Guidance for processors

​​​​[Expand all]

Step 1 - Gather information

Prior to processing logs, you must endeavour to gather information that will give you confidence that they were legally logged. 

How you gather the information is up to you (contract, supplier questionnaire, letters, etc.). Regardless of the approach you use, you must maintain records of your request for information along with the information you have gathered. Information does not need to be sought for each individual log, rather information can be sought for each contract, each delivery or any other suitable means.

The type of information that you must endeavour to gather includes:

  • a description of the logs, including:
  • the common name, genus or scientific name of the tree/s from which the logs are derived; and
  • the area in which the logs are harvested, including the State or Territory and the forest harvesting unit;
  • the name, address, trading name, business and company registration number (if any) of the supplier of the logs;
  • the quantity of raw logs to be processed, expressed in volume, weight or number of units
  • the documentation provided, or that will be provided, by the supplier in relation to the purchase of the logs;
  • evidence that the logs have not been illegally logged, which may include evidence about:
  • whether the harvesting of the species of tree from which the logs are derived is prohibited in the place where the logs have been harvested; and
  • if the harvesting of the logs in the place is authorised by legislation (including regulations)—whether the requirements of the legislation have been met for the harvesting of the log; and
  • if payment is required for the right to harvest the logs—whether that payment has been made; and
  • if a person has legal rights of use and tenure in relation to the place in which the logs are harvested—whether the harvest of the log is inconsistent with the law establishing or protecting those rights.

You are required to gather information about the logs that is reasonably practicable for you to obtain. That is while you must endeavour to collect all the above information, the department understands you may not be able to obtain all of the above information in every instance.

Step 2 – Undertake a risk assessment

Once you have gathered all the information about your logs that you can reasonably gather, you need to use this information to undertake a risk assessment. You can use the template below to do this. The template contains the factors that you must consider as part of your risk assessment.

If you are buying Forest Stewardship Council (FSC) or Programme the Endorsement of Forest Certification (PEFC) (including Australian Forestry Standard (AFS) certified logs, you are not required to undertake a full risk assessment rather you can rely on the certification to address the risk. You should maintain copies of delivery dockets (or other suitable information) that demonstrates the logs were derived from certified forest. You also need to consider any other information that may indicate that the logs were harvested illegally.

If a state spe​cific guideline applies to the place in which the logs are harvested—the guideline sets out information or evidence that can be used to support the legality of the logs (such as certificates, licences or other documents).

Risk Factor

Risk identification
(low, medium, high)

(reason for your low, medium, high)

1. What is the prevalence of illegal logging in the area in which the logs are harvested?

*The most important thing to be mindful of when considering this factor is that you know where your logs are being sourced from. An indicator that something isn’t right might be that the timber is harvested from a known protected area.

2. What is the prevalence of illegal harvesting in the area of the species of the logs?

*Try to determine the species of timber you are processing. Indicators that something isn’t right might be that the species doesn’t grow in the area your supplier says it does or that the species is listed as ‘vulnerable’ or ‘threatened’ under State or Commonwealth legislation.

3. Do you know any other information that may indicate whether the logs were illegally logged?

*This factor requires you to consider any additional information that you may be privy to that indicates the timber was illegally logged. Indicators that something isn’t right might be:

  • Forged, inconsistent or missing documents
  • The supplier is known to deal with illegally logged timber
  • Timber has been harvested in a protected area



If you have concluded the risk to be low, you have completed your risk assessment and can process the logs. Maintain this record as evidence you have completed a risk assessment for 5 years from the day the log is processed.

If you have concluded the risk to be higher than low you must mitigate the risk. Refer to step 3.


DocumentPagesFile size
Risk assessment te​mplate PDF1241 KB
Risk assessment template DOCX122 KB

If you have difficulty accessing these files, please visit web accessibility.

Step 3 – Risk mitigation

Risk mitigation is only required when you have undertaken your risk assessment and you have determined the risk to be higher than low.

The type of risk mitigation you undertake is flexible. However, it needs to be adequate and proportionate to the identified risk.
For example, you may decide to request additional evidence or information from your supplier as to the logs’ legality or its origin. You could also potentially ask them to provide you with a certified alternative (if available), undertake audits of the supply chain or consider changing suppliers.

Once you have applied your risk mitigation, you must document what you have done and show how the mitigation action has reduced the overall risk of the logs having been logged illegally.

If you are unable to mitigate the risk adequately and proportionately to the identified risk you must not process the logs or you risk being fined or higher penalties if the logs are eventually found to have been logged illegally.

Due Diligence System requirements

As part of the requirements, you are required to have a ‘due diligence system’ in place. Processors are responsible for implementing and maintaining a due diligence system.

The due diligence system must set out the process by which you will meet the due diligence requirements and contain your business details such as ABN, address and the details about the person responsible for maintaining the system.

More information and free templates can be found on Illegal Logging.

For further information on how the laws operate and whether they affect your business, you can contact the department via:

  • phone the department during business hours on 1800 657 313 or if outside of Australia +61 2 6272 3933
  • email Illegal logging
  • subscribe to the illegal logging mailing list to stay informed of the release of any new information or guidance materials or any upcoming information events