Learn how to conduct an LkSG Supplier Risk Assessment step by step. This practical guide explains supplier mapping, risk screening, evidence collection, scoring, prioritisation and monitoring. Discover how effective Supplier Risk Management, Supply Chain Due Diligence and LkSG Compliance support better procurement decisions and stronger Supply Chain Compliance in Germany.

German companies often work with suppliers across many countries and sectors. Procurement teams must understand possible human rights and environmental risks.

A Supplier Risk Assessment helps a company find where serious problems may occur and which suppliers need closer review. Under the German Supply Chain Act, this supports risk-based decisions instead of treating every supplier in the same way.

This first half explains how to prepare a LkSG Supplier Risk Assessment, map suppliers and carry out the first checks. It also shows how Supply Chain Risk Management, Supplier Risk Management and Supply Chain Compliance connect with daily procurement work.

Professionals and job seekers can build these skills through the Procurement & Vendor Management (LkSG) course, covering supplier mapping, risk analysis, preventive measures and monitoring.

What Is an LkSG Supplier Risk Assessment?

A Supplier Risk Assessment is a structured review of risks linked to a supplier, its location, industry, products and working practices. A LkSG Supplier Risk Assessment focuses on human rights and selected environmental risks covered by the LkSG.

The aim is not to prove that every supplier has done something wrong. It is to find where harm is more likely or could be more serious. This helps a company decide where deeper Supplier Due Diligence is needed.

A normal Supplier Risk Assessment may cover price, quality, delivery, cyber risk and financial stability. An LkSG Risk Assessment adds issues such as child labour, forced labour, unsafe work, unfair wages and certain environmental harm.

The process supports Human Rights Due Diligence, Supply Chain Due Diligence and wider Supply Chain Risk Management. It also creates a clear Supplier Risk Assessment Framework for procurement teams.

BAFA explains that risk analysis should help companies identify, weight and prioritise human rights and environmental risks. It also separates regular and event-based analysis. See the official BAFA Risk Analysis guidance.

Why Supplier Risk Assessment Matters

A strong Supplier Risk Assessment gives procurement teams a clearer view of their supply base. Without it, a company may spend time reviewing low-risk suppliers while missing a serious risk elsewhere.

The German Supply Chain Act requires covered companies to use risk management and address human rights and environmental risks in their business area and supply chains. Since 2024, it has applied to qualifying companies with at least 1,000 employees in Germany. The law remains in place during the current transition period.

Good LkSG Compliance can improve supplier selection and documentation. Strong Supply Chain Compliance may also reduce disruption.

An effective Supplier Risk Assessment supports clearer ownership, proportionate checks and earlier action. Supplier Risk Management should connect procurement, compliance, legal and sustainability teams. Supplier Compliance Management works best when they share information.

What to Prepare Before the Assessment

Before starting a Supplier Risk Assessment, create a simple process with clear data, roles and decision rules.

Define Responsibilities

Decide who collects data, reviews risks and approves action. Procurement may own the supplier relationship, while compliance or sustainability supports the LkSG Risk Analysis.

Clear roles strengthen LkSG Compliance and Supplier Compliance Management. They also make decisions easier to explain during a review or audit.

Prepare Supplier Master Data

A Supplier Risk Assessment needs reliable supplier information. Collect:

• Supplier name and location
• Production country and industry
• Product or service category
• Direct or indirect supplier status
• Spend and business importance
• Known subcontractors
• Past audits, complaints or incidents

This data supports Supplier Due Diligence and Supply Chain Due Diligence. It also forms a practical Supplier Risk Assessment Checklist.

Choose an Assessment Method

A useful Supplier Risk Assessment Framework should explain which risks are checked, which sources are used and how findings are recorded. It may cover country, industry, product and supplier-specific risk.

Do not send the same long questionnaire to every supplier. BAFA recommends a risk-based approach and says companies should request the information they actually need. Covered companies cannot simply transfer all LkSG duties to suppliers.

Step 1: Map and Segment Suppliers

The first practical step in a Supplier Risk Assessment is supplier mapping. Create one list of direct suppliers and, where relevant, known indirect suppliers and subcontractors.

Group them by country, industry, product, production site, spend, importance and available risk information. This supports Supply Chain Risk Management and makes Supplier Risk Management more focused.

The goal is visibility. Record missing information for follow-up.

Step 2: Conduct an Abstract Risk Screening

The next stage of the Supplier Risk Assessment is an abstract screening. Check broad risk indicators before asking each supplier for detailed evidence.

Review country and industry information related to:

• Child labour and forced labour
• Workplace health and safety
• Wages and working hours
• Discrimination
• Pollution
• Conflict
• Weak legal enforcement

This LkSG Risk Analysis helps identify suppliers that need deeper review. Country risk alone is not proof of misconduct. It is a reason to investigate further.

The result should be a shortlist of higher-risk suppliers. This supports Human Rights Due Diligence and helps the team use LkSG Risk Assessment resources where they matter most.

Step 3: Collect Supplier-Specific Evidence

After screening, move from general indicators to supplier facts. Ask higher-risk suppliers for relevant policies, audit reports, safety records, certificates, subcontractor details and improvement plans.

This turns a broad Supplier Risk Assessment into evidence-based Human Rights Due Diligence. It also strengthens Supply Chain Compliance by showing what the supplier can prove and what needs follow-up.

Use a Supplier Risk Assessment Checklist to record:

• Documents received
• Missing information
• Warning signs
• Planned action
• Responsible owner
• Deadlines

Do not rely only on self-declarations. Certificates and audits may support the review, but they do not automatically remove risk. A good LkSG Supplier Risk Assessment compares different sources and records why the company reached its decision.

At this point, the company has a mapped supplier base, an initial screen and supplier-specific evidence. The second half will cover scoring, prioritisation, preventive measures, monitoring and final decisions.

Step 4: Evaluate Likelihood and Severity

The next stage of a Supplier Risk Assessment is to judge how likely a risk is and how serious the harm could be. This makes the LkSG Supplier Risk Assessment easier to explain.

Likelihood asks: How likely is the risk to happen at this supplier or production site?

Severity asks: How serious could the harm be? Consider the scale of the harm, the number of people affected and whether the damage can be reversed.

A simple Supplier Risk Assessment Framework can use a score from 1 to 5. However, this is an internal method, not an official BAFA formula. BAFA gives companies room to design an appropriate process, but risks must be identified, weighted and prioritised.

A clear Supplier Risk Assessment should record the evidence behind each score. This supports LkSG Risk Analysis, LkSG Risk Assessment and Human Rights Due Diligence.

Step 5: Prioritise the Most Important Risks

A company may identify many risks, but it cannot treat every issue as equally urgent. The purpose of a Supplier Risk Assessment is to decide where action is needed first.

Consider:

• Likelihood and severity
• Number of people affected
• Whether the harm can be reversed
• The company’s link to the risk
• Ability to influence the supplier
• Quality of the evidence

A practical Supplier Risk Assessment may group suppliers as low, medium, high or critical risk. Low-risk suppliers may need normal monitoring. Medium-risk suppliers may need more documents. High-risk suppliers may require direct engagement and an action plan.

This approach strengthens Supply Chain Risk Management, Supplier Risk Management and Supply Chain Compliance.

Step 6: Choose Preventive or Remedial Measures

After the Supplier Risk Assessment, the company must decide what action is suitable.

Preventive measures are used when a risk has been found but a violation has not been confirmed. They may include supplier training, stronger contract terms, more checks or a time-bound improvement plan.

Remedial measures are needed when a violation has happened or is about to happen. They may include corrective action, an on-site review, management escalation or, in serious cases, ending the relationship.

The German Supply Chain Act does not mean every high-risk supplier must be removed at once. BAFA describes supply-chain cooperation as a continuing process based on dialogue and fair collaboration.

A strong LkSG Supplier Risk Assessment should support improvement where possible. These actions connect Supplier Due Diligence, Supply Chain Due Diligence and Supplier Compliance Management. They turn LkSG Compliance into practical procurement decisions.

Step 7: Document, Monitor and Reassess

A Supplier Risk Assessment is not a one-time task. Supplier conditions, production sites and risk information can change.

Document:

• Information reviewed
• Risk score and reason
• Selected action
• Responsible person
• Deadline
• Follow-up result

Repeat the Supplier Risk Assessment regularly and when important changes occur, such as a serious complaint, a new production country or credible information about a possible violation.

BAFA states that risk analysis is the basis of appropriate and effective risk management. Good records help teams understand why a decision was made.

Ongoing review improves Supplier Risk Management, Supplier Compliance Management and Supply Chain Risk Management. It also supports LkSG Risk Analysis and stronger Supply Chain Compliance.

Supplier Risk Assessment Checklist

Use this Supplier Risk Assessment Checklist before closing the review:

• Is the supplier’s location and production site known?
• Have country and industry risks been screened?
• Is supplier-specific evidence available?
• Have likelihood and severity been assessed?
• Is the score supported by clear reasons?
• Have the main risks been prioritised?
• Is an action owner assigned?
• Are deadlines and follow-up steps recorded?
• Is reassessment planned?

This Supplier Risk Assessment Checklist supports a consistent Supplier Risk Assessment Framework across procurement teams.

Practical Example

A German manufacturer buys metal parts from a direct supplier. Some work is done by a subcontractor in a country with higher workplace safety risks.

The Supplier Risk Assessment begins with country and industry screening. The team then asks for safety records, audit findings and subcontractor details. Some documents are missing, so the supplier receives a high score.

The company does not immediately end the contract. It starts deeper Supplier Due Diligence, agrees on corrective measures and sets a deadline. The case is tracked through Supplier Compliance Management.

This example shows how Human Rights Due Diligence, Supply Chain Due Diligence and LkSG Risk Assessment work together. The LkSG Supplier Risk Assessment moves the company from a warning sign to a documented decision.

Common Supplier Risk Assessment Mistakes

Avoid these mistakes:

1. Using the same check for every supplier
2. Relying only on a questionnaire
3. Treating country risk as proof of a violation
4. Ignoring subcontractors
5. Giving a score without recording the reason
6. Collecting data but taking no action
7. Reviewing suppliers only once

A good Supplier Risk Assessment is risk-based, practical and linked to procurement decisions. It supports LkSG Compliance, the German Supply Chain Act and long-term Supply Chain Compliance.

Career Skills for the German Job Market

Useful skills include supplier mapping, data review, risk scoring, corrective-action tracking and supplier communication.

Knowledge of Supplier Risk Assessment, LkSG Risk Analysis, Human Rights Due Diligence and Supply Chain Risk Management can support roles in procurement, vendor management, ESG and compliance.

The Procurement & Vendor Management (LkSG) course covers risk-based sourcing, supplier monitoring, due diligence and documentation for professionals and job seekers in Germany.

Final Thoughts

An effective Supplier Risk Assessment should follow a clear and practical process. Companies need to map their suppliers, identify country and industry risks, collect reliable evidence, score each finding, prioritise the most serious issues and monitor progress over time. This helps procurement teams focus their effort where it matters most instead of treating every supplier in the same way.

A reliable LkSG Supplier Risk Assessment should also be proportionate, well documented and linked to real procurement decisions. A clear Supplier Risk Assessment Framework supports consistent reviews, better Supplier Risk Management and more effective Supplier Due Diligence. It also helps companies improve Supply Chain Compliance by assigning responsibilities, setting deadlines and tracking corrective actions.

When this process is used properly, it strengthens LkSG Compliance under the German Supply Chain Act. It also supports responsible supplier relationships, better transparency and stronger Supply Chain Risk Management. For professionals in Germany, these skills are increasingly valuable in procurement, vendor management, ESG and compliance roles.