Summary

The Department of Health and Social Care (DHSC) pledged to put an end to modern slavery in the National Health Service (NHS). As set out in section 12ZC of the National Health Service Act 2006 (the NHS Act 2006) (as inserted by section 81 of the Health and Care Act 2022). New regulations have been created to eradicate the use in the health service of goods and services which are tainted by slavery and human trafficking.

In December 2023, DHSC, supported by NHS England, delivered a review of risk of modern slavery and human trafficking in the NHS supply chains. The review covered a snapshot in time and showed that across 60% of spend on medical consumables, 21% of suppliers were identified as high risk for modern slavery and 16% were medium risk. The review highlighted the need for standardised risk management across the NHS and better data showing the extent and nature of modern slavery in NHS supply chains. The review also showed a significant amount of commitment from our suppliers to tackle modern slavery in their supply chains and made a recommendation to lay the regulations.

The National Health Service (Procurement, Slavery and Human Trafficking) Regulations 2025 (the regulations) set out a requirement that all those procuring goods and services for the purposes of the health service in England will be required to assess the risk of modern slavery in their supply chains and respond by taking reasonable steps to mitigate that risk.

A key component of the changes introduced by the 2022 act – and strongly supported by stakeholders across government, the NHS and local government – is that the new regulations will address modern slavery risk within all points of the commercial lifecycle. The regulations will build in reasonable steps when developing procurements and contracts, during the contract award stage and throughout the contract term.

These regulations are new and signify an important step to ensuring NHS supply chains are free from modern slavery. The regulations will apply to all procurement activities undertaken by a public body (this term being used throughout this guidance as defined within the regulations), regardless of value. The regulations will apply to all procurements and contracts of goods and services for the purposes of the health service, including:

• those procurements covered under the Procurement Act 2023
• those procurements and contracts awarded in scope of the Health Care Services (Provider Selection Regime) Regulations 2023
• any other procurement activity not covered by either of those regimes

The NHS takes a risk-based approach with a focus on due diligence to address modern slavery in healthcare supply chains. Recognising there is no such thing as ‘no risk’ of modern slavery, all covered procurements will be assigned a risk level of low, medium or high and will require reasonable steps to be taken commensurate to the level of risk. This approach prioritises working collaboratively and constructively with suppliers to improve supplier practices and support potential victims.

The regime is established under section 12ZC of the NHS Act 2006 (as amended) and is set out in the regulations. Regulation 11 specifies that public bodies in scope must have regard for any relevant guidance published by NHS England, which includes this statutory guidance, which has been designed to support organisations to understand and interpret the regulations.

This guidance document has been written for procurement professionals and assumes a minimum level of knowledge of procurement procedures and the relevant procurement regulations.

Introduction

Debates regarding amendments tabled for the Health and Care Bill (now act), brought specific attention to suspected forced labour abuses in the Uyghur region in China. Following the introduction of section 81 of the Health and Care Act 2022, and the findings of the NHS review, DHSC and NHS England are introducing the National Health Service (Procurement, Slavery and Human Trafficking) Regulations 2025. Under section 12ZC of the NHS Act 2006, the regulations introduce new statutory duties for public bodies to assess the risk of modern slavery when procuring goods and services to deliver health services and respond to those risks by taking reasonable steps.

Implementing the regulations strengthens the legal duty to manage modern slavery risk within NHS supply chains, as set out in Procurement policy note 009: Tackling modern slavery in government supply chains (PPN 009).

DHSC co-developed the regulations with NHS England, drawing on the findings and recommendations made within the review of risk of modern slavery and human trafficking in the NHS supply chain. The key recommendations relevant to the development of the regulations included:

• under the power in section 12ZC of the NHS Act 2006 (inserted by section 81 of the Health and Care Act 2022), make regulations that set out how to address the risk of modern slavery and human trafficking through the procurement process for the health service aligning to requirements under PPN 009
• establish guidance for NHS implementation of the new regulations, taking a risk-based approach to increased supply chain due diligence, monitoring of performance and managing supplier non-compliances
• update modern slavery provisions in the NHS terms and conditions for the procurement of goods and services to address supplier disclosure, monitoring, remediation and consider continuity of supply
• establish robust and consistent risk identification methodology to support a standard approach to product level risk management for the health family
• identify opportunities to support a centralised approach to modern slavery risk assessment and mitigation

Each of the recommendations have been addressed either through the specific duties set out in the regulations or this guidance. They have been developed by working across government with affected organisations to understand the progress with implementing the PPN and the support these organisations will need to implement the regulations.

DHSC and NHS England recognise that the implementation of these regulations needs to work compatibly with other areas of legislation. This guidance does not specify how to comply with other legal obligations including:

• NHS Act 2006
• Equality Act 2010
• Modern Slavery Act 2015
• Public Contracts Regulations 2015 (PCR)
• Subsidy Control Act 2022
• Procurement Act 2023
• Procurement Regulations 2024
• Health Care Services (Provider Selection Regime) Regulations 2023

A reference to legislation or a legislative provision is a reference to it as amended, extended or re-enacted from time to time.

Under the new regulations for goods or services being procured for the purposes of the health service in England, public bodies are expected to:

• take steps for assessing and addressing the risk of slavery and human trafficking taking place
• design procurement procedures and contracts which respond in a proportionate and relevant way to the level of risk of modern slavery
• make provisions within contracts to ensure supplier compliance with the regulations and this guidance

The regulations will not apply retrospectively.

This guidance sets out:

• how the regulations should be followed by the public bodies to which they apply
• detailed examples of the scope of the regulations
• proposed reasonable steps public bodies should apply according to the level of modern slavery risk assessed

Public bodies are expected to read this guidance alongside its annexes, which give further detail on how to risk assess modern slavery and respond to incidences of modern slavery within their contracts and/or supply chain.

Public bodies should ensure good record keeping practices in relation to modern slavery risk mitigation activities. Any decisions to deviate from the application of reasonable steps should be justified as relevant and proportionate and documented. NHS England and DHSC may review the implementation of the regulations, and application of this guidance in the future; contracting authorities should be able and ready to report on modern slavery activities where possible.

Scope

The scope is defined within section 12ZC of the NHS Act 2006, and regulations 3 and 11 of the regulations.

This statutory guidance outlines the risk-based approach and minimum due diligence requirements to be conducted for the procurement of goods and services for the health service (NHS procurements) to tackle modern slavery in NHS supply chains. These requirements and approach are aligned with those laid out in PPN 009.

Public bodies, as defined within the regulations, must have regard to this guidance in undertaking a risk assessment and in taking reasonable steps to address identified modern slavery risk, as required by the regulations. Public bodies should always consider the impact on the specific nature of the procurement to ensure the reasonable steps applied are proportionate, relevant and do not create unnecessary burdens in the delivery of the contract. Modern slavery risks can be found in contracts and suppliers of all sizes. However, specific attention should be given to the proportionality of the requirements when applying them to small and medium sized enterprises (SMEs) and voluntary, community and social enterprises (VCSEs).

The regulations and this guidance apply to any public body procuring goods or services for the purposes of the health service in England. Public bodies, as defined within the regulations, will include:

• all NHS organisations
• other health bodies including DHSC and its arm’s length bodies
• local authorities
• central purchasing organisations

Broadly, any organisation that is procuring any goods or services that may be used in any aspect of the NHS is in scope. For example, a framework established by another organisation is in scope where NHS organisations are listed as organisations able to use the framework. This applies even if the framework does not operate only, or principally, for the benefit of NHS customers or call-off authorities. For local authorities, this includes:

• when procuring goods and services for the health service as part of their public health functions
• in section 75 partnership arrangements with the NHS
• when working collaboratively with other public sector authorities procuring goods and services for the health service

This means that, for example, services arranged by local authorities focused on substance use, sexual and reproductive health and health visits are in scope. A joint contract established by a local authority to provide community equipment, which may provide goods and services to the health service, is another example of an in-scope procurement.

The regulations and guidance apply to new procurements only from the commencement of the National Health Service (Procurement, Slavery and Human Trafficking) Regulations 2025 and do not apply retrospectively to existing contracts. Where there is any doubt as to whether a procurement is in scope of the regulations, organisations should seek advice to determine the application or treat the procurement as in-scope and comply with the regulations and follow this guidance.

This guidance and its reasonable steps also apply to complex and mixed procurements (i.e. where services and works or goods and works are procured together, or where only an element of the procurement is for the purposes of the health service in England). The procurement lead should consider the relevance and proportionality of the proposed reasonable steps within the context of each specific procurement and design an approach to managing modern slavery risk accordingly. The justification for any deviation from the reasonable steps set out in the guidance should be clearly documented.

Whilst works are outside the scope of the regulations, works are in scope of PPN 009, which applies to NHS Bodies and this guidance should be followed as best practice for works. The presence of modern slavery risks has been identified within the construction sector.

The independent health sector is encouraged to adopt the requirements within this guidance as best practice.

For simplicity the term ‘modern slavery’ is used throughout this document in place of ‘slavery and human trafficking’. The term ‘modern slavery risk’ in relation to a good or service means a risk that slavery and human trafficking takes place in relation to any person involved in the supply chain for that good or service (as defined within the regulations).

Modern slavery risk assessments

Regulations 4(1) and 4(2)(a) define the requirements for assessing risk.

Public bodies are required under the regulations to complete a risk assessment when establishing new contracts, frameworks or dynamic markets pertaining to goods and services. 

To support public bodies to conduct consistent risk assessments of the modern slavery risks in supply chains, a national tool (see Annex 1) has been built into the health system’s e-procurement system to categorise the level of risk as low, medium or high. The tool draws on data reflecting the 6 characteristics of modern slavery risk in procurements identified in PPN 009. For non-NHS bodies procuring for the purposes of the health system, any risk assessment adopted should reflect the risk of the procurement category with regard to the 6 characteristics of risk outlined in PPN 009 (1- Industry type; 2- Nature of workforce; 3- Supplier location; 4- Context in which the supplier operates; 5- Type of commodity; 6- Business/Supply chain models).

Where a competitive tendering procedure is being followed, the risk assessment must be completed before the public body publishes a notice inviting suppliers to participate in a procedure (except where a contract is established as a call-off from a dynamic market or framework – see further on this below). Following the assessment of the risk level for the procurement, the public body should apply the reasonable steps applicable to the risk level set out in this guidance. These steps must address, and where possible eliminate, the risk through the design of the procedure for award and when managing the contract. Public bodies can deviate from the minimum reasonable steps in this guidance only when market engagement has been carried out and documented by the procuring public body to sufficiently demonstrate and justify a change in approach.

Note, throughout this document the phrase ‘follow the standard procurement process’ is defined as a compliant procurement process in line with relevant legislation, regulations and internal policies (for procurements below the relevant threshold), or the NHS Provider Selection Regime (PSR). 

Frameworks

Regulations 4(3)(a) and 5 define the requirements to assess risk for frameworks.

Frameworks – owners

To reduce the burden on public bodies calling off from frameworks, the public body proposing to enter into a framework (framework owner) is responsible for completing a risk assessment prior to advertising the opportunity to participate in the framework. Once the level of risk is assessed for the sector or framework, follow the ‘Reasonable steps’ section of this guidance.

Due to the potential length of frameworks, it is recommended that reassessment of modern slavery risk be conducted every 2 years using the NHS risk assessment tool, or equivalent, where available. Subject to this recommendation, the framework owner may want to align reassessment with any other periodic reviews of framework policies, such as renewal periods or when an open framework is re-opened for new suppliers to join. See the ‘Reassessment of risk’ section for details of the requirements for reassessment of risk. The framework owner must ensure the date of the latest assessment, or reassessment, is visible to public bodies calling off the framework, and confirm that the assessment has been conducted in line with this guidance.

Any reasonable steps selected by the framework owner should be communicated within the buying instructions (used to refer to framework documents, buying guides and equivalent documents) of the framework. The buying instructions should clearly set out any reasonable steps that will require implementation within any call-off contracts. The framework owner should ensure any reasonable steps which require implementation at a call-off level are proportionate and relevant to the subject matter and level of risk. Requiring individual public bodies to manage the response to the risk should not increase the burden on suppliers. Where a market or sector is reassessed and the risk level changes, framework owners are expected to respond to the change within the context of the procurement laws governing set up and management of these arrangements.

Where a framework establishes a catalogue approach for public bodies to procure goods and/or services, then the framework owner should ensure the reasonable steps implemented throughout the framework term are implemented in a proportionate way, noting the transactional nature of these arrangements.

Where supplier meetings are selected as a reasonable step for managing a procurement or contract, they can be required only for suppliers transacting on a framework. The frequency of supplier meetings should be considered in terms of the context of the framework, value, complexity of the goods or services procured, and the risk level identified.

Frameworks – call-offs

A public body calling off a framework is responsible for confirming a risk assessment has been conducted by the framework owner that is aligned to this guidance. If the risk assessment is not up to date, or the public body is aware of a triggering event for reassessment, the public body must inform the framework owner, who is then required to undertake a reassessment of modern slavery risk for the framework and respond to that risk in accordance with regulation 10(4).

The public body calling off the framework should have regard for any buying instructions developed by the framework owner when selecting measures for inclusion within their call-off contract. Where it is considered relevant and proportionate, the buying instructions may include reasonable steps for managing risk within the call-off term.  The public body’s responsibility for mitigating modern slavery risk is addressed by applying the reasonable steps set out in the buying instructions as a minimum. Any deviation from this should be justified and documented on the basis of proportionality and relevance.

The public body must inform the framework owner if a trigger for reassessment arises during the course of contract management (see the ‘Reassessment of risk’ section).

Frameworks – catalogue procurement

A public body procuring from a catalogue will need to establish internal procedures to ensure that only catalogues provided through an NHS accredited framework host are accessed. NHS accredited framework hosts are required to comply with this guidance, and the accreditation process provides assurance that the framework host has appropriate processes in place.

Public bodies using an internal catalogue or supplier specific catalogue should follow the relevant steps in this guidance for a competitive tendering procedure or framework call off depending on the procedure used.

NHS Supply Chain is responsible for completing risk assessments and implementing reasonable steps for frameworks established to support the NHS Supply Chain catalogue.

The responsibility for implementing reasonable steps for risk mitigation during contract management should remain with the framework owner for catalogues to ensure a consistent approach and reduce the burden on suppliers.

Dynamic markets

Regulations 4(3)(b) and 6 define the requirements to assess risk for dynamic markets.

Dynamic markets – owners

To reduce the burden on public bodies awarding contracts under a dynamic market, the dynamic market owner is responsible for completing the risk assessment prior to advertising the opportunity and before the first supplier is admitted to a dynamic market. Once the level of risk is determined for the sector or dynamic market, the reasonable steps should be followed as documented within the ‘Reasonable steps’ section of this guidance.

If supplier meetings are selected as the reasonable step for mitigating modern slavery while the dynamic market is in operation, then this is only required for transacting suppliers. The frequency of supplier meetings should be considered in terms of the context of the dynamic market, value and complexity of the goods or services that are available under it.

Due to the potential duration of dynamic markets, it is recommended that reassessment of modern slavery risk be conducted every 2 years and should make use of the NHS risk assessment tool where available. The dynamic market owner may want to align reassessment with any other periodic reviews of dynamic market policies. The dynamic market owner must ensure the date of the latest assessment (or reassessment) is visible to public bodies calling off the dynamic market, alongside confirmation that the assessment has been conducted in line with this guidance. Risk assessment ratings can be published alongside other documentation for the framework or dynamic market. The requirements for reassessment of risk are detailed within this guidance in the section ‘Reassessment of risk’.

Where a market or sector is reassessed and a risk rating changes, dynamic market owners are expected to respond to the change within the context of the procurement laws governing set up and management of these arrangements, noting that the conditions of membership may not be changed once a dynamic market is established.

Dynamic markets – procurements

The public body awarding contracts under the dynamic market may be required to implement reasonable steps within their procurements. Dynamic market owners must set out in the buying instructions for the dynamic market, any reasonable steps public bodies should take for responding to modern slavery risk within any procurements. This may include reasonable steps to include certain award criteria or terms within the contract.

Buying instructions should require public bodies conducting the competition to inform the dynamic market owner of the outcome of their procurement and any other details relevant to ensure the risk assessment is up to date and the reasonable steps set out in buying instructions are relevant and proportionate for the management of modern slavery risk. Sharing this information will support the dynamic market owner to comply with their duties under regulation 10 in relation to reassessment of risk. If the award under a dynamic market triggers one of the reasons to reassess risk as documented at regulation 10(3), the dynamic market owner is required to reassess the modern slavery risk for their dynamic market. Where a risk rating changes, the dynamic market owner must review the reasonable steps and update the buying instructions in accordance with regulation 10(4) (see the ‘Reassessment of risk’ section).

When awarding contracts under a dynamic market, the public body undertaking the procurement is responsible for confirming a risk assessment aligned with this guidance has been conducted by the dynamic market owner. Where this risk assessment is not up to date, or the public body is aware of a triggering event for reassessment, the public body must inform the dynamic market owner, who must undertake a reassessment of risk and respond in accordance with regulation 10(4).

The public body must inform the dynamic market owner in the event a trigger for reassessment arises during contract management (see the ‘Reassessment of risk’ section).

Reasonable steps 

Reasonable steps are defined in regulations 7 and 8(1).

The level of modern slavery risk identified for a specific procurement or contract should inform the reasonable steps a public body takes to mitigate the risk when designing the procedure for award, carrying out the procurement and when managing the contract, framework or dynamic market.

Throughout the procurement process, a range of tools can be used to support the mitigation of modern slavery risks, and appropriate tools will depend on the risk level of the procurement. The tools detailed in this guidance support the implementation of reasonable steps as defined within the regulations.

Pre-procurement activities provide the earliest opportunities to ensure that modern slavery risks are identified and mitigated throughout the term of a contract, framework or dynamic market. Early market engagement between public bodies and suppliers are important to assess market understanding of and response to the risk and test approaches to modern slavery risk management. Comprehensive early market engagement is recommended to ensure the reasonable steps are proportionate and relevant to the market.

The following reasonable steps should be considered when reviewing the result of the risk assessment, during preparation of the procurement documentation. Public bodies should consider the reasonable steps outlined and implement those which are proportionate and relevant to the procurement, further detail on how to apply the reasonable steps is outlined in Annex 2.

Reasonable steps – low risk

Where a low risk of modern slavery is identified in a risk assessment or reassessment, the public body should follow the standard procurement process relevant to the value and complexity of the subject matter. Public bodies may wish to utilise specific tools to help mitigate the risk of modern slavery in low risk procurements if they deem it necessary, as low risk does not mean ‘no risk’. Reasonable steps set out for low risk procurements are also applicable to address in both medium and high risk procurements.

Public bodies should include specific schedules relating to modern slavery within the terms and conditions to ensure sufficient cover is provided to address any changes to the level of risk of modern slavery during the term of a contract, framework or dynamic market – such as clauses which permit variations and/or modifications during the term to respond to a change in risk.

Reasonable steps – medium and high risk

Procurement design

The following reasonable steps are proposed for the procurement design stage. Table 1 of Annex 2 outlines further how public bodies might apply the suggested reasonable steps within the procurement design process. 

Conditions of participation

When issuing a tender to bidders, public bodies should consider including the reasonable steps detailed below, whilst also accounting for the requirements laid out in:

• (PA 2023) Procurement specific questionnaire (PSQ)
• modern slavery assessment tool (MSAT)

Table 2 of Annex 2 outlines how public bodies might apply any of the above suggested reasonable steps. 

Modern slavery assessment tool

The modern slavery assessment tool (MSAT) is a UK Government risk identification and management tool, designed to help public sector organisations and suppliers to work in partnership to improve protections and reduce the risk of worker exploitation within the supply chain. Based on supplier responses, the assessment tool provides bespoke recommendations which provides a foundation for addressing areas of risk and its management. The collation of recommendations into a MSAT report equates to an improvement plan as required in ‘reasonable steps’ for medium and high risk procurements. Suppliers completing a full MSAT response early in the procurement process supports suppliers and procuring organisations to better understand the true nature of modern slavery risk in potential supply chains.

A better understanding of modern slavery risk will enable a relevant and proportionately tailored approach to the management of that risk throughout the procurement and contract going forward. Supplier and supply chain information provided via the MSAT may also bolster evidence and justification in relation to the application of relevant mandatory and/or discretionary exclusion grounds by contracting authorities procuring goods and/or services for use in, but not limited to, the health service. For more information, see the following guidance from the Cabinet Office:

• PPN 009: Tackling modern slavery in government supply chains
• (PA 2023) Procurement specific questionnaire

How suppliers engage with the MSAT and improvement plan may constitute a component of ongoing reassessment of the contract risk (see the ‘Reassessment of risk’ section). Public bodies may use an equivalent tool to MSAT where it provides a supplier specific assessment of risk and enables the development of an improvement plan. Public bodies using an alternative supplier risk tool should ensure this does not unduly add supplier burden.

Award criteria

The evaluation and award criteria for medium and high risk procurements should apply the modern slavery questions and metrics from the Social Value Model to further bolster modern slavery risk mitigation activities.

Guidance on the Social Value Model can be found alongside PPN 002: Taking account of social value in the award of contracts. Procurement professionals should specifically note Model Award Criteria (MAC) 1e. (in the Social Value Model on the PPN 002 page 6): “Identifying and managing the risks of modern slavery”. Public bodies may also include modern slavery as a core requirement in the specification.

Procurement professionals should also have regard for NHS England’s NHS Social Value Playbook

Where a public body is establishing a framework or dynamic market, the reasonable steps set out in Table 3 of Annex 2 should be applied at the most suitable point in the process where the risk identified can be mitigated most effectively. This could be at any point between establishing the framework or dynamic market, or as set out in the buying instructions for a public body calling off the framework or dynamic market to implement where appropriate. Any elements identified within the call-off buying instructions should be proportionate and not create additional administrative or financial burden for either the public body or supplier.

Key Performance Indicators (KPIs)

Key Performance Indicators (KPIs) should be used as a reasonable step to measure progress towards goals to improve the supplier’s ability to identify, prevent, mitigate and respond more effectively to modern slavery risks year-on-year. Goals and KPIs should be outcome focused and informed by specific risks in an organisation’s operations and supply chain.

Organisations should develop suitable KPIs that are relevant and proportionate to the contract and risk level. The Transparency in Supply Chains (TISC) guidance is a useful resource to support organisations further when developing KPIs.

Suggested KPIs are provided below, further detail on how public bodies might apply any of the suggested KPIs as a reasonable step is outlined in Table 3 of Annex 2. 

Public bodies should include KPIs covering areas such as:

• Annual MSAT completion to monitor supply chains throughout the life of the contract
• Sharing MSAT recommendations, to collaboratively develop a contract-specific improvement plan, with commitment to be delivered within agreed timescales through the contract term
• Reporting any suspected modern slavery violations to an executive director (of the supplier) immediately upon detection and investigating the reports within 48 hours
• Handling confirmed modern slavery cases successfully within an agreed timeframe and aiding victims immediately upon detection
• Requiring commercial staff to complete training on modern slavery due diligence for risk in the supply chain
• Completion of supply chain mapping, and when a substantial change in the supply chain occurs (for example, introduction of a new associated person or sub contractor) that is proportionate and relevant to the subject matter

Contract management

Regulations 7 and 9(a), 9(b) and 9(d) define managing modern slavery risks during the term of the contract.  

Effective contract management is vital for mitigating and managing modern slavery risks. A positive, proactive and collaborative approach with suppliers fosters transparency and encourages them to raise issues as they emerge, enabling in-scope organisations to address concerns effectively.  

When a potential modern slavery incident is identified, efficient contract management is crucial to minimise its immediate and continued impact. See Annex 2 for how to effectively respond to a modern slavery incident.

When managing contracts, in-scope organisations should consider the impact on suppliers of all sizes. SMEs and VCSEs often have limited time and resources for contract management activities; the overall approach should be proportionate.

The MSAT service and guidance should be noted when reviewing this implementation guidance when including the requirements below within any contract terms and conditions. 

The contract and supplier relationship management approach should encourage suppliers to be proactive and transparent when reporting risks or incidents of modern slavery. It is important that contracting organisations use these tools to effectively respond to incidents of modern slavery to avoid causing further harm to those involved. Other than in extreme cases, terminating a contract for reasons linked to modern slavery should only be considered where the issues continue to occur, and the supplier demonstrates a lack of willing to co-operate and change. Legal advice must be sought in these instances. Further guidance is provided in PPN 009.

Table 4 of Annex 2 outlines how public bodies might apply any of the suggested reasonable steps for contract management. 

Audits and intelligence

Whilst audits are not included as a recommended reasonable step in this guidance, they can be a useful way of verifying a supplier’s approach to tackling modern slavery and their own assessment of risk. Framework and dynamic market owners or public bodies may choose to include audits as a reasonable step in their procurements where they consider them to be relevant and proportionate to the risk and subject matter of the contract. Audits can be useful as part of a wider approach to monitoring supplier activity and should be combined with intelligence from a variety of sources such as local NGOs, trade unions, researchers or experts that have closer relationships with vulnerable workers wherever possible. Audits should not be substituted for long-term, open and collaborative relationships with key suppliers.

The types of audits and considerations to take into account when conducting one can be found in the ‘Supplier Audits: Points to Consider’ guidance at Annex B of PPN 009. This guidance should be considered before organisations carry out an assessment themselves or employ specialist auditors to carry out the process on their behalf.

Reassessment of risk

Requirements for reassessment of risk are defined in regulations 9(c) and 10.

Modern slavery risks can change over the lifetime of a contract. Public bodies must have in place mechanisms to ensure a change in risk can be identified and managed during the term of a contract, framework or dynamic market.

Reassessment of risk – frameworks and dynamic markets

The regulations set out detailed requirements regarding the regular reassessment for frameworks and dynamic markets, as arrangements typically span multiple years.

Due to the potential length of frameworks and duration of dynamic markets, it is expected that risk reassessment should occur as standard in line with any other periodic reviews of framework and contract policies, such as renewal periods. It is recommended that this takes place no less frequently than every 2 years and should make use of the NHS risk assessment tool, or equivalent.

Framework and dynamic market owners are required to reassess risk in a way that is relevant to the subject matter and proportionate to the risk within the specific market. For example, where there is high risk of modern slavery framework and dynamic owners might more regularly, or thoroughly, reassess the risk and management approach. Where a market or sector is reassessed and a risk changes, dynamic market owners would be expected to respond to the change within the context of the procurement laws governing set up and management of these agreements, noting that the conditions of participation may not be changed once a dynamic market is established.

In addition to the above, regulation 10(3) sets out a statutory requirement to reassess where at least one of the following is true:

• there is reason to suspect that the most recent risk assessment is no longer valid
• there has been a significant change in the contract, framework agreement or dynamic market to which the risk assessment relates
• any steps taken in relation to the management of the framework agreement or dynamic market show it to be necessary

The first of these conditions is considered met when at least one of the following occurs: 

• poor practice is indicated in the relevant sector or its supply chain by one or more media or advisory body
• sector risk assessments are conducted for other procurement activities and a change in the risk factors is identified
• suppliers report a risk in their operations or supply chain
• A change is made to the 6 characteristics of risk set out in PPN 009 relevant to the subject matter of the contract, framework or dynamic market

A reassessment must be undertaken as soon as practicable upon any of the regulation 10(3) criteria being identified. This may result in a reassessment being carried out earlier than a planned reassessment in accordance with regulation 10 and this guidance.

Reasonable steps following promotion to a higher risk level following reassessment should take the form of a transition plan and new contract management schedules in line with the new risk level for suppliers transacting on the framework or within the dynamic market. This transition plan may include steps such as:

• instruct affected suppliers to conduct an MSAT within 3 months of being informed of a risk change. If the affected supplier has completed an MSAT within the last 3 months, resubmission should only be instructed where it can be demonstrated that the risk change reflects a recent material change in the supply chain as opposed to improved evidence of risk
• follow KPI development guidance for the new relevant risk level, as defined in the ‘Award criteria’ section under ‘Reasonable steps – medium and high risk’
• conduct an initial supplier meeting no later than 6 months following the supplier being informed of the risk change. From then on, the contract management approach could be followed, as defined in the section ‘Contract management’ (under ‘Reasonable steps – medium and high risk’), for the new relevant risk level

A summary of proposed actions that could be taken following a change in risk rating due to a reassessment during the contract term is set out in Annex 4.

It is recommended that reassessment also takes place as a reasonable step of contract management based on ongoing KPI monitoring. For instance, where the improvement plan indicates substantial action (qualitative or quantitative) be taken to remedy risk, a significant incident is reported, or a supplier is demonstrating poor implementation of the improvement plan, medium risk agreements may be promoted to high risk. This transition could be reflected in the required frequency of supplier meetings, as well as supply chain mapping requirements as per the ‘Contract management’ section.

If sector risk has been ‘downgraded’ following the statutory duty for periodic reassessment, the assessor should use this information in conjunction with the supplier’s ongoing engagement with risk mitigation processes to establish whether protocols of contract management can shift in accordance with a lower risk schedule.

Frequency of supplier meetings may also be reduced where a supplier has demonstrated strong commitment to addressing their MSAT improvement plan and where there is confidence that their current vigilance to risk would precipitate timely communication with the public body in the event of any relevant change in circumstance that might warrant review.

As part of the exit procedures for the framework or dynamic market, the framework or dynamic market owner should progress with the following steps.

For frameworks or dynamic markets which will be renewed, refreshed or reprocured:

• consider whether the management of risk can continue under future iterations of a framework or dynamic market
• communicate the process for managing the reassessment of risk within the sector or market to the public bodies with existing contracts so they are aware they can rely on the risk assessment conducted

For frameworks or dynamic markets which are concluding:

• conduct a final risk assessment at point of closure
• share the outcome of the risk assessment with each public body still in contract
• where reasonable steps for reassessment have been included within the call-off terms and conditions:
• • ensure public bodies are aware that ongoing risk mitigation responsibilities lies solely with their contract management activities
  • establish handover protocols for risk mitigation and reasonable steps to affected public bodies

End of agreement reassessments provides the opportunity to identify the level of risk present for existing and ongoing contracts, to ensure appropriate risk management activities continue beyond the life of the framework or dynamic market.

Reassessment of risk – contracts

While there is no statutory requirement to periodically reassess contracts, regulation 9(c) includes reassessment as a reasonable step to be considered for contract management. Triggers for reassessment may be aligned with those for dynamic markets and frameworks, as detailed in regulation 10(3) and the section above.

It is recommended that periodic reassessment take place for contracts with a term over 2 years. Contract managers should reassess the risk in a way that is relevant to the subject matter and proportionate to the risk within the specific market. Risk changes should be addressed as per the ‘Reassessment of risk – frameworks and dynamic markets’ section above.

Direct award

Requirement for undertaking a modern slavery risk assessment for contracts not competed is defined at regulation 4(2)(b).

Where a contract has been directly awarded to a supplier, the risk assessment should be carried out as outlined in the ‘Modern slavery risk assessments’ section. However, a flexible and collaborative approach should be taken to implementing the risk mitigations set out for the procurement stages from documentation design through to evaluation and award.

While the statutory duty within these regulations for direct award requires risk assessment completion by the point of contract award, it is expected that reasonable steps to manage contract risk includes building appropriate contract terms and conditions prior to agreeing to appoint a supplier under non-competitive procedures. 

Where the direct award supplier does not meet one or more minimum standards (up to contract award) for the assigned procurement risk level, it is recommended that the supplier relationship manager or commercial lead initially instigate a higher frequency of supplier meetings during contract management. Unmet requirements should be prioritised for action over the course of the agreement, such as completion of the MSAT. Where these have been remedied, meetings may default to the recommended frequency for the assessed risk level. 

It should be noted that direct award procedures refer to those as defined within the Procurement Act 2023 schedule 5, direct award procedures included within the Provider Selection Regime and direct award procedures conducted in accordance with an organisation’s own procurement policy (or equivalent financial rules).

For direct award procedures under a framework, it is expected that any rules for direct award are included within the buying instructions issued by framework owner, and reasonable steps implemented at the point of establishing the framework, rather than at the point of awarding a call-off contract or placing an order through a catalogue.

Training and resources

Modern slavery and exploitation helpline

All NHS staff and the staff of supplier should be aware of the modern slavery and exploitation helpline. Concerns can be reported online or by telephone on 08000 121 700.

National referral mechanism guidance

The national referral mechanism (NRM) is a framework for identifying and referring potential victims of modern slavery and ensuring they receive the appropriate support. The online referral system is to be used by first responder organisations for referrals into the NRM and for duty to notify referrals (DtN).

Training

Public bodies are responsible for ensuring commercial staff involved in letting and managing contracts, including where those staff come into contact with the victims of modern slavery, are given appropriate training.    

Public bodies can utilise a range of training for their staff. NHS staff complete the e-learning titled ‘Tackling modern slavery in supply chains’ on the Government Commercial College. The course will help learners: 

• recognise how modern slavery can manifest in supply chains
• spot modern slavery risks in procurement and critically interrogate the assurances suppliers provide
• drive improvements in modern slavery due diligence to create better outcomes for workers

Resources

Public bodies applying the policy can refer to PPN 009: Tackling modern slavery in government supply chains for further context and examples of additional measures.

The Transparency In Supply Chains (TISC) guidance provides guidance for suppliers when publishing a modern slavery statement and outlines actions businesses should consider to tackle modern slavery.

Suppliers can also refer to PPN 009 for further context.

For any other questions, NHS England’s Sustainable Procurement team can provide additional support to help both in-scope organisations and suppliers to understand and meet the requirements. Contact england.ccf-sustainability@nhs.net.

Annex 1 – Methodology for calculating modern slavery risk

The NHS risk assessment tool has been developed in alignment with the risk drivers approach set out in PPN 009.

Annex 2 – Reasonable steps for medium and high risk procurements

Table 1: reasonable steps for procurement design 

Table 2: reasonable steps for the conditions of participation in a procurement 

Note 1: at the point of publication for this guidance, the procurement specific questionnaire content is currently defined within (PA 2023) Procurement specific questionnaire, though all PPNs are subject to refinement and update. Public bodies should refer to the latest PPN for the specific participation conditions in relation to this requirement. 

Table 3: reasonable steps for evaluation and award criteria for medium and high-risk procurements 

Table 4: contract management reasonable steps to manage modern slavery risks and issues 

Annex 3 – Incident response

Responding to modern slavery risk is defined at regulations 8(2)(b) and 8(2)(f).

To ensure the NHS handles all instances of modern slavery and human rights abuses which have been uncovered in the supply chain immediately and in a consistent approach, a standard incident response process is outlined in this document to support public bodies.

Where a potential modern slavery incident has been identified you must: 

• inform the host public body – that is, framework, dynamic market or contract owner
• jointly determine a dedicated lead organisation
• ensure a report to the modern slavery helplinehas been made within 48 hours, nominating the supplier in the instance they have reported the incident voluntarily and, if not, the lead organisation
• for bodies designated as first responder organisations, report using the national referral mechanism, with regard to the appropriate guidance
• collaborate with the affected supplier to define corrective actions and timescales in which remediations are expected to be addressed
• ensure that remedial actions taken do not conflict with any legal investigations prompted by referral to the modern slavery helpline or via the NRM
• consider the appropriateness of a third party audit, aligning to audit standards such as Sedex Members Ethical Trade Audit (SMETA). Outputs from this report may feed into actions for a remedial action plan. (A third party audit may be deemed necessary based on the nature and/or scale of the incident, such as being reflective of systemic issues or where suppliers demonstrate resistance to sharing pertinent information for the purposes of remediation)
• where remediations have not been successfully delivered, clauses for contract conclusion may need to be followed in accordance with any identified breach, and a referral to the Procurement Review Unit (PRU) made to progress for potential debarment
• any consideration of contract termination should have regard to the 6 characteristics outlined in PPN 009 to establish the likelihood of termination negatively affecting victims. If this is a risk, ongoing work must be undertaken involving relevant non-governmental organisations and local authorities in order to drive victim remediation
• keep a record of the incident locally

Annex 4 – proposed actions following reassessment of risk

Publication reference: PRN02203i