Your supplier's environmental audit was written by your supplier

By Evidencity | AI Assisted | 100% Human Verified

In March 2023, Indonesian nickel giant Harita Nickel hosted a fishing tournament near Kawasi village on Obi Island. Locals competed for fresh catch beneath a large corporate banner. The company’s then-director of external relations issued a press release declaring that “good quality fishes are still widely available in the Kawasi waters.”

The press release did not mention that Harita had commissioned a marine study the previous year that found dangerous levels of lead and cadmium in fish in the same waters. An internal email from a Harita marine environmental manager recommended keeping the full study “for internal use only.” Sections detailing safe weekly consumption limits were deleted. References to water quality data showing lead, cadmium, mercury and other pollutants exceeding standards were softened or removed. The shortened version published by IPB University concluded the fish were “safe for consumption.”

Harita cited that edited version in its 2022 and 2023 sustainability reports. Two months before its April 2023 stock exchange listing, internal data showed nickel levels in fish had risen ninefold.

Evidencity has been tracking Indonesia’s nickel expansion since 2023, when we documented the worker death toll, the Chinese investment networks, and the political relationships underpinning the industry’s rapid growth. The country now accounts for over 60% of global nickel production, more than every other producer on earth combined. The Harita case reveals the next layer down, moving beyond the reality that this sector operates with weak oversight, to companies that actively manage the evidence of harm before it reaches the supply chain.

How the evidence disappears before it reaches your desk

Harita’s approach follows a pattern Evidencity’s analysts recognise across extractive industries operating in under-regulated environments: commission the study, control the findings, publish the summary.

An investigation by The Gecko Project, an independent outlet specialising in environmental crime and corporate accountability, obtained internal Harita documents that tell a different story. The full marine study by Professor Etty Riani of IPB University found lead levels in fish from Kawasi village at more than 1.5 times Indonesia’s FDA limit for processed fish products. In the village of Soligi, 12 kilometres along the coast from Harita’s mining site, a locally eaten reef fish carried nearly three times the limit. The study recommended limiting consumption of several species, particularly for children, to reduce heavy metal exposure. That recommendation was deleted before publication.

The edited version that replaced it was cited in Harita’s 2022 and 2023 sustainability reports as evidence that fish were safe to eat. It was cited again in Harita’s response to the Indonesia Stock Exchange ahead of its April 2023 IPO. Indonesian capital markets law requires disclosure of material information that could influence investors’ decisions. A Bali-based lawyer told the Gecko Project that evidence of heavy metal contamination in fish would likely qualify. It was not disclosed.

This was not a single lapse. In 2019, a Harita-commissioned report had already found cadmium in snapper and grouper at up to 17 times the Indonesian regulatory limit. In 2021, the company dramatically expanded its mining operations on Obi Island, opening a new processing plant. By February 2023, two months before the IPO, a marine environmental manager noted internally that nickel in fish had risen ninefold. A week later, a colleague flagged new testing as a “rush hour” priority. No further internal communications or data were found after that point.

Meanwhile the fishing tournament proceeded. The press release went out. The sustainability report was filed.

This is the operating environment that Tesla, Volkswagen, Toyota, BMW and Ford are sourced into. Harita exports nickel from Obi Island to battery material companies that supply these manufacturers directly. None responded to the Gecko Project’s request for comment on the contamination findings. Honda said it has zero tolerance for environmental harm. BMW said it had contacted suppliers to address the allegations. The rest said nothing.

The contamination data existed. It was commissioned, reviewed, edited and filed, internally. Your supplier’s audit would not have found it, because your supplier’s audit was written by the supplier.

A clean screening result and the gap it cannot cross

In 2022, Evidencity profiled a nickel processing company operating in Indonesia’s Morowali industrial complex. The screening returned no sanctions, no regulatory enforcement actions, no adverse connections, no litigation. By every standard metric, the company was clean. The same profile documented a community protest over environmental damage and the absence of any prior consultation before mining permits were issued. Those findings appeared under “adverse media.” They did not move any of the risk indicators.

Screening tools are built to find disclosed, formal, registered risk. A suppressed internal study is none of those things. An edited consultant’s report filed away from regulatory view is none of those things. The gap between a company’s disclosures and its internal documents is precisely the gap that standard adverse media screening cannot cross.

That gap is now carrying legal weight. In early 2026, two rulings, the Dyson supply chain decision and the Rubicon case, dismantled defences that multinationals have relied on for decades. Courts are now asking whether companies had reasonable means to know about supplier misconduct. Sustainability reports citing edited studies, and screening tools that return clean results on companies with documented community complaints, are unlikely to satisfy that standard.

For procurement teams and corporate counsel sourcing from Indonesia’s nickel sector, where production now accounts for over 60% of global supply, and where Evidencity’s own prior reporting documented systemic safety failures and political entanglements across the industrial park network, the Harita case raises a direct question: how many of your supplier’s environmental assessments were written by your supplier?

The audit trail ends where the internal email begins

Harita Nickel is not an outlier. It is an illustration of how environmental evidence is managed in supply chains that move too fast, across jurisdictions that regulate too lightly, for conventional due diligence to keep pace. The fishing tournament is still an annual event. The sustainability reports are still filed. The nickel is still shipped.

Evidencity’s Illicit Network Intelligence (INI) data is built to surface precisely this category of risk, findings that exist in internal documents, community complaints, in-language local sources, and suppressed consultancy reports rather than in the disclosed record that standard screening reads. The Harita case is a demonstration of why that distinction matters. The contamination data was there. It was simply never where your due diligence was looking.

For companies with exposure to Indonesian nickel, whether through EV battery supply chains, consumer electronics, or commodity trading, the compliance question has shifted. Demonstrating that your supplier has no sanctions and a published sustainability report is no longer sufficient. The Dyson and Rubicon rulings have made clear that reasonable means to know is the new threshold. Meeting that threshold requires looking where the disclosed record does not go.