Quick Read
ISO/DIS 37200's risk assessment clause establishes the evidentiary foundation an organization must build before an EU Forced Labour Regulation investigation begins, requiring documented stakeholder engagement, supply chain mapping, structured risk identification, and saliency-based evaluation to demonstrate that forced labour risks were identified and addressed proactively. An FLR competent authority will assess whether a substantiated concern exists largely by reviewing this risk assessment record, making it the single most consequential document set an organization can produce in defence of its due diligence. Speeki's SPK DDMS2000:2026 risk-tiering methodology operationalizes these same requirements as certifiable, auditable standards rather than recommended practices.
Executive Summary
If an EU Forced Labour Regulation investigation ever opens against an organization, the single most consequential document set it can produce is its risk assessment record — evidence that it identified, analysed, and evaluated forced labour risk in its operations and supply chain before the investigation began, not after. ISO/DIS 37200's Clause 5, Modern slavery risk assessment, is the most detailed treatment available of what that record should actually contain: stakeholder engagement, structured risk identification, supply chain mapping, a defined set of risk indicators, and a saliency-based evaluation method.
This paper works through Clause 5 in detail, maps it against the evidentiary standard an FLR competent authority is likely to apply when assessing whether a substantiated concern exists, and shows how SPK DDMS2000:2026's risk-tiering methodology operationalizes the same logic as a certifiable, auditable requirement rather than a recommended practice.
1. Why Risk Assessment Is the Load-Bearing Clause
ISO/DIS 37200's Clause 5.1 states the sequencing plainly: risk assessment — comprising risk identification, risk analysis, and risk evaluation — is what informs and stipulates the specific modern slavery risk management activities that follow, including the operational due diligence addressed later in Clause 8.4.3. Everything downstream in the document, from the leadership commitments in Clause 6 to the procurement controls in Clause 8.3, depends on having first done the work Clause 5 describes.
This is not a stylistic preference. It reflects the same logic that governs how an FLR investigating authority will actually behave. The Regulation gives competent authorities discretion to open an investigation where a substantiated concern exists, built from complaints, risk indicators, and — once operational — the Commission's own forced labour risk database. An organization's own risk assessment record is the primary evidence it can offer to demonstrate that any concern raised about it either has already been addressed or was never well-founded. Without a documented risk assessment, an organization has no way to demonstrate this at all — it is reduced to arguing about the underlying facts with no procedural credibility behind the argument.
2. Stakeholder Engagement as an Evidentiary Requirement, Not a Courtesy
Clause 5.2 treats stakeholder engagement as integral to risk assessment rather than as a separate communications exercise. The clause requires organizations to recognize stakeholders' interests and legal rights, assess stakeholders' relative ability to contact and influence the organization, take into account the views of stakeholders even where they have no formal governance role or are unaware of their own relevant interests, and explore participation in stakeholder-driven initiatives — with particular emphasis throughout on rights-holders specifically, as distinct from stakeholders generally.
The distinction between "stakeholder" and "rights-holder" running through Clause 5.2 is worth pausing on. A supplier, an NGO, and a worker are all stakeholders in the generic sense, but only the worker is a rights-holder whose fundamental interests are directly at stake. ISO/DIS 37200 repeatedly directs organizations to prioritize rights-holder perspectives specifically — a discipline that maps closely onto how an FLR investigation is likely to weight evidence: an organization's own internal risk register carries less evidentiary weight than a risk assessment process that can show it actually engaged the people at risk, or with external stakeholders such as trade unions and NGOs positioned to represent their interests.
3. Risk Identification: Categories, Factors, and the Four Relationship Paths
Clause 5.3.1 sets out risk identification as an ongoing process rather than a periodic exercise, and categorizes risk across four dimensions: risk within the organization itself; risk within the various tiers of its supply chain, both upstream and downstream; risk arising through business associates; and risk arising through private individuals working for or on behalf of the organization — the clause's own example is a worker who independently hires domestic help while posted overseas, a category of exposure many organizations never formally consider.
The clause then sets out eight factors that elevate modern slavery risk: weak governance and poor labour market regulation; labour market structures dominated by a single employer or industry; migration for work, particularly for low-skilled or poorly protected migrant workers; discrimination on protected grounds; long and opaque supply chains or value-generation processes; corruption, described as "often a root cause" of modern slavery abuses; the presence of vulnerable groups, including children; and general supply chain volatility. Alongside these, Clause 5.3.1 sets out five categories of risk information organizations should actively gather: socio-economic risk (economic and cultural context, conflict zones, bribery and corruption, social acceptance of exploitation); workplace risk (proximity to borders, worker demographics, health and safety violations); sector risk; labour supply chain risk (transient and temporary labour, subcontracting, prevalence of low-paid labour); and governance risk (compliance with human rights and labour standards, strength of government anti-slavery legislation).
This risk-factor structure connects directly to the relationship-path framework set out earlier in Clause 4.4, which maps six distinct paths by which an organization can be connected to workers at risk — from a direct contractual relationship, through organizations under the company's own management control, to fully independent external providers, down to extended supply chains reaching tier three and beyond. The combination is powerful for FLR purposes specifically, because the Regulation's product-level liability does not stop at an organization's direct suppliers; a forced labour finding several tiers upstream can still trigger a market ban on the finished product. Clause 5.3.1's supply chain risk categorization gives organizations a structured way to extend risk identification beyond tier one without treating every tier as equally in need of the same depth of scrutiny.
4. Supply Chain Mapping in Practice
Clause 5.3.2 sets out supply chain mapping as a distinct discipline within risk identification: understanding the supply chain, mapping all suppliers, and understanding modern slavery risk across the entire chain. The clause sets out a five-step method — identifying the role of organizations and individuals at each tier; understanding interdependencies and supporting infrastructure; establishing how each element adds value to other members of the chain; determining how each element contributes to the organization's overall risk profile, positively or negatively; and evaluating how each element's actions influence the success of preventing modern slavery.
Two features of this methodology are worth highlighting for organizations building toward FLR readiness. First, Clause 5.3.2 is explicit that decisions taken for individual supply chain elements have chain-wide implications — a discipline that maps directly onto how the FLR treats supply chain risk, since a single tier-three supplier's forced labour finding can produce a market ban on a product several tiers downstream regardless of how compliant every intermediate tier was. Second, the clause requires organizations to identify, record, and periodically review their upstream and downstream supply chain specifically with regard to subcontractors and business associates who might have an impact on modern slavery risk — language that anticipates the kind of documentary trail an FLR investigating authority will request once an investigation opens.
5. Risk Indicators: The Operational Core of Clause 5
Clause 5.4.2 sets out the risk indicator set that ISO/DIS 37200 treats as the practical core of forced labour risk analysis, drawing on the ILO's 2012 Indicators of Forced Labour. The indicators are: recruitment fees large enough to create debt bondage; contract deception, including contracts not provided, or provided in a language the worker does not understand; poor wages and benefits, including withheld or late wages, unreasonable deductions, and in-kind payment; retention of identification documents, effectively binding a worker to an employer; substandard or exploitative worker accommodation, particularly where it restricts freedom of movement; isolation, including workers unable to leave a worksite or having communication devices confiscated; and abusive managerial behaviour, including harassment, intimidation, and blackmail.
These indicators are not abstractions — they are precisely the kind of evidence an FLR investigation will look for when assessing whether forced labour, as narrowly defined by the ILO Forced Labour Convention, is actually present in a supply chain, as distinct from poor labour conditions that fall short of that specific threshold. An organization's operational due diligence process should be built to actively screen for each of these indicators, with documented findings, rather than relying on generic supplier questionnaires that do not probe for them specifically.
6. Evaluation and Saliency: Prioritizing People Over the Organization
Clause 5.6 introduces a concept — saliency — that deserves more attention than it typically receives. Saliency is defined as the combination of likelihood and severity of a given risk, with severity itself broken into three components: scale (how severe an occurrence would be), scope (how widespread it would be), and remediability (how effective remediation would be if the risk materialized). Critically, the clause instructs organizations to prioritize risks to people over risk to the organization itself, while noting the two are not mutually exclusive.
This people-first prioritization principle has a direct bearing on how an organization should design its own risk register. A risk assessment methodology built primarily around commercial or reputational exposure to the organization — the more common default in corporate risk functions — will produce a different, and from an FLR-readiness perspective a weaker, prioritization than one built around the saliency framework Clause 5.6 describes. Regulators and civil society scrutiny of modern slavery risk management increasingly test for exactly this distinction: whether an organization's stated risk priorities track the severity of harm to workers or merely the severity of the organization's own exposure.
7. Mapping to DDMS2000's Tiering Engine
SPK DDMS2000:2026 translates this same risk assessment logic into a certifiable, auditable requirement. Where ISO/DIS 37200 Clause 5 describes what a good risk assessment should consider, DDMS2000's planning clauses require organizations to translate inherent risk factors — geography, sector, transaction and relationship value, red-flag indicators, and prior adverse findings — into a defined due diligence tier per subject category, with concrete actions calibrated to that tier and reviewed against defined performance objectives.
The parallel is close enough that an organization's ISO/DIS 37200 Clause 5.3.2 supply chain mapping output feeds directly into DDMS2000's tiering methodology as an input, and the Clause 5.4.2 risk indicator set gives DDMS2000's subject-specific modules a concrete, ILO-sourced indicator library to build screening criteria against. The distinction that matters is that DDMS2000 requires this work to be done, evidenced, and available for independent audit — converting ISO/DIS 37200's recommended practice into the kind of documented, third-party-verifiable record that carries real evidentiary weight if an FLR investigation ever opens.
Conclusion
Risk assessment is not a preliminary step that organizations complete once and then move past — both ISO/DIS 37200 and the practical logic of FLR enforcement treat it as the continuous foundation everything else rests on. Organizations that build a risk assessment process against Clause 5's structure, evidenced to the standard DDMS2000 requires, will be in a fundamentally stronger position than those relying on generic supplier questionnaires or annual desktop reviews, regardless of how the FLR's own risk database and enforcement guidance continue to develop.
The next paper in this series turns to governance: what ISO/DIS 37200's Clause 6 requires of governing bodies and top management, and the criminal liability exposure set out in the document's Annex B that makes this more than a compliance-department concern.
Speeki is an accredited certification body providing independent assurance and certification of due diligence management systems, including against SPK DDMS2000:2026. Current accreditation scope and certification details are available at speeki.com.
References
ISO/DIS 37200:2025(en), Managing the risk of modern slavery — Guidance for the prevention, identification and response to human trafficking and forced labour, ISO/TC 309 Governance of organizations, Secretariat: BSI, Clause 5 (Modern slavery risk assessment) and Clause 4.4. Version dated 2025-12-08, Draft International Standard status; content subject to change prior to publication.
International Labour Organization, ILO Indicators of Forced Labour, 2012.
ILO Forced Labour Convention, 1930 (No. 29).
Regulation (EU) 2024/3015 of the European Parliament and of the Council of 27 November 2024 on prohibiting products made with forced labour on the Union market.
European Commission, Guidelines on Regulation (EU) 2024/3015, published 30 June 2026.
SPK DDMS2000:2026, Speeki Due Diligence Management System Standard, Clause 4.5 (risk tiering) and Clause 6.1 (planning) (internal Speeki standard).
OECD, OECD Due Diligence Guidance for Responsible Business Conduct.
UN Guiding Principles on Business and Human Rights (2011).