Guide · Compliance Foundations

What Must a Bill S-211 Report Contain?

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditUpdated September 27, 2026

You are the officer or director who signs the attestation this year — at a retailer, distributor, manufacturer, resource company, or importer over the Act's thresholds — and May 31 is closer than the file suggests. Your Bill S-211 annual report has to cover the structure of your business and its supply chains, the forced and child labour risk you actually examined, the due diligence measures you put in force, and the training behind them. It is approved and signed by your governing body, and it is public. This guide walks through what the report has to contain, what the deadline really demands of the months before it, and what you are personally attesting to when you sign.

The report is one page. The proof is the year behind it.

Before the sections below, try the exercise first. Pick one product line that crossed your dock this month. Can you name, in writing, every entity that actually touched it — not just the one that invoiced you? If the trail stops at your direct supplier, that is exactly where this report's biggest exposure is sitting right now.

What must a Bill S-211 report contain under section 11(3)?

Section 11(3) of the Fighting Against Forced and Child Labour in Supply Chains Act sets out the required contents of the annual report. In plain terms, the report covers what you did this year: the structure, the risk, the measures, the training.

Each of those pillars is a claim you are making in public:

• The structure. Your business and its supply chains, described honestly — not the tidy tier-one list in your ERP, but the chain as it actually runs, upstream entities you have never listed included.
• The risk. Where forced and child labour risk actually concentrates in your chain, weighed by region, sector, and recruitment practice. The Act asks whether you looked, honestly, at where the risk lives.
• The measures. Your policies, your supplier requirements, your remediation steps. The report describes your measures, and a reader is entitled to ask whether they exist anywhere but the report.
• The training. Records a reader can point to, not a slide deck someone remembers presenting.

Ask yourself one question before you draft a line: could you write this year's report entirely from dated records, without leaning on anyone's memory of how the year actually went? A report built from records survives a challenge. A report reconstructed each spring from memory and goodwill does not. The thresholds, definitions, and mandatory disclosures under the Act were clarified for 2026, so last cycle's report is not automatically this year's template.

The gap between the two is now measurable. The S-211 Report Card graded 92 real filed reports line by line against the Act, and the national median came out at 50.5 out of 100. Nearly half graded D or F.

When is the Bill S-211 report due?

The Bill S-211 annual report is due May 31 each year. The next annual filing lands May 31, 2027, and the year of evidence behind it is accumulating, or failing to accumulate, right now.

The trap built into the Act is timing. May 31 feels far away in July, and then spring arrives and someone is asked to reconstruct twelve months of supplier examinations, risk decisions, and training records in six weeks. The report covers a year. Nobody writes a year in a month, at least not one a reader can trust.

A rhythm that holds: begin evidence and supplier outreach 60 to 90 days before the deadline, so the proof is in hand before the report is finalized. Better still, treat the reporting year as self-documenting — every supplier examination dated when it happens, every remediation step logged with an owner, every training session recorded when it runs. When the filing comes due, the report becomes an act of assembly, not archaeology.

The calendar raises the bar every year on its own. The first report was the easy one. Every year after, the bar is your own previous filing — if year one said “we are building our mapping,” year two has to show the map, in your own words, filed side by side with the last one.

What is the $250,000 penalty, and who is personally liable?

A Bill S-211 violation can mean a fine of up to $250,000. Directors and officers are personally liable — this is exposure with individual names attached, not a line item the corporation absorbs on its own.

The report is approved and signed by your governing body, and it is public and permanent. So the real question underneath every section is this one: would you sign your name, in public, to a claim about suppliers you have never actually examined?

In more than 25 years working both sides of this — inside compliance teams, and across the table from them during a review — I have never met a director who set out to be careless with this, and I have never met one who wanted their name anywhere near a shipment tied to forced or child labour. Stopping trafficking and smuggling in supply chains has been my mission since long before this Act existed. The mapping underneath the report is genuinely hard, because the risk rarely lives with your direct suppliers — it lives upstream, two and three tiers down, in entities nobody in your building has ever had reason to look for before. That is a resourcing gap, and it is closeable.

But the liability does not wait for the resourcing to catch up. One supplier nobody examined. One region everyone in the industry already talks about, that no one on your team ever formally mapped. One customer, journalist, or regulator who reads your public report and asks the one question your records cannot answer. That is the distance between a signature that holds and one that costs up to $250,000.

No supply chain will ever sit at 100 percent — that is not the bar. What the signature actually needs standing behind it is proof that you examined 100 percent of what you could reach, on the record, with your name attached to the looking, not just the claim.

Who has to file a Bill S-211 report?

The Act sets entity thresholds covering retailers, distributors, manufacturers, resource companies, importers, and government institutions over the size and revenue tests, clarified for 2026.

Two practical tests matter more than the statutory text for most readers of this page.

First: if your customers are asking you for your report, or asking you to feed theirs, the threshold debate is already academic for you. Reporting companies have to describe their chains, which means they have to examine the entities inside them. That examination lands on your desk as questionnaires, attestation requests, and assessment invitations whether or not you file your own report.

Second: the mapping pulls in companies the thresholds never named. When a reporting customer maps its chain past tier one, your company lands on that map, along with your suppliers, and theirs. Plenty of companies below any threshold are living under Bill S-211 anyway, one customer request at a time.

If that is you, the work is the same either way: know your own chain, examine your own suppliers, and hold evidence you can hand over without a scramble. The companies that treat a customer's S-211 request as a fire drill do it again every spring. The ones with a living map answer in a day.

Does C-TPAT, PIP, or AEO work count toward Bill S-211?

The Act adopts no other program by reference, so nothing counts automatically. What is true — and it is the leverage most teams leave on the table — is that the Master 5-Step Risk Assessment behind your C-TPAT, PIP, or AEO evidence produces the same mapping, the same examined suppliers, and the same dated trail the S-211 report has to describe. Run those programs in separate silos and your team is back at the same suppliers three times a year with three questionnaires — and the suppliers notice. Run them as one assessment — one supplier file every program reads from — and your due diligence stands on work you have already done.

This is the piece of leverage most reporting cycles never use. The trusted-trader programs and the forced-labour reporting regime are asking the same underlying question in different words: do you actually know, and can you actually prove, who is in your chain and how they operate? A chain examined to C-TPAT, PIP, or AEO standards has already produced the mapping and the dated evidence the annual report needs to cite.

The reverse is the expensive version: teams that run S-211 as its own isolated project rebuild the map each spring, re-chase supplier attestations other programs already collected, and re-answer what last year already answered. The Act comes due every year. Duplicated effort compounds every year with it.

To be equally clear about what this is not: XFACTOR VERIFIED is not a certification body and does not file your report for you. It builds the mapping, the evidence, and the due diligence underneath your signature, through one live, scenario-based assessment of each supplier, so the signature holds.

How do you build a report that survives a challenge?

Start from the standard a challenger will actually apply: every claim traceable to evidence, every measure in force rather than on paper. Then work through four disciplines.

Map past tier one. A documented chain map with the upstream entities named, not assumed, and the unmapped corners flagged as risk. Have each supplier name their own sub-suppliers, carriers, and transit points — that discovery step routinely surfaces parties nobody in your building knew existed.

Examine, do not survey. A risk assessment per part of the chain, with region and sector risk weighed and evidence behind each conclusion. Standard self-reported questionnaires miss exactly what forced-labour risk is built to hide: a rehearsed answer clears a checklist as easily as a true one. A live assessment that reads how a supplier answers, not only what they answer, surfaces the gap between the written procedure and what is actually happening on the floor.

Fix what you find, on the record. Due diligence measures in force, supplier requirements communicated and tracked, remediation steps documented with named owners and deadlines. A gap you found and fixed, with a signature on the fix, is evidence of diligence. A gap you found and filed away is evidence for the other side.

Brief the people who sign, before they sign. Full visibility into the evidence, not a summary at the last meeting. A leadership team that has actually seen what was examined signs with confidence instead of hope.

Do those four things across the year, and the May 31 filing becomes what it was always meant to be: a summary of work that already exists.

The programs this maps to: Bill S-211 · C-TPAT · The complete Bill S-211 guide