Human Rights Due Diligence in Law and Practice: Good Practices and Challenges for Business Enterprises

Abstract

This article considers the practices of companies worldwide in attempting to implement human rights due diligence (HRDD) as envisaged by the Guiding Principles on Business and Human Rights. Based on empirical research conducted through surveys and interviews, it analyses corporate practices in this area. It examines the responses of companies with reference to the core elements of implementing HRDD: identifying actual or potential human rights impacts; taking action to address these impacts; and tracking or monitoring the effectiveness of actions. In addition, the article places these practices in the context of the legal developments in the field of HRDD. The research shows the difference that dedicated HRDD – in comparison with non-human rights specific processes – can make in terms of identifying adverse human rights impacts of both the company as well as of those which are part of its business relationships.

I. Introduction

Human rights due diligence (HRDD) is a key concept of the UN Guiding Principles on Business and Human Rights (GPs), ¹ because to ‘discharge the [corporate] responsibility to respect [human rights] requires due diligence… [which] describes the steps a company must take to become aware of, prevent and address adverse human rights impacts’. ² However, there is limited information available as to how companies ³ are actually conducting HRDD consistent with their responsibility to respect human rights under the GPs. This article provides much-needed detail – based on empirical research through surveys and interviews – as to what a widespread range of companies are doing in this area, and innovatively analyses these data in the context of current legal developments.

In achieving these objectives, this article considers to what extent, if at all, companies are currently undertaking HRDD, with a focus on four broad and diverse sectors: mining and energy, financial services, health sciences and pharmaceuticals, and technology. It examines the extent to which there are different consequences in terms of human rights impacts as to whether a company adopts a specific HRDD process or uses a process that is part of other processes. We used a threefold analytical framework: identifying actual or potential human rights impacts; taking action to address these impacts; and tracking or monitoring the effectiveness of these actions. ⁴ This research has enabled us to clarify when human rights impacts of both the company itself and its business partners are more likely to be identified, and when actions affecting human rights are more likely to be tracked and communicated. It also provides some exploration of the understanding by companies of what HRDD means for them (building on some of the specific company or single sector ⁵ research in this area), and applies it to a wide range of companies and sectors.

This research is integrated with a consideration of the current legal and other developments in regulation in the area of business and human rights, as set out in two of the initial sections of this article. This enables us to compare whether the matters that courts and regulatory bodies take into account in other areas of law to determine whether due diligence has been effectively implemented, are useful guidelines for the business and human rights area. Accordingly, this research enables us to establish some practical guidance to companies on the implementation of HRDD in accordance with the GPs. In so doing, we aim to assist companies by improving their processes to identify their activities that have impacts on human rights and in turn help in long-term human rights protections worldwide. Prior to the analysis of the actual practice currently undertaken by companies, we explain the methodology taken, clarify the meaning and scope of HRDD, and examine the legal developments and regulations and industry approaches in this area.

II. Methodology

The methodology adopted combined desk-based literature, policy and legal research – including consideration of international and regional legal documents, national laws and jurisprudence – with qualitative insights obtained empirically through surveys and interviews. The primary form of data collection was through a web-based survey with questions about companies’ HRDD practices. The survey was sent to about 1,500 contacts through a combination of direct emailing to legal counsel and other company representatives on the database of the British Institute of International and Comparative Law (BIICL) and distribution through Norton Rose Fulbright’s worldwide contacts. It was completed by 152 respondents during June and July 2015. The responses were anonymous.

Operations of the survey respondents were spread relatively evenly across all regions of the world. ⁶ Respondents were primarily based or headquartered in the following regions: Western Europe, Asia (including China and India), North America, (i.e., the US and Canada), ⁷ Australia, New Zealand and the Pacific, Sub-Saharan Africa, Latin America (including Mexico), the Middle East, and North Africa. ⁸ 63.95 per cent of respondents self-identified as ‘multinational’, followed by ‘large national’, ⁹ ‘medium’ ¹⁰ and ‘small’ company. ¹¹ 66.67 per cent of respondents had public shareholding ownership, or were listed on a stock exchange and 19.44 per cent had private shareholding. 90.91 per cent of survey respondents do not, or had not received in the past, finance from multilateral lending agencies such as the International Finance Corporation, state lending agencies or regional development banks.

In 28.79 per cent of survey responses, the main activity of the person who completed the survey was within the company’s legal department. There were 19.7 per cent in corporate social responsibility, 12.12 per cent in compliance, and 10.61 per cent in human rights. It should be noted that the responses to the survey may not be representative of the level of awareness of HRDD issues, as the respondents were self-selecting. Also, as it was anonymous, the companies in which the respondents were employed were not identified, and so it was not possible to clarify if more than one individual from the same company responded.

Following the survey, semi-structured interviews were conducted with 14 people (being about 10 per cent of the survey responses) working in companies at a senior level and with knowledge of HRDD practices within their company, as well as a roundtable discussion. Every interview was conducted between October 2015 and January 2016. Interviewees were selected based on their known expertise. The interviews explored how HRDD was conducted in their company (and related companies), sector(s) and region(s). Discussions also included their policies, functions, training and best practices. The persons were interviewed on the basis that their responses would not be attributed to them and that their affiliations would not be identified.

Accordingly, this article considers to what extent, if at all, companies are currently undertaking HRDD, by analysing the information provided by a global cross-section survey of companies, and through interviews. Where relevant, the analysis focuses on four sectors: mining and energy (‘extractives’), financial services, health sciences and pharmaceuticals (‘pharmaceuticals’), and technology. ¹²

III. Definition of Human Rights Due Diligence

A. Meaning of Human Rights Due Diligence

Despite its centrality to the GPs, they do not define the term ‘HRDD’. Principle 15 only provides that ‘[i]n order to meet their responsibility to respect human rights, business enterprises should have in place policies and processes … including … (b) A human rights due diligence process to identify, prevent, mitigate and account for how they address their impacts on human rights’. Subsequently, the Office of the High Commissioner for Human Rights (OHCHR) sought to define the term as follows:

Such a measure of prudence, activity, or assiduity, as is properly to be expected from, and ordinarily exercised by, a reasonable and prudent [person or enterprise] under the particular circumstances; not measured by any absolute standard, but depending on the relative facts of the special case. In the context of the Guiding Principles, human rights due diligence comprises an ongoing management process that a reasonable and prudent enterprise needs to undertake, in light of its circumstances (including sector, operating context, size and similar factors) to meet its responsibility to respect human rights. ¹³

This definition is helpful in one respect: it situates the term within the general legal approach to due diligence across most jurisdictions, which is to see due diligence within the tort law language of a reasonable or prudent person. ¹⁴

However, this OHCHR definition leaves uncertainty how this standard is to be applied. There is some discussion in the limited literature on this area, especially as to how the terminologies of HRDD differ across various international instruments, ¹⁵ their operation in relation to different parts of a business enterprise, ¹⁶ and in relation to national law concepts, ¹⁷ though there is no international consensus on a definition.

If HRDD is a process about adverse human rights impacts, rather than about business risks (see below), then it is helpful to have a distinct definition in order to assist companies worldwide. The GPs do seem to establish that ‘human rights impacts’ of companies should be interpreted in the same way as ‘human rights violations’. ¹⁸ While the GPs do not equate ‘impacts’ with legal liability for companies, ¹⁹ they emphasize that simply having a HRDD process does not mean that there is no consequent legal liability. ²⁰ Yet, as with the general legal obligation of due diligence, where a company has identified its human rights impacts and has put in place sophisticated HRDD systems and processes, it is more likely to be able to show to any external regulator or court that it has done everything reasonable that it could have done, should an adverse impact occur.

In our view, the standard of due diligence required to be performed by companies is initially defined by a process of risk (or impact) assessment. This needs to be sufficient to enable a company to identify and address its human rights impacts in the sense described above.

B. Scope of Human Rights Due Diligence

The scope of the HRDD expected of a company will be context specific. It will depend on various factors, including, as listed in the GPs, the company’s size, the risk of severe ²¹ human rights impacts, and the nature and operating context. ²² The scope may change over time as the circumstances in which the business operates evolve. ²³

HRDD differs from business management due diligence in a few prominent ways. HRDD is about human rights impacts and not solely about enterprise-related business risks. Principles 13 and 15 reinforce this by consistently referring to business enterprises’ impacts. ²⁴ Thus merely considering risks to the company without its broader human rights impacts would not be addressing the required objective of HRDD. In this way, HRDD differs from other applications of due diligence, where the risk management process is primarily aimed at preventing risks to the business itself or its employees. Of course, human rights risks also translate into business risks, but the focus of HRDD should be on the prevention of the impact on the rights-holder.

HRDD is not company (or even corporate group) specific. It expects, as seen in Principle 13, every business to consider the human rights impacts not only of its own operations but also of third parties with whom it is directly linked in its business relationships. ²⁵ These may include suppliers and other entities in its value chain, such as consumers and distributors, and other third parties with which it has relationships, including state and non-state entities. ²⁶

The GPs allow for the prioritization of certain rights over others, provided that priority is given to those risks that are most severe or irremediable. ²⁷ Some have called this a reflection of what are the ‘salient’ human rights for a company, ²⁸ but ‘salience’ and ‘severity’ are not the same concept as ‘salience is not a cut-off line, but a principled basis for sequencing how [company] resources [initially] get applied’. ²⁹ Hence, a company must first determine its human rights impacts before it prioritizes its human rights-related remedial actions.

This wide responsibility for the impacts of all third parties indicates that a company would be prudent to consider carefully the scope of their HRDD. A determinative factor is whether the company is aware, or should be aware, of certain human rights issues or high-risk areas or contexts within its operations or value chain. ³⁰ A relevant aspect may include whether a company is aware that industry peers are causing or contributing to adverse human rights impacts. ³¹

Another way in which HRDD is unique is that it must take place on a continuing basis. Other forms of due diligence frequently consist of a once-off process which is completed before a specific transaction takes place. Instead, the GPs provide that HRDD ‘should be ongoing, recognizing that the human rights risks may change over time as the business enterprise’s operations and operating context evolve’. ³²

By being context dependent, HRDD lends itself towards being used to discharge a legal standard in the same way as other due diligence processes. Accordingly, legal advisers are in a unique position to advise companies on the scope of their HRDD. As case law and business practice develops, the content of what kind of HRDD is necessary under different circumstances will be clarified.

IV. Legal Framework

A. Introduction

Our survey respondents attached considerable significance to legal risks. The two top incentives stated by survey respondents (each being selected by 66 per cent of respondents) for undertaking HRDD now or in the future are avoidance of legal risk and reputation. In addition, compliance with regulatory reporting requirements, and compliance with relevant and local laws, excluding reporting requirements, were chosen as incentives by more than 60 per cent of respondents. ³³ So there is an important role which the legal framework plays in driving HRDD, whether through regulation, risks of potential legal claims or potential breach of reporting requirements. Accordingly, a few examples of laws which already require some form of due diligence for impacts that relate to human rights will be considered.

B. Regulation of Corporate Impacts of Human Rights

One category of laws relevant to HRDD is in the area of slavery and trafficking. The United Kingdom’s Modern Slavery Act 2015 requires companies to report on the steps they are taking to eradicate slavery and human trafficking in their own operations and in their supply chains. ³⁴ It applies to all companies supplying goods or services with an annual turnover of £36 million and which carry on business, or a part of their business, in the UK. ³⁵ This Act shares similarities with the California Transparency Supply Chains Act 2010 (CTSC), which requires certain companies to disclose how they sought to eradicate slavery and human trafficking from their supply chains. ³⁶

Another example is the United States (US) Federal Acquisition Regulations, which require companies that sell goods and services to the US government to have a compliance plan in place to show how they will adhere to a list of detailed requirements. ³⁷ The Regulations are given additional enforcement procedures by the False Claims Act, ³⁸ which criminalizes false statements or certifications made in the context of government procurement.

Within various sectors, specific regulation often requires due diligence for activities which may implicitly have human rights impacts. For example, the European Union (EU) Transparency Directive applies to large extractive and logging companies, and requires country-by-country reporting on material payments made to governments. ³⁹ Section 1502 of the US Dodd–Frank Wall Street Reform and Consumer Protection Act ⁴⁰ requires companies to disclose annually whether certain minerals are sourced from the Democratic Republic of Congo (DRC) or adjoining countries, and describe the measures of supply chain due diligence that were taken. In Australia, the Illegal Logging Prohibition Act ⁴¹ requires importers and processers of timber to have verification processes in place to ensure that no illegal logging took place in its supply chains.

Although these regulatory requirements are useful to inform the HRDD process, key aspects of HRDD are missing. For example, compliance with this type of regulation will not be aimed at identifying or addressing any other human rights impacts outside of those occurring with the relevant context, sector or geographical region. Similarly, whereas transparency around payments made to governments may improve human rights conditions on the ground indirectly, this type of regulation does not require the identification or addressing of human rights impacts within the company’s own operations or within its value chain – including the human rights impacts of the governments to whom the disclosed payments were made. Furthermore, most of this legislation and regulation is not in express terms of human rights and generally requires reporting by companies of their activities without expressly requiring companies to address and remediate their human rights impacts. Nevertheless, proof of compliance with these legal requirements by a company may assist towards indicating the creation of a robust HRDD system. ⁴²

A recently adopted French law may overcome some of the above limitations by specifically requiring human rights due diligence of all companies over a certain size, and to publish annual vigilance plans. ⁴³ The law applies to the company’s own activities, activities of companies under its control (such as subsidiaries), as well as activities of third parties such as contractors and suppliers. It allows victims and affected parties to approach a court for compensation for damages. ⁴⁴

C. Legal Claims for Human Rights Due Diligence Failures

HRDD requirements are beginning to surface in legal claims. For example, the Canadian case of Choc v Hudbay is based on claims that the Canadian parent company failed to prevent abuses by the subsidiary over which it had ‘on-the-ground management and control’, ⁴⁵ and in relation to which it had made public statements committing to detailed standards of conduct. ⁴⁶ The earlier UK case of Chandler v Cape PLC ⁴⁷ demonstrated that, depending on the level of knowledge and control, a parent company may owe a direct duty of care to employees of a subsidiary for health and safety standards. ⁴⁸ The Court in Chandler based the company’s liability on its actual or attributed knowledge: the parent company ‘knew, or ought to have known, that the subsidiary’s system of work was unsafe’ and that ‘it knew, or ought to have foreseen, that the subsidiary or its employees would rely on [the parent company’s] superior knowledge for the employees’ protection’. ⁴⁹ This position has been confirmed to some extent in other cases. ⁵⁰

In keeping with the GPs, this duty of care extends beyond the corporate group into value/supply chains. For example, two cases brought in California concerned allegations that companies failed to take adequate steps to address human rights abuses in their supply chains. ⁵¹ These actions were brought in terms of consumer protection laws, the CTSC and unfair competition laws, respectively. ⁵² These cases demonstrate that even where HRDD is not expressly required by legislation, claims for failing to conduct such due diligence may be brought on the basis of other legal requirements, including those protecting consumers’ expectations not to be misled. ⁵³

In some areas of law, due diligence is often provided for as a statutory defence. The company or corporate official is able to defend itself against a civil claim or a criminal charge if it can show that it took all reasonable steps or exercised the necessary due diligence. Examples include misrepresentation or failure to disclose financial matters, ⁵⁴ bribery and corruption, ⁵⁵ environmental offences, ⁵⁶ safety offences ⁵⁷ and other corporate criminal activities. ⁵⁸

D. Industry Standards and Law

Within various sectors, industry bodies have developed standards requiring HRDD. These standards often take the form of soft law instruments, by binding (albeit not through a legally enforceable mechanism) those companies which are members of the relevant group or trade body. In other instances, they may be tools or guidance documents, which may become norm-forming through integration into standard industry practice. ⁵⁹

For example, a UK court has taken into account a company’s adoption of the Voluntary Principles on Security and Human Rights as part of the standard to which the company should be held, as ‘something more than lip-service to those Principles is demanded’. ⁶⁰ Accordingly, it ordered the company to disclose many of the documents requested by the claimants, including searches of the company’s annual reviews of its implementation of the Voluntary Principles. ⁶¹

Companies, particularly multinational corporations (MNCs), are subject to an array of regulations that directly or indirectly regulate their human rights impacts. A comprehensive HRDD process should enable a company to comply with the diverse range of regulations applicable to its operations, and assist the company to address its other actual and potential human rights impacts which are not (yet) addressed by any regulation.

V. Results of Empirical Research and Analysis

A. Introduction

In order to understand what companies are currently doing in relation to HRDD, our survey and interviews sought to gather the existing practices. To analyse and evaluate these in accordance with the GPs, the three primary elements of implementing due diligence set out in Principle 17 will be examined in turn: (i) identifying actual or potential human rights impacts; (ii) taking action to address these impacts; and (iii) tracking or monitoring the effectiveness of these actions.

In our survey, we asked respondents whether their companies had ever undertaken any HRDD process or a human rights impact assessment. Almost half ⁶² of respondents had not. These latter respondents, who had not expressly conducted HRDD or a human rights impact assessment, were then asked whether they had considered human rights impacts as an integrated part of other due diligence processes (not expressly referred to as human rights). 72.34 per cent of these remaining respondents indicated that they had considered human rights as part of other processes, predominantly workplace health and safety, labour rights, equality and non-discrimination, and community, indigenous or land rights.

There were accordingly two groups of the survey respondents: those who had conducted dedicated HRDD; and those who had not, but considered human rights as part of other due diligence processes. We have segregated these two groups for the purposes of comparing the outcomes when a company does ‘dedicated HRDD’, as opposed to using existing non-human rights specific processes which nevertheless directly or indirectly consider certain human rights (‘non-specific HRDD’). Where relevant we refer to these different groups below.

We identified diverse practices from both these groups. In our analysis we combined the results from the two groups where the contrast between those who had done dedicated HRDD and those who had not was irrelevant. Particularly with results analysed according to sector, we took into account the responses from all survey respondents within that sector who had undertaken either dedicated or non-specific HRDD. Accordingly, where no specific distinction is drawn between the two groups, we refer to the outcomes of the composite group, being both those respondents who had undertaken dedicated HRDD and those who had considered human rights as part of other processes.

B. Identification of Human Rights Impacts

1. Introduction

The first aspect of HRDD ordinarily includes the identification of actual or potential human rights impacts. This often takes place through a human rights impact assessment. For the purpose of this article, we refer to ‘human rights impact assessment’ as processes specifically aimed at identifying and monitoring human rights impacts, whereas ‘HRDD’ is taken as a broader concept encompassing the process of identifying human rights impacts, taking actions to prevent, mitigate and account for any such impacts and monitoring the effectiveness of actions taken. As such, human rights impact assessments may and indeed ought to form part of HRDD, but they are not the same process.

2. Results: Using Human Rights Due Diligence

Almost half ⁶³ of the over 150 respondents to our survey had never undertaken dedicated HRDD or a human rights impact assessment. Many of these had conducted processes which included human rights, such as with workplace health and safety, ⁶⁴ labour rights, ⁶⁵ equality and non-discrimination, ⁶⁶ or indigenous or land rights. ⁶⁷ Some of the respondents had considered human rights as part of other due diligence processes – such as with mergers and acquisitions, engaging a new market or client, investment decisions or providing finance, or environmental impact assessments – though in all such cases the process taken would usually not use human rights language or even refer to human rights as such. Interviews confirmed that where companies do not use a human rights lens, it is often because they believe their human rights risks are adequately covered by other processes, such as health and safety or human resources procedures.

The survey results show a significant difference between the various sectors as to whether they had ever undertaken a HRDD process. Over 70 per cent of companies in the mining, ⁶⁸ and pharmaceutical ⁶⁹ sectors had done so. In contrast, around half of respondents in the energy ⁷⁰ and technology sectors and 57.15 per cent in the financial sector have never conducted such a process. Of those who had undertaken dedicated HRDD, 81.08 per cent had conducted the process with reference to the GPs. This is not surprising, as the GPs indeed introduced the concept of HRDD. Of the same group, 75.68 per cent referred to the Universal Declaration of Human Rights and 64.86 per cent to the International Labour Organization (ILO) Core Conventions, both of which are instruments referred to in the GPs.

Of respondents which considered human rights only as part of other processes, 79.41 per cent had done so in terms of workplace health and safety rights, while 70.59 per cent had considered human rights as part of labour rights due diligence, including prison or forced labour in supply chains, and 52.94 per cent as part of equality and non-discrimination (sometimes phrased as diversity and inclusion). The other category of human rights considered by respondents which considered human rights only as part of other due diligence processes were community, indigenous or land rights. At 41.18 per cent, this was the rights category that received the lowest level of attention from this group. None of the respondents that included human rights only as part of other processes listed any other human rights which they had considered.

Of those survey respondents that have undertaken HRDD or human rights impact assessment, 77.14 per cent indicated that they identified actual or potential human rights impact during the process. In contrast, only 19.23 per cent of the group which considered human rights as part of non-specific HRDD identified any adverse impacts during the process. In other words, 77.14 per cent of companies using dedicated HRDD identify adverse impacts, whereas 80.77 per cent of companies using non-specific HRDD do not identify adverse impacts. This gap in human rights analysis in the absence of dedicated HRDD was confirmed during the interviews. For example, one large MNC indicated that if operating mechanisms are examined through a human rights lens, it significantly assists its operational decisions in countries with high human rights risks.

Of those survey respondents which had undertaken dedicated HRDD, 58.62 per cent indicated that their company had in the past been connected to allegations of human rights impacts. Furthermore, 62.07 per cent indicated that their company has had concerns about its own risks after allegations of human rights impacts regarding other companies in the same sector, country or context. In contrast, 80 per cent of those companies who had only considered human rights as part of non-specific HRDD, indicated that they had never been connected to allegations of human rights impacts, nor concerned about their own risks based on allegations relating to peers.

The reliability of these conclusions from the survey results were confirmed during the interviews. Interviewees from a few large MNCs indicated that before they used a human rights lens, they were confident that their various processes covered all relevant human rights impacts. However, after they undertook intensive human rights impacts assessments, gap analyses, or conducted the process of adopting a human rights policy over periods of up to 18 months (which included engaging extensively with stakeholders), they realized that there were human rights impacts which they had been missing. Certain risks would not have been covered by piecemeal existing processes. These companies now use HRDD processes to identify and address human rights impacts across their operations globally. One interviewee stated that ‘internally something happens when you start using the human rights phrasing’.

Only 34.62 per cent of those survey respondents who had considered human rights as part of other processes made reference to the GPs. Instead, the instruments most often referred to in this group’s due diligence processes were national legislation and the ILO Core Conventions. Notably, these are the two types of legal instruments where the majority of labour and employment regulation can be found. These findings correspond with this group’s indication that they predominantly considered human rights as part of employment rights-related processes.

3. Analysis: Using Human Rights Due Diligence

The survey results strongly suggest that where dedicated HRDD is undertaken, human rights are more likely to be detected than during non-specific human rights processes. Where human rights are indirectly taken into consideration through other due diligence processes, such as for labour, and health and safety issues, adverse human rights impacts are significantly less likely to be identified. This shows that the risks of such a limited approach are high. Survey results are starkly contrasted between the two groups: those that have done dedicated HRDD and those that only considered human rights in other due diligence processes. Nearly 80 per cent of companies using dedicated HRDD do identify adverse impacts, whereas over 80 per cent of companies using non-specific HRDD do not identify adverse impacts.

It is also worth noting that most of the non-specific human rights processes were focused exclusively on the rights of employees, which are also areas which are highly regulated in most jurisdictions. ⁷¹ Accordingly, all the other internationally recognized human rights were predominantly considered only by those companies who had undertaken dedicated HRDD.

The link between allegations of human rights violations against a company or another company in their sector and their likelihood of conducting dedicated HRDD, appears to demonstrate a correlation between knowledge about allegations of human rights risks, and undertaking comprehensive or dedicated HRDD. Where companies are aware of the existence of human rights risks within a certain operating context, there seems to be a tendency to undertake HRDD in terms of the GPs. This may indicate a move away from the assumption by a company that less knowledge protects against liability, towards an approach of proactive identification and prevention.

As human rights is an over-arching concept encompassing many different individual rights, interviewees frequently referred to the importance of operationalizing or translating human rights for internal company staff who may not have a human rights background. This frequently requires training on what human rights are and how they work. Many interviewees have found it helpful to break down references to human rights as a whole, and on a day-to-day basis refer instead to specific rights, such as child labour or land rights, with which operational managers have a more direct connection. This breakdown of concepts in order to operationalize them should not, however, be confused with an exclusive focus on these individual rights. Indeed, the companies which follow this approach towards the ‘translation’ of human rights have also stressed the importance of regular human rights impact assessments, to identify and address other human rights risk which may arise.

4. Results: Identification of Human Rights Impacts

The method most commonly used by respondents across sectors for identifying human rights impacts were desktop research and studies, including internet searches, sanctions lists and other database searches, media and non-governmental organizations (NGO) reports and high-risk country research. It also included a review of company policies and training records, legislation, industry guidance and best practice documents.

The second most prominent method employed to identify human rights impacts was an audit, whether internal or external. Auditing standards named by survey respondents include health and safety audits, land rights audits, project-basis audits conducted by technical personnel with specialist expertise, and internal audits on compliance with company policies. Interviewees indicated that internal audits are increasingly incorporating compliance with internal human rights standards, action plans or codes of conduct. Further methods respondents indicated for the identification of human rights impacts were investigations, independent expert reports and grievance mechanisms. Investigations were conducted by internal or external investigators.

Both energy and mining survey respondents indicated local communities as the top most consulted stakeholders during the identification process, showing this is a key area of concern for extractive companies. Financial services sector respondents indicated that local communities and employees were the most frequently consulted stakeholders. All survey respondents from the pharmaceutical and technology sectors identified employees as the stakeholders most often consulted towards the identification of adverse human rights impacts, and suppliers as the second-most consulted group. Technology respondents additionally consulted with trade unions, but apart from these three groups, no other stakeholders were selected as having been consulted by technology survey respondents. ⁷²

In relation to third parties, our survey indicated that across all sectors, where respondents conducted dedicated HRDD, 72.73 per cent identified actual or potential adverse human rights impacts linked to the activities of third parties. However, where human rights were only indirectly considered as part of other processes, this figure dropped to 29.17 per cent. Links to impacts of third parties were perceived differently within our focus sectors. In the mining sector, the difference between those companies which conducted dedicated HRDD and those which only considered human rights indirectly was dramatic: where dedicated HRDD was undertaken, 55.56 per cent identified adverse impacts of third parties, but where non-specific HRDD was conducted, no mining respondents at all identified third party impacts.

Furthermore, only 41.67 per cent of financial sector companies indicated that their due diligence processes had identified human rights impacts of third parties. It is noted that third parties in this context include the financial company’s clients. The likelihood of financial sector companies identifying third party human rights impacts increases to 60 per cent where dedicated HRDD is done.

In regard to prioritizing, of all the survey respondents which had done some form of HRDD (whether dedicated or non-human rights specific), 90.32 per cent indicated that their identification process found certain rights to be more severely at risk than others. Of these, 82.14 per cent prioritized these rights identified as most severe. ⁷³

Our survey shows that where companies have undertaken dedicated HRDD, the department or function most often responsible for the identification of human rights impacts is corporate social responsibility (CSR). ⁷⁴ In contrast, where human rights was considered as part of non-human rights processes, the function most often responsible for identification was human resources. ⁷⁵

These findings were confirmed during the interviews. Where human rights are only considered as part of labour rights or health and safety, human rights often fall within the exclusive ambit of the human resources function. Interviewees indicated that, in order for due diligence to be adequate, staff at all managerial levels should be trained on human rights identification. It was stated that the ultimate monitoring tool is another human rights impact assessment. Another large MNC confirmed this, as it was stated that they could clearly see the difference in the countries where it has conducted human rights impact assessments.

5. Analysis: Identification of Human Rights Impacts

The high frequency of human rights responsibilities located within the human resources department in the group that did not undertake specific HRDD reflects the findings that, where human rights are taken into account only through other existing processes, this is predominantly done as part of employment rights processes. It also confirms the likelihood that non-employment-related human rights will be overlooked where due diligence is confined to employment-related processes. Indeed, 80.77 per cent of this group of companies indicated that their process failed to pick up adverse human rights impacts. The survey results suggest that where identification duties are located within the CSR department, this may result in a HRDD process which is more effective than human resources departments in identifying human rights impacts. While widely varied tasks fall under the CSR label in different companies, the CSR function is ordinarily focused on a broader range of issues than the human resources function, and CSR portfolios increasingly include aspects of human rights.

The GPs use the concept of ‘stakeholders’ to refer to a wide group of affected individuals. Stakeholders in this context potentially include employees and their representatives, suppliers, retailers, consumers and end users, transportation and shipping providers, local communities, NGOs representing affected individuals, governmental and intergovernmental bodies, investors and shareholders, and industry bodies. In our survey it is clear that some sectors only considered a few stakeholders. In particular, the technology sector had a very limited view of its stakeholders. This confirms a concern that ‘many (though not all) ICT companies consistently undervalue [stakeholders]’. ⁷⁶ Engagement with rights-holders may be particularly challenging in the information and communications technology (ICT) sector because there may be ‘hundreds of millions (or even billions) of users spread across the world using diverse products, services, technologies, and applications in vastly different human rights environments’. ⁷⁷ However, unless relevant human rights are identified in this sector, as in others, then many actual or potential human rights impacts might not be discerned. In order to be most effective, a company should pay close attention to identifying its relevant stakeholders, as well as the methods by which they can most appropriately be consulted.

The GPs provide that, even where a company did not itself contribute to adverse human rights impacts, it should seek to prevent such impacts by third parties with whom it has business relationships. Such third parties may include business partners, entities in the company’s value chain, and other non-state or state entities directly linked to its business operations, products or services. Thus it is crucial that companies engage with third parties in order to identify human rights impacts. Indeed, there are some national legislations, such as the UK’s Modern Slavery Act, that require this. Yet our findings indicate that, if HRDD is not undertaken expressly – i.e., not using a human rights lens – then a company is significantly less likely to identify adverse human rights impacts by third parties than if it does so expressly. While our survey results and interviews demonstrate that companies in the financial sector recognize the importance of human rights impacts located in their value chain (such as those of the investments and projects they are financing), it also shows that existing non-human rights procedures within the sector may not be adequate for discovering third party impacts. ⁷⁸

As noted above, where companies have large numbers of entities in their value chains, the GPs allow for the prioritization of certain rights over others, provided that priority is given to those risks that are most severe or irremediable. ⁷⁹ The high number of respondents which found certain rights to be more severely at risk is perhaps not surprising, given that it is unlikely for any one company to have an equally severe impact on all the human rights which it affects. However, it is interesting to note that only 82.14 per cent of respondents prioritized the more severely impacted rights. This implies that 17.86 per cent of companies which had identified certain rights to be more severely impacted did not prioritize such rights. Therefore, there is a real risk that companies will neither identify the human rights impacts it or a third party makes, nor will they prioritize those human rights impacts which are most severe. This could also be a difficulty if ‘salience’ of human rights issues to a company is determined prior to the undertaking of a HRDD process.

One means of engagement with stakeholders is through grievance mechanisms. The grievance mechanisms used by survey respondents for the identification of human rights impacts were predominantly limited to whistleblowing channels, such as emails and hotlines, and human resources or workplace complaints systems. Most grievance mechanisms used by interviewees were either employment and/or anti-corruption focused. The lack of grievance mechanisms available to rights-holders outside of the company suggests that this is one aspect of HRDD which is currently under-utilized by companies towards the identification of their human rights impacts. It is also relevant that, while audits were used by some companies to identify human rights impacts, auditing and certification in and of themselves have been found to be ‘ineffective tools for detecting, reporting, or correcting environmental and labour problems in supply chains’ and human rights impacts in the absence of a wider, ongoing process. ⁸⁰

Most of those interviewed used risk-based methodologies. These processes of risk analysis typically categorized suppliers, customers, or other third party business partners into high, medium or low risk. This was often done through an initial questionnaire. For some geographies, countries or third party relationships, such as joint ventures with state-owned enterprises, the company may automatically require an enhanced due diligence, regardless of whether red flags are raised in the initial questionnaire. Human rights risks were integrated into existing risk assessment questionnaires and processes rather than separately considered. Whereas integration allows for longer-term and mainstreamed identification, unconsidered integration could result in human rights being evaluated as business risks and not as human rights impacts on others. This is contrary to the approach of the GPs.

A recurrent theme was the importance of the role of the board in overseeing and managing risks. The US Caremark case ⁸¹ has demonstrated that the board has the responsibility to demand information to be placed before it, which due to the complex structures typical in MNCs, is often most effectively done through delegation to a dedicated function. ⁸² The lack of board engagement in human rights issues has been confirmed by a report based on the views of 200 senior corporate executives. ⁸³ Our survey indicates that many boards are still not taking overall responsibility for the policies, identification and implementation of HRDD. ⁸⁴

C. Responses and Actions Taken

1. Introduction

The second principal element of implementing HRDD under the GPs is that a company should take action to address actual or potential human rights impacts and to ‘integrate the findings from their impact assessments across relevant internal functions and processes, and take appropriate action.’ ⁸⁵ The GPs also state that effective integration means ensuring that ‘responsibility for addressing such impacts is assigned to the appropriate level and function within the business enterprise’. ⁸⁶ Accordingly, our survey and interviews explored how companies are responding and what actions they are taking to prevent, mitigate and account for actual or potential human rights impacts. We refer to these actions collectively as the ‘implementation’ of HRDD.

2. Results: Who Takes Action

Survey respondents from companies which had done dedicated HRDD indicated that the department or person most frequently responsible for implementation of actions are CSR, ⁸⁷ followed by operations management, ⁸⁸ and procurement or supply chain management. ⁸⁹ In contrast, the group which considers human rights only as part of other due diligence processes, indicated that human resources and operations management are the primary functions ⁹⁰ assigned responsibility for implementation. ⁹¹

Many of those interviewed highlighted the importance of translating and applying human rights as it relates to the individual function in question. In more than one interview this was referred to as ‘making human rights operational’. Yet one interviewee indicated that at their company they do not want to create ‘human rights departments’. One interviewee explained that if procedures are aimed at sustainability functions only, they have to ‘argue with their business colleagues at every step’, whereas if human rights are successfully integrated into operational and commercial procedures, such as how to win a licence, then ‘all of a sudden it is on a project leader’s checklist, not on the support team members’ list’. Survey respondents and interviewees mentioned a few mechanisms which are used to ensure that internal decision making enables relevant actions to be implemented. The interviews indicated that in some companies, budgets for the required implementation was allocated centrally by senior leadership, while in others, they were absorbed into the budgets of the various functions responsible for the necessary actions.

Survey respondents were asked whether they had used internal or external human rights experts to advise on, conduct or evaluate the due diligence process. Our survey shows a significant contrast in the use of human rights experts between those survey respondents who had undertaken dedicated HRDD and those who had considered human rights only as part of other processes. 93.15 per cent of those who had undertaken dedicated HRDD had used human rights experts (whether internal or external), whereas 75.86 per cent of the other group used no human rights experts. Of our four focus sectors, the sector which made the most use of human rights experts was mining, in which 80 per cent of respondents used either internal or external human rights experts or both. Many of the interviewees had made use of external advisers, ranging from lawyers, auditors, specialized consultants, NGOs and business organizations to international organizations such as the United Nation’s International Children’s Emergency Fund (UNICEF).

Many companies indicated that a collective approach assists significantly where individual company action is unlikely to result in change. Some companies found it productive and appropriate to engage with competitors on human rights issues in a collective forum such as industry associations. One example used was the Voluntary Principles on Security and Human Rights which bring together companies, governments and NGOs around the topic of security and human rights. One interviewee demonstrated the advantage of collective action through an example of a large country where it only had a small market share. Approaching the relevant authorities and suppliers on behalf of a collective industry body was considered likely to be more effective than if it was a single company.

Training was another prominent mechanism selected for implementation by 58.06 per cent of all survey respondents. In the mining sector, this figure increases to 100 per cent. Current training was seen as ordinarily limited to either the company’s own employees or the employees of business partners within the value chain, such as contractors or supply chains. Some respondents and interviewees indicated that their training is aimed at the implementation of other policies, such as those relating to health and safety, corruption, sexual harassment, non-discrimination or supply chain management.

Some companies have specific training on their human rights policies, and how these are to be implemented. These training sessions are sometimes complemented by guidelines, instructions and other materials being available internally, for example on the intranet, to provide more detailed guidance on the implementation of the policy. A few companies of those we interviewed had internal training aimed specifically at human rights education, where the questions of what human rights are, and how to identify them, were included.

3. Analysis: Actions Taken

The GPs indicate that ‘internal decision-making, budget allocations and oversight processes enable effective responses to [actual or potential human rights] impacts’. ⁹² Our survey indicated that this is currently done in a piecemeal way, with few examples of coherent approaches across all the company’s departments. The lack of coherence is likely to limit the ability of a company to undertake effective responses to information obtained when identifying human rights impacts.

The lack of coherence was also seen in the different approaches on whether to have a distinct human rights department or to include human rights as part of the responsibilities of many departments. The former approach can create a clearer identity for human rights, including in relation to reporting (see below). The latter – the ‘mainstreaming approach’ – can enable the issues to be managed effectively, and create awareness of human rights throughout all operational areas. For example, an interviewee indicated that part of implementation is to ensure that those persons who deal with suppliers and rights-holders understand human rights, which does not simply entail dissemination of the relevant policies and translating them into local languages, but requires reinforcing the message as to how they apply at the relevant functional level. At the same time, it is important, with the developments in legal regulation in this area that, as the risks might be legal in nature, the legal teams are involved in the process, and that the key responsibility be in a multi-functional team.

Whichever approach is adopted, it is evident that training in identification, implementation and responding to human rights impacts is required across all companies. This would include training as to what human rights are, and how companies can have impacts on them. Despite the frequent emphasis which survey respondents and interviewees placed on the importance of training, few companies presently provide training specifically around human rights. Instead, training is frequently limited to non-human rights specific topics such as health and safety or other regulated areas. Given the ease with which training can be rolled out within a company which already has training sessions in place (relative to the potential preventative and comprehensive impact of training), it appears that companies are not currently capitalizing on the full advantage of human rights training.

Furthermore, companies that had undertaken dedicated HRDD had a significantly higher rate of using human rights experts. Our survey results show that this group also had a higher rate of identifying human rights impacts, both within their own operations as within their value chain. It seems that there is a correlation between the use of human rights experts and the identification of human rights impacts.

It was evident from our research that, in certain circumstances, human rights issues are so prominent and complex that a single company could not be expected to provide a solution through due diligence, though the individual company still has a responsibility to respect human rights in terms of the GPs. Many companies have indicated that a collective approach assists significantly where individual company action is unlikely to result in change. This not only facilitates engagement, but also enables the company to address the issues at its own factories, and within the country’s industry as a whole. However, more than one company highlighted that collective action also has its disadvantages. It usually takes time and resources to engage, and often a compromised approach is required in order to achieve consensus.

4. Results: Engagement with Third Parties

Contractual provisions were the primary method identified in the survey for preventing or addressing human rights impacts: 77.42 per cent of respondents across all sectors selected contractual provisions. This figure rises to 100 per cent in the mining and technology sectors, and 83.33 per cent in the energy sector. Other forms of contractual protection which were identified by interviewees include conditions precedent, indemnities, warranties or undertakings.

Interviewees indicated that where their contracts contain human rights clauses, they are able to authorize more in-depth HRDD, both internally and in third party relationships. The nature and terms of the contractual provisions used towards this purpose differ widely depending on the sector, context and the nature of the leverage. Termination rights may be specifically negotiated before the contract is entered into.

Codes of conduct was the second most important tool selected by survey respondents for addressing human rights impacts – at 64.54 per cent of all respondents. ⁹³ In the mining sector, this figure rises to 100 per cent. Codes of conduct can also inter-relate to operational policies. Codes of conduct are often shorter in format, less detailed and set at a more global level within the company than operational policies, which are aimed at certain particular functions or operational areas.

Interviewees indicated that codes of conduct are particularly useful within supply chains. Codes of conduct would often form part of a contractual obligation, in which case a breach would result in a contractual remedy such as a refusal to renew a contract, termination, compensation or implementation of enforcement mechanisms. A few interviewees referred to these mechanisms as being accompanied by capacity-building efforts to promote compliance.

Another key mechanism for the implementation of HRDD, which was highlighted by survey respondents, is engagement with external partners outside the strict terms of a contract. External engagement may be carried out by various methods such as through inspections or training, and could be understood as the exercising of leverage of third parties within a company’s value chain.

Our survey showed that leverage – being the ability to effect change in the wrongful practices of an entity that causes harm ⁹⁴ – and the perception of leverage, varies widely even within sectors, depending on the type of third party in question. This is demonstrated by survey responses from within the technology sector: 100 per cent of technology respondents who answered a question about levels of leverage ⁹⁵ indicated that they have no leverage whatsoever over purchasers, and 100 per cent indicated that they had reasonable leverage over retailers/distributors. They also indicated that they had either no leverage whatsoever or very little leverage over government entities. They had enough leverage or significant leverage over small suppliers but very little leverage or some leverage over large suppliers.

Other interesting outcomes were that whereas all financial sector respondents who replied to the question referred to having enough leverage over clients, half indicated that they had ‘no leverage whatsoever’ over governments. Two-thirds of energy sector respondents indicated that they had significant leverage over small suppliers, and 42.86 per cent that they have reasonable leverage over large suppliers. In the energy sector, two-thirds of respondents to the question felt they had reasonable leverage over business entities in joint ventures or partnerships. Similarly, two-thirds of energy respondents indicated that they had significant leverage over small suppliers; contrasted to less than a third who had significant leverage over large suppliers.

In the mining sector, more than half of respondents who answered this question indicated that they had significant leverage over small suppliers, and 45.45 per cent that they have reasonable leverage over large suppliers. Forty per cent indicated that they have some leverage over government entities. Similarly, in the pharmaceutical sector, half of the relevant respondents indicated that they had total control over manufacturer/producers, purchasers and/or retail distributors. In contrast, 66.67 per cent indicated that they have very little leverage over government entities. It was indicated that much depends on individual circumstances, including whether the supplier is dependent on the company for revenue.

5. Analysis: Engagement with Third Parties

It is evident that contractual provisions can facilitate some of the other methods for implementation of those human rights impacts that are identified. This includes inspections and training, engagement with business partners, and termination of business relationships. In this way, many of the most frequently utilized methods of implementation are interlinked through contractual clauses.

Where human rights issues arise during the duration of the contract, and termination is not feasible, the contract will most often not be renewed. It was highlighted by one interviewee that where these clauses are included, it is important they are utilized, in order to reinforce the message that they are binding. For example, where monitoring and inspection rights are provided for, they should be exercised. In this way, these clauses drive the obligation to monitor. Most interviewees indicated that termination of a business relationship would be considered as a last resort option, only to be utilized when other reasonable methods of engagement have failed or are patently futile. More than one interviewee referred to the obligation to undertake due diligence around the human rights impacts of the termination itself, particularly where the business is providing an essential good or service to vulnerable customers or clients.

It was clear that the extent of leverage which a company has over a third party will differ according to the circumstances, and that leverage is not necessarily equal to the level of shareholding or amounts involved in the transactions between the parties. For example, in the financial sector, the finance companies may have the maximum amount of leverage before entering into the particular transaction, though options still exist once the agreement has entered into force, and even minority shareholders may have certain levels of leverage. ⁹⁶ It seems that leverage is generally perceived by our respondents to be higher with suppliers and retailers/distributors, and seems to be generally lower with governmental entities, except in the mining sector where 40 per cent seemed to have some leverage. This is presumably due to the nature of mining, which usually requires large, geographically specific investments of considerable value to both the government and company. Nevertheless, our survey indicates that companies largely underestimate their power of leverage.

D. Monitoring Effectiveness of Actions Taken

1. Introduction

The third principal element of implementing HRDD under the GPs is that a company should monitor any adverse human rights impacts through tracking and feedback. Principle 20 provides:

In order to verify whether adverse human rights impacts are being addressed, business enterprises should track the effectiveness of their response. Tracking should:

1. (a) Be based on appropriate qualitative and quantitative indicators;

2. (b) Draw on feedback from both internal and external sources, including affected stakeholders. ⁹⁷

These issues were considered in our research.

2. Results: Tracking and Monitoring

There was a difference in tracking or monitoring between survey respondents who had undertaken dedicated HRDD and those who had considered human rights only through other processes. Of the dedicated HRDD group, 74.19 per cent indicated that they monitor or track the effectiveness of actions taken. Of the non-specific HRDD group, 66.16 per cent do not do such tracking or monitoring. Interestingly, those survey respondents who had only considered human rights as part of other processes showed a higher rate of consulting stakeholders towards tracking or monitoring (72.73 per cent) than those who had done dedicated HRDD (68.97 per cent).

Our survey has shown that tracking or monitoring is done in varying ways, depending on a given sector. Monitoring is particularly complex in the financial sector. Only 16.67 per cent of financial sector survey respondents tracked, audited or monitored the actions taken as a result of a HRDD process. One respondent indicated that contractual relationships in investment banking pose barriers for such tracking of clients’ actions.

Many respondents referred to the use of benchmarking tools and indicators in relation to human rights. These included the Global Reporting Initiative ⁹⁸ and the Danish Institute for Human Rights Compliance Assessment Tool. ⁹⁹ Indicators which do not refer to human rights expressly but are utilized towards compliance with regulated areas, such as labour rights or health and safety, were stated to be commonly used. Several of the interviewees are either in the process of developing, or have recently completed and activated, human rights scoring as part of their internal compliance mechanisms, yet one interviewee referred to the difficulty of measuring quantitatively a qualitative issue such as human rights. One interviewee at a financial company has recently developed a sophisticated annual rating tool with questionnaires that adapted depending on the relevant sector. In this way, it is possible to determine whether the customer’s impacts are above or below average, relative to others, through the use of standardized data.

The department responsible for tracking or monitoring differs between the groups which have done dedicated HRDD and non-specific HRDD. In the former group, the CSR department ¹⁰⁰ is most frequently responsible for tracking or monitoring, followed by the legal department. ¹⁰¹ In the latter group, operations management ¹⁰² is most frequently responsible for tracking or monitoring, followed by human resources. In the dedicated HRDD group, only 12.9 per cent selected the board or non-executive directors, and only 3.23 per cent selected the CEO as being responsible for the monitoring of the effectiveness of actions taken. ¹⁰³

3. Analysis: Tracking and Monitoring

It seems from our research that there is a correlation between undertaking HRDD expressly in terms of the GPs, the likelihood of identifying actual impacts, and the prevalence of tracking or monitoring the effectiveness of any actions taken in response to identified impacts. It is noted that in the group which has undertaken dedicated HRDD, the CSR person or department consistently comes out as the most used for identification, implementation and monitoring. In the non-human rights specific group, which has mainly focused on employment rights, human resources was most frequently responsible for identification and implementation, whereas operations management is most frequently responsible for the monitoring of what is presumed to be mostly employment rights-focused actions.

As indicated previously, the process of identifying relevant groups of stakeholders is essential to the effectiveness of any HRDD process. Our survey shows that consultation with employees is fairly routine in most sectors, presumably as a result of commonly being required by regulation. Similarly, in certain sectors such as extractives, consultations with local communities are fairly commonplace, presumably because of the operational risks connected to community dissent. However, other stakeholder groups, such as end users or transportation providers, may be entirely overlooked, which in turn may result in a company missing valuable information regarding the effectiveness of its HRDD.

While there are sophisticated processes on the part of the non-specific HRDD group, it is clear that the stakeholders consulted by this group were predominantly employees, trade unions or employee representatives and consumers. The only stated exception was where those respondents who had previously indicated that they had considered community, indigenous or land rights due diligence, also indicated that they consulted with communities. This is consistent with the non-specific HRDD group’s indication that they considered human rights predominantly as part of employment rights-related processes.

The GPs refer to the use of appropriate qualitative and quantitative indicators or measurements to track and monitor the effectiveness of actions taken. ¹⁰⁴ No consistent pattern of benchmarking or indicators was given by our respondents. This is an area that would benefit companies in their decisions about HRDD. There are some developments of benchmarks and indicators by which company policies and procedures can be measured for human rights compliance, such as the Human Rights Indicators for Business platform ¹⁰⁵ and the Corporate Human Rights Benchmark, which exclusively and comprehensively ranks implementation of the GPs. ¹⁰⁶ As these are fairly new, none of our survey respondents or interviewees had used it. Similarly, within sectors, human rights benchmarking systems are developing. For example, the Access to Medicines Index ranks pharmaceutical companies’ efforts to improve access to medicine, ¹⁰⁷ and the Higg Index enables companies within the apparel industry to score and benchmark their social, environmental and labour impacts. ¹⁰⁸ It is evident that companies would value clearer benchmarking and indicators, not least because they acknowledge the difficulty of measuring human rights by themselves.

4. Results: Means to Track and Monitor

The survey included questions about grievance mechanisms, as they can be a means to track and monitor the HRDD processes of a company. A number of the companies had grievance mechanisms (which often included complaints mechanisms geared at employees), which are typically used to raise disputes about payment or sexual harassment incidents. Other mechanisms included whistleblowing channels, aimed at the identification of labour issues or corruption.

One method often used by survey respondents and interviewee companies was a free and anonymous telephone hotline, available in local languages. Other mechanisms used by the companies we interviewed include a website, email address and fax number, an ombudsman for complaints with the relevant manager, human resources or compliance officer. One interviewee is making use of social media channels for its grievance mechanism.

The other issue relevant to tracking and monitoring is the reporting of findings. Over half ¹⁰⁹ of all sector survey respondents indicated that they communicated the findings of their HRDD process internally, and 28.57 per cent did so externally. Companies that undertake dedicated HRDD are considerably more likely to report their findings internally, ¹¹⁰ and externally, ¹¹¹ than companies who consider human rights only as part of other non-human rights processes.

Survey responses show that where reporting does take place externally, 81.25 per cent of cross-sectoral respondents indicated that only portions of the findings were communicated. The main reason cited for partial reporting across all sectors is confidentiality. Reporting most frequently takes place in CSR reports, followed by stand-alone human rights reports, annual reports, community meetings and financial reports and websites or social media, respectively.

One interviewee stated that they use the Guiding Principles Reporting Framework ¹¹² not only for reporting purposes but as a management tool. By identifying the issues on which they need to report in terms of the Framework, they are able to engage at operational and country level in order to come up with an action plan to address these issues. Another company interviewee indicated that in addition to reporting, successful communication can often take place through in-person consultations with relevant stakeholders, as well as through online chats and robust questions and answers.

5. Analysis: Means to Track and Monitor

The GPs expect companies to establish or participate in effective operational-level grievance mechanisms accessible to affected individuals and communities. ¹¹³ Grievance mechanisms should be legitimate, accessible, predictable, equitable, transparent, rights-compatible, a source of continuous learning, and based on engagement and dialogue. ¹¹⁴ The GPs state that ‘[a] grievance mechanism can only serve its purpose if the people it is intended to serve know about it, trust it and are able to use it.’ ¹¹⁵

What was seen from our survey was that most of the grievance mechanisms were aimed at internal stakeholders only. Companies using only confidential internal monitoring processes with no human rights focus may not benefit from information held by external stakeholders, and may find that their due diligence is inadequate as a result. Similarly, where the grievance mechanism is available by telephone or internet, it will limit responses from those communities who do not have these access tools. Indeed, direct personal engagement was highlighted by one interviewee as one of the most effective ways of dealing with complaints, and good practice was described by one interviewee as a ‘collection’ of grievance mechanism processes.

While it is understandable that many companies may not wish to publish all their reports on HRDD, the lack of publication can affect confidence in the process. It may also raise concerns as to whether HRDD has occurred to any significant extent. With increasing legal requirements for reporting – as well as possible legal consequences – the demand for greater transparency of these reports will increase. Indeed, companies interviewed indicated that one important benefit of using a human rights lens was that it enables the company to present its information in a way that is increasingly expected and demanded by external stakeholders. This was confirmed by our roundtable discussion. ¹¹⁶ This also includes the increasing litigation and other regulatory action which is taking place in the area of HRDD. Using human rights as a framework helps the company to ensure that it is viewing its activities in terms of the standards (including legal standards) used by its external audience.

VI. Conclusions

Our research has captured a considerable practice of HRDD by companies across the world. This was enhanced by the in-depth interviews to give a picture of how many (mainly reasonably well-informed) companies are trying – and often struggling – to conduct HRDD that is consistent with the GPs. Our analysis focused on examining the responses by reference to the core elements of implementing HRDD: identifying actual or potential human rights impacts; taking action to address these impacts; and tracking or monitoring the effectiveness of these actions.

Our research clearly demonstrates that a company which undertakes dedicated HRDD – with a human rights lens – is much more likely to identify adverse human rights impacts than through its ordinary non-specific HRDD (such as labour procedures or health and safety processes). It also showed that existing non-specific HRDD may not be adequate for raising awareness of third party impacts. There is a stark contrast between those companies which have undertaken dedicated HRDD and those which only considered human rights in other due diligence processes: while nearly 80 per cent of companies using dedicated HRDD do identify adverse impacts, over 80 per cent of companies using non-human rights specific due diligence, do not identify adverse impacts. Similarly, over 70 per cent of the dedicated human rights group identified adverse impacts linked to the activities of third party business relationships, whereas 70 per cent of the non-human rights specific group had not done so.

Our research strongly suggests that where HRDD is done expressly, human rights impacts of both the company itself and its business partners are significantly more likely to be identified, effectiveness of actions are significantly more likely to be tracked, human rights experts are more likely to be consulted, and a wider range of human rights are likely to be considered. Furthermore, whereas more severe rights may be prioritized in terms of the GPs, prioritization should not be based solely on assumptions about ‘salience’ of certain rights to the company or reactions to allegations in the industry, but on ongoing and comprehensive identification and HRDD processes which expressly take into account the entire spectrum of human rights. Our research shows that a failure to undertake such a dedicated HRDD process could result in other human rights risks being overlooked. Thus the correlation between the use of an express human rights lens and a more effective process for the identification of human rights impacts is an important finding which emerges repeatedly in the results of our empirical research.

Some companies have indicated that human rights terminology has significantly assisted them in external engagement, depending on the audience. One company stated that before they had a human rights policy, engagements on ‘fluffy concepts’ such as social issues were seen as ‘nice to have, but not essential’. However, once human rights language was prompted by the company’s human rights policy, issues were recognized as being more important: ‘Everyone knows you do not fool around with human rights’. This is especially relevant as, whereas business incentives to respect human rights may be driven by the perceived risks to the business, the HRDD process is aimed at identifying and preventing the human rights risks faced by the rights-holders.

The survey also showed that certain common elements feature in all the discussions about HRDD. Many of these – including communication channels within management procedures, training, expertise of trainers, factual circumstances and attributed knowledge – are the same elements that courts and regulatory bodies take into account to determine whether due diligence was comprehensive enough and effectively implemented in other areas of law. The widespread use of these elements amongst those that are aiming to undertake HRDD demonstrate an increasing understanding on the part of business that HRDD requires a substantive, contextual and ongoing approach, as opposed to a mere formalistic tick-box exercise. It also raises the issue as to whether a CSR department is best placed to deal with HRDD and indicates that both compliance and operational departments, including the legal department, need to be involved in a multi-functional team, and appropriately trained in HRDD.

The research indicated a number of the challenges faced by companies at this time. A key challenge was in relation to third parties. Even where no direct contractual relationship exists with, for example, second tier suppliers, legal and reputational risks may still arise. ¹¹⁷ Many companies struggle to satisfy themselves as to ‘how far is far enough’ into a supply chain. In addition, information on third parties’ or country-specific human rights risks may not be readily available, and there may be withholding of information, which an audit may not find. Another key challenge highlighted was of changing the focus from risks to the business to impacts on rights-holders, in accordance with the approach of the GPs. One interviewee indicated that when risk is expressed as being a risk to business, it does not represent the seriousness of the issues and the severity with which they affect, and impact upon, rights-holders. This also indicates the challenges of incorporating risks to rights-holders into risk management processes, which have thus far been aimed exclusively at identifying risks to the business. Nevertheless, our research demonstrates that by preventing adverse human rights impacts, HRDD can offer protection against various risks to the business, including legal, financial, reputational and operational risk.

It is evident that developments in the law and other regulations are an important factor in how companies respond to HRDD. HRDD is similar to due diligence in other legal contexts in that it is an objective standard by which a defendant can show compliance with a certain duty of care, and it is a contextual enquiry, which takes into account what the reasonable or prudent company knew or ought to have known in the circumstances. However, HRDD is different from other due diligence in that it focuses on the human rights impact of the company’s activities and not just on the business risk. Our research indicated that companies which are undertaking sophisticated, dedicated HRDD processes feel significantly more confident about dealing with possible legal claims, as they will be able to show the extent of steps they have taken. For example, an interviewee from a large MNC indicated that there is a move away from the past concerns that more reporting leads to more liabilities, with their legal counsel being keen for more transparency of their human rights processes. Another company indicated that if a company has internal initiatives in place, sets up policies, activates multifunctional teams, and discloses those activities publically, it was felt that the public would not really blame them for not doing anything, because they were doing something within their control.

Interestingly, our research confirmed that companies would generally prefer clearer regulation over uncertainty and inconsistency. ¹¹⁸ For example, it has been shown that those human rights which are generally regulated, such as health and safety and labour rights, have a higher likelihood of being considered as part of due diligence processes, most notably by companies which are not undertaking comprehensive or dedicated HRDD. ¹¹⁹ One interviewee stated that whereas they previously wanted to ‘think positively’, they had changed their mind and now believed that legislative change is needed, as ‘sometimes you just need the forceful push.’ Another interviewee stated that regulation tends to ‘mainstream’ the issues and referred to the example of statutory requirements regarding the percentage of women on the board, which resulted in the issue swiftly being ‘fixed’ after the legislation was adopted.

One new and vital aspect uncovered by our research was that although individual companies and sectors do differ, the approach to HRDD is overwhelmingly similar across sectors and corporate structures. The following steps were the most prominent components of HRDD as established by our research:

• ∙ initial identification through human rights impact assessment, desktop research or gap analysis, perhaps followed or complemented by interviews;

• ∙ assessment of human rights risks, including risks to rights-holders;

• ∙ prioritization of human rights issues;

• ∙ development of action plans;

• ∙ strategic direction at the board level;

• ∙ cross-functionality: steering groups, working groups, interaction between relevant functions;

• ∙ integration of human rights into internal compliance mechanisms, scoring and tools;

• ∙ translation and application of human rights to apply to each function;

• ∙ inclusion of HRDD requirements in contractual provisions;

• ∙ having codes of conduct and operational policies;

• ∙ providing training to employees (and in some cases to other stakeholders); and

• ∙ ensuring that there are effective grievance mechanisms.

These components are applied differently within each company. In some companies, compliance with human rights standards will take place centrally (at headquarters level), in other companies where operations are decentralized according to country, region or individual business operations, compliance may be overseen at those levels. Those interviewed were all at various stages in undertaking these steps. Most interviewees are currently at the beginning phases of at least one or two of the components, and identified finalizing and rolling these out as part of their main mandate for the next year or two. Many have moved further on some components than on others. None of those interviewed viewed themselves as having already completed all the work that they intend to do on all the components.

One or more of these components are being undertaken to varying degrees within all the companies we interviewed, although in many companies they are not expressly referred to as steps within a HRDD process. Many of the interviewees emphasized their intention – and often express mandate – to spend the next year or more focusing on reviewing, updating or implementing specific components. There is, accordingly, a forward-looking, ongoing process of ‘learning by doing’. As our research makes clear, this process of HRDD requires detailed knowledge of company practices to ensure that any developments in regulation assists both the companies and those affected by their human rights impacts.