Risk mitigation evidence

Risk mitigation evidence is the dated record showing what was done about an identified risk, who owned the action, when it was due, and what follow up measure showed whether the action worked. A statement of intent is not mitigation evidence, because intent alone changes nothing on the ground. The mitigation plan must state the risk, the action, the supplier or site, the support or leverage used, and the evidence that will be collected after the action. Where mitigation involves working with a supplier over time, the record must show milestones and reviews. Where mitigation fails, the record must show the failure and the next step.

Risk mitigation means the set of actions taken to prevent, reduce, or remedy an adverse impact identified in the supply chain. The scope covers actions by the operator, actions agreed with suppliers, and collaborative actions with other actors, for the risk stated in the register.

What is the legal frame for this record?

Risk mitigation for identified supply chain risks sits inside that sequence, so a record that shows only one step leaves the chain of reasoning incomplete. A sustainability lead agreeing a corrective plan with a refiner therefore needs a file that shows the policy, the owner of the policy, the date of adoption, and the review cycle. A refiner with weak grievance handling might agree to a dated plan for a new grievance route, staff training, and a review after three months, with the review evidence filed against the original risk entry.

How is the chain mapped?

The map should name each tier that handles risk mitigation for identified supply chain risks, record the function of each actor, and note where material changes form, such as refining, precursor production, cathode production, cell production, and pack assembly. The mitigation plan, milestone records, and follow up checks should be tied to a named tier, a named site where that information is known, and a date. A sustainability lead agreeing a corrective plan with a refiner should record gaps on the map itself, with the reason for each gap and the next step planned. Continued engagement, suspension, and disengagement are different responses, and the record should state why the chosen response fits the severity of the risk and the leverage available, with the decision date.

How is evidence judged?

A supplier statement, a contract clause, a third party audit summary, a mass balance record, and a chain of custody document do not carry equal weight, and the record should say which type supports each claim about risk mitigation for identified supply chain risks. The mitigation plan, milestone records, and follow up checks needs a source name, a collection date, a coverage period, and a statement of what was actually checked. A sustainability lead agreeing a corrective plan with a refiner should separate facts received from conclusions drawn, so a later reviewer can test the conclusion. A refiner with weak grievance handling might agree to a dated plan for a new grievance route, staff training, and a review after three months, with the review evidence filed against the original risk entry.

How is risk identified and assessed?

A red flag can be a place of origin, a processing route, a supplier practice, a change of ownership, or a gap in records for risk mitigation for identified supply chain risks. Continued engagement, suspension, and disengagement are different responses, and the record should state why the chosen response fits the severity of the risk and the leverage available, with the decision date. A sustainability lead agreeing a corrective plan with a refiner should date each assessment and name the person or function responsible for the next review.

How is mitigation planned and followed up?

For risk mitigation for identified supply chain risks, the plan should state the risk addressed, the action chosen, the supplier or site involved, the support offered, and the evidence that will show whether the action worked. The mitigation plan, milestone records, and follow up checks collected after the action should be compared with the position before the action, using the same measure where possible. A refiner with weak grievance handling might agree to a dated plan for a new grievance route, staff training, and a review after three months, with the review evidence filed against the original risk entry.

How is reporting checked?

The due diligence report should summarise the policy, the management system, the risks found, the actions taken, and the verification arranged for risk mitigation for identified supply chain risks, without disclosing confidential commercial detail that the Regulation does not require to be published. A sustainability lead agreeing a corrective plan with a refiner should check that every public claim can be traced to an internal record, and that the report date, coverage period, and scope match the internal file. Continued engagement, suspension, and disengagement are different responses, and the record should state why the chosen response fits the severity of the risk and the leverage available, with the decision date.

What does a mitigation case file contain after six months?

After six months, a mitigation case file should contain the original risk entry, the agreed plan with milestones, the evidence for each milestone, and a review note that compares the position before and after the action. For a refiner grievance case, the file might show a new grievance route launched, training records for site staff, the number of grievances received and resolved, and an independent check of the route. If a milestone was missed, the file shows the missed date, the reason given, and the revised date. A file that shows only the plan and a closing statement, without milestone evidence, does not prove that mitigation happened, only that mitigation was intended.

Mitigation stays open until the follow up check is filed, and a plan without a review date is a promise without a test.