How Risk Prioritization Can Streamline Your Supply Chain Due Diligence

Manufacturers face growing expectations to understand the environmental, human rights, and trade-related risks associated with their supply chains. Regulations such as the EU Corporate Sustainability Due Diligence Directive (CSDDD), the EU Batteries Regulation, and the EU Conflict Minerals Regulation place specific due diligence expectations on companies and the supply chains in their scope. At the same time, product compliance requirements such as REACH and RoHS require manufacturers to maintain reliable information about the substances and materials used in their products.

Meeting these obligations requires more than collecting supplier declarations or maintaining a list of applicable regulations. Companies need enough visibility into their supply chains to identify where potential risks exist, determine what information is missing, and decide where additional investigations are warranted.

For a large electronics manufacturer, this can be a substantial undertaking. A company may work with thousands of suppliers and manage tens of thousands of individual parts across multiple product lines. Investigating every supplier, component, and upstream relationship with the same level of scrutiny is neither practical nor necessarily effective. A missing material declaration, a component that may contain a restricted substance, and a supplier sourcing minerals from a high-risk region represent different types of exposure and require different investigative approaches.

This is where risk prioritization can streamline supply chain due diligence. By evaluating the severity and likelihood of potential adverse impacts—while also considering relevant supplier, material, product, and regulatory exposures—companies can direct their investigative resources toward the areas that warrant the greatest attention. The objective is not to narrow the scope of supply chain visibility, but rather to make better decisions about where deeper assessment, stronger evidence, and more frequent oversight are needed.

What Is Supply Chain Due Diligence?

Supply chain due diligence is the ongoing process of identifying, assessing, and mitigating actual and potential adverse impacts associated with a company's operations, suppliers, and other business relationships. Depending on the applicable framework, these impacts may involve human rights, labor practices, environmental conditions, and other areas of responsible business conduct.

The OECD Guidelines for Multinational Enterprises on Responsible Business Conduct provide a widely recognized framework for this process. The OECD Due Diligence Guidance describes six interconnected steps:

1. Embed responsible business conduct into company policies and management systems.

2. Identify and assess actual and potential adverse impacts.

3. Cease, prevent, or mitigate adverse impacts.

4. Track implementation and results.

5. Communicate how impacts are addressed.

6. Carry out remediation when appropriate.

These steps are intended to operate as an ongoing cycle, rather than a one-time assessment. Companies should continuously evaluate their business relationships, respond to new information, and adjust their approach as risks change. An important principle underlying the OECD framework is that due diligence should be proportionate to the risks involved. Companies are not expected to investigate every business relationship identically. Instead, they should direct attention toward those that pose the highest potential risks and adverse impacts, and take appropriate measures to address them.

It’s also important to recognize that supply chain due diligence and product compliance are related but distinct activities. A company may need to assess adverse environmental impacts associated with a raw material supply chain while separately determining whether a finished component meets a substance restriction under REACH or RoHS. Both activities depend on reliable supply chain information, but they do not necessarily follow the same assessment methodology.

Why Supply Chain Due Diligence Breaks Down Without Prioritization

For large manufacturers, the volume of information involved in supply chain due diligence can quickly become difficult to manage. A single original equipment manufacturer (OEM) may purchase components from thousands of suppliers, many of which rely on additional subcontractors, material processors, and raw material producers. Each relationship can introduce different environmental, geographical, and regulatory considerations. Without a structured prioritization process, companies often fall into one of two approaches: attempting to investigate everything equally, or concentrating their efforts on the suppliers that are the easiest to reach. Neither of these approaches, however, necessarily identifies the most significant risks.

Supplier questionnaires can also create diminishing returns. Sending identical surveys to every supplier may generate substantial amounts of information without necessarily improving risk visibility. Suppliers with little exposure to a particular issue receive the same requests as suppliers operating in higher-risk industries or regions. And over time, repeated requests can contribute to survey fatigue, lower response rates, and less useful information.

Uniform checklists can overlook differences between suppliers and products. A supplier manufacturing a relatively low-risk mechanical component may have very different exposure from one supplying battery materials or components containing substances subject to regulatory restrictions. Treating both relationships identically can result in unnecessary investigation in some areas and insufficient scrutiny in others.

Limited resources may also become spread across too many activities. Compliance teams have finite time to review documentation, investigate supplier responses, validate material disclosures, and follow up on potential concerns. If resources are distributed evenly, teams may spend considerable time resolving minor documentation gaps while more significant risks remain uninvestigated.

Risk prioritization addresses these limitations by creating a systematic way to determine where additional due diligence is most valuable. It allows companies to maintain broad supply chain visibility while concentrating their most intensive assessment and analysis activities on the suppliers, materials, and products that warrant closer attention.

What Is Risk-Based Prioritization?

Risk-based due diligence is an approach that adjusts the depth and urgency of risk analysis according to the nature and significance of the threats. Rather than applying the same level of scrutiny to every supplier, companies evaluate potential adverse impacts and determine which require attention first. For adverse impacts under the OECD framework, two central considerations are severity and likelihood.

Severity measures how serious an adverse impact would be if it occurred. Under OECD guidance, severity is evaluated using three characteristics:

• Scale: How serious or significant is the impact? For example, does it involve a limited environmental concern or a substantial violation of fundamental human rights?

• Scope: How widespread is the impact? Consider the number of people, workers, communities, or environmental areas that could be affected.

• Irremediable Character: How difficult would it be to restore those affected to their original condition? Some impacts, such as permanent damage to human health or irreversible environmental destruction, cannot be fully corrected.

These characteristics should not simply be averaged. An impact may be considered severe because of one particularly significant characteristic, even if the other two are less pronounced.

The second top consideration is likelihood, which considers how probable the adverse impact is based on all available information. Relevant considerations may include the supplier's operating location, industry, sourcing practices, known incidents, and the presence or absence of relevant controls.

Together, severity and likelihood help companies determine which adverse impacts should receive attention first. However, not every type of supply chain exposure should be assessed using this same methodology. Product compliance requirements, for example, may establish specific substance limits or restrictions that must be met regardless of a supplier's overall risk classification. A component either meets the applicable restriction based on sufficient evidence or it doesn’t. A supplier risk score cannot replace that determination.

Similarly, operational risks such as single-source dependencies and component criticality can influence business continuity decisions, but they’re not interchangeable with the severity of human rights or environmental impacts. A useful risk prioritization program can consider all these factors while keeping the assessment criteria distinct. This allows companies to prioritize investigative effort without treating every type of risk as though it were measured the same way.

The Risk Factors to Prioritize in Your Supply Chain

An effective supplier risk assessment should consider multiple indicators. For manufacturers, evaluating both their suppliers and the products or components they source can reveal exposures that would otherwise remain hidden.

Geographic Risk

The location where a supplier operates or sources materials can significantly influence its exposure to human rights violations, environmental risks, and trade compliance gaps. Certain regions have documented concerns involving forced labor, weak labor protections, environmental degradation, or conflict-related activities. Xinjiang, for example, is a significant geographical consideration for companies evaluating potential exposure under the U.S. Uyghur Forced Labor Prevention Act (UFLPA). Other conflict-affected and high-risk areas may require additional scrutiny when sourcing minerals and raw materials.

Geographical considerations also appear in environmental due diligence requirements. Under the EUDR, the country or region where a covered commodity is produced is one of the most decisive factors used to assess the risk of deforestation. Under the EU Batteries Regulation, the location of raw material extraction and processing can be relevant to identifying potential social and environmental impacts. Geographic risk should not be treated as an automatic determination that a supplier or product is noncompliant. Rather, it is an indicator that additional information may be necessary to understand the actual sourcing relationship and potential exposure.

Material and Commodity Risk

Certain raw materials and commodities carry greater inherent exposure to environmental or human rights concerns, whether due to the nature of their extraction, processing technologies, or manufacturing conditions.

Examples relevant to electronics manufacturers include:

• Tin, Tantalum, Tungsten, and Gold (3TG): These minerals are subject to responsible sourcing due diligence requirements under the EU Conflict Minerals Regulation, and are commonly assessed through industry reporting tools such as the Conflict Minerals Reporting Template (CMRT).

• Battery Materials: Cobalt, natural graphite, lithium, and nickel can involve environmental and social risks during extraction and processing. These materials are specifically relevant to due diligence under the EU Batteries Regulation.

• Chemicals and Substances: Substances subject to REACH restrictions, RoHS requirements, or other environmental product regulations create a different type of exposure. Manufacturers need sufficient material information to determine whether components and products meet applicable substance requirements.

Material risk is particularly important because a supplier may purchase a finished component without having direct visibility into the origin of its raw materials or the full composition of the product. Evaluating only the immediate supplier can therefore overlook potential risks further upstream.

Supplier and Entity Risk

The identity, ownership, operating history, and business relationships of a supplier can provide additional indicators of exposure. Companies should consider whether suppliers or relevant upstream entities appear on government lists that may affect their sourcing or market access. The UFLPA Entity List, for example, identifies entities associated with forced labor concerns and can be a significant screening consideration for companies importing goods into the United States. Ownership relationships also matter. A supplier may operate under a different business name from an entity that controls it or has significant ownership influence. Without parent-company and ownership visibility, screening based only on the immediate supplier’s name may not identify relevant relationships.

These indicators should be interpreted according to the purpose and scope of each list. A restricted-party or national security list is not necessarily a human rights or environmental risk list. Companies should understand what a particular designation means before incorporating it into a supplier risk assessment.

Part and Product Risk

Supplier-level assessments provide an important starting point, but they don’t always identify where risks enter a manufacturer's actual products.

A supplier may provide hundreds of different components, each with different material compositions, manufacturing locations, and upstream sourcing relationships. Some parts may contain higher-risk materials, while others may have limited exposure to the issues being investigated.

Product-level considerations can include:

• Material composition and the presence of regulated or high-risk substances.

• Known manufacturing locations and upstream material sources.

• Whether the component contains minerals or commodities associated with elevated human rights or environmental risks.

• The availability and quality of material declarations, certificates, and other supporting documentation.

• Component criticality, including single-source dependencies and limited alternatives.

• Product lifecycle status and the potential impact of supplier changes or material substitutions.

It’s important to distinguish product criticality from adverse-impact severity. A single-source semiconductor may represent substantial operational risk because of its importance to the bill of materials (BOM), but that doesn’t automatically make it a high-level environmental risk. Both assessments are useful, provided they remain distinguishable from one another.

Regulatory Change Risk

A supplier or component that presents limited exposure today may become more relevant as regulations change. Manufacturers should monitor developments affecting their products and materials, including new substance restrictions, changes to the REACH Candidate List or Annex XVII requirements, RoHS exemptions, PFAS requirements, and evolving battery obligations. Regulatory change risk is particularly important for electronics, as a single material or component may be subject to several regulatory frameworks across different markets.

A useful prioritization model should therefore consider not only existing noncompliance but also the potential for upcoming restrictions to affect product availability, supplier declarations, or future compliance obligations. This type of monitoring helps companies identify where updated supplier information may be needed.

How to Build a Risk Prioritization Model for Supply Chain Due Diligence

A practical risk prioritization model doesn’t need to be unnecessarily complicated. The objective is to establish a repeatable methodology that helps companies identify significant exposures, determine the appropriate level of investigation, and document why certain risks receive more attention than others.

1. Map Suppliers and Parts Beyond Tier 1

Begin by establishing visibility into direct suppliers, their products, and the upstream relationships relevant to the risks being assessed.

Tier 1 suppliers are often the easiest relationships to identify, because they’re the companies selling and delivering components directly to the manufacturer. However, the materials and processes involved in manufacturing those components may originate much further upstream. For example, an electronics manufacturer purchasing a circuit board may have a direct relationship with the board manufacturer but limited visibility into the sources of the copper, gold, solder, or other materials used in the production of that board. Similarly, a company incorporating batteries into its products may need information about the sourcing and processing of relevant raw materials for those batteries, which could originate at the second, third, or even fourth tier.

A meaningful supply chain due diligence process should connect supplier information to the relevant materials, components, and upstream sources whenever that information is necessary to understanding potential adverse impacts. This doesn’t mean that every company must achieve complete visibility into every tier right away. Rather, it means identifying where additional traceability is needed based on the risks and impacts under consideration.

2. Segment Suppliers and Parts by Inherent Risk

Once you’ve mapped your supply chain, establish initial risk categories using available information. Inherent risk refers to the potential exposure associated with a supplier, material, product, industry, or geographical location before considering the effectiveness of specific controls.

For example, a supplier sourcing battery materials from a region associated with significant environmental or labor concerns may warrant a higher initial risk classification than a supplier providing a well-documented, lower-risk component. A component with incomplete material composition information may also warrant additional review if it could contain substances subject to product restrictions.

Useful segmentation criteria include geographic exposure, material composition, known incidents, and relevant regulatory requirements. At this stage, the objective is to identify where more detailed assessments are necessary, not to make a final compliance determination.

3. Assess Severity, Likelihood, and Information Gaps

For adverse impacts, evaluate severity and likelihood using the principles established in the applicable due diligence framework. A simple scoring model can help standardize this process. For example, companies may assign scores from 1 to 5 for each of the following categories:

An illustrative model may multiply the two scores, creating a simple equation:

• Risk score = Severity × Likelihood

Consider two hypothetical suppliers:

Supplier A receives a higher priority because the potential impact is more severe and the likelihood of the risk coming to pass is greater. Supplier B may still require monitoring, but the available information doesn’t indicate the same urgency for additional investigation. This type of model provides a consistent way to organize information, but it should not be mistaken for a regulatory formula, either. The OECD doesn’t prescribe a universal numerical scoring system, and simple multiplication can obscure important differences between impacts. For example, a very severe human rights or environmental impact should not automatically receive a low priority simply because its likelihood score is relatively low. Companies should establish escalation rules for uniquely severe impacts and document the reasoning behind their assessments.

It’s also important to distinguish between a lack of evidence and evidence of low risk. An incomplete supplier response should not automatically result in a low score. Where information is insufficient, the appropriate response may be additional investigation or an uncertainty classification.

For product compliance, companies may need a separate verification assessment. A component with incomplete material data, for example, may warrant additional supplier documentation or technical review. That information gap should not be converted into an OECD severity score unless the assessment is actually evaluating an adverse impact under that framework.

4. Match Due Diligence Depth to Each Risk Tier

Once suppliers and products have been evaluated, companies can establish different response requirements for each risk category. A lower-risk supplier may require routine documentation reviews and periodic monitoring. A medium-risk supplier may warrant additional questionnaires, material disclosures, or verification of upstream sourcing. A high-risk supplier may require enhanced traceability, independent assessments, or a documented corrective action process. The response should be appropriate to the identified exposure.

A supplier with a potential forced labor concern, for example, may require a different investigative approach from a supplier with incomplete environmental substance declarations. Both may need additional information, but the evidence required and the potential corrective actions will differ.

For product compliance, additional investigations might involve obtaining a full material declaration (FMD), reviewing a REACH or RoHS declaration, requesting substance-specific information, or conducting testing when the available evidence is insufficient. For responsible sourcing, it may involve identifying upstream processors, obtaining relevant mineral reporting, or investigating the origin of raw materials.

5. Continuously Reassess

Risk assessments should not remain static after their initial completion. Supplier ownership changes, new sourcing locations, regulatory amendments, enforcement actions, and newly identified adverse impacts can all affect an existing risk classification. For example, a supplier that previously presented limited trade compliance exposure may require reassessment if a relevant upstream entity is added to a sanctions list. Similarly, a change in component composition or manufacturing location may introduce new environmental or human rights considerations.

Companies should establish periodic review schedules and event-based monitoring processes that trigger reassessment when relevant information changes. This helps ensure that due diligence reflects current supply chain conditions, rather than relying exclusively on historical assessments.

Tiered Due Diligence Responses: What High, Medium, and Low Risks Require

Risk prioritization is useful when it leads to clearly defined actions. Without a connection between risk assessments and concrete follow-up procedures, scoring can become an administrative exercise rather than a meaningful part of the due diligence process.

The following is an illustrative approach manufacturers can adapt to their own supply chain requirements.

These categories should not be interpreted as fixed regulatory requirements. Rather, the specific actions depend on the type of risk, applicable regulations, and available evidence, among other determinative factors. For example, CMRT and EMRT reporting may be appropriate when evaluating conflict mineral sourcing, but those templates are not substitutes for every type of due diligence. Similarly, an audit may provide useful information about facility conditions but may not establish the origin of every material used in a finished electronic component.

For product compliance, evidence may include full material declarations, REACH or RoHS declarations, substance-specific disclosures, and test reports. And while these documents help establish whether applicable product requirements are met, they don’t replace the broader assessment of adverse impacts required under a due diligence framework.

Companies should also recognize that identifying a high-risk supplier does not automatically mean the relationship must be terminated. Depending on the circumstances, appropriate action may involve increasing supplier engagement, developing corrective action plans, or using leverage to address the underlying issue. The objective is to address the adverse impact, not simply remove the supplier from the company's supply chain.

How Z2 Helps Prioritize Supply Chain Due Diligence

For manufacturers with complex product formulations, one of the greatest challenges in supply chain due diligence is connecting supplier information to the individual components and materials used in finished products.

Supplier-level assessments provide valuable insight, but they don’t always identify which parts introduce the greatest exposure. A supplier may provide hundreds of components across multiple product lines, and the risk associated with each part may differ depending on its composition, sourcing, and regulatory relevance. Supply chain risk management (SCRM) platform Z2 helps manufacturers connect supplier and part-level information through its BOM-level risk assessments and compliance capabilities.

BOM Risk Grades help organizations identify and evaluate potential risk exposure across their product structures. By identifying risks at the BOM level, manufacturers can better understand which components may require additional attention, rather than relying exclusively on supplier-level classifications. This is just one of Z2’s range of capabilities, and the software also identifies and assesses risk through the lens of suppliers, regulations, parts, and supply chain disruptions.

To learn more about Z2 and all the ways it can help businesses prioritize their risks and bolster their supply chain due diligence, schedule a free trial with one of our product experts.