(1) If a company identifies a risk in the course of a risk analysis in accordance with Section 5, it must immediately take appropriate preventive measures in accordance with Paragraphs 2 to 4.

(2) The company shall issue a policy statement on its human rights strategy. The management of the enterprise shall

issue the policy statement. The policy statement shall contain at least the following elements of a human rights strategy of the enterprise:

1. a description of the procedure by which the company fulfills its obligations pursuant to Section 4 Paragraph 1, Section 5 Paragraph 1, Section 6 Paragraphs 3 to 5, and Sections 7 to 10

fulfilled,

2. the priority human rights and environmental risks identified for the company on the basis of the risk analysis, and

3. the definition, on the basis of the risk analysis, of the human rights-related and environmental expectations that the company has of its

its employees and suppliers in the supply chain.

(3) The company must embed appropriate prevention measures in its own business operations, in particular:

1. implementing the human rights strategy outlined in the Policy Statement in relevant business operations,

2. the development and implementation of appropriate sourcing strategies and practices that prevent or minimize identified risks.

mized,

3. the implementation of training in the relevant business areas,

4. the implementation of risk-based control measures to verify compliance with the human rights strategy contained in the Declaration of Principles in its own business area.

own business area.

(4) The company must anchor appropriate preventive measures with respect to a direct supplier, in particular:

1. the consideration of human rights and environmental expectations in the selection of a direct supplier,

2. contractually assuring an immediate supplier that it will comply with the human rights-related and environmental expectations required by the company's management and adequately address them along the supply chain,

3. the provision of training and education to enforce the direct supplier's contractual assurances under

Number 2,

4. agreeing on appropriate contractual monitoring mechanisms, and implementing them on a risk-based basis, to verify the immediate supplier's compliance with the human rights strategy.

(5) The effectiveness of the preventive measures shall be reviewed once a year and on an ad hoc basis if the company must expect a significantly changed or significantly expanded risk situation in its own business area or at the direct supplier, for example due to the introduction of new products, projects or a new business area. Findings from the processing of notices pursuant to § 8 (1) shall be taken into account. The measures shall be updated without delay as required