We rely on various data sources to identify potential risks for human beings and the environment arising from our business activities. External data from internationally recognised indices is systematically recorded and processed to identify country-specific and commodity-group risks (supplier network) and/or business-purpose-specific risks (own business area and other business partners).

External data is evaluated and weighted as part of an “abstract analysis”, considering criteria such as the probability of identified risks occurring and the projected severity of potential violations. This results in an overall assessment of the risk situation in our own business area and at our suppliers and business partners.

We then define risk-based control measures, such as questionnaires or assessments, which provide us with additional information on  the actual situation on-site. These findings are incorporated into the “concrete analysis”. We also integrate from our complaints mechanisms into the risk identification process as additional data points.

We apply additional criteria such as ability to exert influence and causation to determine our risk exposure at the BMW Group. This helps us further substantiate the risk assessment and identify any (imminent) human rights violations or non-compliance with environmental standards. In this case, we respond immediately with appropriate preventive and remedial measures.

Prioritising risk enables us to take targeted action, either in areas where we have already identified particularly relevant risks (increased risk exposure) and/or where forecasts indicate that increased impact from our business activities cannot be ruled out . What we learn from this approach about human rights and environment-related risks and their effect is channelled into our business decisions.