A reporting duty in a code of conduct is not enough. Auditors ask for the clause in the purchase contract and for the last file the supplier sent.

The clauses that hold up are specific: which data, by which date, in which format, and what happens if the file does not arrive.