Due diligence in supply chains

The Supply Chain Due Diligence Law passed by the Bundestag comes with new monitoring and control obligations for companies in Germany. From 1st January 2023, all companies with at least 3,000 employees in Germany must fulfil due diligence obligations along their supply chain and be able to implement and demonstrate human rights and environmental requirements in an appropriate manner. From 2024, the law will also apply to all companies with 1,000 or more employees in Germany. Companies that violate the law face fines and exclusion from public contracts. The aim of the law is to make companies more aware of their social responsibility along their supply chain and to ensure that they take greater account of human rights and environmental concerns. 

Criticism

Some non-governmental organisations consider the regulations to not  be far-reaching enough. They criticise that the required social responsibility is only limited to direct suppliers and does not consider the entire supply chain equally.

German business associations, on the other hand, see the law as an increased bureaucratic burden, which will primarily affect German companies but ultimately contribute little or nothing to the fulfilment of human rights and better environmental protection 
in globally interconnected supply chains.

Rapid action required

The fact is that companies with at least 3,000 employees will have to comply with the requirements from 1st January 2023. This also includes subsidiaries of foreign companies that employ a corresponding number of employees in Germany. They have less than 16 months to prepare for the new requirements. 

So, the countdown has begun. Especially companies with complex supply chains will have to invest some time to comply with legal obligations. But smaller companies will also feel the effects of the law: as direct suppliers of large companies, they are also required to meet minimum standards in terms of human rights and environmental protection. Their clients will increasingly insist on compliance with the associated requirements and stipulate this in supplier contracts and purchasing 
conditions. In addition, they will check compliance with human rights and environmental aspects on site or have them checked.

Finally, companies covered by the law will have to prove that all their direct suppliers adhere to certain minimum standards. The law will also affect indirect suppliers: If companies have a “substantial suspicion” that human rights or environmental protection requirements may be 
violated in their supply chain, they will have to specifically investigate this and prove their efforts.

First step: status analysis

How much effort is required and where should companies start? It can be assumed that companies vary in their level of commitment to human rights and environmental concerns. Companies with complex supply chains and numerous direct suppliers, as can be the case for companies in the cosmetics industry, will have to expect greater efforts to comply with the legal requirements. This is especially true if they have not yet dealt with the due diligence obligations and CSR issues enshrined in the new law or have hardly dealt with them at all. On the other hand, companies that work with few suppliers or have already qualified their main suppliers accordingly in the past will probably have to reckon with less effort.

In all cases, it makes sense to first analyse the areas in which the requirements of the Supply Chain Due Diligence Law are already fulfilled and where additional work is needed. So-called GAP analyses are useful for this. With the help of the analyses, companies can determine within a few days where possible risks lie, and which gaps need to be remedied to comply with the legal requirements.

GAP analysis

TÜV Rheinland’s GAP analysis first looks at whether and when the company must comply with the requirements of the law based on the number of employees. Depending on whether it is the parent company or an affiliated company, the concrete fulfilment of the legal requirements is considered based on more than 80 individual criteria. These consider not only the fulfilment of individual due diligence obligations – such as the appointment of a human rights officer – but also more complex requirements.

These include the interaction of processes, which are assessed using a process maturity model. In addition to a risk management system designed to meet human rights and environmental obligations, the law also requires regular risk analyses. In addition, a definition of preventive and remedial measures related to the risks is necessary, which must also be mapped in the affiliated companies. The company’s complaints management is also examined as part of the GAP analysis. Experts check, among other things, whether this has been effectively implemented. In doing so, they check the complaint management system to see to what extent it meets the requirements in terms of access, transparency, and protection of complainants. The comprehensibility of the transparency reports and documentation required for the public and the auditing authorities is also examined on a random basis.

Standards and audits

In principle, it is foreseeable that internationally recognised standards for environmental and compliance management – such as ISO 14001 and ISO 37301 – will be increasingly used to comply with environmental protection and compliance requirements. Recognised social standards are also likely to be a key element in verifying compliance with contractual requirements. The conduction of supplier audits by independent auditing companies is an important measure in this context. It supports companies in fulfilling their due diligence obligations along the supply chain.