evidence feeds directly into modern slavery disclosure documentation

SA8000

SA8000 and RBA Code share labor and management system standards

Combined Value
Multi-standard supplier validation from one evidence collection campaign

UFLPA

UFLPA enforces forced labour import ban; RBA audits verify labour conditions at supplier sites

Combined Value
Combined RBA + UFLPA evidence package demonstrates ethical sourcing compliance

Managing RBA compliance alongside related regulations eliminates duplicate supplier requests. Certivo validates one submission against multiple frameworks.

Industries Most Impacted

Electronics Manufacturing
Your Pain Point
Core RBA membership sector; complex multi-tier supply chains; multiple OEM customers requiring VAP

Semiconductor & High-Tech
Your Pain Point
High-volume contract manufacturing; migrant worker risks; cleanroom safety requirements

Automotive Manufacturing
Your Pain Point
RBA adoption expanding into automotive; IATF + RBA overlap; OEM sustainability scorecards

Aerospace & Defense
Your Pain Point
Prime contractor flowdown; sub-tier labour compliance; conflict minerals overlap

Medical Devices & Equipment
Your Pain Point
Contract manufacturing in high-risk regions; FDA + RBA dual compliance

Industrial & Heavy Equipment
Your Pain Point
Global supplier networks; legacy facilities; EHS + RBA environment overlap

Consumer Goods
Your Pain Point
Retail brand reputation risk; high SKU counts; seasonal labour surges

Energy & Infrastructure
Your Pain Point
Expanding RBA adoption in renewable energy supply chains; solar + battery component sourcing

Return on Investment

80% Reduction in Compliance Labor
From Manual Evidence Assembly to Automated Compliance Management

CORA collects, parses, and validates supplier RBA evidence automatically. Your team focuses on corrective actions and improvement—not compiling spreadsheets and chasing audit reports.

4 hours to Customer Response
OEM Compliance Package Acceleration

Generate complete, audit-ready RBA compliance packages for any OEM customer in hours—not the 4–6 weeks of manual compilation across facilities and pillars.

Real-Time Supplier Risk Visibility
Proactive RBA Compliance Monitoring

When the Code is updated, audit findings are reported, or corrective action deadlines approach, Certivo alerts you and reassesses your supplier base automatically. Know your compliance posture before customers ask.

Key Statistics

42

RBA Code provisions validated across all five compliance pillars

99.2%

Compliance data extraction accuracy from supplier documents

95%

Supplier response rate with CORA-powered campaigns

Frequently Asked Questions

Which companies need to comply with the RBA Code of Conduct?

Any company that is an RBA member, supplies to an RBA member, or manufactures products on behalf of an RBA member brand is expected to conform to the Code. This includes direct suppliers, contract manufacturers, and subcontractors across all tiers. The obligation cascades—RBA members must require next-tier suppliers to implement the Code. In practice, thousands of facilities globally must demonstrate conformance to maintain OEM business relationships.

What happens if a supplier fails an RBA VAP audit?

VAP audit findings are categorized as Priority, Major, or Minor. Priority findings require immediate corrective action. Major findings must be remediated within prescribed timelines (typically 90 days). Failure to close findings can result in loss of VAP recognition, customer disqualification, or removal from approved supplier lists. Market access depends on documented closure evidence for every finding.

How does Certivo support RBA compliance across multiple OEM customers?

Certivo collects one set of RBA compliance evidence from each supplier and generates customer-specific packages for any OEM. CORA validates supplier data against all 42 Code provisions, maps findings to each customer's reporting format, and produces audit-ready documentation on demand. One supplier submission satisfies multiple customer compliance requests simultaneously.

Does Certivo support VAP audit preparation and corrective action management?

Yes. Certivo provides structured corrective action workflows aligned with RBA CAP requirements—including root cause analysis templates, remediation tracking, evidence collection, and closure documentation. CORA monitors approaching deadlines, escalates overdue actions, and generates closure summaries for VAP reassessment. This replaces last-minute scrambling with systematic, continuous audit readiness.

How does RBA compliance relate to EU and US supply chain due diligence laws?

RBA conformance demonstrates operational labour, environmental, and ethics practices that directly support compliance with the EU CSDDD, EU Forced Labour Regulation, UFLPA, UK Modern Slavery Act, and Conflict Minerals regulations. Certivo validates supplier evidence against RBA Code provisions and regulatory due diligence requirements simultaneously—providing multi-tier supply chain transparency from a single evidence base.

Ready to Automate RBA Compliance?

See how Certivo's ethical supply chain compliance software transforms RBA evidence management from reactive audit scrambling to continuous conformance confidence.

Book a Demo

Talk to an Expert