Reducing sustainable supply chain risks: a digital technology-enabled risk management framework for ESG-oriented engineering procurement

2.1. ESG trends in supply chain management

While economic development is undoubtedly necessary for a company's business objectives, social and environmental sustainability is attracting much attention in recent years. ESG, as a foundation for sustainable development^[9], has become a new competitive strategy for firms, influencing their decision-making^[10]. Since 2018, there has been significant growth in research on ESG [Figure 2], with possible reasons including the EU's enactment of the Non-Financial Reporting Directive (NFRD), which has been in effect since 2018 and requires large corporations to disclose ESG-related information. This has directly stimulated demand for ESG management, which has driven academic research into ESG disclosure standards, compliance implications, and corporate practices.

Figure 2. ESG research trend.

Firms' ESG performance not only affects firms' risk but also attracts the attention of external investors^[2,11]. Firms with high ESG performance tend to be less risky. High ESG-performing firms demonstrate better ESG risk identification and management, reducing total and idiosyncratic risk^[23], while also exhibiting greater resilience^[24]. ESG ratings, as an essential indicator of firms' sustainability performance, can enhance firms' ability to cope with risks by alleviating the constraints of financing and improving their reputation^[14,25]. With the development of sustainable finance, financial institutions and investors are increasingly favoring ESG-rated and performance-friendly companies. For investors, ESG considerations can reduce investment risks to a limited extent and better assess long-term development potential^[26]. For companies, ESG considerations can also make obtaining low-cost financing easier and gaining policy support.

Corporate ESG information has shifted from expressing good intentions and pursuing internal operational efficiencies to responding to key business issues involving complex strategic relationships and activities^[27]. Institutions and regulations are powerful drivers of sustainability^[28], and capital market participants, regulators, and other stakeholders are increasingly calling for transparent measurement and disclosure of information about financial, environmental, social, and governance (ESG) risks^[11]. Many studies have explored the impact of corporate ESG compliance and the relationship between ESG risk disclosure and the risk of "greenwashing"^[13]. Some papers analyze the challenges that companies may face in ESG disclosure and how regulators can address these issues through the regulatory framework^[3,11].

In addition, as sustainability principles become more developed, companies continue to integrate ESG into their supply chain strategies and related research is increasing^[1,17,19]. In the procurement process, companies use rigorous management practices to ensure ongoing compliance^[29]. Specifically, ESG compliance requires companies to invest more resources in environmental monitoring, social responsibility assessments and corporate governance optimization. Companies need to rigorously investigate their suppliers during the procurement process and conduct regular ESG audits of suppliers to avoid any risk of violating ESG regulations. For example, given concerns about greenhouse gas emissions, companies should monitor their own energy consumption and force suppliers to disclose their carbon usage to avoid environmentally harmful behavior. Meanwhile, advancing DTs such as blockchain, big data, and AI enhance ESG data transparency and efficiency^[17], improving supply chain traceability and enabling better management of ESG risks^[7,30]. However, most of the current research focuses on public and family business procurement in supply chains^[6,19], and there is a wide research prospect for the role of ESG in EPRM under the current trend.

2.2. Descriptive review of EPRM and SSCM

Procurement is a series of coordinated processes to obtain resources to support core business activities^[31]. Procurement risk can be viewed as the possibility of supply chain disruption that may threaten the associated supply chain processes and negatively impact a firm's profitability^[32]. EPRM, as part of PRM, overlaps with PRM in the literature, so this paper analyses PRM from a broader perspective and scope. PRM is conducted to cope with the uncertainties raised in procurement, such as material unavailability, price fluctuations, supply disruptions, and misjudgment of demand. As one of the most critical issues in supply chain risk management, poor PRM can also lead to severe supply chain risks.

2.2.1. Keywords co-occurrence network analysis

This paper collects and analyzes English-language journal articles from the Web of Science (WoS) database. The study searched for "procurement risk management" as a keyword and limited the time frame from 2020.1.1 to 2025.3.31 [Figure 1]. The search results were refined by excluding non-article publications, and articles were selected based on title and abstract to ensure quality. Finally, 554 papers were available for the bibliometric analysis of PRM-related papers. According to the automatic classification method of VOSviewer, the co-occurring keyword networks of the selected PRM papers are divided into three groups [Figure 3]. Different colors indicate distinct subsets, and the range of circles indicates the number of keyword occurrences. The three subsets are centered on "supply chain resilience, procurement risk", "blockchain, smart contract", and "supplier, contract", respectively. This indicates that procurement risk is strongly associated with digital technology and SCM. The strong relationship between procurement risk and digital technology and supply chain suggests that PRM in engineering can be studied from digitalization and supply chain perspectives.

Figure 3. The keywords co-occurrence network of PRM.

PRM is interconnected with various areas such as economic factors (as shown by red points), strategic planning^[33], supply chain, supplier relationship management (SRM, as shown by green points) and digitalization (as indicated by blue points). In particular, economic factors are the foundation of PRM and directly impact purchasing decisions and risk management, and companies quantify these uncertainties through economic forecasting and risk assessment models. Meanwhile, SRM is one of the core aspects of PRM, which reduces the risk of supply disruption and improves the transparency and flexibility of the supply chain by establishing long-term relationships, sharing risks and benefits, and enhancing supplier evaluation and monitoring mechanisms^[34]. Therefore, PRM is not an isolated field; it involves multiple factors such as the economy, market, supply chain, and digitalization^[35,36]. Many studies have used different approaches to address PRM, such as mathematical models, decision-making methods, and intelligent algorithms. Mathematical models are developed to predict and assess risk. Mathematical models, such as probabilistic reasoning and hierarchical analysis, analyze correlation patterns and impact intensity among risk factors^[37]. Existing studies in the mineral supply chain conduct ESG risk grading assessments based on urgency levels and impact magnitudes^[38]. Meanwhile, intelligent algorithms - exemplified by enhanced GA-BPNN integrated with PCA - have demonstrated significant advances in portfolio risk modeling accuracy^[39]. Hewlett-Packard (HP) developed and implemented a PRM methodology consisting of mathematical models, business processes and software that resulted in cumulative cost savings of more than $425 million over 6 years^[40].

2.2.2. Keywords time-series network analysis

Integrating ESG objectives with risk management enables companies to reduce operational risks, enhance social competitiveness, achieve short-term efficiency gains, and build long-term sustainability foundations. By breaking down ESG objectives and closely integrating them with risk management, companies can better identify and respond to ESG-related risks.

In the keyword time-series network [Figure 4], the color of the nodes changes from dark to light (purple-dark green-light green-yellow) over time. Along with the time changes, central dots changes from the purple colored ones "retailer", "price", and "storage", to the dark green colored keywords "system", "supplier", "machine", and the light green and yellow keywords "supply chain", "resilience", "sustainable development" and "potential risk". In recent years, PRM is no longer focused only on products, retailers and prices but also tends to identify potential risks, supplier management, sustainable development and supply chain resilience^[41]. PRM research forms an evolution from economic factors to ESG integration and enabling of DTs to resilience and sustainability. Wang et al. used mixed-methods analysis to study sustainable supply chain risk management, summarizing its motivations, strategies, methods, and tools, and developed a tripartite model covering risk identification, assessment, and mitigation-response^[42]. Some researchers frame supply chain sustainability as a risk management process, categorizing risks by environmental, social, and economic pillars^[22], and also apply failure mode and effects analysis (FMEA) methodology to identify risk causes/impacts while analyzing inter-risk correlations^[43,44].

Figure 4. The keywords time-series network of PRM.

Furthermore, risk mitigation measures are not always effective in reducing the supply chain risks organizations face. However, sustainability practices, including environmental, social and other aspects, have significantly reduced supply chain risks, especially in emerging markets^[45]. That is, sustainable supply chain activities can reduce the likelihood of procurement risks occurrence. In the process of EPRM, companies can add sustainability criteria to their supplier selection, such as environmental management system certification and social responsibility performance scoring^[29], and at the same time, work with suppliers to develop risk management plans that identify potential risks and develop mitigation measures^[46]. Enhancing supply chain ESG performance mitigates supplier, environmental, social, and geopolitical risks while strengthening stability and resilience^[47], necessitating integrated sustainability-risk management for optimized assessment and mitigation.

2.3. Previous frameworks of PRM

Contemporary research on PRM encompasses multiple dimensions, including closed-loop supply chain process optimization, ESG sustainability integration, and DTs enablement. Driven by technological evolution, technology-enabled governance has emerged as the core paradigm for risk management^[48]. The research focus shifts from reactive responses in emergency management phases to proactive digital risk governance underpinned by Industry 4.0 technologies^[32,49]. However, current technological applications predominantly rely on single or dual-technology combinations, lacking systemic synergistic architectures^[50]. Simultaneously, the objective dimensions of digital risk management have significantly expanded: beyond traditional risk mitigation, ESG compliance^[1], closed-loop supply chain^[51], and data security protection constitute emerging research dimensions^[15]. Existing framework constructions predominantly concentrate on the analytical deployment of DTs and strategic-level integration, exhibiting significant gaps in risk implementation mechanisms and dynamic governance^[48,52].

As summarized in Table 1, prior studies have primarily focused on closed-loop procurement processes, single-technology enhancement, and sustainability objectives^[50,51]. However, their static architectures and technological silo characteristics prove inadequate in addressing contemporary risk dynamism and multi-stakeholder collaborative governance requirements. Thus, based on the characteristics and operations of DTs, ESG principles, and CLM, it is necessary to establish a fundamentally new paradigm for EPRM. This paradigm transcends static integration or sequential workflows, leveraging the synergistic mechanisms of DTs to construct a system capable of incorporating ESG data streams into its dynamic evolution.

2.4. DTs applications in the EPRM

With the development of DTs in recent years, many emerging technologies have been applied to risk management to improve the efficiency and accuracy of risk prediction and assessment^[53]. For example, AI can be used to facilitate risk identification and mitigation by autonomously analyzing and responding to collected signals^[54]. The emergence of the LLM has brought new opportunities for ESG-oriented EPRM. ESG data (e.g., corporate sustainability reports, supply chain contracts) commonly exhibit complex semantic characteristics including cross-cultural metaphors, domain-specific term ambiguities, and dynamic contextual dependencies^[55]. Traditional Natural Language Processing (NLP) models (e.g., Term Frequency-Inverse Document Frequency (TF-IDF), Support Vector Machine (SVM), Conditional Random Fields (CRF)) are hindered by limited contextual windows, impairing long-range semantic parsing, and incur substantial cross-industry adaptation costs due to manual feature engineering. In contrast, LLMs capture global contextual dependencies via self-attention. Using transfer learning from massive corpora, they efficiently adapt to data-scarce ESG scenarios, enabling cross-industry semantic alignment for precise latent risk identification, thereby enhancing risk detection comprehensiveness and accuracy^[56].

MAS enables systemic governance of ESG-oriented PRM through distributed cognitive architectures and dynamic coordination mechanisms that effectively address multidimensional complexities^[57]. Simple monitoring systems, constrained by centralized structures and rigid rule dependencies, are inadequate in capturing dynamically emergent risks and lack real-time coordination capabilities. In contrast, MAS employs distributed cognitive frameworks to empower agent collectives with autonomous perception of localized environmental conditions while facilitating negotiation protocols that achieve multi-stakeholder equilibrium optimization and globally coordinated decision-making. Concurrently, the system continuously refines risk patterns through deep reinforcement learning applied to historical intervention data, establishing evolutionary learning mechanisms^[58]. This integrated approach provides implementable pathways for closed-loop dynamic management of procurement.

Additionally, adopting DTs such as blockchain and BDA addresses critical data privacy challenges while delivering data-driven insights^[59]. Applying blockchain technology, for example, ensures that procurement data is tamper-proof and traceable throughout the process, increasing transparency and data privacy protection in the supply chain. Compared to traditional Business Intelligence tools, BDA leverages distributed computing architectures and machine learning algorithms to extract features from high-dimensional ESG indicators while uncovering relationships among risk factors, thereby providing quantitative foundations for risk grading and response prioritization decisions^[39]. It is worth noting that implementing DTs does not happen overnight and requires long-term planning and gradual progress by enterprises. When promoting digital PRM, enterprises can implement it in stages and gradually build an intelligent risk prevention and control system.

2.5. Research gaps

Although previous research provided fruitful outcomes on EPRM and SSCM, there are still research gaps between current requirements and these studies. The gaps mainly fall in such aspects as the following:

(1) While many studies have focused on developing ESG evaluation indicators, scant attention has been paid to EPRM under ESG compliance review. Furthermore, prior research on PRM and ESG remains fragmented, with ESG risks often treated as isolated components rather than being integrated into conventional PRM processes.

(2) Existing studies have yet to systematically apply DTs to EPRM and realize technological synergy, with current applications largely restricted to fragmented process steps. Consequently, most DT-focused research fails to establish a closed-loop framework for comprehensive procurement risk governance.

3.1. LLM-based multi-source risk identification

Contract-based engineering procurement relies heavily on unstructured textual data. Manual processing of this complex heterogeneous information proves prohibitively inefficient, impeding integrated data management. Leveraging advanced text comprehension and knowledge integration capabilities, LLM can systematically process multi-source data.

The framework initiates by ingesting multi-source data, spanning unstructured documents (contract clauses, supplier qualifications, regulatory policies, industry standards, and market reports) and structured datasets (ERP material specifications and SQL-based supplier performance metrics). The framework deploys LLM with adaptive data pipelines that concurrently ingest unstructured textual inputs and structured data streams. LLM parses the logical architecture of documents using semantic segmentation techniques, while domain-optimized Named Entity Recognition (NER) models extract granular critical elements. Subsequently, the risk inference engine initiates contrastive learning algorithms to detect contractual contradictions and quantifies descriptive ambiguity through embedding vector similarity analysis. These analytical outcomes generate preliminary risk registers. Simultaneously, a co-processing digital twin engine executes system-level risk simulation based on supply chain topological graphs. Textual risk entities extracted by LLM are spatially mapped to corresponding digital twin nodal coordinates, enabling detection of potential risk patterns. Ultimately, the framework synthesizes a machine-actionable risk list through automated LLM compilation.

However, practical deployment considerations must acknowledge resource constraints and system interoperability barriers that small-to-medium enterprises (SMEs) encounter. Key implementation challenges include prohibitive GPU computational costs for model fine-tuning and integration complexities with legacy systems (e.g., on-premises ERP lacking standardized API interfaces). These obstacles can be mitigated through strategic technical adaptations: (1) Adoption of cloud-based LLM solutions with consumption-based pricing models, (2) Implementation of distilled architectures (e.g., DistilBERT) for reduced inference overhead; and (3) Deployment of intelligent OCR middleware or API-First transformation layers that retrofit legacy systems with RESTful wrappers. Such approaches maintain analytical robustness while enhancing operational feasibility for resource-limited environments.

3.2. BDA-driven multi-criteria risk assessment

Currently, engineering procurement risk assessment primarily depends on the expertise of professionals and departmental personnel. The assessment process and methodologies employed are relatively unsophisticated. In addition, the outcomes of these assessments are predominantly qualitative, lacking quantitative metrics. Given the dynamic nature of risks, traditional assessment methods fall short in promptly detecting new risks arising from fluctuations in the market, policy changes, and technological advancements. As a result, there is a discernible disconnect between the assessment findings and the actual circumstances. BDA can build unified predictive models and capture dynamic information, with automated processes that reduce human interference.

Identified risk information and ESG factors are used as metrics to be considered in the assessment, and the framework integrates multi-criteria decision-making (MCDM) methodologies (e.g., Best Worst Method (BWM)^[60], entropy weight method (EWM), technique for order preference by similarity to ideal solution (TOPSIS)^[44]) with group decision-making mechanisms through BDA. It uses real-time data streams to dynamically calculate indicator weights across economic, environmental, social, and governance dimensions (e.g., automatically increasing governance weight coefficients during policy volatility scenarios). Concurrently, machine learning modules continuously parse risk correlation patterns, transforming qualitative expertise into quantitative probabilistic models (e.g., XGBoost regression algorithms to predict supplier disruption probabilities and their multidimensional impact scopes). Ultimately, dynamically optimizing the parameters of the risk matrix to achieve a refined risk classification - clear risk level, priority and disposal order - provides a basis for decision making for the subsequent differentiated response strategies.

It is noteworthy that during the implementation of BDA and machine learning, algorithmic biases may arise, such as ESG score distortion caused by historical data bias, authority bias in group decision-making, and indicator weighting bias. To address this, the framework can deploy Adversarial Debiasing algorithms that embed fairness constraints during model training, leveraging a generator-discriminator game to decouple spurious correlations between sensitive attributes and risk labels. Combined with Anonymous Delphi and EWM, it reconstructs expert decision weights through anonymized iterations and objective weight calibration based on indicator dispersion, enabling dynamic evolution of risk coefficients.

3.3. Human-machine-integrated risk solution designing

In addition to the organization itself, risk resolution also takes into account the impact of suppliers on the organization, including vendor stability, compliance, and technical capabilities. Furthermore, the generation of risk solutions often involves multiple departments. Cross-departmental collaboration suffers from cognitive differences, low collaboration efficiency and long cycle times, especially when it involves complex business or emerging risks. The current platform developed by blockchain and AI breaks the problem of information asymmetry and improves processing efficiency. At the same time, the intervention of manual review provides further assurance of the feasibility of the program.

The risk ratings and rankings derived from the risk assessment help to generate targeted solutions subsequently. The framework enables multi-party collaborative risk governance through a blockchain-powered supply chain collaboration platform. Leveraging blockchain's immutability, transparency, and decentralization, the platform ensures trusted ESG data verification: Supplier compliance data, environmental certifications, and social responsibility metrics are automatically validated by smart contracts and stored on-chain. This process, utilizing hash encryption and distributed ledger technology, secures data sources, guaranteeing the authenticity and traceability of ESG data. The platform can employ a Federated Learning architecture to address data privacy concerns while ensuring transparency. Raw data remains locally stored; only model parameter updates are exchanged, mitigating leakage risks at the source.

AI tools generate diversified response strategies - such as supplier replacement, diversified sourcing, inventory buffering, or ESG certification partnerships - at the decision-making level based on risk assessments and historical best practices. To produce a solution list, these strategies undergo multi-objective optimization (cost-benefit vs. ESG performance). The framework establishes an online collaborative decision-making environment by recognizing conflicting stakeholder values in complex systems. This integrates expert opinions, partner feedback, and AI suggestions, culminating in a manual final review. Human expertise iteratively refines and confirms the optimal risk response strategy. Finally, LLM quickly summarizes and generates a comprehensive risk resolution report.

3.4. MAS-Integrated multidimensional adaptive monitoring

Finally, the generated risk solutions will be continuously monitored and improved. Current EPRM frameworks lack continuous monitoring components. Monitoring systems may exhibit deficiencies, with unclear processes, undefined responsibility allocations, and insufficient tools/technical means to enable real-time dynamic monitoring. MAS is a collaborative system comprising autonomous, cooperative, distributed, and dynamically adaptive intelligent agents. It enables independent perception and decision-making while coordinating to execute holistic procurement risk monitoring tasks. The system dynamically reallocates responsibilities and adjusts decision strategies in response to environmental changes, achieving efficient PRM.

After implementing the solution, the framework proposes closed-loop control and real-time monitoring to achieve risk protection rather than outputting a one-off program regardless of the outcome. IoT edge nodes collect real-time physical world data and construct dynamic dashboards. Agents autonomously adjust monitoring responsibilities based on real-time procurement data streams from IoT - including inventory levels, supplier on-time delivery rates, quality compliance rates, and environmental indicators - enabling dynamic task allocation. The MAS governs adaptive coordination through the Contract Net Protocol (CNP), utilizing a task bidding-allocation model to respond to environmental changes and optimize decision strategies. The system integrates multi-source data to generate supplier profiles, continuously tracking supplier risk response effectiveness to inform supplier management and risk prevention decisions. Potential risks are rapidly identified through inter-agent collaboration and information sharing, triggering real-time assessment and countermeasure implementation to ensure stable supply chain operations. Concurrently, agents continuously inject lessons learned, case data, and solution effectiveness records from supply chain operations into the knowledge base. Subsequently, deep learning techniques continually mine emerging risk patterns and best practices from this repository for subsequent cycles. Within this dynamic monitoring closed loop, the entire EPRM framework establishes an adaptive evolution mechanism, continuously adapting to risk scenarios and compliance requirements in complex engineering environments.

As an advanced technology, we must consider that MAS implementation may face collaborative failures caused by heterogeneous communication protocols, task allocation conflicts, management bottlenecks formed by high implementation costs, and cross-domain collaboration difficulties. To mitigate these challenges, it is necessary to adopt standardized MCP protocols integrated with game-theoretic incentive mechanisms (e.g., MACPO) to unify communication frameworks and implement modular progressive deployment alongside domain-driven design (DDD) to reduce implementation costs and cognitive barriers.

This closed-loop framework continuously learns and adapts to environmental changes, optimizing risk strategies while ensuring sustained improvement in risk management capabilities and sustainability. It integrates four stages into an organic whole, enabling data flow transfer and dynamic EPRM optimization.

4.1. The framework implemented by Company S

Company S is a new energy company, which produces batteries and corresponding accessories, and provides energy solutions to its customers. It has an extensive supply network, which includes multi-tier suppliers for critical materials and advanced components. Previously, the quickly-changing technology in battery manufacturing and high-compliance requirements of ESG regulations challenge the risk management in Company S, especially in its business strategies and technological capabilities. Considering its business challenges, with traditional personnel checking procedures, human beings' limited knowledge cannot support the identification of various risks and some newly arising risks such as harm-material screening and carbon-cost compliance. Additionally, human-based EPRM procedures lack continuous monitoring. Thus, Company S needs to invest more resources in environmental monitoring, social responsibility assessments and corporate governance optimization. Considering the technology insufficiency, Company S has scattered risk data storage and lacks an integrated analytic platform which leads to the phenomenon of data silos. Under this circumstance, the proposed framework, DEEP-RM is so fit with Company S to address these issues.

4.1.2. Multi-criteria risk assessment using BDA

In the risk assessment stage, the emergency and severity should be measured to facilitate decision-making regarding the methods of dealing with risks. BDA allows Company S to extract latent patterns from high-dimensional ESG datasets, enabling real-time risk identification and trend forecasting. For instance, using machine learning algorithms, the system continuously updates the weighting of ESG risk indicators based on temporal and contextual variations, thereby supporting dynamic, data-driven risk evaluation. For example, temporal and contextual variations manifest in Company S through evolving regulatory landscapes (e.g., CBAM implementation timelines), seasonal logistical risks, and technology cycles. Contextually, ESG risk weights fluctuate with the geographical location of suppliers, the type and carbon intensity of materials procured, and the stage of the engineering-procurement-construction (EPC) process. A dynamic weighting mechanism, powered by big data analytics, is thus essential to ensure adaptive and context-sensitive ESG risk assessment. According to the practical experience, company S divided the evaluated risks into four groups with percentages of 5%, 15%, 30%, and 50%, which can be illustrated as a pyramid shape [Figure 6]. The top 5% risks are those most urgent and severe, such as increasing tariff, which influences the price of imported raw materials and the cost of exporting products. The second level is the risks scoring in the 6%-20% percentile, indicating those severe but not urgent risks. The other two levels are "urgent but not severe", and those "neither urgent nor severe". According to practice, around 50% percent of risks can be categorized as "neither urgent nor severe". However, the categories are time-related, which means that some risks that are not urgent or severe at the moment can develop into more severe and urgent risks.

Figure 6. Risk assessment categories for company S.

4.2. Comparison and discussion

Emerging DTs provide rich avenues for engineering procurement management in companies under ESG transformation, improve the efficiency of internal management and external communication, and promote supply chain sustainability and resilience. This paper utilizes bibliometric methods to investigate the current ESG transformation, PRM correlates, DTs application and SSCM. Then, the study creates a framework to further understand how DTs embedded in PRM under ESG transformation enhance corporate supply chain sustainability and resilience.

The proposed framework DEEP-RM simultaneously considers ESG, PRM and emerging DTs in various complex engineering environments. It is a holistic framework that considers ESG dimensions to maintain sustainability while applying advanced digitization techniques to maintain digitization and innovation trends in PRM. The DEEP-RM has many advantages over other frameworks [Table 3].

The risk management process in DEEP-RM is no longer a simple linear process, but a cycle of risk identification, assessment, resolution and dynamic feedback monitoring. For most risk management frameworks, traditional linear management is applied to reduce corporate risk. In DEEP-RM, the knowledge base formed by the dynamic feedback monitoring can provide the latest experience for risk identification, so that the enterprise can continuously learn from the experience and optimize the risk management strategy.

With the rapid advancement of emerging technologies, the DEEP-RM framework transcends the limitations of conventional single-technology applications^[48], enabling synergistic operation of multiple integrated technologies. For example, LLMs decipher semantic undercurrents in unstructured text (e.g., compliance risks implicit in "flexible labor arrangements") and convert them into structured features. These vectors enable BDA to synthesize multi-source numerical indicators for generating high-dimensional risk profiles. Concurrently, BDA refines LLM attention mechanisms through statistical significance analysis, achieving data-driven semantic focus optimization.

Sustainability considerations are integral to the framework. DEEP-RM fully responds to the current needs of corporate ESG transformation, integrating ESG dimensions into four stages of CLM, including ESG goal setting, ESG performance assessment, and ESG compliance review. Nelissen^[1] mentions the use of solutions to support companies in effectively managing ESG risks and improving regulatory compliance.

The DEEP-RM realizes collaborative communication of multiple subjects, ensures the security of information sharing, and utilizes reliable information through the blockchain. Poor cross-departmental and stakeholder communication and data privacy issues remain procurement risk challenges^[15,32]. DEEP-RM considers suppliers, checks supplier compliance and works with suppliers to create a coordinated and green supply chain as a whole.

In addition, to illustrate the practical application of the proposed framework, this paper includes a case study of PRM in a new energy company S. Compared with previous studies, the case study in this paper not only reflects the PRM practices of a representative industry, but also validates the CLM of the DEEP-RM, including rich data processing computational capabilities, dynamic adaption, and automatic report generation.

In summary, this paper identifies research hotspots in closed-loop PRM that combine ESG aspects with DTs. The proposed framework incorporates the advantages of DTs while considering the organization's ESG transformation to drive PRM from four phases and fills the gap in previous studies that have not combined ESG and emerging DTs to form closed-loop procurement management. The evolutionary nature of the framework and the feedback mechanism can provide companies with continuous improvement suggestions and timely regulatory support.

5.1. Contributions of the framework

Through a systematic literature review, this study identifies that while ESG and DTs have garnered extensive attention from academia and industry, their integration with EPRM remains fragmented. To fill the gaps and respond to the RQs, this paper constructs the DEEP-RM framework for incorporating ESG and DTs into PRM. This paper constructs the DEEP-RM framework for incorporating ESG and DTs into PRM to promote supply chain sustainability and resilience. The application at Company S validates the applicability and priority of the proposed framework.

This paper makes several contributions to theory and practice. Firstly, it conducts a bibliometric analysis of ESG and PRM literature, the findings of which underpin the construction of the framework for ESG-DTs application while advancing theoretical research on EPRM. ESG research has experienced explosive growth since 2018, necessitating its integration into the PRM framework to address regulatory compliance and sustainability imperatives. Through keyword network and time-series evolution mapping, it is found that PRM research is undergoing an evolution of "economy-led-ESG integration and DTs empowerment - resilience and sustainable development", and nodes such as blockchain smart contracts and supplier information sharing constitute a technological synergy network to promote the formation of a framework integrating "ESG-DTs-PRM". This discovery not only fills the absence of the ESG dimension in traditional risk management, but also provides empirical evidence for constructing a CLM framework empowered by DTs, marking the entry of EPRM into a new paradigm of sustainable development with value co-creation.

Second, based on the trend of sustainable development, this paper innovatively constructs a closed-loop PRM framework, DEEP-RM, which, for the first time, combines DTs with corporate ESG transformation to realize EPRM. Compared with traditional linear risk management models, DEEP-RM realizes full-cycle ESG embedding, replacing traditional single financial KPIs with a dynamic ESG indicator matrix in the four phases of risk identification, assessment, solution, and monitoring. Through suppliers' ESG digital passports and collaborative smart contracts, DEEP-RM transforms the traditional adversarial sourcing relationship into an ecosystem community of responsibility, realizing ESG integration and sustainable value symbiosis.

Thirdly, the framework fully systematically integrates the deployment and synergy of DTs to achieve cross-level and multi-object EPRM. Traditional EPRM typically relies on siloed ERP modules or manual intervention. Limitations include fragmented data and delayed response, which are increasingly pronounced under volatility, particularly in addressing non-linear and sudden supply chain risks. However, DEEP-RM leverages digital twin technology, synchronizing physical supply chain operations with virtual models in real-time. This enables end-to-end data mapping from raw material sourcing to final delivery. Simultaneously, LLM deeply analyzes multilingual ESG regulations and industry standards to generate dynamic risk labels and compliance recommendations, overcoming semantic miscalculations and delayed updates inherent in traditional legal management. Blockchain certifies immutable supplier data (e.g., carbon footprints, labour rights) to further build a trustworthy collaboration ecosystem, while IoT sensing enables cross-validation. This synergy generates comprehensive supplier profiles, assisting selection of credible partners and driving procurement decisions from relational collaboration to data-driven "intelligent selection".

To illustrate the practical significance of the DEEP-RM, the study demonstrates the implementation in Company S. The evidence confirms that DEEP-RM propels corporate ESG transformation and advances sustainable development by leveraging DTs, such as LLM, BDA, and MAS through closed-loop systems. Compared with traditional frameworks, the DEEP-RM is more advanced and comprehensive. The selected DTs not only are easy and efficient to apply to real procurement and supply chains, but also have the capability of handling newly emerging problems. The DTs and ESG integrated in the framework are constantly evolving and adapting to the diverse and dynamic scenarios in EPRM to enhance the efficiency and sustainability of the business.

5.2. Limitations and future research directions

This paper reveals current limitations on EPRM based on literature reviews, and a conceptual framework is proposed and verified by a transferrable case study. The following aspects can be explored in the future:

First, future works can apply pre-implementation baselines or industry benchmarks on EPRM to quantitatively measure the impacts of system revolution. Then, researchers will be encouraged to explore how to balance sustainability and using DTs. Last but not least, research on companies' ESG compliance policies is also very interesting. The study could start with the relationship between the focal company, the regulator and the government to provide insightful recommendations.