RSB Standard for risk management

Transcription

1 0 Roundtable on Sustainable Biofuels. All rights reserved. Type of document: RSB International Standard Status: Approved for certification Date: March 0 Version:.0 RSB Standard for risk management RSB reference code: RSB-STD-0-00 Published by the Roundtable on Sustainable Biofuels, an initiative of the Energy Center of École polytechnique fédérale de Lausanne (EPFL). This publication or any part thereof may only be reproduced with the written permission of EPFL, the publisher. Any reproduction in full or in part of this publication must mention the title and reference code and credit the above-mentioned publisher as the copyright owner. Contact details: RSB - Roundtable on Sustainable Biofuels EPFL - Ecole Polytechnique Federale De Lausanne Energy Center Château de Bassenges, Station CH - 0 Lausanne Switzerland web: rsb@epfl.ch RSB-STD-0-00-vers..0-RSB Standard for risk management

2 0 Roundtable on Sustainable Biofuels. All rights reserved. Introduction In all kinds of economic activity, there is the potential for events and consequences that constitute opportunities for benefit or threats to success. Risk management is increasingly recognized as being concerned with both positive and negative aspects of risk. The RSB certification systems are based on a comprehensive risk management approach. The risk management approach is the overall strategic and operational course of action taken to minimize the risk to comprehensive, consistent, and transparent implementation of the RSB standards as well as to the stability and integrity of the RSB certification systems. The risk management approach is designed to identify and address the respective risks each constituent adds to the overall stability and integrity of the RSB certification systems. The approach identifies, evaluates and addresses at the level of each constituent the relevant risk factors which could compromise comprehensive, consistent and transparent implementation of the RSB standards. Through the risk management approach s, certification bodies and the RSB certification system as a whole are able to focus especially on those areas of implementation of the RSB standards (and those constituents) which add risk to the RSB certification systems. In a system as complex as the RSB certification systems it is critical that each constituent and constituent group involved accepts responsibility and accountability for comprehensive, consistent and transparent implementation the RSB standards and systems. Moreover, in order to enable broadest possible flexibility in implementation of the RSB standards and RSB certification systems, it is critical that all constituents and constituent groups take responsibility for implementing their respective roles to the best of their ability. The risk management approach outlined below serves as a strong incentive to install accountability among all constituents in the RSB certification systems. A comprehensive risk management approach is introduced to ensure that all constituents and constituent groups are held accountable and assume responsibility for, and are evaluated according to the risk they add to the comprehensive, consistent and transparent implementation of the RSB standards and to the performance, integrity and stability of the RSB certification systems. The risk management approach is laid out in this RSB Standard for risk management In the context of the RSB certification systems risk is defined as the probability of social, environmental and/or economic damage to any organization, entity or person and/or the environment and/or the community at large resulting from deficient implementation of the RSB standards and/or RSB certification systems. Risk is expressed as the sum of: Ø the potential extent of damage resulting from deficient implementation of the RSB standards due to a risk factor PLUS Ø the probability of uncovering deficient implementation of the RSB standards due to a risk factor. The overall risk to the operation of a constituent is the sum of the risks associated with each risk factor in the operation. Risk factors are aspects of an operation which could result in damages if not implemented comprehensively, consistently and/or to the fullest extent possible. The risk management approach detailed in this standard is structured in different stages the risk identification, the risk evaluation, the risk management and risk monitoring. The risk identification is the stage where all risk factors which could compromise comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems are identified and documented. RSB-STD-0-00-vers..0-RSB Standard for risk management

3 0 Roundtable on Sustainable Biofuels. All rights reserved. The risk evaluation is the stage where each risk factor which could compromise comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems is evaluated and where the overall risk to the operation is determined and documented. The risk management is the stage where management strategies and activities are developed, implemented and documented to address and minimize the risk associated with each risk factor and to ensure comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems. The risk monitoring is the stage where all risk factors and the risk management are monitored and assessed continuously to ensure minimum overall risk to the operation with respect to comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems. Participating operators in the RSB certification systems shall use the risk management approach to steer their respective operations to minimize associated risks and achieve full, comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems. RSB recognized certification bodies in the RSB certification systems shall use the risk management approach to steer their respective operations to minimize associated risks and ensure that auditing s for compliance with the RSB standards is conducted with substantially equivalent effort and stability and that the assurance provided is substantially equivalent for all s. Important note: The risk factors focus on the general conditions under which the operation(s) of the are implementing the RSB Principles & Criteria, the RSB standards and the RSB certification systems, rather than the effort these operation(s) invest into implementing and complying with the RSB Principles & Criteria. Thus many of the risk factors especially those related to the RSB Principles & Criteria are beyond the control of the. While a high risk class does not give any indication on the level of compliance with the RSB Principles & Criteria by the, it may provide an indication that the is operating under most challenging conditions, and that the due to these challenging conditions likely has to expend significant effort to achieve compliance with the RSB Principles & Criteria. Only the independent evaluation of a is able to establish reliably the degree on compliance with the RSB Principles & Criteria, the RSB standards and the RSB certification systems. Thus a with a high risk class (i.e. risk class or ) can achieve or fail compliance with the RSB Principles & Criteria, the RSB standards and the RSB certification systems, just like a with a low risk class (i.e. risk class or ). While some of the RSB Principles & Criteria apply only to some s (i.e. feedstock producers and/or feedstock processors and/or biofuels producers, etc.), the general risk factors and the risk factors related to the RSB Principles & Criteria apply to all s. RSB-STD-0-00-vers..0-RSB Standard for risk management

4 0 Roundtable on Sustainable Biofuels. All rights reserved. Table of contents A. Intent of this standard B. Scope of this standard C. Status and effective date D. Note on use of this standard E. References F. Terms and definitions G. Requirements of this standard. General requirements for risk assessment in the RSB certification systems. Risk identification. Risk evaluation. Risk assessment. Risk management. Risk monitoring 7. Exception to risk assessment Annex Risk factors Annex Minimum weighting assigned to risk factors Annex Risk evaluation Annex Risk classes according to the overall risk Annex Maximum intervals for periodic risk assessment Annex Minimum requirements for periodic evaluation RSB-STD-0-00-vers..0-RSB Standard for risk management

5 0 Roundtable on Sustainable Biofuels. All rights reserved. A. Intent of this standard The intent of this standard is to ensure that risks to the comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems are identified and minimized. Participating operators of the RSB certification systems shall implement the applicable requirements of this standard and achieve the intent of this standard and ensure the best performance, integrity and the stability of the RSB certification systems. More specifically the intent of this standard is to ensure that s involved in the RSB certification systems: Ø identify the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems associated with their particular operations; Ø evaluate the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems associated with their particular operations; Ø develop, adopt and implement management strategies and activities to minimize such risks, Ø monitor continuously the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems associated with their particular operations, and thereby Ø ensure that each is fully aware of the risks it adds to the comprehensive, consistent and transparent implementation of the RSB standards and the stability and integrity of the RSB certification systems, and Ø ensure that each takes responsibility and is held accountable for the risks it adds to the comprehensive, consistent and transparent implementation of the RSB standards and the stability and integrity of the RSB certification systems. A comprehensive risk management approach at the level of each engaged in the RSB certification systems is an important decision-making tool that shall be used to identify and minimize existing problems, deficiencies, and potential risks. It is useful both for prioritizing management efforts and for evaluating the effectiveness of management efforts that are implemented. Participating operators in the RSB certification systems shall use the risk management approach to steer their respective operations to minimize associated risks and achieve comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems. B. Scope of this standard This standard is an international standard and valid worldwide, and specifies the requirements for the risk management approach for s engaged in the RSB certification systems. The standard defines and addresses the basic elements of a risk management approach, which shall be met by all s in the RSB certification systems. RSB-STD-0-00-vers..0-RSB Standard for risk management

6 0 Roundtable on Sustainable Biofuels. All rights reserved. C. Status and effective date The version.0 of the RSB Standard for risk management shall be effective on March 0. D. Note on use of this standard All aspects of this standard are considered to be normative, including the intent, scope, standard effective date, note on the use of this standard, references, terms and definitions, and requirements, unless otherwise stated. Users implementing this standard shall ensure that the intent of this standard is met. To ensure that the intent of this standard is met users shall implement all of the requirements specified in this standard, and any and all additional measures necessary to achieve the intent of this standard. E. References RSB-STD-0-00 RSB-STD-0-00 RSB-STD-0-00 RSB Generic Chain of Custody Standard RSB Standard for s RSB Standard on communication and claims RSB-STD RSB General requirements for certification bodies: The application of ISO/IEC Guide :99 (E) RSB-STD RSB-STD operators RSB-STD RSB-DOC ISO/IEC Guide 7 ISO/DIS 000 RSB Requirements for auditor qualification RSB Requirements for evaluation of and reporting on participating RSB Requirements for certification bodies risk management RSB Glossary of terms ISO/IEC Guide 7 Risk management Vocabulary ISO 000 Risk management Principles and Guidelines on Implementation F. Terms and definitions For the purposes of this International Standard, the terms and definitions given in RSB- DOC-0-00 RSB Glossary of Terms shall apply. RSB-STD-0-00-vers..0-RSB Standard for risk management

7 0 Roundtable on Sustainable Biofuels. All rights reserved. G. Requirements of this standard. General requirements for risk assessment in the RSB certification systems.. The risk management approach shall be in compliance with ISO 000 and the applicable requirements of the RSB standards... Participating operators shall develop, document and implement a risk management approach which includes the following main stages:... risk identification Risk identification is the stage in the risk management approach where all risk factors which could compromise comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems are identified and documented.... risk evaluation - Risk evaluation is the stage in the risk management approach where each risk factor which could compromise comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems is evaluated and where the overall risk to the operation is determined and documented.... risk management Risk management is the stage in the risk management approach where management strategies and activities are developed, implemented and documented to address and minimize the risk associated with each risk factor and to ensure comprehensive, consistent, and transparent implementation of the RSB standards and the RSB certification systems.... risk monitoring Risk monitoring is the stage in the risk management approach where all risk factors and risk management are monitored and assessed continuously to ensure minimum overall risk to the operation with respect to comprehensive, consistent, and transparent implementation of the RSB standards... The risk management approach shall specify the link to the operations objectives and to the comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... Participating operators shall appoint a representative of the management holding overall responsible for the risk management approach... Participating operators shall provide the person holding overall responsibility for the risk management approach with sufficient resources to implement a comprehensive and consistent risk management approach... Staff responsible for implementing the risk management approach shall be properly trained and qualified.. 7. Staff responsible for risk management approach shall be knowledgeable of all aspects of the operation(s). RSB-STD-0-00-vers..0-RSB Standard for risk management 7

8 0 Roundtable on Sustainable Biofuels. All rights reserved.. 8. Staff responsible for risk management approach shall have access to any and all details of the operation.. 9. Participating operators shall maintain complete and up-to-date records covering all aspects of the risk management approach and all applicable requirements of this standard.. 0. Participating operators shall inform without delay the RSB SOE and the RSB recognized certification body of any changes in the risk management approach, the risk factors and associated risks, the overall risk to the comprehensive, consistent and transparent implementation of the RSB standards and the risk management plan associated with their respective operation... Participating operators shall retain all records and reports, including risk assessments, reports of stakeholder suggestions and training records for at least five () years... Participating operators shall inform all entities, sites, facilities, employees in its operation about the risk management approach, the risk factors and associated risks, the overall risk to the comprehensive, consistent and transparent implementation of the RSB standards and the risk management plan... Participating operators shall inform all sub-contractors and other independent third parties engaged in or possibly affecting the comprehensive, consistent and transparent implementation of the RSB standards about the risk management approach, the risk factors and associated risks, the overall risk and the risk management plan associated with the operation... Participating operators exceeding risk class in the overall risk associated to their respective operation(s) shall implement a precautionary approach to the comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... Participating operators exceeding risk class in the overall risk associated to their respective operation(s) shall disclose upon request to other s, to suppliers and to customers the risk factors and associated risks, as well as the overall risk to the comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... Participating operators exceeding risk class in the overall risk associated to their respective operation(s) shall inform suppliers and customers about the overall risk to RSB-STD-0-00-vers..0-RSB Standard for risk management 8

9 0 Roundtable on Sustainable Biofuels. All rights reserved. the comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems.. 7. Participating operators exceeding risk class in the overall risk associated to their respective operation(s) shall be listed by the RSB SOE as very high risk operations. The listing by the RSB SOE of very high risk operations shall be publicly available.. Risk identification.. The shall identify relevant risk factors associated with the particular operation. This shall include the identification potential sources of risk to their respective operation as a whole and to any part thereof, and to the comprehensive, consistent and transparent implementation of the RSB standards, as well as the associated areas of impact, events and their causes and their potential consequences... The shall at minimum include in the risk identification the risk factors listed in Annex... The shall weight each risk factor. The weighting of each risk factor shall reflect the importance of the risk factor to the comprehensive, consistent and transparent implementation of the RSB standards in the operation. The weighting of each risk factor shall be the weighting listed for each risk factor in Annex.... The may apply on a case by case basis to change the weighting of a risk factor in exceptional circumstances, through its RSB recognized certification body. The certification body shall verify the validity of and rationale for such request to change the weighting of a risk factor.... If the request to change the weighting of a risk factor is found to be valid by the RSB recognized certification body, the certification body may recommend changing the weighting of the risk factor for the particular case to RSB SOE.... The RSB SOE shall consider and decide the recommendation to change the weighting of the risk factor for the particular case. The decision of the RSB SOE shall be final and binding... In addition to the risk factors listed in Annex the shall identify any and all new risk factors which have the potential to compromise the comprehensive, consistent and transparent implementation of the RSB standards. The shall recommend such new risk factors to its RSB recognized certification body. The certification body shall verify the validity of and rationale for the new risk factor(s). RSB-STD-0-00-vers..0-RSB Standard for risk management 9

10 0 Roundtable on Sustainable Biofuels. All rights reserved.... If the recommendation for new risk factor(s) is found to be valid by the RSB recognized certification body, the certification body may recommend to the RSB SOE the new risk factor(s) together with the suggested weighting and the risk indicators for each of the risk classes of the new risk factor(s).... The RSB SOE shall consider and decide the recommendation for new risk factor(s). The decision of the RSB SOR shall be final and binding.. Risk evaluation.. The shall evaluate for each risk factor identified the potential extent of damage resulting from deficient implementation of the RSB standards and/or RSB certification systems due to the risk factor. The potential extent of damage resulting from deficient implementation of the RSB standards and/or RSB certification systems due to the risk factor, shall include all possible social, environmental and/or economic damage to any organization, entity or person, and the environment and the community at large... The shall evaluate for each risk factor identified the probability of uncovering deficient implementation of the RSB standards due to the risk factor... The shall evaluate for each risk factor identified the associated risk as the sum of: Ø the potential extent of damage resulting from deficient implementation of the RSB standards due to a risk factor PLUS Ø the probability of uncovering deficient implementation of the RSB standards due to a risk factor. using the risk indicators listed for each risk factor in Annex. or defined for new risk factors in accordance with section.. The shall multiply the risk associated with each risk factor in the operation with the weighting identified in sections. and. respectively... The shall evaluate the overall risk to the operation as (the sum of the risks associated with each risk factor in the operation) divided by the total sum of the weightings assigned to risk factors (see annex )... The shall identify its risk class according to the overall risk to the operation evaluated. The risk classes according to the overall risk are listed in Annex. RSB-STD-0-00-vers..0-RSB Standard for risk management 0

11 0 Roundtable on Sustainable Biofuels. All rights reserved.. Risk assessment.. The shall compile the risk identification (section.) and the risk eval uation (section.) as the risk assessment and submit the risk assessment to the RSB SOE and the RSB recognized certification body engaged by the participating operator... The shall conduct a risk assessment [risk identification (section.) and the risk evaluation (section.)] in periodic intervals. The intervals shall correspond to the overall risk to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems in the operation. The maximum intervals for risk assessment according to risk class are listed in Annex... The shall, in addition, conduct a risk assessment [risk identification (section.) and the risk evaluation (section.)] when changes in the operation occur which affect one or more of the stages of the risk management approach... The shall submit the periodic risk assessment to the RSB SOE and the RSB recognized certification body engaged by the.. Risk management.. The shall develop, for each risk factor identified and evaluated, strategic and operational management activities to minimize the associated risk to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... The shall prioritize the strategic and operational management activities and develop a comprehensive risk management plan including timelines and management indicators to minimize the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... The shall implement the risk management plan to minimize the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... The shall review and update the risk management plan for each risk assessment. RSB-STD-0-00-vers..0-RSB Standard for risk management

12 0 Roundtable on Sustainable Biofuels. All rights reserved.. Risk monitoring.. The shall monitor implementation of the risk management plan for effectiveness in minimizing the risks to comprehensive, consistent and transparent implementation of the RSB standards and the RSB certification systems... The shall update and optimize the risk management plan according to the results of the risk monitoring. 7. Exception to risk assessment 7.. In case the risk management approach detailed in this standard does not result in a risk assessment which correctly reflects the overall risk associated with the operation(s) of the, the shall provide to the RSB recognized certification body engaged an updated risk assessment, and substantiating evidence that this risk assessment does not reflect correctly the overall risk associated with the operation(s) of the, and an application for exception to risk assessment together with a proposal for adjustment of the risk assessment. 7.. The shall include for each risk factor and risk indicator substantiating evidence whether it applies correctly to the operation(s) of the and if necessary a proposal for adjustment of the respective risk factor and risk indicator. 7.. The RSB recognized certification body engaged by the shall evaluate in a field audit in detail the proposal for adjustment of the risk assessment including all substantiating evidence and documentation and evaluate in particular any and all social, environmental and/or economic impacts which the risk assessment and the proposal for adjustment of the risk assessment could potentially have on the RSB, the RSB certification systems and other third parties. 7.. The RSB recognized certification body engaged by the shall document its observations and evidence collected in a certification report, and submit the certification report to peer review. 7.. The RSB recognized certification body shall submit the certification report together with the peer review to the certification decision entity. 7.. The RSB recognized certification body shall submit the certification report together RSB-STD-0-00-vers..0-RSB Standard for risk management

13 0 Roundtable on Sustainable Biofuels. All rights reserved. with the peer review and the decision by certification decision entity to the RSB SOE for approval The RSB SOE shall review the application for exception to risk assessment together with a proposal for adjustment of the risk assessment, the certification report the peer review and the decision by certification decision entity and decide on the application for exception to risk assessment. The RSB SOE may at its discretion approve, approve with amendments and/or conditions, or decline the application for exception to risk assessment. The RSB SOE may provide a rationale substantiating its decision but shall not be required to do so. RSB-STD-0-00-vers..0-RSB Standard for risk management

14 0 Roundtable on Sustainable Biofuels. All rights reserved. Annex Risk factors General risk factors. The risk factors listed in the following evaluate the general characteristic of the operation(s) of the and their respective operating environment, and apply to all s... total size of This risk factor shall identify the risks associated with the total size of the... legal entities This risk factor shall identify the risks associated with the number and complexity of corporate legal structures involved in the operation(s) of the... geographic spread of the operation This risk factor shall in particular analyze the risks associated with the complexity and extent of geographic spread the operation(s) controlled by the (e.g. accessibility of operations, the communication links within the organization, the physical time it takes to travel between operations, whether operations are in different countries/continents)... operational sites.. operational facilities This risk factor shall identify the risks associated with the number and complexity of operational sites involved in the operation(s) controlled by the. This risk factor shall identify the risks associated with the number and complexity of operational facilities involved in the operation(s) controlled by the... internal processing steps This risk factor shall identify the risks associated with the number and complexity of internal processing steps undertaken and controlled by the operation(s) controlled by the.. 7. sub-contractors This risk factor shall identify the risks associated with the number and complexity of sub-contractors involved in and engaged by the operation(s) controlled by the.. 8. partial compliance with RSB standards This risk factor shall identify the risks associated with only part of the operation(s) of the being compliant with the RSB standards and participating in the RSB certification systems.. 9. parallel acquiring, handling and forwarding RSB compliant and noncompliant biomass/biofuels This risk factor shall identify the risks associated with acquiring, handling and forwarding in parallel RSB compliant biomass/biofuels and biomass/biofuels not compliant or not evaluated for compliance with the RSB standards, the risks associated with mixing of compliant and non-compliant biomass/biofuels, and the risks associated with correct declaration of RSB compliant biomass/biofuels.. 0. supplier relations This risk factor shall identify the risks associated with the number and complexity suppliers to the operation, supplier relations and supplier management by the operation(s) controlled by the participating operator. RSB-STD-0-00-vers..0-RSB Standard for risk management

15 0 Roundtable on Sustainable Biofuels. All rights reserved... customer relations.. scope of products.. employee structures.. internal controls This risk factor shall identify the risks associated with the number and complexity customers to the operation, customer relations and customer management by the operation(s) controlled by the. This risk factor shall identify the risks associated with the diversity and complexity of products acquired, handled and forwarded by the operation(s) controlled by the. This risk factor shall identify the risks associated with number of employees, complexity of employee structures, employee relations and employee management by the operation(s) controlled by the. It shall in particular analyze employee qualification, turnover, employment security, position management, and other aspects which influence employee performance. This risk factor shall identify the risks associated with existence or lack of internal control structures as well as their respective management and effectiveness in the operation(s) controlled by the... organizational and decision making structures This risk factor shall identify the risks associated with complexity and clarity of organizational structures, decision making structures, management structures, definition of responsibilities and access to decision makers in the operation(s) controlled by the participating operator... quality management This risk factor shall identify the risks associated with existence or lack of quality management structures as well as their respective management and effectiveness in the operation(s) controlled by the.. 7. calculation and maintenance of conversion factors This risk factor shall identify the risks associated with accurately determining conversion factors, including the methodology for establishing them and for ensuring that they are kept updated in the operation(s) controlled by the.. 8. length and complexity This risk factor shall identify the risks associated with the length and of the chain of custody complexity of the chain of custody in the operation(s) controlled by the.. 9. history of certification This risk factor shall identify the risks associated with experience of the with implementation of and conformity assessment against independent standards. It shall in particular analyze the experience of the, whether the is implementing other biomass certification schemes, other social, environmental, economic, and/or management standards and independent conformity assessment, whether the has already identified and addressed major problems (and/or associated risks) when implementing other standards systems, and/or excluded from participation in any other social, environmental, economic, and/or management standards scheme for lack of compliance (performance).. 0. management of conflicts of interest and risk of corruption This risk factor shall identify the risks associated with conflict of interest and corruption related to the operations of the participating operator. It shall in particular analyze the existence, implementation and effectiveness of systems to avoid and manage conflict of interest, and corruption in the operation(s) controlled by the participating operator. RSB-STD-0-00-vers..0-RSB Standard for risk management

16 0 Roundtable on Sustainable Biofuels. All rights reserved... legal issues and judiciary actions pending This risk factor shall identify the risks associated with legal issues and judiciary actions pending in the operation(s) of the participating operator. It shall in particular analyze whether judiciary action, legal disputes and/or prosecution for criminal wrongdoing are pending against the and/or any part of the operation(s) controlled by the... stakeholder involvement This risk factor shall identify the risks associated with mechanisms for receiving, seeking and/or encouraging stakeholder input with respect to the operation(s) controlled by the..... non-compliances issued during the last independent evaluation major noncompliances issued during the last independent evaluation This risk factor shall identify the risks associated with number and complexity of non-compliances issued at the most recent independent evaluation by a RSB recognized certification body to the operation(s) controlled by the. This risk factor shall identify the risks associated with number and complexity of major non-compliances issued at the most recent independent evaluation by a RSB recognized certification body to the operation(s) controlled by the... non-compliances pending This risk factor shall identify the risks associated with number and complexity of non-compliances which are still pending (i.e. not brought into compliance with the RSB standards and RSB certification systems) at the time of risk assessment of the operation(s) controlled by the... major noncompliances pending This risk factor shall identify the risks associated with number and complexity of major non-compliances which are still pending (i.e. not brought into compliance with the RSB standards and RSB certification systems) at the time of risk assessment of the operation(s) controlled by the. RSB-STD-0-00-vers..0-RSB Standard for risk management

17 0 Roundtable on Sustainable Biofuels. All rights reserved.. Risk factors related to the RSB Principles & Criteria The risk factors listed in the following are specifically designed to evaluate the risk to comprehensive and consistent implementation of and compliance with the RSB Principles & Criteria. These risk factor focus on the general conditions under which the operation(s) of the are implementing the RSB Principles & Criteria, rather than the effort these operation(s) invest to implement and comply with the RSB Principles & Criteria. Thus most of the risk factors related to the RSB Principles & Criteria are beyond the control of the. While a high risk does not give any indication as to the implementation of and compliance with the RSB Principles & Criteria by the, it may provide an indication that the is operating under most challenging conditions and likely has to expend significant additional effort to achieve compliance with the RSB Principles & Criteria. While some of the RSB Principles & Criteria apply only to some participating operators (i.e. feedstock producers and/or feedstock processors and/or biofuels producers, etc.), the risk factors related to the RSB Principles & Criteria apply to all s... Principle : Biofuel operations shall follow all applicable laws and regulations Principle : Sustainable biofuel operations shall be planned, implemented, and continuously improved through an open, transparent, and consultative Environmental and Social Impact Assessment (ESIA) and an economic viability analysis. Principle. Biofuels shall contribute to climate change mitigation by significantly reducing lifecycle GHG emissions as compared to fossil fuels. Principle. Biofuel operations shall not violate human rights or labor rights, and shall promote decent work and the well-being of workers. Principle. In regions of poverty, biofuel operations shall contribute to the social and economic development of local, rural and indigenous people and communities. Principle. Biofuel operations shall ensure the human right to adequate food and improve food security in food insecure regions. Principle 7. Biofuel operations shall avoid negative impacts on biodiversity, ecosystems, and other conservation values. Principle 8: Biofuel operations shall implement practices that seek to reverse soil degradation and/or maintain soil health. Principle 9. Biofuel operations shall maintain or enhance the quality and quantity of surface and ground water resources, and respect prior formal or customary water rights. Principle 0. Air pollution from biofuel operations shall be minimized along the supply chain. Principle. The use of technologies in biofuel operations shall seek to maximize production efficiency and social and environmental performance, and minimize the risk of damages to the environment and people... Principle. Biofuel operations shall respect land rights and land use rights. RSB-STD-0-00-vers..0-RSB Standard for risk management 7

18 0 Roundtable on Sustainable Biofuels. All rights reserved. Annex Minimum weighting assigned to risk factors Risk factors. General risk factors minimum weighting.. total size of.. legal entities.. geographic spread of the operation.. operational sites.. operational facilities.. internal processing steps. 7. sub-contractors. 8. partial compliance with RSB standards. 9. parallel acquiring, handling and forwarding RSB compliant and non-compliant biomass/biofuels. 0. supplier relations.. costumer relations.. scope of products.. employee structures.. internal controls.. organizational and decision making structures.. quality management. 7. calculation and maintenance of conversion factors. 8. length and complexity of the chain of custody. 9. history of certification. 0. management of conflicts of interest and risk of corruption.. legal issues and judiciary actions pending.. stakeholder involvement.. non-compliances issued.. major non-compliances issued.. non-compliances pending.. major non-compliances pending SUM OF THE WEIGHTINGS ASSIGNED TO GENERAL RISK FACTORS 9 RSB-STD-0-00-vers..0-RSB Standard for risk management 8

19 0 Roundtable on Sustainable Biofuels. All rights reserved.. Risk factors related to the RSB Principles & Criteria.. Principle : Legality.. Principle : Planning, monitoring and continuous improvement.. Principle : Greenhouse gas emissions.. Principle : Human and labor rights.. Principle : Rural and social development.. Principle : Local food security. 7. Principle 7: Conservation. 8. Principle 8: Soil. 9. Principle 9: Water. 0. Principle 0: Air.. Principle : Use of technology, inputs, and management of waste.. Principle : Land rights SUM OF THE WEIGHTINGS ASSIGNED TO RISK FACTORS RELATED TO THE RSB PRINCIPLES & CRITERIA TOTAL SUM OF THE WEIGHTINGS ASSIGNED TO RISK FACTORS 8 RSB-STD-0-00-vers..0-RSB Standard for risk management 9

20 0 Roundtable on Sustainable Biofuels. All rights reserved. Annex Risk evaluation potential extent of damage resulting from deficient implementation of a risk factor (extremely high) (very high) (high) (medium) (low) (very low) the probability of uncovering deficient implementation of a risk factor (extremely low) (very low) (low) (medium) (high) (very high) small entities: < 0.0 % of the total size of the sector across the region /regions of the medium entities: > 0.0 % of the total size of the sector across the region/regions of the large entities: > 0. % of the total size of the sector across the region/regions of the Where for a risk factor only a single set of indicators is given the shall apply this set of indicators to determine the respective risk class. This applies to risk indicators.;.;.;.;.;.8;.;.;.;.7;.;.;.;.;.;.. Where for a risk factor separate alternative indicator sets are given for small entities and/or medium entities and/or large entities, the shall evaluate for this risk factor the indicator set appropriate to the operation(s) under his control. This applies to risk indicators.;.7;.0;.;.. Where two or more complementary sets of indicators are provided for a risk factor, the shall evaluate each complementary set of indicators separately and average the resulting risk classes to determine the risk class for the respective risk factor. This applies to risk indicators.7;.9;.0;.;.;.;.8;.9;.0. region is defined here as the sub-national legislative division (also referred to as sub-national state, etc.) RSB-STD-0-00-vers..0-RSB Standard for risk management 0

21 0 Roundtable on Sustainable Biofuels. All rights reserved..... total size of total size of the is > 0. % of the total size of the sector across the region/regions where the is located total size of the is > 0.0 % of the total size of the sector across the region/regions of the is located total size of the is < 0.0 % of the total size of the sector across the region/regions where the is located... legal entities are small entities controls a high number of legal entities (more than 00) controls less than 00 legal entities controls less than 000 legal entities controls less than 00 legal entities controls less than 00 legal entities controls only one legal entity.. legal entities... legal entities are medium entities controls a high number of legal entities (more than 00) controls less than 00 legal entities controls less than 0 legal entities controls less than 00 legal entities controls less than legal entities controls only one legal entity... legal entities are large entities controls a high number of legal entities ( or more) controls less than legal entities controls less than legal entities controls less than 0 legal entities controls less than legal entities controls only one legal entity RSB-STD-0-00-vers..0-RSB Standard for risk management

22 0 Roundtable on Sustainable Biofuels. All rights reserved... geographic spread of the operation controls operations in more than 0 different countries on more than two different continents controls operations in less than 0 different countries on more than two different continents controls operations in less than 0 different countries on two continents only controls operations in less than different countries on one continent only controls operations in less than different neighboring controls operations in one countries on one continent country only only.. operational sites controls more than operational sites per legal entity controls less than operational sites per legal entity controls less than 0 operational sites per legal entity controls less than operational sites per legal entity controls less than operational sites per legal entity controls only one operational site per legal entity.. operational facilities controls an average of more than facilities per operational site controls an average of less than facilities per operational site controls an average of less than 0 facilities per operational site controls an average of less than facilities per operational site controls an average of less than facilities per operational site controls an average of facility per operational site RSB-STD-0-00-vers..0-RSB Standard for risk management

23 0 Roundtable on Sustainable Biofuels. All rights reserved... internal processing steps controls a high number of internal processing steps (more than ) per operational site controls a low number of internal processing steps (less than ) per operational site controls a low number of internal processing steps (less than ) per operational site controls a medium number of internal processing steps (less than 0) per operational site controls a low number of internal processing steps (less than ) per operational site controls a low number of internal processing steps (less than ) per operational site.7... legal entities are small entities sub-contractors engaged in 0% or more of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in less than 0% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in less than 0% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the.7. subcontractors.7... legal entities are medium or large entities sub-contractors engaged in more than 80% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in more than 0% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in less than 0% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in less than % of the legal entities, operational sites, operational facilities and internal processing steps controlled by the sub-contractors engaged in less than 0% of the legal entities, operational sites, operational facilities and internal processing steps controlled by the RSB-STD-0-00-vers..0-RSB Standard for risk management

24 0 Roundtable on Sustainable Biofuels. All rights reserved legal entities are small entities total number of personnel engaged by subcontractors in the operation(s) of the is 7% or more of the total number of personnel employed in the operation(s) controlled by the total number of personnel engaged by sub-contractors in the operation(s) of the is less than 7% of the total number of personnel employed in the operation(s) controlled by the. total number of personnel engaged by sub-contractors in the operation(s) of the is less than % of the total number of personnel employed in the operation(s) controlled by the. total number of personnel engaged by subcontractors in the operation(s) of the is less than 0% of the total number of personnel employed in the operation(s) controlled by the.7... legal entities are medium or large entities total number of personnel engaged by subcontractors in the operation(s) of the is more than 7% of the number of personnel employed in the operation(s) controlled by the total number of personnel engaged by sub-contractors in the operation(s) of the is 0% or more of the total number of personnel employed in the operation(s) controlled by the total number of personnel engaged by subcontractors in the operation(s) of the is less than 0% the total number of personnel employed in the operation(s) controlled by the total number of personnel engaged by sub-contractors in the operation(s) of the is less than % of the total number of personnel employed in the operation(s) controlled by the. total number of personnel engaged by sub-contractors in the operation(s) of the is less than 0% of the total number of personnel employed in the operation(s) controlled by the. total number of personnel engaged by subcontractors in the operation(s) of the is less than 0% of the total number of personnel employed in the operation(s) controlled by the.7.. all legal entities sub-contractors engaged primarily on an activity basis no continuity sub-contractors engaged primarily on a project by project basis little continuity sub-contractors engaged for more than year on average some continuity sub-contractors engaged for more than consecutive years on average decent continuity sub-contractors engaged in the long term for more than consecutive years on average good continuity sub-contractors engaged in the long term for more than 0 consecutive years on average excellent continuity RSB-STD-0-00-vers..0-RSB Standard for risk management

25 0 Roundtable on Sustainable Biofuels. All rights reserved..8. partial compliance with RSB standards less than 0 % of the operations controlled by the comply with the RSB standards less than % of the operations controlled by the comply with the RSB standards less than 0 % of the operations controlled by the comply with the RSB standards more than 7 % of the operations controlled by the comply with the RSB standards more than 90 % of the operations controlled by the comply with the RSB standards all operations controlled by the comply with the RSB standards.9. parallel acquiring, handling, and forwarding of RSB compliant and noncompliant biomass/biofuels acquires, handles, and forwards RSB compliant biomass/biofuels at irregular intervals on a case by case basis repeated incidents of discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; acquires, handles, and forwards on a regular basis < 0% RSB compliant biomass/biofuels and > 90% non-compliant biomass/biofuels isolated incident of discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; acquires, handles, and forwards < 0% RSB compliant biomass/biofuels and > 0% non-compliant biomass/biofuels no discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; acquires, handles, and forwards > 0% RSB compliant biomass/biofuels and < 0% non-compliant biomass/biofuels no discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; acquires, handles, and forwards > 90% RSB compliant biomass/biofuels and < 0% non-compliant biomass/biofuels no discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; acquires, handles, and forwards only RSB compliant biomass/biofuels no discarding of RSB compliant biomass/biofuels material within the past months because of deficient tracking; RSB-STD-0-00-vers..0-RSB Standard for risk management