Annex

Good Due Diligence Practicefor Downstream Companies

1Five Step Framework for Due Diligence Step 1: Establish robust company managementsystems

2

Step 1: Establish robust company management systems
 1-A. Adopt and commit to a supply chain policy for a

responsible global mineral supply chain.

Adopt a policy commitment setting forth principles for common reference on mineral extraction,transport, handling, trading, processing, smelting, refining and alloying, and export, against
which the company will assess itself and the activities and relationships of suppliers.

Ensure that this policy is consistent with the standards set forth in the model supply chain policy
in Annex II of the OECD Guidance.

Establish clear and coherent management process to ensure risks are adequately managed.

Commit to the due diligence steps and recommendations outlined in the OECD Guidance.

ExamplesDefine a responsible mineral procurement policy
 Example: Include 3TG + cobalt (etc.) in the policy as the target minerals
 Example: Include required keywords (CAHRAs/OECD guidance/Annex II risks/company
internal control process)Specify the policy application dateDisseminate and publicize to internal & external parties and suppliers by posting on your website
If human rights violations are discovered, consider risk mitigation measures including suspensionof transactions

3

Step 1: Establish robust company management systems
 1-B. Structure internal management systems to support supply

chain due diligence.

Assign authority and responsibility to senior staff with the necessary competence, knowledge,
and experience to oversee the supply chain due diligence process.

Secure the resources necessary to support the operation and monitoring of these processes.

Put in place an organizational structure and communication processes that ensure that criticalinformation, including the company policy, reaches relevant employees and suppliers.

Ensure internal accountability with respect to the implementation of supply chain due diligenceprocess.

ExamplesCreate an organizational chart/promotion system chart, etc. to clarify the roles of leaders andofficers in charge.
Build cooperative relationships with the relevant internal departments (procurement, legal,compliance, CSR, and technical departments, etc.).
Share your supply chain policy with internal and external parties (via website, intranet, etc.).
Educate internal personnel on due diligence implementation and monitoring.
Conduct regular meetings and share necessary relevant information with team members.

4

Step 1: Establish robust company management systems
 1-C. Establish a system of controls and transparency over theconflict minerals supply chain.

Introduce a supply chain transparency system that allows the identification of the smelters/refiners in thecompany’s mineral supply chain through which the following information on the supply chain of minerals from “redflag locations of mineral origin and transit” should be obtained: identification of all countries of origin, transport
and transit for the minerals in the supply chains of each smelter/refiner.

Companies which find it difficult to identify actors upstream from their direct suppliers may engage and actively
cooperate with industry members with whom they share suppliers or downstream companies with whom they
have a business relationship to identify which smelters are in the supply chain.

Maintain related records for a minimum of five years, preferably on a computerised database.

Support extending digital information-sharing systems on suppliers to include smelters/refiners.

Adapt systems to assess supplier due diligence in the supply chain of minerals from conflict-affected and high-riskareas utilizing the criteria and process recommended in this Guidance, with due regard to business confidentiality
and other competitive concerns.

Examples

Clarify survey methods, risk criteria, and schedule (survey frequency), etc.
Retain CMRT/CRT (and supplier communication records) for at least 5 years.

5

Step 1: Establish robust company management systems
 1-D. Strengthen engagement with relevant suppliers.
Establish, where practicable, long-term relationships with suppliers as opposed to short-term or one-off contracts
in order to build leverage over suppliers.

Communicate to suppliers your expectations on responsible supply chains of minerals from CAHRAs andincorporate the supply chain policy and due diligence processes set out in the OECD Guidance into commercial
contracts and/or written agreements with suppliers which can be applied and monitored, including, if deemednecessary, the right to conduct unannounced spot-checks on suppliers and have access to their documentation.

Consider ways to support and build capabilities of suppliers to improve performance and conform to company
supply chain policy.

Commit to designing measurable improvement plans with suppliers with the involvement, if relevant and whereappropriate, of local and central governments, international organizations and civil society when pursuing risk
mitigation.

Examples

Request support for company policy when contracting with a supplier (better to include in contract).
Communicate your expectations (RMAP Conformant, no human rights violations, etc.) whenrequesting a survey.
Guide to lecture programs for suppliers (JEITA “Responsible Minerals Briefing”, etc.).

6

Step 1: Establish robust company management systems
 1-E. Establish a company level grievance mechanism.
（From Supplement on Tin, Tantalum and Tungsten) Develop a mechanism allowing any interested party (affected persons or whistle-blowers) to voice
concerns regarding the circumstances of mineral extraction, trade, handling and export in a conflictaffected and high-risk area. This will allow a company to be alerted of risks in its supply chain as tothe problems in addition to the company fact and risk assessments.
 Provide such a mechanism directly, or through collaborative arrangements with other companies ororganizations, or by facilitating recourse to an external expert or body (ie, ombudsman).

Examples

Clearly indicate on the relevant pages on your company website where interested parties cancontact you with concerns.
If you have an internal grievance mechanism, ensure that it can be used to voice concerns related
to conflict mineral sourcing and surveys.

7

Five Step Framework for Due Diligence Step 2: Identify and assess risks in thesupply chain

8

Step 2: Identify and assess risks in the supply chain
 2-A. Identify, to the best of your efforts, the smelters/refiners

in your supply chain.

(From Supplement on Tin, Tantalum and Tungsten)
Downstream companies should aim to identify the mineral smelters/refiners that produce the refined
metals used in their supply chain. This may be carried out:





through confidential discussions with the companies’ immediate suppliers,
through the incorporation of confidential supplier disclosure requirements into supplier contracts,by specifying to direct suppliers the smelters/refiners that meet the requirements of this Guidance,
by using confidential information-sharing systems on suppliers and/orthrough industry wide schemes to disclose upstream actors in the supply chain.

Examples Use the CMRT and CRT to identify upstream smelters/refiners to the greatest extent
possible:－ Check ”Smelter Not Listed” and ”Smelter Not Yet Identified” on the Smelter List.
－ Follow up on your suppliers by checking your CMRT supplier response rate (Q5)and smelter identification status (Q6).

9

Step 2: Identify and assess risks in the supply chain
 2-B. Identify the scope of the risk assessment of the mineral

supply chain.

（From Supplement on Tin, Tantalum and Tungsten)
Downstream companies should engage with … smelters/refiners in their supply chains and
obtain from them initial information on country of mineral origin, transit and transportationroutes used between mine and smelters/refiners.
 Downstream companies should review this information and any information generated in Step 1
in order to target risk assessments on those minerals and suppliers triggered by the “red flag
locations of mineral origin and transit” and “supplier red flags.”

Examples Use RMAP audit results to assess supply chain risk upstream from yoursmelters/refiners.
 Decide what risks your company should address given your mode of business andthe characteristics of your supply chain with reference to OECD Guidance Annex
Ⅱand lay out the grounds for selecting those risks.

10

Step 2: Identify and assess of risks in the supply chain
 2-C. Assess whether the smelters/refiners have carried out allelements of due diligence for responsible supply chains ofminerals from conflict-affected and high-risk areas.

（From Supplement on Tin, Tantalum and Tungsten) Obtain evidence on due diligence practices of the smelter/refiner.
 Review the information generated by the assessment team. Cross-check evidence of due
diligence practices of the smelter/refiner against the supply chain policy and due diligenceprocesses contained in the OECD Guidance.
 Work with the smelter/refiner and contribute to finding ways to build capacity, mitigate
risk and improve due diligence performance, including through industry-wide initiatives.
Examples Cross-check the CMRTs and CRTs you have received from suppliers against
the Conformant, Active, and SSN Lists on the RMI website.
 Where necessary, check the audit reports on the RMI website.

11

Step 2: Identify and assess risks in the supply chain
 2-D. Where necessary, carry out, including throughparticipation in industry-driven programs, joint spot checks at
the mineral smelter/refiner’s own facilities.

Obtain evidence of smelter due diligence practices, including information gathered from on-site
assessments and review guidance for due diligence processes (which can be done throughindustry mechanisms such as RMI).



Spot check at smelter/refiner if necessary.

Assess the risk to your company's supply chain policy (according to Annex II), relevant guidance
supplements, national laws and other relevant legislative requirements.

Examples Check smelter/refiner audit status reports on the RMI website.
 Detect and identify OFAC rule infringement risk through your own due
diligence activities.
 Check smelter information.

12

Five Step Framework for Due Diligence Step３: Design and implement a strategy torespond to identified risks

13

Step 3: Design and implement a strategy to respond to identified risks
 3-A. Report findings to designated senior management.
 Outline the information gathered and the actual and potential risks identified in the
supply chain risk assessment.

Examples Add "responsible mineral sourcing" to existing regular internal reports.
 Report KPI results (recovery rate, etc.) and next year's targets at meetings
such as CSR and procurement.

14

Step 3: Design and implement a strategy to respond to identified risks
 3-B. Devise and adopt a risk management plan.
（From Supplement on Tin, Tantalum and Tungsten) Companies should adopt a supply chain risk management plan that outlines the company
responses to risks identified in Step 2. Companies may manage risk by eitheri) continuing trade throughout the course of measurable risk mitigation efforts;ii) temporarily suspending trade while pursuing ongoing measurable risk mitigation; oriii) disengaging with a supplier in cases where mitigation appears not feasible orunacceptable.
 Consult with suppliers and affected stakeholders and agree on the strategy for measurable risk
mitigation in the risk management plan. Measurable risk mitigation should be adjusted to thecompany’s specific suppliers and the contexts of their operations, state clear performance
objectives within a reasonable timeframe and include qualitative and/or quantitative indicators tomeasure improvement.

Examples Pre-determine checkpoints in CMRTs collected from suppliers.
 Pre-determine the company policy for dealing with smelters/refiners when risk isdetected.
 Share that policy with the relevant smelters/refiners.

15Step 3: Design and implement a strategy to respond to identified risks
 3-C. Implement the risk management plan, monitor and track

performance of risk mitigation, report back to designatedsenior management and consider suspending or discontinuingengagement with a supplier after failed attempts at mitigation.

(From RMI Downstream Assessment Program Assessment Tool)Implement the risk management plan, monitor risk mitigation and report performance todesignated senior management, and consider suspending or discontinuing engagement with asupplier after failed attempts at mitigation.

If there is no [significant and measurable improvement towards eliminating the identified risks
within six months, companies should suspend or discontinue engagement with the supplier for aminimum of three months.

Example Decide what you will do if the deadline for risk mitigation is not met or noimprovement is foreseen (suspend or discontinue engagement).

16

Step 3: Design and implement a strategy to respond to identified risks
 3-D. Undertake additional fact and risk assessments for risks

requiring mitigation, or after a change of circumstances.

（From Supplement on Tin, Tantalum and Tungsten) Supply chain due diligence is a dynamic process and requires on-going risk monitoring.
After implementing a risk mitigation strategy, companies should repeat Step 2 to ensure
effective management of risk. Additionally, any change in the company’s supply chain may
require some steps to be repeated in order to prevent or mitigate adverse impacts.

Examples Continue to undertake regular CMRT surveys and monitor risks in line withyour company policy and/or customer requests.
 When any changes occur in the specifications of sourced products or in the
supply chain, conduct additional risk assessments (surveys) as necessary.

17Five Step Framework for Due Diligence Step 4: Carry out independent third-party

audit of smelter/refiner’s due
diligence practices

18

Step 4: Carry out independent third-party audit of smelter/refiner’s
due diligence practices
 4-A. Plan an independent third-party audit of thesmelter/refiner’s due diligence for responsible supply chains ofminerals from conflict-affected and high-risk areas.
 4-B. Implement the audit in accordance with the audit scope,criteria, principles and activities set out above.
（From Supplement on Tin, Tantalum and Tungsten) It is recommended that all downstream companies participate and contribute throughindustry organizations or other suitable means to appoint auditors and define the terms of
the audit in line with the standards and processes set out in this Guidance. Small andmedium enterprises are encouraged to join or build partnerships with such industryorganisations.
Examples Include RMAP utilization in smelter/refiner assessments in your company policy.
 Where necessary, try direct communication such as visiting smelters/refiners.
 If limited resources mean that you struggle with outreach to smelters/refiners, try
working in conjunction with multiple other companies or through an industry
association.

19

Five Step Framework for Due Diligence Step 5: Report annually on supply chain duediligence20

Step 5: Report annually on supply chain due diligence 5-A. Annually report or integrate, where practicable, into

annual sustainability or corporate responsibility reports,
additional information on due diligence for responsible supply
chains of minerals from conflict-affected and high-risk areas.

（From Supplement on Tin, Tantalum and Tungsten) Company management systems: Set out the company’s supply chain due diligence policy;
explain the management structure responsible for the company’s due diligence and who in thecompany is directly responsible.
 Risk assessment and management: Describe the steps taken to identify smelters/refiners in the
supply chain and assess their due diligence practices, including the published list of qualified
smelters/refiners through industry validation schemes conforming to the due diligence processes
recommended in this Guidance. Describe the steps taken to manage risks
 Audits: Publish the audit reports of their due diligence practices, with due regard taken of
business confidentiality and other competitive concerns and responses to identified risks.

ExamplesDisclose your company’s due diligence status in sustainability reports, etc., including your due
diligence management structure and survey results.
Use the Responsible Mineral Reporting Toolkit issued by GRI and RMI
http://www.responsiblemineralsinitiative.org/news/rmi-and-gri-launch-responsible-mineralreporting-toolkitDisclose the smelter list identified in the previous year’s survey (unlisted US companies).

21