Risk based human rights due diligence: What it means and why it matters

Key Takeaways

• Risk-based due diligence means prioritising the most severe risks to people. Businesses should focus resources on the areas of their value chain where harm to people is most likely and most serious, rather than applying a blanket approach across all suppliers.
• Salient human rights risks are assessed by severity and likelihood. Severity is judged by scope, scale and remediability, and these factors, combined with the probability of a risk occurring, determine where attention should be directed.
• Supply chain mapping is the essential starting point. Without basic visibility of where products and services come from and who is involved, meaningful risk assessment is impossible.
• Due diligence is an ongoing and iterative process. Risks evolve over time, so supply chain mapping and risk assessments must remain dynamic and lead to concrete actions that prevent, mitigate or remediate harm.

Risk-based human rights due diligence is a process through which businesses identify, assess and address the risks their operations and value chains pose to people. The United Nations Guiding Principles on Business and Human Rights (the "UN GPs"), which have set the benchmark for best practice since 2011, expect companies to adopt this approach. It is also what is required by the recently amended EU Corporate Sustainability Due Diligence Directive (the "CSDDD").

In a world where businesses can impact many people in different ways across complex value chains, a risk-based approach means that businesses must prioritise their salient human rights risks rather than treating all risks equally.

Salient risks: Identifying the most severe threats to people

Salient human rights risks are those that stand out because they could cause the most severe harm to people, either through a company's own activities or through its business partners. Severity is assessed according to three criteria: scope, which considers how many people could be affected; scale, which measures how grave the harm would be; and remediability, which evaluates how difficult it would be to put things right. Alongside severity, the likelihood or probability of a risk occurring must also be considered. Together, these factors help a business focus on the risks that matter most to people.

It is important to stress that salience is about risk to people, not risk to the business. Forced labour and child labour are common salient risks in many supply chains, including sectors such as cotton, cocoa, cobalt and palm oil. Migrant workers in manufacturing can be particularly vulnerable, especially where recruitment fees create debt bondage. These risks can be deeply rooted and difficult to tackle, which is precisely why they demand prioritised attention.

Standard questionnaires: Why a blanket approach falls short

Some companies still take a more basic and standardised approach to human rights, often limiting their engagement to their direct or tier one suppliers and requiring them all to complete a standard human rights questionnaire or to agree to standard contractual terms relating to human rights risks. This is not a risk-based approach. It can place a heavy and unnecessary administrative burden on low-risk parts of a supply chain whilst obscuring where the risks are actually highest.

Supply chain mapping: Where to start with due diligence

A business cannot assess risks without basic visibility of where its products and services come from and who is involved. The best starting point is therefore a high-level review of business operations and the value chain to identify those activities, geographies, products and relationships where risks to people are most salient.

In practice, carrying out this high-level review, or scoping exercise as it is referred to in the new CSDDD, means using available information on high-risk sectors, countries or regions to identify areas of the business and value chain where adverse impacts are most likely. The approach will vary for each company depending on size and resources. Larger companies might commission external organisations to support them, whereas smaller businesses might do robust work with publicly available sources on country and sector risks, supplemented by what they know about specific sites, such as wages, health and safety practices, recruitment practices and channels through which workers can raise concerns.

This initial scoping exercise can be complex. Some companies have thousands of direct suppliers and many more indirect ones. Certain supply chains, including smallholder farming, artisanal mining, logistics and warehousing, are often opaque and employ vulnerable workers. Data can be fragmented and quickly outdated. Most companies therefore start by mapping and reviewing their highest risk supply chains, building visibility tier by tier and iterating as they learn.

In-depth assessment: Focusing on the most severe and likely risks

The next step is to carry out a more in-depth assessment, focusing on the most salient risks to people. Increasingly, companies use diverse sources of data to do this, including audits, grievance mechanisms and hotlines, as well as engagement with trade unions to understand workers' perspectives. Some also use technology, including artificial intelligence, to scan for risk signals. Whatever the tools, the aim is the same: to build an evidence-based picture of where severe harm to people is most likely, increase transparency and encourage suppliers to be open about sourcing risks.

For complex supply chains, there will often be more than one salient risk. Seafood may require a focus on vessel-based labour risks. Electronics may require deeper raw material scrutiny. Garments may require attention to factory and mill conditions. A business will not resolve everything at once, and it is therefore important to be explicit about priorities, timelines and resourcing. Being prepared to say "not now" where necessary is appropriate, provided there is a clear plan for how and when those issues will be revisited.

Continuous improvement: Keeping due diligence dynamic and effective

Risk-based human rights due diligence is not a one-off exercise. Risks evolve over time, and supply chain mapping and risk assessments should be ongoing and dynamic. The process must lead to concrete actions that prevent, mitigate or remediate harm to people. Businesses should keep their focus on risks to people, start where the risk is greatest, use mapping to build visibility and continue iterating as circumstances change.

For more information and tailored advice on risk-based human rights due diligence, watch the video in full and please reach out to Kerry Stares at Charles Russell Speechlys for tailored advice.