(1) Companies must establish an appropriate and effective risk management system to ensure compliance with the due diligence requirements (Section 3 (1)). Risk management shall be embedded in all relevant business processes through appropriate measures.

(2) Effective measures are those which enable the identification and minimization of human rights and environmental risks and the prevention, cessation or minimization of the extent of violations of human rights or environmental obligations where the enterprise has caused or contributed to such risks or violations within the supply chain.

(3) The company shall ensure that it is determined who within the company is responsible for overseeing risk management, such as through the appointment of a human rights officer. The management shall obtain information on the work of the responsible person or persons on a regular basis, at least once a year.

(4) In establishing and implementing its risk management system, the company shall give due consideration to the interests of its employees, employees within its supply chains, and those who may otherwise be directly affected in a protected legal position by the economic actions of the company or by the economic actions of a company in its supply chains