The Supply Chain Act

Stand

• On Friday, June 11, 2021, the German parliament approved the federal government's draft law on corporate due diligence in supply chains. It appeared in the Federal Law Gazette.
• The law will come into force on January 1, 2023.
• In October 2021, the EU Commission intends to present a legislative proposal on due diligence requirements for the protection of human rights and the environment in the supply chain. It is expected that the regulations will go beyond those of the German law (Parlarment's recommendations to the Commission). This means that there may be further changes to the law in the foreseeable future.

History

.

• In 2011, the United Nations adopted the Guiding Principles on Business and Human Rights. In it, principles were formulated for states and for companies to strengthen human rights.
• In Germany, the federal government adopted the National Action Plan on Business and Human Rights (NAP) in 2016. In it, the federal government for the first time enshrines the responsibility of German companies to respect human rights.
• Reviews of the implementation of the National Action Plan fell short of expectations, so the coalition agreed of a bill.

What does the law regulate?

The law regulates requirements for responsible management of global supply chains for certain companies. Companies are provided with a legal framework for fulfilling human rights due diligence requirements. For monitoring and enforcing compliance with the due diligence obligations and is given powers to intervene. The law establishes a duty of effort. It establishes neither a duty to succeed nor a guarantee liability for the companies.

Who is affected?

• Companies, regardless of their legal form, that 1. have their head office, principal place of business or registered office in the country and generally employ more than 3,000 employees (from 2023) or more than 1,000 employees (from 2024).

What are the requirements?

• Establishment of risk management. The law requires the establishment of effective risk management in all relevant company operations. Appropriate measures must be embedded to identify and avert risks, and to terminate and minimize violations. This applies to risks within the supply chain in the company's own business unit or in the business unit of a direct or indirect supplier. Communicate the results of the risk analysis internally to the relevant decision-makers.
• Establish an internal company responsibility Companies should clarify the responsibility for monitoring within the company and appoint a human rights officer. The management should be informed regularly (at least once a year) about the work.
• Conduct regular risk analyses Risks are to be analyzed, evaluated and prioritized in the company's own business area and at direct suppliers. The risk analysis is to be carried out once a year and on an occasion-related basis.
• Delivery of a policy statement The company through its management must issue a policy statement on its human rights strategy. The following elements are required: (1) the description of the process, (2) priority human rights and environmental risks identified based on the risk analysis, (3) the determination made of the human rights and environmental expectations of its employees and suppliers.
• Anchoring preventive measures

  in its own business unit : implementation in relevant business processes, development and implementation of appropriate procurement strategies and purchasing practices, conducting training in relevant business units, implementing risk-based control measures.

  against direct suppliers: Contractual assurances from immediate suppliers, conducting training and education to enforce the contractual assurances of the immediate supplier, agreeing on appropriate contractual control mechanisms, and implementing them on a risk-based basis.

  Efficacy of preventive measures The effectiveness of the preventive measures must be reviewed once a year as well as on an ad hoc basis if the company is confronted with a significantly changed or significantly extended risk situation in its own business area or at the direct supplier.

• Taking corrective action In the event of an occurred or foreseeable violation of a human rights-related or an environmental obligation in its own business or at a direct supplier, the supplier shall take appropriate remedial action without delay. The effectiveness of the remedial measures shall be reviewed once a year and on an ad hoc basis.
• Establishment of a complaints procedure The grievance procedure enables individuals to raise human rights and environmental risks and violations of human rights-related or environmental obligations.
• Implement due diligence with respect to risks at indirect suppliers

  Implement the grievance procedure in such a way that it also allows individuals to human rights or environmental risks, as well as violations of human rights-related or environmental related or environmental obligations that are affected by the economic actions of an indirect supplier.

  Extending the risk management, corrective action and policy statement in the event of factual indications that a violation of a human rights-related or an environmental obligation at indirect suppliers appears possible (substantiated knowledge).

• Documentation and reporting

  Continuous internal company documentation with a minimum seven-year retention period.

  Publishing a report on the company's performance of its due diligence obligations in the previous fiscal year on the company's website no later than 4 months after the end of the fiscal year and for at least 7 years

What does the inspection authority do?

• Authority report review The authority checks the existence and content of the reports for plausibility and, if necessary, demands improvements. It can order measures in the event of non-compliance, and is granted access rights. The companies concerned are obligated to provide the authorities with information and to surrender it, as well as to tolerate and cooperate. obligation to tolerate and cooperate. It can impose coercive fines or fines.
• Handouts The Authority shall publish information, assistance or recommendations on compliance with this Act.
• Accountability The Authority shall report on its activities at least annually.

Disclaimer: This is a summary of the law. We do not guarantee its completeness or accuracy. For details, see the text of the law.

---

---

In detail: risk analysis

.

Risks

.

The risks mentioned in the law are summarized in the following table. Further details are provided in the text of the law.

#	human right
1	Child labor or employment
2	Forced labor
3	Slavery
4	Disregard for the freedom of coalition
5	Unequal treatment
6	Withholding a reasonable wage
7	Harmful soil degradation, water or air pollution, harmful noise emission, excessive water consumption.
8	Illegal eviction
9	Assignment of security forces for the protection of the entrepreneurial project, from which risks (torture, life and limb, freedom of association) emanate
10	Serious impairment of protected legal positions
11	Production of products containing mercury
12	Use of mercury during production
13	Behandlung von Quecksilberabfällen entgegen den Bestimmungen des Artikels 11 Absatz 3 des Minamata-Übereinkommens
14	Production and use of chemicals pursuant to Article 3(1)(a) and Annex A of the Stockholm Convention of May 23, 2001 on Persistent Organic Pollutants (BGBl. 2002 II p. 803, 804) (POPs Convention).en)
15	Non-environmentally sound handling, collection, storage and disposal of waste in accordance with the regulations in force in the applicable jurisdiction under the terms of Article 6(1)(d)(i) and (ii) of the POPs Convention
16	Non-environmentally sound handling, collection, storage and disposal of waste in accordance with the regulations in force in the applicable jurisdiction under the terms of Article 6(1)(d)(i) and (ii) of the POPs Convention
16	Export of hazardous waste as defined in Article 1(1) and other waste as defined in of Article 1, paragraph 2, of the Basel Convention on the Control of Transboundary Movements of Hazardous Wastes and their Disposal of 22 March 1989 (Federal Law Gazette 1994 II pp. 2703, 2704) (Basel Convention)
17	Export of hazardous waste from countries listed in Annex VII to the Basel Convention. States to States not listed in Annex VII (Article 4A of the Basel Convention, Article 36 of Regulation (EC) No 1013/2006)
18	Import of hazardous waste and other waste from a non-Party to the Basel Convention (Article 4(5) of the Basel Convention)

For the risk analysis, the risks are to be recorded, weighted and prioritized. There are no further explanations in the law.

Recording the risks

To capture the risks, you need a systematic approach. This should be based on the MECE principle ( mutually exclusive and collectively exhaustive). Which approach you choose is up to you. Three possibilities:

• By supply chain If you use only a few supply chains and want to be able to show the risks per supply chain, it is a good idea to make the first level of breakdown by supply chain.
• By country If you use many supply chains and perhaps identify regional or country-specific focal points in their procurement and value creation, it is a good idea to make the first level of breakdown by country. This has the advantage that many general country-level risk metrics are provided by NGOs.
• By suppliers and locations This is a detailed breakdown that takes into account specific differences between sites. You will also need to break down by supplier and site with the other two breakdowns to agree appropriate actions (such as contracts, training and controls).

To capture the risks, use different sources. Interested parties (internal and external employees, Customers, employees of suppliers and subcontractors, and people from the communities at their sites), NGOs, representatives of the public administration are a good point of for direct contact. In addition, you can use publicly available databases, media reports or reports from the Internet. Even if not all reports and information have to be correct, you could be shaping public opinion and damaging your supply chains as a result.

You can use the list of risks as a basis for discussion and research. Also look for data to help you evaluate and prioritize (see next section).

Weighing and prioritizing risks

Three aspects play a role in weighting and prioritizing risks: the severity of impact, your ability to influence it, and the likelihood.

Severity of impact To evaluate the severity of impact use three dimensions related to your economic activity.

• Degree of harm to human rights. To what extent are human rights affected? A case of years of forced labor or child labor weighs more heavily than a one-time withholding of a decent wage. The law and agency guidance do not specify. Based on the identified risks, you can construct an example of lesser rights violation and a case of severe rights violation, which you use as a reference for categorization.
• Number of people actually or potentially affected. Are they individual cases or would I relate the risk to many mesnchen.
• Possibility of recovery. How easily can those affected be restored to a position where they can again claim the human rights affected by the impairment? A withheld wage is easier to make amends for than years of child labor or even permanent damage to health.

If your identified risks in one of the three dimensions falls into the higher class, the violation is classified as serious. The initiation of measures is independent of the classification. It is only used for prioritization purposes.

Influence name possibility. The law recognizes different constellations in the supplier relationship. You do not always have the economic power to enforce something with the supplier. Therefore, it is necessary to categorize the possibility of influence. Here it is helpful to make a gradation. One possibility is in:

own group company - dependent company (§§ 16, 17 AktG) / controlled company (§ 17 AktG) / dependent group company (§ 18 para. 1 AktG) - independent company

The ability to influence determines whether to what extent you can agree measures (such as contracts, training, controls) with the company. If you cannot do this, you still need to monitor and assess risks. In extreme cases, changing suppliers or making your own will help.

Probability of occurrence. The probability of occurrence has an impact on prioritization. You can try to derive it from historical data. However, you should also consider regional conditions

• Existence and enforcement of national laws and regulations.
• Conflicts between national laws and international human rights.
• Social customs and traditions
• Presence of corruption
• Presence of conflicts
• Whether the policies of your business partners take into account respect for human rights
• Whether your business partners have effective procedures in place to meet their responsibilities to respect human rights
• Whether business partners comply with or violate human rights.
• Practices related to corruption
• Whether business partners are in conflict with local interest groups

Prioritization In a classical risk analysis, probability and impact are plotted. You can do this in the case of supply chain law in terms of probability and severity of impact. A graph might look like this, depending on your choice of gradations.

With the help of this representation, you visualize the risks and can derive an appropriate order and the scope of the measures.

However, take the opportunity to log information that led to the assessment. This will help you determine if changes have occurred over time. The next time you go through for risk analysis, ask for new information and changes to existing information.