How often does the risk analysis have to be carried out?

Under section 5(4) LkSG once a year and on an ad hoc basis, if the company must expect a significantly changed or significantly expanded risk situation in the supply chain.

Which suppliers have to be included?

The risk analysis under section 5 covers the company's own business area and its direct suppliers. For indirect suppliers, section 9(3) requires a risk analysis when actual indications suggest that a violation is possible.

Does Ovenca carry out the risk analysis?

No. Ovenca has no scoring logic with country or sector indices and does not rate suppliers automatically. The platform provides order statistics and catalog data as an export, and suppliers submit self-disclosures and certificates in the Vendor Portal. The assessment takes place in a compliance tool or with the template.

What does the template contain?

The template describes abstract and concrete risk analysis, a scoring matrix for country, sector, commodity group and purchasing volume, examples and the derivation of measures. It is in German, dated October 2026, and includes an overview of the legal status. Because the legal framework is changing, re-check the references, in particular on the reporting duty, before use.

How long do the results have to be kept?

Documentation on fulfilment of the due diligence duties has to be kept for at least seven years under section 10(1) LkSG. That includes the records of the risk analysis.

LkSG risk analysis: method, prioritisation and template

How procurement sets up a risk analysis, which data it needs and where software helps. With a template to download.

Section 5 LkSG requires an appropriate risk analysis, once a year and on an ad hoc basis. It covers the company's own business area and its direct suppliers. Ovenca contains no risk scoring, but it supplies the procurement data the analysis builds on.

To supply chain act software

Free template
Scoring matrix
Procurement perspective
Status October 2026

A good risk analysis prioritises

The most common mistake at the start is trying to assess every supplier in the same depth. The law requires an appropriate analysis: risks have to be weighted and prioritised, among other things by the severity and reversibility of a possible violation and by the company's own ability to influence. In practice the analysis therefore begins with a rough classification by country, sector and commodity group and goes deeper only where risks become apparent. This page is not legal advice.

Download the LkSG risk analysis template

The template walks through abstract and concrete risk analysis, a scoring matrix for country, sector and commodity group, and the derivation of measures. It is a working aid for getting started and does not replace legal advice. The template is in German and dated October 2026. Because the legal framework is changing, check its legal references against the current state of the law before use.

Pages: 7
Size: PDF, 235 KB

Download template (PDF, German)

Four steps of the risk analysis in procurement

The procedure follows our template. Each step states which data Ovenca contributes.

1. Compile the data basis
No analysis without a complete supplier list. You need master data, locations, commodity groups purchased and purchasing volume.
- Supplier master from the ERP
- Order statistics from Ovenca as an export
- Commodity groups from the catalog data
- Record one-time vendors separately
2. Abstract risk analysis
Classification of all suppliers by country, sector, commodity group and purchasing volume using a scoring matrix.
- Country and sector risk from recognised indices
- Scoring per dimension on a fixed scale
- Thresholds for low, medium, high
- Takes place outside Ovenca
3. Concrete risk analysis
A closer look at suppliers with elevated risk: self-disclosures, certificates, audit reports, information from the complaints procedure.
- Self-disclosures and certificates via the Vendor Portal
- Review and approval by procurement
- Changes versioned, with timestamp
- Assessment of the answers by compliance
4. Prioritise and derive measures
Weight the results, communicate them to the decision-makers and turn them into preventive or remedial measures.
- Document decision and reasoning
- Define the operational consequences in procurement
- Catalogs and items can be blocked in Ovenca
- Action tracking in a separate tool

What matters in a procurement risk analysis

Six points that determine the quality of the analysis, whichever tool you work with.

Same method over the years: The analysis is repeated annually. Results are only comparable if scale and criteria stay stable.
Prioritise instead of checking everything: Concentrate effort where country, sector and commodity group point to risks.
Define triggers: New suppliers, new sourcing countries or information from the complaints procedure should prompt a fresh look. Decide who initiates it.
Use procurement data: Order volumes and commodity groups are already available in the procurement system. Ovenca provides them as reports and exports.
Record the reasoning: A rating without reasoning is of little help in an audit. Document source, date and decision.
Start with the template: A structured template is enough to begin with. Whether a specialised tool is needed later depends on the number of suppliers and their risk situation.

Questions and answers on the LkSG risk analysis

Build the risk analysis on procurement data

We show which data Ovenca provides for your risk analysis and how self-disclosures and evidence are collected through the Vendor Portal.