Due Diligence

Responsibility does not begin when harm is discovered. It begins with the discipline of looking for it, acting on it and learning from the result.

Due diligence once belonged mainly to the language of transactions. A company investigated financial, legal or commercial risk before making an investment or signing a contract. Responsible-business due diligence asks a different question.

It is concerned not only with risks to the company, but with adverse impacts on people, the environment and society that the company may cause, contribute to or be directly linked to through its operations, products, services and business relationships.

The OECD describes due diligence as a risk-based process for identifying and addressing actual and potential adverse impacts across operations, supply chains and business relationships. It is continuous rather than occasional and preventative rather than purely reactive. The objective is not to produce a file showing that checks were completed. It is to improve decisions and outcomes.

The process embeds responsible business conduct into governance, identifies and assesses impacts, prevents or mitigates them, tracks results, communicates and supports remediation where appropriate. Its value lies in the logic connecting those steps, not in completing a checklist.

Due diligence is a cycle because supply chains, evidence and risk change. A system that was reasonable last year may become inadequate today. Review and improvement are part of the process, not signs that the process failed.

Risk-based does not mean convenient. It means prioritising according to the severity and likelihood of impacts, not according to the commercial importance of a supplier or the ease of collecting data. Severe human-rights harm may deserve urgent attention even where volumes are small. Widespread environmental degradation may require a landscape response rather than a narrow supplier audit.

The analysis should be based on harm to people and the environment, while also considering the organisation's relationship to that harm and its leverage to influence change.

Traceability can provide essential input. It shows which products are linked to which origins, suppliers or facilities. Risk data can then be overlaid: forest loss, water stress, labour vulnerability, conflict, grievances or income gaps. But due diligence cannot be outsourced to traceability.

Knowing where a product came from is only the beginning; the organisation must decide what to assess, how to respond and whether its response worked.

Audits and certification can also contribute evidence, yet neither is equivalent to due diligence. An audit is a snapshot against defined criteria. A certificate indicates conformity within the scope and method of a scheme. Due diligence is the organisation's broader management responsibility.

It includes risks outside an audit checklist, conditions between audit visits, purchasing practices, stakeholder voices and the need to adapt when evidence shows that existing controls are ineffective.

The collapse of the Rana Plaza building in Bangladesh in 2013 remains a stark warning about the limits of compliance evidence. Factories in the building had been subject to social-audit and buyer-control systems, yet the structural danger that killed more than 1,100 people was not prevented. The lesson is not that audits have no value.

It is that a checklist focused on the wrong scope, used without worker voice, engineering evidence or effective escalation, can create the appearance of control while the most severe risk remains outside view.

The appropriate response depends on the organisation's connection to the impact. If it causes harm, it should stop and remediate it. If it contributes, it should stop its contribution and use leverage to mitigate remaining harm. If it is directly linked through a business relationship, it should seek to prevent or mitigate the impact, using and increasing leverage where possible.

Ending a relationship may sometimes be necessary, but abrupt disengagement can worsen harm. Responsible disengagement considers consequences and is not a substitute for trying to improve conditions.

Agricultural supply chains show why prioritisation is necessary. Companies may source through intermediaries from thousands of farms and cannot investigate every issue with equal depth. A risk-based approach directs stronger evidence and action towards the most severe and likely impacts while maintaining a credible process for emerging concerns.

Documentation shows how decisions were made, but it is not the purpose. A polished policy has little value if commercial incentives reward behaviour that undermines it. Due diligence becomes real when procurement, finance, legal, sustainability and leadership share responsibility and decisions change in response to evidence.

Communication should report scope, methods, limitations, significant risks and remaining gaps. A statement that no issues were found may reflect strong performance, a narrow review or a system that failed to detect harm. Transparency requires enough detail to distinguish between them.

Due diligence is therefore not a promise that nothing will ever go wrong. Complex supply chains will continue to contain risk and, at times, harm. The standard is whether the organisation has built a serious, ongoing process to understand its impacts, prioritise responsibly, take proportionate action, learn from evidence and contribute to remedy.

It is the operating discipline that turns sustainability commitments into accountable practice.

Practical application

In a coffee or cocoa supply chain, due diligence may begin with traceability and contextual risk screening, followed by deeper assessment in higher-risk origins. Evidence can include satellite analysis, worker and farmer interviews, grievance data, income studies, supplier systems and field verification.

Findings should lead to specific decisions: change a purchasing practice, strengthen safeguards, provide support, collaborate at landscape level or escalate where harm persists.

The organisation should then track both implementation and outcome. Training delivered, farms mapped and suppliers assessed show activity. Reduced exposure, resolved grievances, improved labour conditions or halted conversion show whether the response affected the risk. Where evidence is weak, the conclusion should be uncertainty, not assumed compliance.

Why it matters

Due diligence is the mechanism that connects knowledge to responsibility. It helps organisations direct attention to the most serious impacts, act before harm escalates, use leverage more effectively and demonstrate how sustainability commitments influence real decisions. It is increasingly central to regulation, investor expectations and credible supply-chain governance.

Common misconception

Due diligence is often treated as a one-time audit, a legal checklist or a guarantee of a risk-free supply chain. It is none of these. It is a continuous management process that prioritises significant impacts and expects improvement over time. Strong due diligence may uncover more problems, not fewer, because the system is capable of seeing what was previously hidden.

Connections

Traceability provides the map, living income reveals one important livelihood outcome, and due diligence determines how organisations should identify, prioritise and respond to adverse impacts. The next chapter widens the boundary. A landscape approach asks what happens when the drivers of harm, the people affected and the solutions required extend beyond any one farm, supplier or company's direct control.

A question worth asking

If a serious impact were identified in your supply chain tomorrow, could your organisation show not only that it had a policy, but how the risk was prioritised, who made the decision, what action followed and whether conditions improved?

Selected references

- OECD. 2018. Due Diligence Guidance for Responsible Business Conduct.

- United Nations. 2011. Guiding Principles on Business and Human Rights.

- OECD and FAO. 2016. Guidance for Responsible Agricultural Supply Chains.

- International Labour Organization. 2017. The Rana Plaza Accident and Its Aftermath.

- LeBaron, G. , Lister, J. and Dauvergne, P. 2017. Governing Global Supply Chain Sustainability through the Ethical Audit Regime. Globalizations 14(6): 958-975.