LkSG: How to set up a solution-oriented process

Create and com­mu­nic­ate policy state­ment

One re­quire­ment of the LkSG is to produce a policy state­ment with a clear com­mit­ment against human rights vi­ol­a­tions and en­vir­on­ment­al de­grad­a­tion and to dis­trib­ute the doc­u­ment to all rel­ev­ant stake­hold­ers.
Process support: otris di­li­gence in­cludes editing func­tions. You work to­geth­er in a team on a draft text and use func­tions for com­ment­ing and editing as well as ap­prov­al work­flows. Once the policy state­ment has been created, you send the doc­u­ment to the stake­hold­ers from the system. The system auto­mat­ic­ally doc­u­ments the sending and the status of the con­firm­a­tion of receipt.

Import sup­pli­er data

In order to identi­fy risks arising from sup­pli­er re­la­tion­ships, basic data on all sup­pli­ers must be com­piled and struc­tured as com­pletely as pos­sible. This is sup­ple­men­ted by data from the company’s own op­er­at­ing sites.
Process support: An in­ter­face in otris di­li­gence enables the con­nec­tion of ex­tern­al data­bases. The system imports basic data from the company’s sup­pli­er data­base. In ad­di­tion to the sup­pli­er name, this in­cludes the country of op­er­a­tion, the volume of the busi­ness re­la­tion­ship or the product group. Data on the company’s own op­er­at­ing sites can be im­por­ted from third-party systems ac­cord­ing to the same prin­ciple or created manu­ally.

Carry out pri­or­it­isa­tion

If you have a large total in­vent­ory of sup­pli­ers, it makes sense to first examine the sup­pli­ers that have a high level of ab­stract risk.
Process support: otris di­li­gence provides support through a pri­or­it­isa­tion process that sorts sup­pli­ers ac­cord­ing to the level of ab­stract risk. The solu­tion auto­mat­ic­ally checks whether sup­pli­ers are on indices or sanc­tions lists. To do this, the system reg­u­larly com­pares the im­por­ted sup­pli­er data with pub­licly ac­cess­ible data­bases. In a second step, the solu­tion iden­ti­fies ab­stract risks that are defined ac­cord­ing to pre­defined cri­ter­ia. These cri­ter­ia include, for example, the loc­a­tion of an op­er­at­ing site, the products sup­plied or the value of the goods sup­plied. As a result, otris di­li­gence creates a list of sup­pli­ers and company op­er­at­ing sites that should be sub­jec­ted to further risk as­sess­ment with high pri­or­ity.

Define initial pre­ven­tion meas­ures

The iden­ti­fic­a­tion of ab­stract risks may already be suf­fi­cient to derive pre­vent­ive meas­ures.
Process support: After de­cid­ing on a pre­vent­ive measure, it is as­signed to the risk / company in otris di­li­gence. You or­gan­ise the com­mu­nic­a­tion with the af­fected sup­pli­er as well as the pro­cessing and follow-up of the measure with solu­tion-spe­cif­ic func­tions. The system doc­u­ments the com­mu­nic­a­tion and all activ­it­ies auto­mat­ic­ally.

Create/dis­trib­ute sup­pli­er ques­tion­naires

After ab­stract risks have been iden­ti­fied, ques­tion­naires must be sent to the pri­or­it­ised sup­pli­ers.
Process support: You create sup­pli­er ques­tion­naires within the solu­tion. You send the ques­tion­naires bundled from the system to sup­pli­ers you have se­lec­ted. The re­cip­i­ents are asked to fill in a web form (no ad­di­tion­al com­mu­nic­a­tion via e-mail with at­tach­ment).

Eval­u­ation / Re-pri­or­it­isa­tion

The re­sponse to the sup­pli­er ques­tion­naires enables further pri­or­it­isa­tion.
Process support: The system not only doc­u­ments the sending, but also the con­firm­a­tion of receipt and auto­mat­ic­ally eval­u­ates the re­turned answers. The clear eval­u­ation clas­si­fies sup­pli­ers ac­cord­ing to risk po­ten­tial.

Assess risks

The LkSG de­scribes a func­tion­ing risk man­age­ment as a central element in order to fulfil due di­li­gence ob­lig­a­tions ad­equately and ef­fect­ively. The aim of the risk ana­lys­is is to identi­fy human rights and en­vir­on­ment­al risks in the company’s own busi­ness op­er­a­tions as well as in the supply chain. The risk ana­lys­is is in turn the basis for pre­vent­ive and re­medi­al meas­ures.
Process support: otris di­li­gence in­teg­rates a com­plete risk man­age­ment system. You collect the rel­ev­ant in­form­a­tion from your sup­pli­ers using the ques­tion­naires you have pre­vi­ously created. Eval­u­ation func­tions support you in the clas­si­fic­a­tion and weight­ing with regard to prob­ab­il­ity of oc­cur­rence as well as extent, scope and ir­re­vers­ib­il­ity. By visu­al­ising the results, the system makes clear where action is needed.

Re­cord­ing com­plaints

The LkSG re­quires com­pan­ies to set up a pub­licly ac­cess­ible com­plaints channel that pro­tects the iden­tity of the user and is avail­able in all ne­ces­sary lan­guages.
Process support: otris soft­ware is the man­u­fac­turer of an es­tab­lished whis­tleblow­ing system that meets all legal re­quire­ments and com­ple­ments otris’ LkSG solu­tion. A con­nec­tion to ex­ist­ing third-party systems is also pos­sible. Sub­mit­ted com­plaints can be linked to the re­spect­ive sup­pli­er and flow into the risk as­sess­ment.

Im­ple­ment pre­vent­ive and re­medi­al meas­ures

To respond ap­pro­pri­ately to iden­ti­fied risks, com­pan­ies must im­ple­ment tar­geted pre­vent­ive and re­medi­al meas­ures.
Process support: The risk as­sess­ment iden­ti­fies the need for action. You assign the derived pre­vent­ive and re­medi­al meas­ures to the cor­res­pond­ing risks in the system. Using es­tab­lished methods, otris di­li­gence or­gan­ises the com­mu­nic­a­tion of the meas­ures to those re­spons­ible and the follow-up of their im­ple­ment­a­tion. In ad­di­tion, the system sup­ports you in plan­ning and car­ry­ing out audits.

Create a report

A key re­quire­ment of the LkSG is the regular pro­duc­tion of a public report in ac­cord­ance with BAFA spe­cific­a­tions. The report is gen­er­ated from the answers to a struc­tured ques­tion­naire with open and closed ques­tions.
Process support: otris di­li­gence gen­er­ates the report “at the push of a button”. To answer the BAFA ques­tion­naire, the solu­tion com­piles data from the dif­fer­ent func­tion­al areas of the system (risks iden­ti­fied, com­plaints re­ceived, meas­ures im­ple­men­ted, etc.).