risikoanalyse-lksg

/lieferkettengesetz:risikoanalyse-lksg

Purpose

The risk analysis is the anchor of the LkSG. An inadequate risk analysis makes the subsequent obligations (prevention, remediation, complaints procedure, reporting) vulnerable — and regularly leads to BAFA inquiries with the risk of fines under § 24 LkSG: up to EUR 800,000 (paragraph 2 sentence 1 no. 1) for breaches of duty such as failure to take remedial action, EUR 500,000 for a risk analysis violation (no. 2), EUR 100,000 in the other cases. In the case of legal persons with an average annual turnover > EUR 400 million a fine under § 24 paragraph 3 LkSG of up to 2% of the worldwide average annual turnover may be imposed — limited to violations of remediation obligations (paragraph 1 no. 6, no. 7 lit. a).

Inputs

• Business area (sectors, geography, products/services)
• Direct suppliers (list, countries, risk profiles)
• Known incidents / complaints / NGO reports
• Result of the previous risk analysis
• CSDDD application period (for preparation)

Procedure

1. Scope of application (§ 1 LkSG)

• Head office in DE and ≥ 1,000 employees in Germany (since 2024)
• Group attribution: employees of affiliated companies in DE are taken into account (§ 1 paragraph 3 LkSG)

2. Protected legal positions (§ 2 LkSG)

• Human rights risks § 2 paragraph 2 (prohibition of child labor, forced labor, discrimination, inadequate occupational safety, withholding of adequate remuneration, violation of freedom of association, torture, unlawful land acquisition, use of security forces with abuses)
• Environmental risks § 2 paragraph 3 (Minamata Convention mercury, Stockholm Convention POPs, Basel Convention waste)

3. Risk analysis stages (§ 5 LkSG)

Stage 1 – own business area:

• Sites, subsidiaries
• Employees, subcontractors on the factory premises

Stage 2 – direct suppliers:

• Contractual direct relationship
• Risk assessment at least annually and on an ad hoc basis

Stage 3 – indirect suppliers (§ 9 LkSG):

• Only on an ad hoc basis in the event of "substantiated knowledge" of a possible violation
• Trigger: NGO report, media report, internal indications, audit findings

4. Methodology of risk assessment

Assess each risk:

1. Severity – how serious is the possible violation?
2. Reversibility – how reversible is the harm?
3. Probability – how likely is it to occur?
4. Contribution – causes / contributes to / is in a direct business relationship?
5. Ability to exert influence – how much influence does the company have?

5. Prioritization (Section 5(2) LkSG)

Risks are prioritized according to appropriateness criteria:

• Nature and scope of business activity
• Ability to exert influence
• typical severity and reversibility
• Probability
• Nature of the contribution

6. Documentation (Section 10 LkSG)

• Documentation obligation internal (Section 10(1))
• Reporting obligation to BAFA annually (Section 10(2))
• Retention 7 years

7. CSDDD outlook (Directive (EU) 2024/1760)

• Formally adopted 24.05.2024; transposition by Member States by mid-2026.
• Phasing (as of: original version):
  • Phase 1 (26.07.2027) – EU companies with > 6,000 employees and > EUR 1.5 billion net turnover worldwide; third-country companies with > EUR 1.5 billion EU net turnover.
  • Phase 2 (26.07.2028) – companies with > EUR 900 million net turnover.
• Due diligence obligations across the entire "Chain of Activities" (upstream + parts of downstream).
• Climate plan obligation (Art. 22 CSDDD).
• Civil liability for violations (Art. 29 CSDDD).
• ⚠️ Currency: In November 2024 the Commission announced the merger of the CSRD, CSDDD and EU Taxonomy into a single regulation; in February 2025 an omnibus simplification initiative ("Stop-the-Clock") was added, intended to extend application deadlines. In November 2025 the EU Parliament adopted amendments with a conservative majority. Before any mandate decision, check the current status of the CSDDD and any transposition laws (DE: still open).

Sources

Statute

• LkSG (Lieferkettensorgfaltspflichtengesetz) — full text, Sections 1–24
• Section 5 LkSG, Section 9 LkSG, Section 10 LkSG, Section 24 LkSG
• Directive (EU) 2024/1760 (CSDDD)
• UN Guiding Principles on Business and Human Rights (UNGPs)
• ILO core labour standards

BAFA

• BAFA – Lieferkettengesetz — point of contact, guidance documents, reporting forms
• BAFA guidance documents on risk analysis (current version)

Secondary literature

• Grabosch, LkSG, 1st ed. 2023
• Hembach, in: Beck'scher Online-Kommentar LkSG (updated)

Output format

LkSG-RISIKOANALYSE — <Berichtsjahr> — <Datum>

I.    Geltungsbereich                [Ja / Nein — Beschäftigtenzahl]
II.   Methodik
      Schwere | Umkehrbarkeit | Wahrscheinlichkeit | Beitragsleistung | Einfluss
III.  Stufe 1 — eigener Geschäftsbereich
      Identifizierte Risiken: <Liste>
      Bewertung: <Priorisierung>
IV.   Stufe 2 — unmittelbare Zulieferer
      Top-N nach Risikoexposition: <…>
      Methodik: <Self-Assessment / Audit / Datenanbieter>
V.    Stufe 3 — mittelbare Zulieferer
      Substantiierte Kenntnis: [keine / Ja — Quelle: …]
      Vertiefte Prüfung: <…>
VI.   Priorisierte Risiken (Top 5)   <…>
VII.  Folgemaßnahmen
      - Prävention § 6              <…>
      - Abhilfe § 7                  <…>
      - Vertragliche Verankerung     <…>
VIII. BAFA-Bericht-Vorbereitung      <…>

Risiko-Restrisiko: <…>
Wiedervorlage: jährlich + ad-hoc

Risks / typical errors

• Sequence of steps ignored — direct leap to indirect suppliers without substantiated cause.
• Self-assessment without verification — BAFA requires robust methodology.
• CSDDD preparation forgotten — transitional periods are short for a valid data basis.
• Documentation incomplete — the obligation is subject to the burden of proof in BAFA proceedings.
• Complaints ignored — an incoming complaint is regularly "substantiated knowledge" within the meaning of Section 9 LkSG.
• Climate protection / environment interpreted narrowly — the LkSG covers mercury/POPs/waste, the CSDDD will be broader (Paris Climate Agreement).