Due diligence for importers

As an importer, you are required to have a written due diligence system before you import regulated timber products into Australia (s 13A of the Act; s 7 of the Rules).

The due diligence system must include:

1. The importer’s name, street and postal address, contact number and email address.
2. If the importer is not an individual, the name, position and contact details (including telephone number and email address) of the person responsible for maintaining the system.
3. If the regulated timber products are to be imported in connection with a business, the importer’s ABN and ACN (if any), and a description of your main business activity.
4. The process the importer will take to meet the due diligence requirements for importing regulated timber products.

Your due diligence system should be easy to understand and follow. It will help you make decisions about what to do each time you import a regulated timber product. If you change your due diligence process, you should also update your due diligence system.

In certain circumstances the Secretary may request information or documents, or require an audit to be carried out. If you are audited or issued with a Request for Information notice, you may be asked to provide a copy of your due diligence system to us for review, which will be assessed for compliance against the requirements in the Act and the Rules.

Before importing your product, you should first check if your product is a regulated timber product – as defined in the Rules (s 5). If so, your product may be subject to due diligence requirements.

However, you should first check to see if your product/s are exempt from the due diligence requirements (s 6 of the Rules).

Regulated timber product/s are exempt where:

• the timber product is recycled material
• the timber product is entirely made from recycled material
• where all timber, and products derived from timber, included in the regulated product are recycled material
• they are imported as part of a consignment if the total customs value of the regulated timber products in the consignment, on import, does not exceed $1,000.

For products that are partially made from recycled material, the due diligence requirements do not apply to the recycled parts of the product (s 8(2) of the Rules).

For the purposes of the illegal logging laws, recycled material does not include by-products of manufacturing processes, for example off-cuts from sawn timber used to make particle board or medium density fibreboard.

While these products are exempt from the due diligence requirements, if you are issued a Request for Information notice, you will be expected to provide information or documents that are relevant to:

• your due diligence system in place at the time you imported the regulated timber product
• your compliance with the due diligence requirements for importing regulated timber products.

This could include information that demonstrates you determined the product was exempt before it was imported into Australia.

For more information about regulated timber products, and the exemptions, visit the Regulated timber products webpage.

Before you import a regulated timber product, you need to gather specific information about the timber in the product.

You must obtain as much of the following information as it is reasonably practicable to obtain, before each occasion you import a regulated timber product (Rules s 8(3)):

• A description of the product, which includes:
  • the type and trade name (if any) of the product
  • the common name and scientific name of the tree from which the timber, or the timber in the product, was derived.
• The country, and the area of the country, in which the timber, or the timber in the product, was harvested.
• The country in which the product was processed or manufactured, if applicable.
• Details of your supplier, including the name, address, trading name, and business registration number (if any) of the supplier of the product.
• The quantity of the shipment of the product being imported (expressed in volume, weight or number of units).
• The sales or delivery document in relation to the purchase of the product by the importer.

Many of these details about your product may be found in existing commercial documents, contracts, or invoices. However, you may need to work with your supplier to gather more information, documents, or evidence.

How you gather the prescribed information is up to you. This could include phone calls, emails, online research or questionnaires sent to suppliers, among other approaches.

The law requires you to gather as much of the above-listed information about the product as it is ‘reasonably practicable’ to obtain. In determining what is reasonably practicable, you should consider what information is possible to obtain and what information is reasonably able to be gathered given the specific circumstances for the product being imported.

Where applicable, the onus is on you as the importer to prove that it was not reasonably practicable to obtain the information, under your specific circumstances.

Visit our FAQs page for more information on what is meant by 'reasonably practicable'.

You must keep a record of information obtained for the purposes of s 8(3) of the Rules for five years beginning on the day the product is imported. Your records should allow you to demonstrate compliance with the information gathering requirements.

Once you have completed Step 1, you need to use the information you have gathered to identify and assess the risk. If you have imported the same product via the same supply chain within 12 months and previously completed this step, you may be able to apply an exception to this step. Information about the exception is outlined in detail later on this page. If this exception does not apply you must identify and assess the risk of whether your imported product is or contains illegally logged timber.

The illegal logging laws provide two pathways to do this:

• certified product pathway
• non-certified product pathway.

You must use one of these pathways to carry out your risk assessment. Further information on each pathway is provided on this page.

The pathway that you use will depend on whether your timber product is certified. The certified products pathway can only be used where your regulated timber product is certified under Forest Stewardship Council (FSC) or Programme for the Endorsement of Forest Certification (PEFC).

You need to consider all the information you have which may indicate that the product is made from, or contains, illegally logged timber.

Your identification and assessment of risk must include assessing all information gathered in Step 2. As you gather information for your due diligence requirements, ask yourself the following questions:

• Have you been able to obtain sufficient information to inform your risk assessment?
• Does the information cover all timber components (including any paper components) of your product?
• Do the classification of species, quantities, and qualities match across the documentation?
• Can the claims made in the information gathered be verified with evidence?

If you have been unable to obtain information about the species of timber and where it has come from, it will be difficult to conclude that the product is low risk.

Your identification and assessment of risk must be to a reasonable standard and supported by the information that you have gathered. This reasonable standard applies to all the facts and considerations in the risk assessment process, including the requirement to consider the source, reliability and validity of documents used in the process. Visit our FAQs page for more information on how to conduct your risk assessment.

You must also make a written record of the assessment and risk identification process. If you are audited or you receive a Request for Information notice, you may be asked to provide information on what you considered during the risk assessment, and how you reached the risk conclusion for the regulated timber product.

If after completing the risk assessment, you conclude that your product is low risk, then you can move on to the record keeping step (Step 4) and finalise your due diligence requirements before import. However, if you have assessed the risk as greater than low, you will need to undertake risk mitigation as set out in Step 3.

This risk assessment pathway applies to regulated timber product(s) certified under the:

• Forest Stewardship Council (FSC)
• Programme for the Endorsement of Forest Certification (PEFC).

Forest certification schemes are defined in s 4 of the Rules to include country or jurisdiction-specific schemes which are recognised or accredited against the FSC and PEFC international standards.

This pathway recognises that the FSC and PEFC certification schemes work to reduce the risk that forest products have been illegally harvested. However, the pathway also acknowledges that certification does not provide a guarantee of the legality of the timber. As such, the simplified risk assessment process in this pathway does not rely on certification as the sole indicator of the risk associated with a timber product and does not provide a blanket exemption from due diligence requirements. If eligible to use the certified products pathway, you will still need to provide all the information required to conduct the risk identification and assessment process. However, your risk assessment step will be simplified as compared to the risk assessment process required in the non-certified product pathway.

You may encounter documents or claims from other non-FSC or PEFC accredited forest certification schemes. While they can be used to support a risk assessment using the non-certified products pathway, they cannot be used under the certified products pathway as the product will not be considered a certified timber product. As FSC and PEFC are internationally recognised forest certification standards, the definition of forest certification standard (s 4 of the Rules) and certified timber products (s 8(4) of the Rules) are limited to recognising these two standards.

A common mistake is assuming that your product is certified because your supplier or someone else in the supply chain is certified. It is important to understand that a certified business can still deal in non-certified products. There is also a risk that your supplier may be falsely claiming their product is certified. As such, it is important to follow both steps in the certification products pathway:

1. Confirm that your product is a certified timber product (s 8(4) of the Rules)
2. Conduct a risk assessment (s 8(5) of the Rules).

Step one: Confirm that your product is certified

The Rules set out a definition for a ‘certified timber product’ (s 8(4)). To verify that your regulated timber product is certified, you must:

• obtain a copy of the relevant certification record from either the FSC or PEFC database
• confirm that the regulated timber product falls within the scope of the certification, where the scope includes the product, trade name, species and output category (where applicable).
• verify that all the supplier’s details – and all other details – are correct and align with the information gathered under s 8(3)
• verify that the sales or delivery documentation for the product obtained from the supplier contains a certification claim that is consistent with the certification record from the relevant database and the FSC or PEFC certification standard.

If your product is not certified, you must conduct your risk assessment using the non-certified products pathway (Pathway 2B).

Step two: Conduct a risk assessment

Before importing the regulated timber product, you must identify and assess the risk that the regulated timber product is, is made from, or includes, illegally logged timber.

As part of the risk assessment, you must consider:

• all the information gathered in Step 1
• the extent of illegal logging involving known entities in the supply chain
• any other information you know which may indicate that the timber was illegally logged
• the source, validity and reliability of all matters considered in the risk assessment.

You must also make a written record of the risk identification and assessment that you have made.

Further information on completing a risk assessment under Pathway 2A is provided in the FAQs page.

If your products are not certified, you must identify and conduct your risk assessment using the non-certified products pathway (s 8(6) of the Rules).

The non-certified products pathway includes a list of specific risk factors that you must consider when identifying and assessing the risk that the regulated timber product is, is made from, or includes, illegally logged timber.

As part of the risk assessment, you must consider:

• all the information gathered in Step 1
• any Country Specific Guidelines that related to the timber in the product
• the extent of illegal logging involving known entities in the supply chain
• the extent of illegal logging of the species or genus from which the timber was derived
• the conservation status and/or CITES listing of the species or genus
• the extent of illegal logging in the country or area of harvest
• the extent of armed conflict in the area or country of harvest
• the extent of corruption in the area or country of harvest
• the governance arrangements for forest management in the area or country of harvest
• any other information you know which may indicate that the timber product is, is made from, or may include, illegally logged timber
• the source, validity and reliability of all matters considered above in the risk assessment.

You must also make a written record of the risk identification and assessment that you have made.

Country Specific Guidelines (CSGs) are documents that have been developed and co-endorsed by the Australian Government and the governments of key trading partners. They outline:

• the legal frameworks that regulate timber harvesting in these countries
• relevant documents (certificates, licences, etc.) that demonstrate harvest legality.

The CSGs may also provide helpful information on timber transportation, processing, and export approval processes.

We have compiled a list of third-party resources which may be useful when conducting your risk assessment.

Further information on completing a risk assessment under Pathway 2B is provided in the FAQs page.

If you are not able to conclude that the product is low risk after identifying and assessing the risk of the product being made from or including illegally logged timber, you need to take reasonable steps to reduce the risk before you import the product.

How you mitigate the risk is up to you. It will depend on your individual circumstances.

You may need to do more research, such as:

• ask for more evidence or information from your supplier
• ask your supplier for a certified alternative
• visit your supplier to learn more about their supply chains
• use scientific timber identification methods to verify the species and/or origin of the timber before importing.

In some cases, you may need to consider sourcing a lower risk product, or even changing suppliers. If you are unable to mitigate the risk by taking other measures, your risk mitigation may involve not importing the product.

Your risk mitigation efforts need to be reasonable and proportionate to the identified risk.

Once you have put your risk mitigation measures in place, you will need to reassess the risk to be satisfied that the measures you have taken have had the desired effect of reducing the risk level to low, or if further risk mitigation measures are necessary.

You must keep records of your risk mitigation process, including the mitigation steps you have taken, the risk conclusion, and any other information you obtained as part of the process.

You may be found to have committed an offence and face serious penalties if:

• you import any product(s) that are later found to contain illegally logged timber
• you import regulated timber products without conducting due diligence prior to import.

The Rules set out an exception where importers who are importing the same product via the same supply chain multiple times within a 12-month period are not required to conduct another risk assessment or risk mitigation (s 8(10) of the Rules) within that 12-month period.

This is not an exception to the information gathering requirements set out in step 1, so importers must gather the prescribed information before each import. It is also not an exception to determine that the product is a certified timber product.

If your earlier product was certified, and you conducted your risk assessment using the certified products pathway (set out in Pathway 2A), you must confirm that your current product is certified, as per the definition set out in the Rules (s 8(4)) (see Pathway 2A for further details).

Before relying on an earlier risk assessment, you must:

• confirm that you have imported the same product within the last 12 months
• where applicable, confirm that the certification status of the earlier product and the current product are the same
• confirm that certain information gathered for the current product is the same as the information for the earlier product, namely:
  • the product description
  • the common name and scientific name of the timber in the product
  • the country and area of harvest
  • the country of processing or manufacture (if applicable)
  • the supplier’s details, including the name, address, trading name and business registration number (if any).
• have completed a risk assessment and risk mitigation (if applicable) process on the earlier product within the last 12 months
• consider whether, since the risk assessment was conducted, there have been any significant changes which would increase the risk that the product is made from or contains illegally logged timber and determine that there have been no such changes.
  • What is significant will depend on the circumstances surrounding your regulated timber product. Examples of such significant changes are:
    • the outbreak of war or armed conflict in the area or country of harvest
    • a military coup occurs in the area or country of harvest
    • the relevant certification for timber harvested in certain areas is suspended or revoked
    • a significant increase in the reports of illegal logging in a particular area
    • the introduction of a log export ban or similar measure in the country or area of harvest
    • the conservation status of the relevant species of tree has changed.

You must make a written record of your information gathering and the steps you took to determine that the exception was applicable. If you are audited or issued a Request for Information notice, you may be required to provide a copy of the earlier risk assessment and risk mitigation process (if applicable) that you relied upon.

You must keep records covering certain steps you took in the due diligence process (s 8(11) of the Rules). This includes records of all information and evidence obtained as part of the information gathering requirement.

Your records must be able to demonstrate that you undertook your due diligence obligations before importing the product. Records can be kept digitally or on paper. Your records must be maintained for at least five years beginning on the day the product is imported.

If you are audited or issued with a Request for Information notice, you may be required to provide information and produce documents relevant to:

• your due diligence system in place at the time of import
• your compliance with all the due diligence requirements for importing regulated timber products.

Failure to provide required information or produce documents is an offence under the Act and the person may be liable for a civil penalty.

You may commit an offence or be liable to a civil penalty if you provide false or misleading information or documents to the department.

Visit the Compliance and enforcement webpage to find out more.