CSDDD adverse impact prioritisation workflow

Start with the CSDDD definitions. Record whether each item is an adverse human rights impact, an adverse environmental impact, or both. For human rights, identify the abused right or reasonably foreseeable risk to a protected legal interest. For environmental impacts, link the issue to the prohibitions or obligations covered by the Directive's Annex.

Map the chain of activities in enough detail to locate where the impact is most likely and most severe. The register should separate own operations, subsidiaries, direct business partners, and indirect business partners, and should distinguish upstream activities such as design, extraction, sourcing, manufacture, transport, storage, and supply from covered downstream distribution, transport, and storage.

For the in-depth assessment, request business-partner information only when it is necessary. If the business partner has fewer than 5,000 employees, request it only when the information cannot reasonably be obtained by other means. Where several partners could provide the information, ask the partner where the impact is most likely to occur when that is reasonable.

Article 9 requires prioritisation by severity and likelihood where it is not feasible to address all identified impacts at the same time and to their full extent. Do not rank by commercial exposure alone. The register should show why a lower-revenue site, supplier, product line, or geography was escalated if the harm to people or the environment is more severe.

For severity, use the Directive's severe adverse impact definition: nature, scale, scope, irremediable character, gravity, number of affected individuals, extent of environmental damage, irreversibility, and limits on restoration within a reasonable period. For likelihood, use evidence of occurrence, credible complaints, sector and geography risk, business-partner history, and whether the activity is moving into a higher-risk product, process, or location.

The 1-to-5 labels below are Sorena's internal calibration example, not a scale or formula prescribed by the CSDDD. Define each level for the affected right or environmental harm, keep the written rationale, and do not let a numerical average conceal an impact with extreme severity. For example, a credible risk of fatal exposure affecting a small workforce can outrank a more frequent but readily reversible administrative harm; the case facts still control the score.

After ranking, route each priority item to the right response. Potential adverse impacts go through Article 10 prevention or mitigation measures. Actual adverse impacts go through Article 11 measures to bring the impact to an end or minimise its extent, plus Article 12 remediation where the company caused or jointly caused the impact.

The response record should explain the company's involvement and ability to influence the partner: whether the impact may be caused by the company alone, jointly with a subsidiary or business partner, or only by a business partner in the chain of activities; whether the impact sits in a subsidiary, direct partner, or indirect partner; and what influence the company can reasonably exercise.

Include relevant stakeholders in prioritisation. Amended Article 13 requires consultation when gathering information to identify, assess, and prioritise adverse impacts; when developing prevention, corrective, and enhanced action plans; and when adopting remediation measures. The 2026 amendment deleted suspension decisions and monitoring-indicator development from the mandatory-stage list.

Use the complaint and notification mechanism as an evidence input, not a separate archive. If a complaint is well-founded, the adverse impact is treated as identified under Article 8 and should move into the register for Article 10, 11, or 12 action.

The evidence file should let a reviewer understand why one impact was handled before another. Keep the raw evidence, the scoring rationale, the stakeholder input considered, the selected measure, the owner, the timeline, the monitoring indicator, and the reason any lower-ranked impact was deferred.

CSDDD monitoring is recurring. Current Article 15 requires assessment without undue delay after a significant change, at least every five years, and whenever there are reasonable grounds to believe measures are no longer adequate or effective or new impact risks have arisen or may arise. Five years is a maximum regular interval, not a waiting period for a serious complaint, failed control, new country, new product, acquisition, or major supplier change. Update the due diligence policy, identified impacts, and measures when the assessment warrants it, taking relevant stakeholder information into account.