Framework overlap

Does ISO/IEC 23894:2023 cover German Supply Chain Due Diligence Act (LkSG)?

You hold ISO/IEC 23894:2023 and have been told to do German Supply Chain Due Diligence Act (LkSG). Here is how much overlaps, control by control.

36% of German Supply Chain Due Diligence Act (LkSG) you already have

ISO/IEC 23894:2023 already covers about 36% of German Supply Chain Due Diligence Act (LkSG), leaving 7 of 11 controls as genuinely new work.

Already covered 3 Likely covered 1 New work 7

What is genuinely new work

Nothing in ISO/IEC 23894:2023 reaches these. This is the list to scope.

LkSG-BAFA-Enforcement-Sanctions
BAFA Enforcement, EUR 8M + 2% Sanctions and Public Procurement Exclusion
LkSG-Coord-Hinweisgeberschutz-Sectoral
Coordination with German Whistleblower Protection (HinSchG), Sectoral Frameworks and ESG
LkSG-Crosswalk-CSDDD-UNGPs-OECD
Crosswalk to EU CSDDD, UN Guiding Principles, OECD MNE Guidelines and German NAP
LkSG-EU-CSDDD-Coordination-Status
EU Corporate Sustainability Due Diligence Directive (CSDDD) Coordination + LkSG 2024-2025 Status
LkSG-HumanRights-Environmental-Risks
Protected Human Rights + Environmental Risks (Sections 2(2)-(3))
LkSG-Implementation-Roadmap-Org
LkSG Compliance Program Implementation - Organizational Roles, Tooling and Metrics
LkSG-Scope-Threshold-GroupCascade
Scope, Applicability Thresholds (>3,000 then >1,000 employees) and Group Cascade
Show the 4 you already have
LkSG-Sec4-RiskMgmt-Sec5-RiskAnalysis
Section 4 Risk Management System + Section 5 Annual Risk Analysis
LkSG-Sec6-Policy-Preventive
Section 6 Policy Statement and Preventive Measures (Own + Direct Suppliers)
LkSG-Sec7-IndirectSupplier-Sec8-Remedial
Section 7 Indirect Supplier DD + Substantiated Knowledge Trigger + Section 8 Remedial Action
LkSG-Sec9-Complaints-Sec10-Doc-Report
Section 9 Complaints Procedure + Section 10 Documentation + Annual Reporting

How this is calculated

Already covered means a mapping runs from a control in ISO/IEC 23894:2023 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition