Overview
The aim, timing and process of the ESG risk analysis in the Tacto App, plus the ESG score, analysis progress and risk status at a glance. Relevant for everyone who is responsible for or carries out the risk analysis under the LkSG. The article Process overview of the ESG risk analysis shows the process in the table views.
Note: Evaluation templates, score formulas, score thresholds, status values and table views are configured per customer. This article describes Tacto's standard configuration – your configuration may differ.
Aim of the risk analysis
The risk analysis is the basis for appropriate and effective risk management. Companies must observe human rights and environmental due diligence obligations in their supply chains in an appropriate manner. The aim is to prevent or minimise these risks or to end violations.
When to carry out the risk analysis
According to Section 5 (4) LkSG, the risk analysis must be carried out once a year and on an ad hoc basis.
Ad hoc mainly refers to events that significantly change or expand the risk situation in the supply chain – for example new products, projects or business areas – or a substantiated suspicion of a violation.
Adding a new supplier in the core business does not usually trigger an ad hoc risk analysis.
Process in the Tacto App
The risk analysis has two stages and is carried out individually for each supplier:
Abstract risk analysis: All direct suppliers are assessed automatically based on location (country) and industry.
Concrete risk analysis: Suppliers with a medium or high risk are analysed in more detail.
The weighted risks result in the supplier's ESG score.
Data basis
The risk model of the standard configuration is based on recommendations from the German Federal Office for Economic Affairs and Export Control (BAFA) and the law firm Taylor Wessing. Quantifiable values from the following indices are used for the country and industry ratings:
World Justice Index
UN Sector Mappings
ITUC Global Rights Index
AMAP/UNEP: Technical Background Report for the Global Mercury Assessment 2013
ILO ILOSTAT Database
UNSD Environmental Indicators
Sensoneo Global Waste Index
Yale Environmental Performance Index (EPI)
amfori BSCI
CEIP Emissions Database
Abstract risk analysis
Automated process that assesses the risk of all direct suppliers based on country and industry.
The score is based on the average values of the relevant indices for countries and industries.
Each supplier is assigned a risk status: High, Medium or Low.
Concrete risk analysis
For suppliers with a medium or high risk, you carry out the "ESG risk analysis – Mitigation factors & appropriateness" Evaluation:
Three legal positions are examined: human rights, labour rights and environmental rights.
A separate score is calculated for each legal position from the country and industry values. The concrete ESG score corresponds to the lowest of these three values.
Mitigation factors: If the concrete score is below 80, the following certificates are taken into account:
Code of Conduct
Sedex/SMETA
ISO 9001/IATF 16949
ISO 14001
ISO 37001
ISO 45001
amfori BSCI
EMAS
SA8000
They can improve the score. If it is then 80 or higher, the risk analysis for the supplier is complete.
Appropriateness assessment: If a medium or high risk remains despite mitigation factors, you assess the supplier for each legal position based on:
Severity
Probability of occurrence
Contribution to causation
Influence
Depending on the answers, the score can improve or worsen.
Self-assessment: If the score remains below 80, you send the supplier a self-assessment as a Request. Once the supplier has responded, you carry out the "ESG risk analysis – Supplier self-assessment" Evaluation; the answers are transferred automatically.
The self-assessment asks about violations and risk mitigation measures for each legal position.
If a supplier confirms a violation, it is automatically classified as a high-risk supplier. Otherwise, its answers are included in the score on a weighted basis.
If a medium or high risk remains after mitigation factors, the appropriateness assessment and the self-assessment, you initiate preventive or remedial measures.
ESG analysis progress, ESG score and risk status
ESG analysis progress
Processing completed: All legal positions have a score ≥ 80 or the assessment of all legal positions is complete.
Waiting for SSA: The "Mitigation factors & appropriateness" Evaluation is complete, the supplier self-assessment (SSA) has been sent and the response is still pending.
Risk analysis skipped: It was justified that no concrete risk analysis is required because there is no risk.
In progress: None of the other conditions apply; further steps are still pending.
ESG score
The ESG score ranges from 0 to 100. 100 points correspond to the lowest risk, 0 points to the highest.
Risk status
Low risk: score ≥ 80
Medium risk: score between 60 and 80
High risk: score < 60
Red flag: substantiated suspicion of a violation, ad hoc risk analysis or known violation
Unknown: The risk status is not yet known.
Next steps
Prepare the risk analysis (including providing and transferring data)
Evaluate the results