Chain of Custody of Forest Based Products - Guidance for Use, PEFC GD 2001:201X, Enquiry Draft - Public Consultation

Chain of Custody of Forest Based Products - Guidance for Use, PEFC GD 2001:201X, Enquiry Draft

5 Minimum Due Diligence System (DDS) requirements

The PEFC DDS is embedded in the main body of the standard and applies to all organisations that use the PEFC Chain of Custody standard and also certified material is subject to the PEFC DDS. However, input material with a PEFC claim is exempt from the risk assessment thereby generally limiting the PEFC DDS for PEFC claimed material (PEFC Certified and PEFC Controlled Sources) to the gathering of information.

This answers to the growing demand of increasing transparency in supply chain. Through legislation such as the EUTR, US Lacey Act and the Australian Illegal Logging Act it is demanded that organisations take “due care” or “due diligence” when sourcing wood based products. A key element is the availability of relevant information on, amongst others, the origin and the tree species of supplies. The PEFC DDS is the mechanism that provides the access to this information at any point in the PEFC certified supply chain.

The PEFC DDS is the mechanism that avoids material from controversial sources entering into the PEFC Chain of Custody and ultimately in products with a PEFC claim and carrying the PEFC logo. As such the PEFC DDS is crucial in protecting the credibility of PEFC and delivering transparency. The PEFC Chain of Custody can only deliver the promise of “originating in sustainably managed forest, recycled and controlled sources” if input material tells a credible story: from a known origin and composition and without risk of coming from controversial sources.

1.      Just as the EUTR, the PEFC DDS uses the principle of minimizing the risk that controversial material enters chain of custody. This principle works on the basis of three steps: Gathering of information (clause 5.2).

2.     Risk assessment (clause 5.3).

3.     Risk mitigation (clause 5.5 & 5.6).

Lastly, clause 5.4 deals with substantiated comments and complaints. Even though it is placed between the second (risk assessment) and third step (risk mitigation) it should not be seen as a step between. The organisation shall at any time be aware off, and act upon, any substantiated concerns.

5.1       General requirements

The PEFC DDS has to be implemented for all input material entering the organisation’s PEFC Chain of Custody. Any material outside this scope is not subject to the PEFC DDS. An organisation that has implemented the chain of custody for a specific part of its production has to implement the PEFC DDS only for the materials that are used as an input into this process.  Normally the scope would be limited to the production of PEFC Certified products.

However, the PEFC Controlled Sources claim enables the organisation to make a claim on non-PEFC Certified products for which the PEFC DDS was implemented. The organisation can therefore consider extending its scope beyond the production of PEFC Certified products. See also Figure 3 and Figure 4.


To encourage recycling and to avoid a disproportionate burden on organisations as it is practically impossible to retrieve the origin and species information on recovered material, material from a recycled origin (see clause 3.24) is exempt from the PEFC DDS requirements.

Material with PEFC claim (X% PEFC Certified and PEFC Controlled Sources) is not exempt from the PEFC DDS. For example, the requirements on the gathering of information have to be fulfilled for PEFC certified material. The material with PEFC Claim is however exempt from the risk assessment.


Supplies including species that are listed in the CITES appendices 1, 2 or 3 shall be accompanied by the applicable export permit(s) and/or licenses. For more information consult the CITES website at A searchable database including all species listed in the CITES appendices can be accessed at


For more information on UN sanctions visit For more information on EU sanctions visit (Currently no timber sanctions).

Note: Sanctions that are not applicable to the organisation are for example national government sanctions outside the organisation’s own country. E.g. a sanction by the government of Sweden on timber imports from Denmark would not affect a German organisation.


For more information on the prevalence of armed conflicts worldwide visit, the Armed Conflict Database of the International Institute of Strategic Studies.

5.2       Gathering of information

The gathering of information is the first basic step in the PEFC DDS. The purpose is to receive information about the supplies’ origin and tree species which can be used in the subsequent risk assessment. Without this information it is not possible to assess the risk on origin level. (see 5.3 Risk Assessment).

The standard requires the organisation to have “access to the following information”. This means that the ‘access to information’ is the minimum required level. It does not require the organisation to have the information physically available when it is not necessary. The organisation shall have at least a procedure in place that enables them to get the information from its supplier when needed. The procedure has to be coordinated with and confirmed by the supplier. The procedure and the confirmation shall be documented.

An organisation is affected by this requirement in two ways:

  • First, as the purchaser of material used as input into their PEFC Chain of Custody, they will need to arrange the access to information with the supplier.
  • Second, as the supplier of material to a PEFC certified customer, they will be asked by their PEFC certified customer to provide (access to) the information.
  • The organisation should further consider that their own supplier may have a similar agreement in place to have the access to information from their supplier.

Organizing access to information

The standard does not specify detailed requirements on the way the access to information has to be organized. The supplier and the organisation are free to arrange the procedure for the access to/transfer of information in a suitable manner. It can include other means than transferring the information physically, like making reference to (external) online/web-based information source. This allows for the implementation of procedures that allow for efficient access to information throughout supply chains.

Figure 11 shows an example: A supply chain could be organized in such a way that the information on the tree species and origin is available at the manufacturer’s website, in the form of a product information sheet, or perhaps an external database. All subsequent organisations in the chain would refer back to this central source where the information can be accessed if necessary.

The new PEFC Registration and Information can be used as a tool for the provision of the information.

fig. 11

Providing information

When the organisation is asked to provide information on the origin and tree species to a PEFC certified customer, or when the supplier provides the information to the organisation they can apply the following principles:

Accumulating information

The information provided can include multiple tree species and multiple sources of origin. It is not necessary to specify the exact contents or shares of the different species and/or origins. It is not necessary to link the tree species and the origin information, unless a certain tree species’ risk differs between countries.

Information on potential origins and tree species

Where it is difficult to give the exact information on tree species and origin (e.g. in paper and panel production) the information can include all potential species and origins. This information should include the species that could normally be included in the product. It is not the purpose to include species that may have a risk of accidentally ending up in the product, unless there would be a high risk of unintended species ending up in the product.

Example: a panel manufacturer normally purchases a mixture of Spruce, Pine and Birch. However, in its production process it is not able to exactly specify the composition for each produced batch. The information it provides may include all three species even if a specific batch would only include two of those species. The same manufacturer also wishes to include a list of 50 other species that may have a low risk of accidentally ending up in the product. This information he does not need to provide. 

Note 3

Information about sub-national level is particularly important when the country as a whole might indicate “significant risk” but the governance level in a certain region is known to be effective in preventing illegal harvesting. In some countries for example research has identified significant differences between regions. As such, material from one region may be accepted as having a low/negligible risk, but material from the other regions would still have a significant risk. Clearly, the condition to accept the material is to have the information on the region of origin.


The mandatory requirement for a self-declaration in the context of the Due Diligence System was removed in the 2013 version. In the 2010 version the following content was required:

(a)     a written statement that to the best of the supplier’s knowledge the supplied material does not originate from controversial sources,

(b)     a written commitment to provide information on the geographical origin (country / region) of the supplied raw material which is necessary information for the organisation’s risk assessment,

(c)     a written commitment that, in the case where the supplier’s supplies are considered as “high” risk, the supplier will provide the organisation with necessary information to identify the forest management unit(s) of the raw material and the whole supply chain relating to the “high” risk supply.

(d)     a written commitment, where the supplier’s supplies are considered as “high” risk, the supplier will enable the organisation to carry out a second party or a third party inspection of the supplier’s operation as well as operations of the previous suppliers in the chain.

The requirement was deleted since the organizations should have a higher flexibility how to organise the data flow and the business relation between organization and supplier. Nevertheless, a self-declaration would still be a useful tool for an organisation to arrange the access to information.

Table 2 shows some examples which elements can be included in a self-declaration.

table 2

5.3       Risk assessment

The purpose of the risk assessment, the second step in the PEFC DDS, is to determine the risk associated with a specific supply. The assessment is based on the information provided by the supplier. In order to carry out the risk assessment it is therefore necessary to have the information on origin and tree species available. The basic principle of the risk assessment is shown in Figure 12. The overall risk, classified as “negligible” risk or “significant” risk, is determined by the combination of two “likelihoods” (clause 5.3.3):

a)     An assessment of the likelihood that activities under the definition of controversial sources occur in the country/region/FMU of origin or are associated with the specific tree species of the supply. Indicators for a high likelihood are presented in Table 2 of the standard.

b)    An assessment of the likelihood that any supply from a controversial source is identified in the supply chain. Indicators for a high likelihood are presented in Table 3 of the standard.

Whereas the indicators in Tables 2 and 3 (of the standard) represent a high likelihood (if one of those indicators applies the overall risk will be significant) the indicators in Table 1 of the standard represent the combination of a low likelihood on the origin and a low likelihood on the supply chain level. Hence, looking at Figure 12, these indicators establish negligible Risk. Further, Table 1 overrules the other tables.

fig. 12


Two types of material/products are exempt from the risk assessment:

(a)   Material delivered with X% PEFC Certified claim

(b)   Material delivered with PEFC Controlled Sources claim

For both material types any possible risks of controversial sourcing have already been effectively mitigated, provided that no substantiated comments or complaints have been raised on the specific supply (see clause 5.4). Being exempt from the risk assessment does not mean that these materials are exempt from the PEFC DDS as a whole. The requirements in clauses 5.1 5.2, 5.4 and onwards still apply to material with a PEFC claim.

Carrying out the risk assessment

The wording of clause 5.3.6 indicates that the risk assessment does not have to be repeated for identical supplies/shipments by the same supplier. On an annual basis the risk assessment has to be reviewed and if necessary revised (for example when the CPI of the country has passed the threshold of 50).Whenever one of the characteristics of a supply by the same supplier changes, e.g. another country of origin, another tree species, another type of product, the supply has to be considered as a ‘new’ supply by this supplier and the risk assessment has to be performed.

Example: An organisation has a fixed contract with one supplier for a weekly supply of Birch from Hungary. The organisation should then only carry out the risk assessment for the first delivery and afterwards review and revise the risk assessment on an annual basis.

The standard provides a range of indicators to be used for the risk assessment. Figure 13 contains the general approach on how to use the indicators and carry out the risk assessment:

fig. 13


The three tables of clause 5.3.5 present the indicators that are used to determine the respective likelihoods. In the tables below there are additionally references, examples and explanations that can be used to assess the specific indicators. These references are not exhaustive and any other appropriate references can be used.

table 3 part 1

table 3 part 2

table 3 part 3

*special attention has to be given to the assessment of third party certification and verification or licensing mechanism to make sure these systems cover all elements of the PEFC definition of controversial sources. Most notably the elements that could be outside the scope are; the use of genetically modified forest based organisms, the conversion of forest to other vegetation type (including converting primary forests to plantations) and not complying with health and labour issues relating to forest workers.

table 4 part 1

table 4 part 2

CPI: other options

Transparency International’s Corruption Perception Index (TI CPI) serves as a threshold for the analysis of risk on the origin level induced by an inadequate legal framework and law enforcement system in a country. The TI CPI is presented at PEFC is aware that the TI CPI does not always represent the fully correct governance level for forestry. Nevertheless, a threshold as a start for the assessment and the subsequent mitigation is necessary.

Already in the 2010 version of the chain of custody standard PEFC incorporated the following procedure: “On the provision of sufficient evidence that the TI CPI does not reflect the level of corruption in the forest based sector in a specific country scoring less than 5.0, the PEFC Council may make a different determination for this indicator” (PEFC ST 2002:2010, Appendix 2, Table 1). This option is still available under the 2013 version. Hence, either another index can be applied or proof of evidence for a sufficient governance level can be delivered by other means.

Two options are described in the following sections.

1.     Alternative index application

Several other indices delivering information about the level of governance, deviating in some details, exist. TI itself e.g. provides alternative information sources. Such an index accepted by TI could be an alternative to the TI CPI. Table 5 shows an example for Italy. PEFC Italy tried to find an alternative option in cooperation with Transparency International Italy. TI Italy informed PEFC Italy that there are other indices which can be used in the forest sector. Transparency International Italy provided a list with indices which can be used under certain circumstances in various countries/regions.

table 5

If PEFC International has not yet approved an alternative index for a specific country, PEFC certificate holders or PEFC National Governing Bodies can send a request to the PEFC International Secretariat. PEFC International will actively consult with Transparency International regarding potential alternatives for the particular country.

2.     “Area risk assessment”

The TI CPI indicates a specific risk of lack of governance for a specific country based on a quite general analysis of corruption perception of different actors for the whole economy of the country. This general CPI statement can be overruled by a specific risk assessment focusing “on the level of origin” either for the whole country or for a specific region. The following steps constitute such an area risk assessment (equivalent procedures are possible):

1)     A PEFC National Governing Body (or several cooperating bodies) establishes a “Risk Assessment Group” (RAG). The composition of the group (stakeholder representation) should be mirrored from the national standard setting process for the SFM standard. Expertise for the area under assessment shall be represented in the group.

2)     The RAG carries out a risk assessment on the origin level for country or a specific region. The risk assessment has to consider all indicators foreseen by PEFC for the assessment on origin level (5.1.6 – 5.1.9, tree species with prevalence of illegal harvesting, implementation of health and labour rights relating to the ILO Declaration on Fundamental Principles and Rights at Work).

The RAG can e.g. consider, whether and how in the country documentation which clearly identifies

  • country of harvest and/or sub-national region where the timber was harvested (including consideration of the prevalence of armed conflict)
  • trade name and type of product as well as the common name of tree species and, where applicable, its full scientific name
  • all suppliers within the supply chain
  • the forest management unit of the supply origin
  • documents or other reliable information indicating compliance of those timber and timber products with activities referred to by the term controversial sources

is used.

Furthermore, documents as described in Table 3 can be considered in the analysis as well as in a later mitigation.

3)     The risk assessment procedures as well as the result have to be provided to the PEFC International Secretariat. The responsibility for the approval of a submitted area risk assessment lies with the PEFC Council Secretary General. If deemed necessary, an independent consultant with particular country expertise can be assigned with an assessment. The costs have to be covered by the RAG.

4)     After making procedures and result publicly available the results can be used by all actors.

table 6


The option to conduct the risk assessment for multiple deliveries from a specific geographical area has been designed for, but is not necessarily limited to, organisations with large numbers of suppliers that all source from the same geographical area. It prevents an organisation from performing multiple identical risk assessments where only the (known) suppliers are different.

The geographical area on which the risk assessment is based has to be clearly defined. In principle, there is no limitation to the size of the area as long as all the area represents significant risk. For example, the area could be a certain region within one country, a country as a whole, or a certain region across, or spanning, multiple countries.

5.3.8 states that an area orientated risk approach is not possible if one of the indicators in table 2 or table 3 applies. Nevertheless, an organisation can carry out such an assessment if for the critical indicator specific mitigation procedures are established. Table 7 gives some examples.

table 7

5.4         Substantiated comments or complaints

This clause applies again to all materials for which the PEFC DDS is implemented. The material with PEFC claims that is exempt from the PEFC DDS risk assessment has to be in compliance with this clause. The awareness and investigation of substantiated concerns shall be part of the organisation’s procedures on the handling of material with PEFC claims. This ensures that these materials are part of a “risk assessment” in terms of the EU Timber Regulation.

5.5       Management of significant risk supplies

The management of significant risk supplies is necessary if the organisation wishes to accept supplies for which it determined a significant risk in the risk assessment. The purpose of this step is the mitigation of the significant risk to the level of negligible risk, based on additional information provided by the supplier.

The risk assessment will have revealed the specific areas of significant risk. The supplier has to provide additional information to enable the organisation to revise the risk level from significant to negligible. b)

The on-site inspection is only necessary in relevant cases. Clause explains when the on-site inspection can be avoided: “The organisation may substitute the on-site inspection with documentation review where the documentation provides sufficient confidence in the material origin in non-controversial sources.”

In determining the actors and steps in the supply chain and the countries in which the products have been traded it suffices to identify these up to the first point of transparency. This is demonstrated through verification with any of the table 1 indicators.

For example, if the organisation determines that at one point in the supply chain the supply was PEFC Certified, it can assume that the supply chain after that up to the point of harvest is without significant risk.

The on-site inspection of a supplier’s operations is necessary when the review of additional documentation provided by the supplier is not sufficient to determine a negligible risk. The on-site inspection program focusses on suppliers. All suppliers of significant risk have to be inspected. However, not all the supplies from one supplier need to be included in the inspection. From all significant risk supplies by one supplier the organisation shall take a sample to be verified during the on-site inspection.


  • The sampling is based on all significant risk supplies by one supplier
  • If the organisation has received significant risk supplies by multiple suppliers a sample is to be determined for every single supplier
  • Identical shipments/supplies by the same supplier can be considered as one supply.

The sample size (y) is determined as y=√x with (x) being the number of significant risk supplies. The outcome is rounded to the nearest whole number. Please note that the standard specifies two different ways of rounding the sample size. In the second case, which determines the reduced sample size (y=0.8√x), the outcome is rounded up to the next whole number.

Figure 14

In the example in Figure 14 the organisation carries out an on-site inspection at suppliers B and C. The inspection at supplier B deals with one specific supply, whereas the inspection at supplier C deals with two supplies.

5.6       No placement on the market

There is a clear distinction between material that shall not be included in the organisation’s PEFC Chain of Custody and material that shall not be placed on the market. The difference lies in the fact that the PEFC definition of controversial sources goes beyond the definition of illegal harvesting in the EU Timber Regulation.

For example an organisation receives a supply that originates in a conversion of forest to other land use (e.g. agricultural development) in compliance with the national legislation. From the EUTR perspective this supply is legally harvested and can be placed on the market as such. From the PEFC perspective this supply is from a controversial source and cannot be included in their Chain of Custody.