One supplier registry. Two workspaces. Every regulation asked once.

Two workspaces, one supplier registry

A risk picture and a regulatory position answer different questions, and neither is sufficient on its own. A supplier can be low risk and still make you the operator, with full information duties under the Deforestation Regulation. A high-risk supplier can sit entirely outside its scope.

Cora keeps one supplier list with two layers of enrichment that never overwrite each other. You switch workspace, not systems, and the supplier keeps one contact point and one login.

From your existing supplier list to a scored portfolio

You already have the list. Cora reads it and returns a reasoned risk picture the same day, before a single questionnaire is sent.

The inherent score is built from six weighted components: environmental 30 percent, social 30 percent, deforestation exposure 15 percent, governance 10 percent, geopolitics and sanctions 10 percent, purchase volume 5 percent. Scores fall into three bands, with thresholds at 70 and 40.

Every sub-score shows the source it came from and the date it was last updated, and flags itself when that source is getting old. The prioritisation explains itself in plain language rather than simply ranking, so a reviewer can see why a supplier moved up the list.

Ask once, answer many regulations

Every new regulation normally sends a new form to the same suppliers. Response rates fall with each round, and the buying company ends up holding the same data in five systems, none of which agree.

Cora has one supplier registry and one dispatch layer. Reference numbers, plot evidence, embedded emissions data and questionnaire answers are collected in the same request, to the same contact, on the same page. The supplier answers once, and the answer is reused wherever it is relevant.

It is also the reason each new regulation costs a fraction of the last one to add. The collection layer already exists, so a new framework is a new set of questions on top of infrastructure your suppliers already know.

The Deforestation Regulation, at article-line level

Upload the article catalogue. Before anything is written, Cora returns a coverage report on your own data quality, so you know what the result rests on. Every line is then matched against Annex I at customs-code level, and your legal role is derived per line.

That role split is where the work disappears. The same catalogue divides into lines where you are the operator, owing information collection, assessment and a declaration, and lines where you are downstream and simply hold your supplier's reference number for five years. Roughly a hundredfold difference in effort, derived from one file.

Negative determinations are kept, together with the annex version they were made against. Every tool finds problems. Almost none proves the absence of problems. That saved determination is the answer when an auditor asks why thousands of articles were never assessed.

Carbon border adjustment, same engine

The same matching machinery, run against a different annex. A supplier's reported figure is a claim until an accredited verifier has checked it, so Cora keeps default-applied, supplier-reported and verified as three distinct states. Only the third can be used in a declaration.

What comes out

All three are version-stamped with the annex and country-classification versions they were produced against, so a document can be read years later against the rules that applied when it was made.