Risk analysis, identification and management
Starting in 2025, large companies will be required to do the following:
- Set up a risk management system
- Introduce an internal responsibility strategy and system
- Conduct regular risk analysis
- Determine preventive and corrective measures to manage identified risks during sustainability-related due diligence
The risk analysis aims to identify and minimize ESG risks within the company's operations and supply chain. A properly conducted risk analysis should categorize risks associated with environmental and social responsibility as well as corporate governance, as follows.
- Environmental risk (E): Risks associated with negative environmental changes due to damage caused by environment use, exposure or pollution, or changes in the climate, natural events or factors (e.g., pollution, environmental damage from operations).
- Social risk (S): Risks arising from a lack of respect for fundamental rights, lack of family support, unfair working conditions or social inequalities (e.g., discrimination, unjustified and significant pay gaps between male and female workers).
- Corporate governance risk (G): Risks associated with inadequate corporate behavior or governance activities, measures or regulations (e.g., corruption, noncompliance with laws).
Risk identification involves measures to identify actual and adverse effects arising from the company's activities, its subsidiaries and direct suppliers. Companies must map their activities and those of their subsidiaries and direct suppliers to identify areas where adverse effects are most likely and serious.
A risk analysis system should include 1) an annual risk analysis process carried out by 30 June each year and 2) an ad hoc risk analysis process. The ad hoc risk analysis should be carried out without delay if there is a risk of noncompliance with social or environmental responsibilities in relation to the enterprise's operations, or direct or indirect suppliers.
Identified adverse effects need to be analyzed and prioritized based on their severity and likelihood. Companies should address the most serious and likely-to-occur adverse effects first before those that are less serious and less likely to occur.
Proper risk management is ultimately the management's responsibility under the ESG Act. If a company identifies ESG risks related to its operations or direct suppliers, management must take appropriate measures to eliminate or minimize adverse effects. This may include developing a concept with the direct supplier to minimize the risks and take appropriate corrective measures. If corrective measures are inadequate and the company cannot influence its direct supplier, the company must suspend business relations with the supplier for three months.
Prequalification based on questionnaires
The use of questionnaires will be a mandatory tool for supplier due diligence. The questionnaires must be sent to direct suppliers with the mandatory content set out in the SZTFH decree and thus require information such as a direct supplier's energy use, greenhouse gas emissions or raw material use.
Given that identifying a potential risk can have significant consequences for the business relationship with direct suppliers, it is recommended that the sustainability staff monitor incoming inquiries or notifications on a regular basis, considering particularly the fact that a company may be both the sender and the recipient of a questionnaire, depending on its position in the supply chain.
Based on the responses in the questionnaires, the company that conducts the due diligence may decide to implement a pre-qualification system, which in the case of an extensive supplier network can help determine which direct suppliers need to be subject to a detailed risk analysis depending on the ESG risk level.
ESG report
The company is required to prepare an ESG report on the fulfillment of its sustainability due diligence obligations in the previous year. Large companies are required to prepare and upload their first ESG report — for their activities in the financial year 2025 — in 2026, with the exception that the first ESG report for large companies will not be published, to allow sufficient time for such companies to prepare for the application of the legislation.
The rules of the SZTFH decree also cover the formal requirements and minimum requirements for the ESG report, so we advise our clients to review Annex 3 of the decree when preparing and finalizing their ESG report.
Contact us
The establishment of an internal risk management system or the due diligence of a supply chain raises several compliance related questions in which our experts are happy to assist your company. Should you have any questions regarding either the sustainability related due diligence obligations or the preparation and the publication of an ESG report, please contact one of our experts in order to identify and manage risks.
