(1) As part of risk management, the company shall conduct an appropriate risk analysis in accordance with paragraphs 2 to 4 to identify the human rights and environmental risks in its own business operations and those of its direct suppliers. In cases where an enterprise has engaged in an abusive arrangement of the immediate supplier relationship or a circumvention transaction to circumvent the due diligence requirements with respect to the immediate supplier, an indirect supplier shall be deemed to be an immediate supplier.

(2) The identified human rights and environmental risks shall be appropriately weighted and prioritized. In particular, the criteria set out in Section 3 (2) shall be decisive in this respect.

(3) The company must ensure that the results of the risk analysis are communicated internally to the relevant decision-makers, e.g. the management board or the purchasing department.

management board or the purchasing department.

(4) The risk analysis shall be carried out once a year and on an ad hoc basis if the company is confronted with a significantly changed or significantly increased risk situation in the supply chain.

or significantly increased risk situation in the supply chain, e.g. due to the introduction of new products, projects or a new business field. Findings from the processing of notices pursuant to § 8 (1) shall be taken into account