also uses 'supply chain mapping, auditing and stakeholder engagement' (pg 7) in risk assessment process