{"supplier":{"name":"Heinrich Fasteners GmbH","registration":"HRB 78421 Amtsgericht Düsseldorf — VAT DE312845221","country_code":"DE"},"assessment_date":"2026-04-12","assessor":{"name":"Marc Dewinter","role":"Procurement Risk Officer — Acme Supplies SRL"},"risk_dimensions":[{"dimension":"financial","findings":"Latest filed accounts (2024 — Bundesanzeiger) show turnover of 18,7 M EUR, EBIT margin 7,4%, equity ratio 41%, current ratio 1,8. Creditreform rating 215 (low risk). No payment-incident reports in 2025. Ownership stable, no LBO. Conclusion: financial standing healthy.","likelihood":"low","impact":"medium"},{"dimension":"operational","findings":"Single manufacturing site (Düsseldorf). On-time-in-full 96,2% over the last 12 months (vs. Acme target 95%). One major NCR in 2025 closed within 28 days. ISO 9001:2015 and IATF 16949:2016 certified. Backup capacity at sister plant in Wuppertal documented but not formally activated.","likelihood":"medium","impact":"medium"},{"dimension":"data_protection","findings":"Personal data exchanged is limited to ordering-platform user accounts (ca. 6 named contacts). DPA in place since 2024, sub-processor list reviewed. No transfer outside the EU. No GDPR incident reported.","likelihood":"low","impact":"low"},{"dimension":"cybersecurity","findings":"Supplier completed Acme cyber questionnaire (NIST CSF-aligned, 47 questions) — overall score 78/100. Has ISO/IEC 27001-aligned ISMS but not certified. MFA enforced on EDI portal. Last penetration test by independent third party Q4 2025, two findings remediated.","likelihood":"medium","impact":"medium"},{"dimension":"esg","findings":"EcoVadis Silver (62/100). Scope 1+2 emissions disclosed (CDP 2025 — climate change response: B). No reported breaches of ILO core conventions. Conflict-minerals reporting in line with Reg. (EU) 2017/821. CSDDD-readiness: high (Heinrich is itself in scope of CSDDD by 2027).","likelihood":"low","impact":"medium"},{"dimension":"geographic","findings":"Single jurisdiction (Germany, EU member). Düsseldorf site outside flood-risk zones per LANUV Hochwasserrisikomanagement maps. No reliance on logistics through chokepoint regions.","likelihood":"low","impact":"low"},{"dimension":"regulatory","findings":"REACH and RoHS conformity certificates current. EU Construction Products Regulation (CPR) declarations of performance available for fasteners used in load-bearing applications. CSDDD: in scope by 2027 (group turnover > 450 M EUR), preparation under way.","likelihood":"low","impact":"medium"},{"dimension":"concentration","findings":"Heinrich represents 38% of Acme's annual fastener spend (target ≤ 50%). Acme represents ca. 6,5% of Heinrich's revenue (low dependency). One alternative dual-source qualified (Bossard AG, CH) but at higher unit cost.","likelihood":"medium","impact":"high"}],"overall_rating":"medium","mitigations":[{"dimension":"operational","action":"Formalise activation playbook for Heinrich's sister plant in Wuppertal (RACI, lead times, capacity envelope) and run a tabletop exercise.","owner":"Heinrich Operations + Acme Procurement (Marie Laurent)","due_date":"2026-09-30"},{"dimension":"cybersecurity","action":"Request ISO/IEC 27001:2022 certification roadmap from Heinrich; reassess in 12 months. Mandate annual penetration test of EDI portal.","owner":"Acme CISO (Marie Laurent — security delegation) + Heinrich IT","due_date":"2027-04-12"},{"dimension":"concentration","action":"Increase qualified volume at dual-source Bossard AG to ≥ 15% of fastener spend over 12 months to reduce concentration on Heinrich below 30%.","owner":"Acme Procurement (Marc Dewinter)","due_date":"2027-04-12"}],"monitoring_cadence":"Annual full reassessment, with quarterly KPI review (OTIF, NCR count, payment behaviour, EcoVadis re-score) tracked in Acme's supplier scorecard. Trigger-based ad-hoc review on: change of control, public safety incident, sanctions list update affecting Germany or related entities, news of cyber incident affecting Heinrich's group.","next_review_date":"2027-04-15","signatory":{"name":"Marie Laurent","role":"Head of Procurement — Acme Supplies SRL","date":"2026-04-12"}}