Getting to know your company's human rights risks

Companies today are expected to know and show that they respect human rights in their business activities and business relationships.

Processes to identify and understand impacts are key to doing this. They’re a core part of the ‘know’ in ‘know and show’.

Implementing these processes can be easier said than done. Companies can impact virtually any human right – from workplace rights to health and safety issues, discrimination, privacy, security, cultural rights and more. And they can become involved in impacts through their own activities and their business relationships. For companies with a global value chain, the task can seem overwhelming. But it doesn’t have to be.

The key is to start somewhere, and then build on that. Done well, impact assessments help you know what your company’s actual or potential human rights impacts are, so you can take steps to address these. They can also help build trust and credibility with stakeholders.


What do processes to identify impacts look like in practice?

Ways to identify and understand impacts:

  • Undertake desk research to identify key risks in the company's industry and the regions where it operates.
  • Implement in-depth processes to identify risks and impacts connected to specific operations, products or services.
  • Draw on market reports, government reports and academic studies, as well as information from audits and internal grievance mechanisms.

Ways to ensure the company acts on findings:

  • Integrate efforts to identify impacts into business decision-making (e.g. before entering a new market or developing a new product/business).
  • Ensure lines of accountability for acting on the findings of impact assessment processes are clear.
  • Establish feedback loops between teams conducting impact assessments and those acting on the findings.

What do the UN Guiding Principles say about identifying impacts?

The UN Guiding Principles on Business and Human Rights, or UNGPs, expect companies to take active steps to identify and understand human rights impacts that they may be involved in through their own activities and through their business relationships.

Key guidance on identifying impacts includes:

  • Assessments of human rights impacts should be undertaken prior to a new activity or relationship, major decisions or changes in the operation, in response to (or anticipation of) changes in the operating environment, and periodically throughout the lifecycle of an activity or relationship.
  • The purpose of processes to identify and assess adverse impacts is to understand the specific impacts on specific people, in a specific context of operations.
  • Companies should draw on internal and/or external human rights expertise and consult meaningfully with potentially affected groups and other relevant stakeholders.
  • Companies should integrate the findings of their impact assessments across relevant internal functions and processes – and take appropriate action.

See Guiding Principles 12, 17, 18 and 19 for more.

Insights from business practice

  • Impact assessments are a means to an end, not an end in themselves

    When developing processes to identify and understand impacts, be clear about your objectives. Ideally, these processes should enable you to assess any impacts on the ground. However, it will be important to act on the findings – the assessment will give you information, but the company needs to act on that information appropriately to meet its responsibility to respect human rights.  

    Impact assessment processes can help strengthen trust and credibility with stakeholders and affected people.

    In some situations, you may be trying to assess whether a business partner operates responsibly. In such cases, a process may focus on assessing the management systems the partner has in place – but stay mindful that this may not give you any insight into or visibility of impacts on the ground.

  • There are many ways to assess impacts, and your approach should be context-specific

    The approach and methodology you choose should suit what you’re assessing, and the context in which the assessment is to be undertaken. For example, impact assessments may be undertaken at a high level, to map key risks for the company. They may also be undertaken at a more granular level, focused on a specific product, supply chain, business relationship, geographic region, project or part of the business.

    Processes to identify and understand human rights impacts should be carried out as early as possible - preferably before contractual obligations have been entered into - and repeated periodically. Processes may include a number of steps, such as desktop research, document reviews, stakeholder interviews (e.g. with customers, governments and local authorities, employees, contractors, communities, civil society), analysis and prioritisation of findings, and the development of action plans. It will be important to tailor the approach to the context. For example, an assessment of an operation in a region characterised by weak governance and vulnerable groups will need to be designed with these factors in mind.

    Methodologies and processes can be refined over time, with subsequent processes incorporating lessons learned from earlier ones.

  • Focus on risks to people

    Processes to identify and understand human rights risks should primarily focus on risks to people. Whilst companies' initial instinct is often to identify human rights-related risks to the business (such as legal risk or reputational risk), the company's responsibility to respect human rights is about what happens to affected - or potentially affected - people.

    This focus on risks to people can be new to companies. Existing due diligence and risk identification tools are likely to focus instead on risks to the business. Accordingly, you may need to sensitise colleagues to the need to focus on risks to people when undertaking human rights due diligence. You may also need to adapt existing tools and systems - or develop new ones - to accommodate this focus. 

    Many practitioners observe that where there are risks to people, there are also risks to the business. So by working to identify and understand risks to people - and taking proactive steps to manage these risks - you will generally also be helping the business.

  • Choose tools and methodologies that will give you the information you need

    There are many tools and methodologies that can help you identify human rights impacts. It can be useful to consider their various strengths/uses in order to apply them effectively.

    Importantly, there are now publicly available examples of companies' human rights impact assessments, and sector-specific guidance developed for business practitioners. Familiarise yourself with these - particularly those relevant to your company's sector.

    Sampling methodologies work well for some human rights issues, but won’t necessarily generate enough information to resolve an issue. Telephone hotlines can also be useful sources of information, but their reliability requires users’ trust in the system. Companies are increasingly exploring how blockchain technologies can be applied to help identify and manage human rights issues – particularly their potential to enhance traceability.

    Audit processes are very commonly employed in many industries. Although widely recognised as imperfect, they can yield valuable information and insights. Incorporating worker interviews into audit processes can be time and resource intensive, but very valuable in eliciting information that might otherwise be missed. Some companies now require suppliers to pay for audits. Whilst this creates a burden for suppliers, it also increases pressure to pass the audit, and address any issues quickly and effectively.

    Some practitioners are also exploring worker voice tools to enhance their visibility of issues on the ground. These need to be designed and deployed thoughtfully to generate useful insights. Poor question design and lack of trust by workers can undermine the usefulness of these tools.

  • Civil society organisations can be instrumental partners, particularly where information is needed quickly

    Building collaborative relationships with civil society organisations on the ground can help companies get information about human rights impacts and issues. This can be particularly valuable where information is needed fast to enable a rapid response to an incident.

    However, companies are well-advised to do due diligence on a civil society organisation prior to engagement to ensure that they are likely to receive quality input and can base their relationship on mutual trust, and an ability to have candid and constructive conversations about challenging issues.

  • Colleagues involved in impact assessments need the right knowledge and skills

    A key challenge confronted by practitioners working to undertake effective assessments of human rights impact is building the know-how of colleagues involved in the assessment.

    Ensuring that those involved understand the breadth of human rights and know what to look for is key.

    For more, see:

    Awareness raising, training and capacity building

  • Impact assessments are only effective if you act on the findings

    Processes to assess human rights impacts need to be linked to action.

    The need to act on findings and implement action plans can present challenges, particularly where resources and capacity are limited. Where action plans need to be implemented by other teams, monitoring progress can also be difficult. Linking impact assessments to clear governance structures that ensure accountability for acting on the findings can help. Some practitioners observe that it can be difficult to incorporate human rights into enterprise risk management (ERM) systems, but that this can be very effective in ensuring action. One challenge relates to the need to focus on human rights risks to others, rather than to the company, which may not be the language or focus of a company’s ERM system. Risks to others, however, are very often also company risks - moral, legal, financial and reputational.

    Where risks and impacts cannot be mitigated, acting on the findings may mean participating in processes to ensure affected people have access to remedy.

  • Meaningful engagement with stakeholders can be challenging, but is critical

    Processes to identify and understand human rights impacts should incorporate meaningful engagement with stakeholders. These may include customers, governments and local authorities, colleagues, business partners, affected people and communities, civil society organisations, experts and investors.

    Engaging with affected people and communities can be particularly challenging. But it is key to understanding what risks and impacts may affect people – and their experience of these. Practitioners find that it can be more time-consuming in the long term to assume you understand the issues and act quickly, than to take time to do a deep dive with a select group. Some companies find the World Food Café methodology can be helpful in mitigating the risk that local power dynamics will influence what community members say. It is important to find legitimate leaders and proxies, and to ensure that women, youngsters, elders and vulnerable groups are heard. Working relationships and the flow of information can improve where there is trust between affected people and the company.

    You may also need to build buy-in to engage with internal colleagues. Having strong leadership support can help here. Some practitioners also find it useful to work through a function (such as the legal department) that has existing relationships and bonds of trust with relevant teams and parts of the business.

    The World Food Cafe methodology

Looking forward: Broadening knowledge of human rights risks

In recent years, we’ve seen increasing numbers of companies implementing processes to identify and understand their human rights impacts – and these processes are becoming more sophisticated.

New regulatory requirements and stakeholder expectations are driving more companies to take their human rights responsibilities seriously. Accordingly, it’s important that we find ways to overcome challenges and advance company efforts to identify and understand impacts.

Places to start include:

  1. Overcoming challenges of scale: One of the key challenges for business practitioners is overcoming the challenges of scale. Effective prioritisation can help make the task more manageable, at least initially. But to develop and maintain a robust understanding of the company’s human rights risks, more will be needed. Collaboration at an industry level to set common expectations and share information has demonstrated potential to create efficiencies and enable access to more information than a company could identify acting alone. We can build on these emerging practices, and new tools, thinking and innovation are needed to enable effective human rights risk identification in a globalised world.

  2. Increasing opportunities to deepen understanding: Really understanding the human rights impacts a company may be involved in takes time and resources. Going beyond numbers, labels and analytics, speaking with people to understand how they are – or might be affected. How can companies – particularly those with vast operations and value chains – find ways to do this whilst also grappling with the challenges of scale? And how much is enough? As we find more efficient ways to process large quantities of information, we need to also find ways to keep focused on individual people and the diversity of their experiences.