Human rights due diligence (HRDD)

“A policy states an intention. Due diligence tests what the business does when people may be harmed. ”

Human rights due diligence is often mistaken for a supplier audit, a risk register or a policy approved by the board. Each may contribute, but none is the process itself. Due diligence is the discipline through which an organisation repeatedly asks where people may be harmed, how its own decisions are connected to that harm, what action is proportionate and whether the response is working.

The UN Guiding Principles on Business and Human Rights describe four core elements: assessing actual and potential impacts; integrating the findings and taking action; tracking the effectiveness of the response; and communicating how impacts are addressed. Where a business has caused or contributed to harm, it should provide for or cooperate in remedy.

The cycle is continuous because suppliers, workers, products, operating contexts and business decisions continue to change.

Its perspective is different from conventional enterprise risk management. Enterprise risk asks what may harm the company. Human rights due diligence asks how the company may harm people through its operations, products, services or business relationships. Reputational, legal and financial exposure may follow, but they are not the organising principle.

A severe impact on a small, politically marginalised group does not become unimportant because it is unlikely to affect earnings. The UN Guiding Principles therefore prioritise impacts by severity when not all can be addressed at once.

Severity depends on scale, scope and irremediable character: how serious the harm is, how many people are affected and whether those affected can be restored to their previous position.

Likelihood remains relevant to assessing potential impacts, but a low-probability risk of catastrophic or irreversible harm may demand attention before a common but readily reversible issue. Responsibility also depends on the nature of the connection.

A business may cause an impact through its own action, contribute to it alongside others, or be directly linked to it through a product, service or business relationship. The distinction changes the expected response. Causing harm requires stopping it and providing remedy. Contributing requires ending the contribution, using leverage to mitigate remaining harm and supporting remedy.

Direct linkage generally requires using leverage to prevent or mitigate the impact, even where the business did not create it. These categories cannot be decided by contract wording alone.

Purchasing practices may contribute to excessive overtime even when supplier codes prohibit it. Rapid order changes, prices below the cost of compliant production or short lead times can create predictable pressure on labour. Conversely, merely buying from a supplier where harm occurs does not automatically mean contribution.

The analysis turns on the business's conduct, foreseeability, leverage and the relationship between its decisions and the impact. The European Union's Corporate Sustainability Due Diligence Directive, adopted in 2024 and subsequently amended, translates parts of this normative framework into binding requirements for companies within scope.

Its thresholds, timelines and legal details may change through legislation, but the underlying management challenge remains. Compliance with a particular law does not replace the broader responsibility to respect human rights across all business activities and relationships. Disengagement is one of the hardest decisions.

Leaving a high-risk supplier may protect the buyer's exposure while removing income, worker voice or leverage and leaving the abuse unchanged. The OECD and UN frameworks therefore call for responsible disengagement: consider the severity of the impact, the feasibility of improvement, consultation with affected people and the consequences of exit.

Due diligence is not a mechanism for removing difficult relationships from a dashboard. It is a method for reducing harm to people.

Practical application

Begin with a value-chain map focused on potentially affected people, not only tier-one suppliers. Use worker, farmer and community engagement to identify impacts that management data may miss. Record the basis for severity assessments, the organisation's connection to each impact, the actions assigned, deadlines, responsible owners and indicators of effectiveness. Integrate findings into commercial decisions.

Review prices, lead times, recruitment arrangements, security practices, data systems and incentives alongside supplier controls. Establish safe grievance and remedy pathways, and test whether affected people can use them without retaliation. When disengagement is considered, assess and document likely human-rights consequences before exit.

Why it matters

Human rights due diligence turns a general responsibility to respect rights into a repeatable management process. It helps organisations find impacts before they become crises, directs attention to the most severe harm and makes commercial functions accountable for the conditions their decisions create.

Common misconception

Human rights due diligence is often reduced to auditing suppliers against a code. Audits provide snapshots and may miss informal, hidden or retaliatory abuse. Due diligence is continuous, risk-based, informed by affected people and connected to prevention, leverage, remedy and business decision-making.

Connections

Human rights establishes the substantive rights at stake. Due diligence provides the process for addressing them. Living wage, decent work, child labour and forced labour are specific areas in which the process must distinguish indicators from actual conditions and consider how purchasing and recruitment practices contribute to risk.

A question worth asking

When your organisation identifies a severe human-rights risk, which commercial decision is allowed to change - and who is accountable if none does?

Selected references

United Nations. 2011. Guiding Principles on Business and Human Rights. OHCHR. 2012. The Corporate Responsibility to Respect Human Rights: An Interpretive Guide. OECD. 2018. Due Diligence Guidance for Responsible Business Conduct. European Union. 2024. Directive (EU) 2024/1760 on Corporate Sustainability Due Diligence, as subsequently amended. OHCHR. 2018.

Improving Accountability and Access to Remedy for Victims of Business-Related Human Rights Abuse.