Most supplier diversity programs stop at Tier 1: you buy directly from a certified diverse business, you count it, done. Tier 2 is the harder problem. It asks your prime suppliers — the Bosch, Accenture, or Johnson Controls of your supply chain — to report what they spend with diverse sub-suppliers on your behalf.
Done right, it multiplies your reportable diverse spend by 3x to 5x. Done wrong, it becomes a compliance liability with unverified self-certifications and spreadsheets that no auditor will trust.
Why companies track Tier 2 at all
The honest answer for most federal contractors: they have to.
The Small Business Act requires large prime contractors with contracts over $750,000 (or $1.5M for construction) to submit a Subcontracting Plan to their contracting officer. That plan must include goals for spending with small disadvantaged businesses, women-owned small businesses, HUBZone firms, service-disabled veteran-owned businesses, and other SBA-designated categories. The contracting officer reviews progress through SF-294 and SF-295 reports. Failing to meet your subcontracting plan goals is a contract performance issue, not just a paperwork one.
For companies without federal contracts, Tier 2 tracking is typically voluntary. The driver is usually one of three things: ESG reporting (Scope 3 supply chain metrics now appear in GRI 204 disclosures and some CSRD filings), Fortune 500 supplier diversity team pressure on key suppliers, or industry coalitions. The Billion Dollar Roundtable — a group of corporations that each spend $1B+ annually with diverse suppliers — explicitly counts verified Tier 2 spend toward member thresholds.
The automotive origin
The Big Three automakers built Tier 2 tracking before the term was widely used. General Motors launched its Tier 2 supplier diversity initiative in the early 1990s, driven partly by Congressional pressure and partly by internal diversity commitments after civil rights era scrutiny of auto industry contracting. Ford and Chrysler (now Stellantis) followed within a few years.
By the mid-2000s, all three had formal Tier 2 reporting portals requiring major direct suppliers to submit annual or quarterly spend reports. GM's 2023 sustainability report shows $4.6B in Tier 1 diverse spend and $15.6B in combined Tier 1 and Tier 2 diverse spend. Ford reported over $15B in total diverse spend (Tier 1 plus Tier 2) in its most recent supplier sustainability data. Stellantis targets 25% of total procurement spend from diverse suppliers across both tiers.
The automotive model is the closest thing to a Tier 2 standard that exists. When a company like Honda or Toyota builds its Tier 2 program today, they study GM's playbook from the 1990s.
Setting up a Tier 2 reporting program
Which prime suppliers to ask
You cannot realistically ask every supplier to report Tier 2 data. Start with your top 20 to 50 suppliers by spend — these typically represent 70% to 80% of your total procurement spend. Any supplier with an annual contract value above $1M is a reasonable candidate for formal Tier 2 reporting requirements.
Two additional filters: suppliers that themselves have formal supplier diversity programs (they already track this data, so the ask is small), and any supplier providing services with significant sub-supplier usage — construction, IT services, facilities management, logistics.
Build the Tier 2 requirement into contract language at renewal. A clause requiring quarterly Tier 2 reporting and permitting audit of records is standard in automotive and aerospace supply chains. Without contractual language, you are relying on goodwill.
What data to collect
At minimum, you need: the diverse supplier name, their certification type and certifying body, the certification number, the certification expiration date, the dollar amount spent in the reporting period, and a NAICS code for the work performed.
The certification number is load-bearing. Without it, you cannot verify the certification independently, and a significant portion of self-reported certifications in Tier 2 programs turn out to be lapsed, incorrect, or fabricated. Require that all certifying bodies be on your accepted list.
Which certifications to accept
Federal set-aside certifications (8(a), HUBZone, WOSB, SDVOSB) are issued by SBA or VA and verifiable through SAM.gov or the SBA certification portal. Accept these unconditionally.
For corporate certifications, the standard accepted set is: NMSDC (MBE), WBENC (WBE), NGLCC (LGBTBE), Disability:IN (DOBE), NaVOBA (VBE), and NVBDC (VBE). Some programs also accept state-issued certifications (DBE, state MBE/WBE), though verification is harder since each state has its own portal.
Self-certification without third-party validation is not acceptable for Tier 2 reporting in any serious program. If a supplier reports spend with a firm that "certifies itself as minority-owned" without a recognized certifying body, that spend cannot count.
Technology options
Supplier.io
Supplier.io is the market leader for large enterprise Tier 2 programs. Its platform lets you invite prime suppliers to a portal, have them submit Tier 2 spend data with certification documentation, and then validates certifications against NMSDC, WBENC, and SBA databases automatically. Pricing is not public; enterprise contracts typically run $50,000 to $250,000 per year depending on supplier count and reporting complexity. GM, Ford, and several defense primes use it.
Coupa Supplier Diversity
Coupa's supplier diversity module (part of the broader Coupa Business Spend Management suite) tracks diverse supplier spend at both Tier 1 and Tier 2. If you are already on Coupa for procurement, the Tier 2 module adds supplier self-registration, certification upload, and spend reporting within the existing platform. The advantage is that spend data feeds directly from purchase orders rather than requiring manual entry from prime suppliers. Implementation cost varies by configuration.
SAP Ariba Supplier Lifecycle and Performance (SLP)
SAP Ariba SLP includes a supplier diversity classification and Tier 2 reporting capability. Like Coupa, the main advantage is integration with existing Ariba procurement data. Large manufacturers and government contractors already running Ariba often extend it to Tier 2 tracking rather than adding a separate system. The weakness is that Ariba's certification validation is less automated than Supplier.io's, requiring more manual review.
Spreadsheet-based programs
Many mid-market companies run Tier 2 programs on Excel or Google Sheets. This works for 10 to 20 prime suppliers with low reporting volume. It breaks down at scale: manual certification verification is too slow, version control becomes a problem, and aggregation across suppliers introduces errors. If you are reporting to a major customer or to a federal contracting officer, you will eventually need a system with an audit trail.
Common challenges
Double-counting
If Supplier A and Supplier B both sub-contract work to the same certified MBE, and both report that spend to you, you will double-count it in your totals. The fix is supplier deduplication by EIN or UEI (the SAM.gov Unique Entity Identifier). Require prime suppliers to include the sub-supplier's EIN in every report. Aggregate by EIN before summing diverse spend totals.
Unverified self-certifications
In one study of corporate Tier 2 programs, roughly 15% to 25% of self-reported "diverse supplier" certifications could not be verified against any certifying body database. This is not always fraud; certifications lapse, suppliers forget to renew, data entry errors happen. But a Tier 2 number built on unverified certifications will not survive an audit by a federal contracting officer or an ESG rating agency. Automated verification against NMSDC, WBENC, and SAM.gov databases is the only scalable answer.
International supplier inclusion
Federal subcontracting plans apply to U.S.-based diverse businesses only. Corporate ESG programs increasingly want to count diverse spend globally, but there is no international equivalent of NMSDC or WBENC. Some companies accept local certifications (e.g., UK MSDUK for minority-owned businesses, Canada's CCAB for Indigenous businesses), but the data is hard to aggregate and harder to audit. The practical approach is to track domestic and international diverse spend separately and be explicit about which standard applies to each figure.
Prime supplier participation rates
A well-run Tier 2 program typically sees 60% to 75% of invited prime suppliers actually submitting data. The rest either do not track it internally, consider it proprietary, or deprioritize the reporting work. Contractual requirements with financial consequences (performance scorecard impact, payment term penalties) move participation rates to 85% to 95% in programs that enforce them.
What good looks like
A mature Tier 2 program reports quarterly, not annually. It accepts only verified certifications from recognized bodies. It uses a platform with automated certification validation and EIN-based deduplication. Prime suppliers with contracts above $1M are required by contract to participate.
GM's Tier 2 program, now over 30 years old, covers several hundred direct suppliers and tracks spend at the sub-tier with quarterly reconciliation. That is not achievable in year one. But the structure — contractual requirements, verified certifications, systematic deduplication, technology-enabled aggregation — is replicable at any scale.
Start with your top 20 suppliers by spend, put the reporting requirement in the next contract renewal, and pick one platform to own the data. That is a program you can actually defend.
