CSDDD risk prioritisation how to rank adverse impacts by severity, likelihood, and evidence

Article 9 applies after Article 8 identification and assessment. If it is not feasible to prevent, mitigate, bring to an end, or minimise all identified adverse impacts at the same time and to their full extent, the company must prioritise the impacts so it can fulfil the prevention and mitigation duties in Articles 10 and 11.

The priority order must be based on the severity and likelihood of the adverse impacts. After the most severe and most likely impacts have been addressed within a reasonable time, the company must move on to less severe and less likely impacts. New Article 9(4) also says that the mere fact that a less significant impact has not yet been addressed does not expose the company to Article 27 penalties when the prioritisation decision complied with Article 9. That protection does not excuse a defective ranking or remove the duty to progress to lower priorities.

Severity should focus on the impact on people or the environment. The CSDDD definition of severity of an adverse impact points to scale, scope, and irremediable character, including gravity, the number of people affected, environmental extent, irreversibility, and limits on restoring affected people or the environment within a reasonable period.

Likelihood should capture credible indicators that the impact has occurred or may occur, such as prior assessments, notifications, complaints, geography and context, sector, business operation, product or service, and changed operating conditions. The Directive does not prescribe a numeric scale, weighting formula, tier count, or automatic cutoff. If a team uses scores, it should retain the underlying evidence and explain how the scores express severity and likelihood.

These risk factors should be specific enough to test. For example, a weak rule-of-law context, a history of worker complaints, a hazardous production process, or a product linked to an Annex-listed environmental harm can change the evidence for likelihood or severity. The example identifies inputs, not an automatic classification or score.

The OECD Due Diligence Guidance is non-binding but useful for method design. It treats severity as the predominant factor when prioritising potential human-rights impacts, especially where delay could make an impact irremediable. That method does not replace the CSDDD requirement to consider both severity and likelihood.

Stakeholder evidence should help test the company's view of severity and likelihood. Amended Article 13 requires consultation of relevant stakeholders when gathering information to identify, assess, and prioritise adverse impacts; when developing prevention, corrective, and enhanced action plans; and when adopting remediation measures. Suspension decisions and monitoring-indicator development are no longer listed as mandatory consultation stages.

The record should distinguish direct stakeholder evidence from expert input. If effective stakeholder engagement is not reasonably possible, the company should consult experts who can provide credible insight into actual or potential impacts.

An audit-ready rationale should let a reviewer trace the decision from identified impact to priority ranking to action. It should explain why the selected impacts were treated first, which evidence was used, which stakeholders or experts informed the assessment, and when lower-ranked impacts will be addressed.

The rationale should also separate prioritisation from response design. Articles 10 and 11 ask different questions after prioritisation, including whether the company caused the impact, caused it jointly, or whether only a business partner caused it; where the impact occurs in the chain of activities; and what influence the company can exercise.