A risk assessment is how your company finds out where it may harm people or the environment, in its own operations and in its value chain. It is the base for everything else in sustainability due diligence: your policies, your training, and your work with suppliers all depend on knowing where the risks are.
This article explains how to identify and assess sustainability risks step by step, with a worked example of how to prioritize them. It follows the method in the OECD Due Diligence Guidance for Responsible Business Conduct.
⚡️ Quick summary
A risk assessment identifies the actual and potential negative impacts your company may have on people and the environment, in your operations and value chain.
Do it in 5 steps: map your operations and value chain, find where risks are likely, assess them in more depth, prioritize them by severity and likelihood, and document and review.
Prioritize by how severe and how likely a risk is, not by how important the supplier is to your business.
Review the assessment at least once a year and when your business changes, e.g. a new country or a new supplier.
18 of the 20 topic assessments ask whether your company has a process to identify and assess impacts for their topic.
Why stakeholders ask about risk assessment
Stakeholders ask about risk assessment because it shows that your company knows where its biggest risks are. 18 of the 20 topic assessments ask about it for their own topic, e.g. "Does your company have a process to identify and assess actual and potential impacts on labor rights?"
The Baseline assessment asks the same for environmental, human rights, and corruption risks, and whether you document your procedures. The Supply chain practices assessment asks whether you perform risk analysis on your suppliers.
One risk assessment can cover all these topics. Most companies run one assessment and look at each topic in it.
🤔 Risk to whom?
In sustainability due diligence, a risk is a risk of harm to people or the environment, not a risk to your company. The OECD guidance and the UN Guiding Principles on Business and Human Rights (UNGPs) both use this meaning. A risk that is severe for workers counts, even if it would not cost your company money.
Assess your risks step by step
The OECD guidance describes risk assessment as step 2 of its 6-step due diligence method. In practice it works in 5 steps.
1. Map your operations and value chain
List what your company does, where, and with whom. Include:
Your own sites and activities, and the countries they are in
Your main products and services, and the raw materials in them
Your suppliers, at least Tier 1, and the countries they operate in
Other business partners, e.g. distributors, agents, and contractors
2. Find where risks are likely
Use the map to find where negative impacts are most likely. This first scan is broad, so it does not need detailed information about every supplier. Look at:
Country risk: e.g. weak protection of labor rights, high corruption, or water scarcity
Sector risk: e.g. agriculture, mining, construction, and textiles have well-known risks
Product and raw material risk: e.g. cotton, cocoa, palm oil, and some minerals
Business model risk: e.g. many subcontractors, temporary or migrant workers, or short lead times
Public sources such as country and sector risk indexes, reports from international organizations, and news can help. Information from your suppliers, audits, and talks with workers and other stakeholders adds detail.
3. Assess the most likely risks in more depth
For the areas where risks are most likely, collect more specific information. For example, send a questionnaire to the suppliers concerned, ask for certificates or audit reports, visit sites, or talk with workers and local communities.
4. Prioritize by severity and likelihood
You cannot address every risk at once, so decide which to act on first. The UNGPs judge the severity of an impact by 3 factors:
Scale: how serious the harm is for the people or environment affected
Scope: how many people or how large an area is affected
Irremediable character: how hard it is to undo the harm
Then consider how likely the impact is. A simple scoring method helps you compare risks, see the worked example below.
5. Document and review
Write down your method, the risks you found, how you prioritized them, and what you decided to do. A table of risks, often called a risk register, is enough for most companies. Review the assessment at least once a year, and when your business changes, e.g. when you enter a new country, start a new product line, or add an important supplier.
Worked example: prioritize risks with a score
A score helps you compare risks in the same way every time. This example uses a scale from 1 to 3 for both severity and likelihood.
The scale for severity is:
1 = low: limited harm that is easy to undo
2 = medium: serious harm to a group of people, or harm that takes time to undo
3 = high: very serious harm, many people affected, or harm that cannot be undone
The scale for likelihood is:
1 = unlikely: no known cases in this country, sector, or supplier
2 = possible: known cases in this country or sector
3 = likely: known cases at this supplier or in very similar operations
To calculate the score, multiply the severity by the likelihood. Here is how it works for 3 risks at a clothing company:
Risk | Severity | Likelihood | Score |
Forced labor at a cotton farm in a high-risk region | 3 | 2 | 3 × 2 = 6 |
Excessive overtime at a garment factory | 2 | 3 | 2 × 3 = 6 |
Office supplier paying below the minimum wage | 2 | 1 | 2 × 1 = 2 |
Step by step, for the first risk: forced labor is very serious harm, so severity is 3. Forced labor is known in the region but not at this farm, so likelihood is 2. The score is 3 multiplied by 2, which is 6.
The first 2 risks both have a score of 6. When scores are equal, the more severe risk comes first, so forced labor at the cotton farm is the top priority. The OECD guidance recommends this: severity matters more than likelihood when you decide where to start.
Frequently asked questions
How detailed does our risk assessment need to be?
How detailed your risk assessment needs to be depends on your company's size and risks. The OECD Due Diligence Guidance for Responsible Business Conduct says that due diligence should be proportionate. A small company with few, low-risk suppliers can do a short assessment once a year. A company with complex, high-risk supply chains needs more detail.
Do we have to assess every supplier?
No, you do not have to assess every supplier in depth. Start with a broad scan of all suppliers by country, sector, and product, then assess in depth only the suppliers where risks are most likely. This is the risk-based approach that the OECD guidance describes.
Is a risk assessment the same as a double materiality assessment?
No, a risk assessment for due diligence is not the same as a double materiality assessment, but they overlap. A double materiality assessment under the Corporate Sustainability Reporting Directive (CSRD) looks at which topics to report on, from both the impact and the financial perspective. A due diligence risk assessment looks at where to act to prevent harm. Many companies use the same information for both.
Does following this guide make our company compliant with the law?
No, following this guide does not by itself make your company compliant with any law. The guide describes good practice from the OECD guidance and the UNGPs, for inspiration and general guidance only. Check the legal requirements that apply to your company, and consider asking a legal advisor.