Due diligence for processors

Before you process Australian grown raw logs, you must have a written due diligence system that lists the steps you are going to take to minimise the risk of processing illegally harvested logs.

Your due diligence system must include:

1. Your details, including: business name (where applicable), street and postal address, contact number and email address.
2. If you process logs through a business, your ABN/ACN, and a description of your main business activity.
3. The name of the person in charge of the due diligence system, and their contact details.
4. The steps you will take to minimise the risk of processing illegally logged timber.

Your due diligence system should be easy to understand and follow. It will help you make decisions about how to act before you process a log.

The department has published a guide for establishing a due diligence system for processors.

If you change your due diligence process, you should also update your due diligence system.

If you are audited you will be asked to provide a copy of your system to the department, which will be assessed for compliance against season 18 of the Regulation.

Before you process Australian grown raw logs, you need to attempt to gather information about it concerning the risk of illegal logging.

You need to gather as much of the following information as is reasonably practicable to obtain:

• A description of the logs, including the name (common or scientific) of the tree it came from.
• The State/Territory and forest harvesting unit where the logs were harvested.
• The quantity of raw logs to be processed (in volume, weight or number).
• Details of your supplier, including name, address, trading name, and ABN/ACN.
• Documents provided by your supplier for the log’s purchase.
• If a Timber Legality Framework (PEFC or FSC) applies to the raw logs, a copy of the applicable licence or certificate.
• If a State Specific Guideline applies to the raw logs, the information relating to the product that the document requires importers to obtain.
• Further evidence that can demonstrate the raw logs were not illegally logged including, but not limited to:
  • Whether the harvesting is prohibited in the source location.
  • Whether the legislative requirements concerning the harvest of the logs have been met.
  • Whether payment was made for the timber harvesting rights (where applicable).
  • Whether harvest was consistent with the use and tenure rights (where applicable).

Many of the details about the raw logs may be found in existing commercial documents, contracts or invoices. However, you may need to work with your supplier to gather more information, documents, or evidence.

Additional resources are available to assist with gathering further contextual information.

How you gather the necessary information is up to you. This could include: phone calls, emails, online research, questionnaires sent to suppliers or site visits, among other approaches.

The law requires you to gather as much of the above-listed information about the product as it is ‘reasonably practicable’ to obtain. In determining what is reasonable, you should consider: the availability of the required information; the time, expense and difficulty in gathering the information; and the steps required to gather the required information.

If you can’t answer basic questions about your logs, such as what species it is and where it was grown, it will be difficult to conclude that it is low risk (see Step 3).

If audited, you will need to be able to show that you have obtained as much information as was reasonably practicable to. You must keep a record of the information you gather, for at least five years from the day the raw logs are processed.

Australia’s illegal logging laws provide three methods to do this:

• Timber Legality Framework (TLF) risk assessment
• State Specific Guideline (SSG) risk assessment
• Regulated Risk Factors (RRF) risk assessment

You need to use one of these methods to carry out your initial risk assessment. Further information on each of these methods is provided below. We have also provided comprehensive risk assessment templates below to guide you through each of the steps involved in applying each method.

The method that you use will depend on the circumstances surrounding your raw logs. However, the first two methods can only be used where your raw logs meet certain requirements. The third method can be used in all circumstances.

Each method requires you to come to a risk conclusion. You need to consider all the information you know of, or should know. This means you cannot ignore relevant information when coming to your risk conclusion.

This includes assessing information gathered in Step 2. Consider:

• Have you been able to obtain sufficient information to inform your risk assessment?
• Do the classification of species, quantities, and qualities match across the documentation?
• Can the claims made in the information gathered be verified with evidence?

If you have been unable to obtain enough information about the species of timber and where it has come from, it will be difficult to conclude that the product is low or nil risk.

Your risk conclusion needs to be reasonable and supported by the information that you have gathered. If audited, you will be asked to justify your risk conclusion.

If, after completing the risk assessment, you conclude that your product is low or nil risk, then you can move to the record keeping step and finalise your due diligence steps for the raw logs. However, if you have assessed the risk as greater than low, you will need to take further steps this. If you used the Timber Legality Framework risk assessment method or the State Specific Guidelines method, you must complete a subsequent risk assessment using Regulated Risk Factors. If the risk is still greater than low, you must take the risk mitigation steps set out in Step 4 (see below).

Additional resources are available to help with your risk assessment.

You can use this risk assessment method when the logs you are processing are certified under the:

• Forest Stewardship Council (FSC), or
• Programme for the Endorsement of Forest Certification (PEFC)

In Australia, PEFC certified logs are likely to be certified under the Responsible Wood Certification Scheme. Responsible Wood are the Australian member of PEFC.

This method recognises that the FSC and PEFC certification schemes provide rigorous forest management and chain of custody standards that consider risks of illegally logged timber.

If you use this method, you need to do two key things:

1. Confirm your supplier and the logs you are processing are certified (see below).
2. Consider the information gathered in Step 2 to determine if anything else suggests the logs have come from illegal sources.

If you can confirm that the logs are certified, and are not aware of any other information that suggests that they come from an illegal source, you can assess the risk as low and proceed with processing.

A common mistake is assuming that your logs are certified because your supplier is certified. A certified supplier can still deal in non-certified logs. There is also a risk that your supplier may be falsely claiming that their logs are certified.

If you find that your supplier or logs are not certified, you must choose a different risk assessment method (see option 3B or 3C).

How to use the TLF risk assessment method

When using this method, there are five steps you need to follow:

1. Check the supplier’s certification number
2. Check if the certificate is valid for the period of supply
3. Check if the products or species being supplied are listed
4. Check if the product is certified
5. Consider any other information that may indicate illegality of harvest

If you can confirm that the logs are certified and you are not aware of any other information that suggests that they come from an illegal source, you can assess the risk as low or nil and proceed to the subsequent due diligence steps.

We provide a comprehensive TLF risk assessment template below that guides you through each of these steps. We encourage you to use this to assist you when using this risk assessment method.

You can use this risk assessment method when you are processing logs from an Australian state with a State Specific Guideline (SSG).

SSGs have been developed by the federal government with each state government. They help you understand:

• the legal frameworks that regulate timber harvesting in each state
• relevant documents you should obtain to demonstrate harvest legality

The SSGs may also provide helpful information on timber transportation and processing requirements.

How to use the SSG risk assessment method

In using a SSG to conduct your risk assessment, there are four steps to follow:

1. Decide if an SSG applies to the raw logs you are processing
2. Assess the information you have gathered against the SSG
3. Consider any factors that the SSG may not account for
4. Consider any other information that may indicate illegality of harvest

We provide a comprehensive SSG risk assessment template below that guides you through each of these steps. We encourage you to use this to assist you when using the SSG risk assessment method.

You can use this risk assessment option when processing any Australian grown raw logs.

By using the risk factors, you should be able to make a reasonable determination of whether the logs are likely to have come from illegal sources.

In using the regulated risk factors, you may need to do additional research. There are additional resources to help with your risk assessment.

How to use the RRF risk assessment method

There are three key steps to this method:

1. Consider the prevalence of illegal logging in the area in which the logs were harvested
2. Consider the prevalence of illegal harvesting of the species of tree from which the logs are derived
3. Consider any other information that may indicate illegality of harvest

If you have assessed the risk and decided that the logs are a low or nil risk of being illegally harvested, you have completed your due diligence. You must document your risk conclusion and meet your record keeping requirements..

If you have assessed the risk as greater than low, you must take additional actions to mitigate the risk before you are able to process the raw logs. This is explained in Step 4 (below).

We provide a comprehensive RRF risk assessment template below that guides you through each of these steps. We encourage you to use this to assist you when using the RRF risk assessment method.

Case Study

Antonia is using the Regulated Risk Factors method (Option 3C) to conduct a risk assessment on some logs she plans to process. Working her way through the risk factors, Antonia uses several online resources to research whether illegal logging is a problem in the area of harvest, and whether the species of wood in the logs is regularly illegally logged. In doing her research, Antonia finds nothing to suggest the logs have come from illegally logged sources. Drawing on this research and the information she originally gathered from her supplier in Step 2, Antonia concludes the logs are low risk. She records this conclusion and arranges to purchase and process the logs.

If you are not able to conclude that your product is low or nil risk after assessing risk via the Regulated Risk Factors you need to take reasonable steps to mitigate the risk before you process them.

How you mitigate the risk is up to you. It will depend on your individual circumstances.

You may need to do more research, such as:

• ask for more evidence or information from your supplier
• ask your supplier for a certified alternative
• visit your supplier to learn more about their supply chains
• start a regular audit process, such as a detailed supply chain audit or onsite supplier audit

Your risk mitigation may involve not processing the raw logs. You may need to consider sourcing different logs, or even changing suppliers.

Regardless of the steps you take, your mitigation efforts need to be adequate and proportionate to the identified risk.

Once you are satisfied that you have reduced the risk to a low level of being illegally harvested, you must keep records to show the steps you have taken.

If you were to process any logs that are later found to have been illegally harvested, you could face serious penalties.

You must keep records covering all the steps you took in the due diligence process. This includes records of all information and evidence gathered as part of your due diligence. Records can be kept digitally or on paper. They must be maintained for at least five years after processing.

Your records should clearly state:

• your due diligence system (Step 1)
• the information gathered (Step 2)
• your risk assessment process and conclusion (Step 3)
• where applicable, how you attempted to mitigate the risk (Step 4)

We may audit your records. Learn more about our compliance audits.

No. You do not have submit your due diligence information to the department each time you process domestically grown raw logs. However, this information must be provided to the department, if requested for compliance purposes, and you must keep a written record of your due diligence process.

The legislation requires that each time a processor processes a raw log, they complete the due diligence process set out in Part 3, Division 1 of the Regulation. Where a processor has previously processed the same kind of raw logs, they must first verify that none of the information relating to the raw logs previously gathered, or required to be gathered under section 19, has changed. This could include the harvest location or product certification number. A record of having done this must be created that references to the original due diligence assessment process relied upon.

Where no changes have occurred, processors can utilise the previous risk assessment and mitigation process undertaken for the raw logs, and keep a record of having done this. Where any element has changed, the importer must repeat the risk assessment and mitigation steps at sections 20 – 23 of the Regulation, and keep records of having done this.

No. While such a statement can help inform your risk assessment, it is not sufficient evidence to satisfy your due diligence requirements.