my customer wants supporting documents for the answers to the sustainability questionnaire

Supporting documents belong with the answer, not separately

A request for supporting documents usually means that the answer in itself is not sufficient: the customer wants to be able to verify what it is based on. For identity questions, that is often straightforward — the registration number can be verified via the Business Register, which is immediately the supporting document. For questions that come from the EFRAG VSME baseline module, it is different: an underlying document is often requested, such as an energy bill for consumption or a policy document for a stated measure. If that document does not exist, the honest answer is that the supporting document is not yet available — do not invent a supporting document that does not exist, and do not adjust the underlying answer so that it happens to match what does exist.

Supporting documents also require precision about the form. "A statement from management" is different from "a signed policy document", and a customer who specifically asks for a certificate — such as with ISO 9001 — means the certificate itself, not an internal quality procedure that is similar in content. If the requested document does not exist, "no, not yet available" is a more complete and sustainable answer than uploading a supporting document that says something slightly different from what was requested.

Where the request for supporting documents comes from

The CSRD (Directive (EU) 2022/2464) requires reporting undertakings to provide substantiated, verifiable information, and that expectation filters through to suppliers who are approached for supporting evidence in the chain. In cybersecurity questionnaires, the request for supporting documents is often directly traceable to the ten measures of Article 21, paragraph 2, of the NIS2 Directive, or to the control measures in Annex A of ISO/IEC 27001 — both requests for a demonstrable measure, not an intention.