LkSG duties: implementing due diligence in procurement
What section 3 of the German Supply Chain Act requires, which part of it arises in procurement and which system carries which duty.
The act describes the due diligence duties briefly. The work lies in implementation: who collects self-disclosures, where is the risk analysis kept, how does a rating affect a purchase order? This page sorts the duties from the procurement perspective and shows what Ovenca contributes and what it does not.
- Duties under section 3 LkSG
- Procurement perspective
- Status October 2026
- Audit trail
Which due diligence duties the LkSG lists
Section 3 LkSG lists the due diligence duties: establishing risk management, designating internal responsibility, carrying out regular risk analyses, issuing a policy statement, anchoring preventive measures in the company's own business area and towards direct suppliers, taking remedial action, setting up a complaints procedure, implementing due diligence with regard to indirect suppliers, and documenting and reporting. Under the government bill amending the LkSG the reporting duty is to be dropped; BAFA has not reviewed reports since 2025. This page is not legal advice.
Four areas of duty and what procurement contributes
For each area: what the law requires, what has to be done in procurement and where Ovenca supports it.
Risk management and risk analysis
Under section 5 the risk analysis has to be carried out once a year and on an ad hoc basis, for the company's own business area and its direct suppliers. The results have to be weighted, prioritised and communicated internally to the decision-makers.
- Procurement supplies suppliers, commodity groups and order volumes
- Ovenca provides order statistics and catalog data as an export
- The assessment itself is done in a specialised tool or with the template
- Ovenca contains no country or sector indices
Preventive and remedial measures
Prevention also concerns procurement strategy and purchasing practices. If a violation is identified, remedial action has to be taken.
- Ordering from the catalogs of approved suppliers
- Multi-level approvals by role and value
- A supplier's catalogs and items can be blocked
- Action plans, training and audits are managed outside Ovenca
Complaints procedure
Section 8 requires a complaints procedure with publicly accessible rules of procedure that protects the confidentiality of identity. Its effectiveness has to be reviewed at least once a year and on an ad hoc basis.
- Ovenca is not a whistleblowing system
- A separate solution or an external service is required
- Procurement helps to clarify reports concerning suppliers
- Order history and logs from Ovenca serve as evidence
Documentation
Under section 10(1), fulfilment of the due diligence duties has to be documented continuously and the documentation kept for at least seven years.
- Log with user, action and timestamp
- Catalog changes with old and new value
- Export as CSV or JSON
- Retention period configurable; the default is at least two years
What works in practice
Due diligence rarely fails because the law is misunderstood. It fails on responsibilities, duplicate data maintenance and rules that never reach the ordering process.
- Clarify responsibilities
- Compliance owns method and assessment, procurement owns the supplier relationship and the data. Decide who requests self-disclosures and who reviews them.
- One supplier master
- In most landscapes the ERP holds the supplier master. Portal and compliance tool should refer to it rather than keep lists of their own.
- Rules in the ordering process
- A rating only has an effect when it influences the purchase order. Approved catalogs and approvals are the simplest lever for that.
- Keep evidence current
- Certificates expire and self-disclosures go out of date. In the Vendor Portal suppliers submit updates themselves; procurement reviews and approves.
- Start step by step
- Ovenca can be started with one module and extended later, for example with the Vendor Portal for the most important suppliers first.
- Know the limits
- Risk scoring, the complaints procedure and action tracking are not part of Ovenca. Plan a compliance tool or a clearly defined manual process for them.
Questions and answers on the LkSG duties
Related pages
Assign duties to the right systems
Show us your supplier structure and your system landscape. We outline which tasks Ovenca takes on in procurement and where a compliance tool remains necessary.