Step 1: Mapping the supply chain The first step in a risk analysis consists of mapping the supply chain to find out its structure. This includes identifying in which countries the work is carried out, and if possible also in which regions. This is particularly relevant if the work is carried out in any region known to have high risks. Within certain industries such as food, textiles and IT there is a lot of information. For other industries such as pharmaceuticals, however, transparency is low. To obtain this information, you can ask the category manager, the category councils, ask questions of suppliers, find out import data, read audit reports and market analyzes for specific industries. It is also important to identify what type of work is carried out and what type of actors in the supply chain that performs it. Is it, for example, an industry characterized by low wages and health-hazardous processes? Does the workforce consist of migrant workers or seasonal workers? Is the supply chain complex with many subcontractors and a lack of transparency? This type of information is important as both geographical risks, industry risks and product risks need to be taken into account. Step 2: Gather information from credible and independent sources Once you have mapped the origin and the supply chain, the next step is to gather information about the situation of human rights, workers' rights, the environment and business ethics in the relevant countries where the work is carried out, that is, both for final manufacturing, component manufacturing and raw materials. For this you need to turn to credible and independent sources such as international organizations, authorities, voluntary and civil society organizations and global trade unions. Sources Step 3: Identify and assess negative impacts The last step involves assessing the actual and potential negative impact the supply chain is associated with, based on the information that has been compiled in steps 1 and 2. This is to be able to determine which concrete measures need to be taken to manage the risks. Often several risks have been identified and to prioritize them you need to make a seriousness assessment. The most significant risks are prioritized based on probability and seriousness ( read more under point d in process requirement 2 )