Risk Assessment — Value Chain

Direct operations plus upstream and downstream. Suppliers and subcontractors are scored on their own locations rather than on a questionnaire, EUDR materials are traced to the plot, and the requirements your customers push down the chain are carried into the same plan.

In scope

The three stages, in the words CDP and the ESRS use

Rating agencies and regulators no longer accept an assessment that stops at the factory gate. Every risk we score carries the value chain stage where it happens.

Direct operations — everything in the Direct Operations scope, unchanged
Upstream — suppliers and subcontractors scored on their own sites, weighted by criticality, annual spend and single-sourcing
Upstream — EUDR materials traced: plot geolocation, legality, due diligence statements, deforestation risk by country of origin
Downstream — products and customers exposed to transition risk and to buyer requirements, including the supplier programmes of large accounts
Downstream — transport, distribution and end of life where they carry the exposure
Supplier actions costed and scheduled like your own: questionnaires, dual sourcing, contract clauses, adaptation co-investment at the single-source supplier

How it runs

Four steps, and a consultant at the end of each one

Direct operations first
The site assessment runs exactly as in the Direct Operations scope. It is the baseline the rest is measured against.
Supplier and product mapping
Two more structured forms: subcontractors and suppliers, then materials and products. Addresses are geocoded, HS codes and volumes attached, countries of origin resolved.
Upstream and downstream scoring
Each supplier location is scored on the same eight categories. Criticality, spend and single-sourcing set the weight it carries in your own exposure.
One consolidated plan
Site actions and supplier actions land in the same action plan, with the same budgets, owners and dates — not in a separate procurement annex nobody reads.

Continuity case

A continuity break that starts at your supplier

The same discipline applied upstream, where most continuity breaks actually start — at a supplier you did not score because a questionnaire told you it was fine.

Gamma — Orléans, single-source supplier (demo data)Supplier scored on its own location · critical input · single-sourced · strategic weight carried into your own exposure

The break does not start at your gate. A single-sourced supplier loses its own water allocation or its own site to a flood; its output stops, and two weeks later your line stops with it. A questionnaire would have told you the supplier has a policy. Scoring its actual location tells you the hazard it sits in, and the weighting tells you how much of your exposure travels through it.

Item	Value	Where it comes from
Supplier score	Computed on the supplier’s own sites, eight categories	Same engine, same datasets — not a declaration
Weight in your exposure	Criticality × annual spend × single-source flag	Declared by you, applied to the supplier’s score
Propagated downtime	Supplier stoppage carried into your own business interruption	Same downtime scale, applied upstream
Contractual exposure	Penalties, de-listing, cost of emergency re-sourcing	Costed in the action plan, with FOU-02 and FOU-04
Insurance	Contingent business interruption — only covered if the supplier is named	The supplier list with its locations and scores, which is what the policy needs
ESRS	2 SBM-3 · E1-9 · S2 · E3-5	Upstream value chain, anticipated financial effects, workers in the chain
CDP	3.1.1 · 5.11 · supply chain module	Risk register, value chain engagement, supplier response

Upstream figures are orders of magnitude built from the supplier’s location and your declared spend, not from the supplier’s accounts.

Compliance tables

The compliance tables you actually reuse

Annexes A to I are delivered in Excel, Word, PDF and an HTML explorer. They are the part clients come back to: not the narrative, the tables. Each one is produced from the data the assessment already holds, so nothing is retyped and every cell keeps its source.

Annex	Table	What is in it
A	World inventory of labels, certifications, standards, ratings and regulations	147 instruments, 19 columns each — issuing body, jurisdictions, thresholds, deadlines, procedure, validity, official source, verification date, confidence and limits
B	Schemes by company and site	What applies to each entity and each location, split between held and verified, declared, relevant to examine, and recommended — with the justification and the missing data named
C	Risks / scenarios / trajectories / schemes matrix	Every risk crossed with the scenario, the trajectory and the instrument it feeds — this is the table that turns an assessment into a questionnaire answer
D	Verbatims and documentary evidence	Exact excerpts with their source and date; model excerpts and demo texts are labelled as such
E	Gap analysis	Requirement by requirement: evidence available, declared but unverified, planned, or open
F	Prioritisation matrix	Effect over cost, with a no-regret bonus, so the order of work is argued rather than asserted
G	Trajectories, targets and indicators	The baseline, the target, the pathway and the indicator that proves it moved
H	Register of sources and assumptions	Every value with where it came from, when, and what was assumed — the annex auditors open first
I	Consolidated action plan	One line per action: budget, owner, date, ISO clause, CDP question, residual risk

Applicability is shown as likely and confirmed with you — it is never asserted for every entity. Obligations are kept apart from voluntary schemes, and no certification is said to reduce a risk: the mapping states what the scheme structures or evidences.

What you get

The same four levels of reading

Everything in the Direct Operations scope

Map, per-site tables, four deliverable levels, annexes A to I.

Upstream and downstream tables

Supplier risk by location, criticality and spend; products and customers by transition exposure; the value chain stage carried on every row.

EUDR due diligence pack

Materials mapped to HS codes and volumes, plot geolocation collected, due diligence statements, mitigation where risk is not negligible, contract clauses and the annual report.

Customer requirement matrix

What each large account asks of you — emissions disclosure, low-carbon electricity targets, supplier code of conduct — and where you already answer it.

What it answers

CSRD / ESRS — E1-E4 value chain datapoints, upstream and downstream
CSDDD — risk-based due diligence across the chain of activities
EUDR — plot geolocation, legality, due diligence statements, annual report
CDP — supply chain module, 3.1.1 supply chain response, 5.11 value chain engagement
EcoVadis — Sustainable procurement
ISO 20400 — sustainable procurement, §7
SBTi and SBTi FLAG — scope 3 and land-related targets
Large-account supplier programmes, including Microsoft supplier requirements

Pricing on request, set with you once the number of sites and materials is known.

How it grafts on

This is a system, not a report. It grafts onto what you already run: the site goes into the insurance programme, the exposure into the business plan, the mitigation into the ISO 14001 improvement programme, the figures into CDP and the ESRS, and the decision into the committee that was going to meet anyway. One assessment, one set of figures, every function reading its own line of it — that is the link it exists to create.

Going further

Risk Assessment — Overall

Add your competitors: public reports, CDP and EcoVadis scores, verified SBTi targets and published commitments, each kept with its evidence quote. It tells you where you stand before a customer does.

Contact