Overview
This article explains step by step how to carry out the concrete ESG risk analysis for suppliers with a score below 80.
The assessment covers mitigation factors such as certificates, the appropriateness assessment and the supplier self-assessment.
This is step 2 of 4. Before: (1/4) Preparing the risk analysis. Next: (3/4) Preventive and remedial measures.
Note: Evaluation templates, Request forms, score formulas, point values, score thresholds and table views are configured per customer. The names, point values and thresholds mentioned here describe Tacto's standard configuration – your configuration may differ.
Basics
A concrete risk analysis is required for suppliers with the following values:
Abstract ESG score: < 80
ESG risk status: high or medium risk
ESG analysis progress: In progress
The abstract score provides a general assessment based on country and industry. The concrete score, by contrast, assesses three legal positions individually: human rights, labour rights and environmental rights.
The data model is based on the following internationally recognised indices: World Justice Index, UN Sector Mappings, ITUC Global Rights Index, AMAP/UNEP: Technical Background Report for the Global Mercury Assessment 2013, ILO ILOSTAT Database, UNSD Environmental Indicators, Sensoneo Global Waste Index, Yale Environmental Performance Index (EPI), amfori BSCI, CEIP Emissions Database.
The concrete ESG score corresponds to the lowest result of the three legal positions. It ranges from 0 to 100; 100 represents the lowest risk.
How to carry out the concrete risk analysis
1. Create an Evaluation
Open the Suppliers module.
Select the table view "ESG risk analysis – Mitigation factors & appropriateness".
Right-click the supplier.
Select Create new Evaluation.
Under Select Evaluation template, choose the template "ESG risk analysis – Mitigation factors & appropriateness" and click Create Evaluation.
2. "Overview" section and skipping the risk analysis
Optional – correct country and industry: If the automatic assignment is wrong, adjust the country and ISIC code. The abstract score is then recalculated automatically.
Score then ≥ 80: The Evaluation is complete.
Score still < 80: Continue the Evaluation.
Optional – skip the risk analysis: If you answer the "Skip risk analysis" field with "Yes", a comment field and a field for attachments open.
Comment: required.
Attachments: optional, to support the justification.
3. Mitigation factors
In the "Mitigation factors" section, certificates are added to the scores of the legal positions with the following point values:
Certificate | Human rights score | Labour rights score | Environmental law score |
CoC | + 5 Points | + 5 Points | + 5 Points |
Sedex/SMETA | + 5 Points | + 5 Points | + 5 Points |
ISO 9001 | + 5 Points | + 5 Points | - |
ISO 14001 | - | - | + 5 Points |
ISO 37001 | - | + 5 Points | - |
ISO 45001 | - | + 5 Points | - |
amfori BSCI | + 5 Points | - | + 5 Points |
EMAS | - | - | + 100 Points |
SA 8000 | + 100 Points | + 100 Points | - |
IATF 16949 | + 5 Points | + 5 Points | - |
The certificates stored in the supplier's Documents tab are taken into account. Therefore, upload documents before the Evaluation.
In the standard configuration, documents without an expiry date are considered valid indefinitely.
Example: If a code of conduct is available, the human rights score including mitigation factors is 5 points higher than the original score.
If a legal position is still below 80 despite mitigation factors, the appropriateness assessment is displayed automatically and must be completed.
If all legal positions are 80 or higher, the risk analysis is complete at this point.
4. Appropriateness assessment
The appropriateness assessment is your individual assessment of the supplier. Four equally weighted questions assess severity, probability of occurrence, contribution to causation and influence (25% each).
If you answered the questions in the previous year's risk analysis, the answers are pre-filled and can be adjusted.
Each answer yields 0, 50 or 100 points. The mean results in the appropriateness factor between 0.5 and 1.5, which is multiplied by the concrete ESG score.
The assessment can improve or worsen the score.
Score then ≥ 80: The risk analysis is complete.
Score still < 80: The ESG analysis progress changes to "Waiting for SSA". Conclude the Evaluation and send the supplier a self-assessment.
For explanations of the questions, see Significance of the appropriateness assessment.
5. Send the supplier self-assessment
If the risk remains elevated, request a self-assessment. There is a separate Request form "Supplier self-assessment – legal position" for each legal position – select the appropriate one. The "Supplier self-assessment" table view shows all suppliers to whom a self-assessment is to be sent and marks the affected legal positions.
1. In the "Supplier self-assessment" table view, select the supplier or suppliers using the checkboxes.
2. In the action bar, click Request → Create new Request.
3. Select the forms for the affected legal positions.
4. Select the desired contacts.
5. Fill in the general information and click Publish request.
6. As soon as the Responses submitted column shows 1/1, continue with step 6.
Content of the self-assessments
In the standard configuration, the forms contain the following questions:
Supplier self-assessment human rights – two questions per topic:
Child labour (Section 2 (2) Nos. 1–2 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Forced labour (Section 2 (2) No. 3 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Slavery (Section 2 (2) No. 4 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Unlawful forced eviction (Section 2 (2) No. 10 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Commissioning or using private or public security forces to protect the business project (Section 2 (2) No. 11 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Supplier self-assessment labour rights – two questions per topic:
Occupational safety at the place of employment (Section 2 (2) No. 5 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Freedom of association (Section 2 (2) No. 6 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Unequal treatment in employment (Section 2 (2) No. 7 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Withholding an adequate wage (Section 2 (2) No. 8 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Supplier self-assessment environmental rights – two questions per topic:
Use of mercury (Section 2 (3) Nos. 1–3 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Chemicals containing persistent organic pollutants (Section 2 (3) Nos. 4–5 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Hazardous waste (Section 2 (3) Nos. 6–8 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
Soil changes, water and air pollution, harmful noise emissions or excessive water consumption (Section 2 (2) No. 9 LkSG): Does your company violate the requirements? Does your company have internal processes in place that mitigate these risks?
The answers are scored as follows:
Questions about violations: a violation yields 0 points, no violation 100 points.
Questions about internal processes: "Yes" or "n/a" yields 50 points, no measures 0 points.
6. Carry out the "Supplier self-assessment" Evaluation
1. Open the "Supplier self-assessment" table view. It shows which suppliers have been sent a self-assessment and what the Request contains.
2. Right-click the supplier who has responded, select Create new Evaluation and the template "ESG risk analysis – Supplier self-assessment".
3. The supplier's answers are transferred automatically. Review them and click Conclude Evaluation.
Concrete score ≥ 80: The Evaluation is complete; the supplier is considered low risk.
Concrete score < 80: Define measures.
Next steps: define measures
After the abstract and concrete risk analysis, you know the risk profile of your supply chain. The LkSG requires you to define preventive and remedial measures for identified risks. Create them as Tasks – in the Evaluation's Tasks side panel or in the supplier profile's Tasks tab via Create Task. Details: (3/4) Preventive and remedial measures.