Can regulators assess the seriousness of companies' compliance with HRDD laws?

With the rise in mandatory human rights and environmental due diligence (mHREDD) legislation (notably the EU’s imminent directive), a new question is coming up for companies and policymakers—how can regulators determine the robustness of companies’ due diligence efforts in order to meet legal requirements? Shift proposes six “signals of seriousness” to help guide regulators in the following six areas: 1) Governance of human rights; 2) Meaningful engagement with affected stakeholders; 3) Identifying and prioritizing risks; 4) Taking action on identified risks; 5) Monitoring and evaluating progress in addressing risks; and 6) Providing and enabling remedy.

The EU’s new regulations are part of a second generation of laws that require companies to go beyond simple disclosure. This type of legislation, which would seek to compel mandatory human rights and environmental due diligence (mHREDD), would come with administrative and judicial mechanisms to enforce the law. This in turn raises a critical question: “how will national regulators – which may be new to this area and have limited resources and capacity – assess whether a wide range of companies are meeting the spirit and intent of a new legal standard of conduct?”

“Signals of seriousness”

A new paper by Shift explores this question and maps out the “signals of seriousness”, i.e. indicators of “a company’s HRDD efforts that go beyond the observable basics of policies and processes on paper and provide insight into the behaviors and mindsets that inform how HRDD is done.” In Signals of Seriousness for Human Rights Due Diligence: How Can Regulators Best Assess the Quality of a Company’s HRDD Efforts Under Potential EU Legislation?, Shift proposes key signals for regulators to look to as they consider implementation of a mHREDD law.

The signals are categorised within six areas of company practice that align with the UN Guiding Principles on Human Rights. Importantly, Shift points out that “[n]ot all these features need to be present to judge HRDD to be meaningful or serious, yet where few of them are present, it is unlikely that HRDD will achieve its purpose in practice.”

We include some of the key elements of this framework below:

1. Governance of human rights:

The company’s most senior governing body…

• … “regularly discusses progress and challenges in addressing the company’s salient human rights risks, supported by appropriate expertise, informed by the perspective of affected stakeholders and with knowledge of leading practice.”
• … “reviews the company’s business model and strategy, and any proposed changes to them, to ensure any inherent human rights risks are identified and addressed.”
• … “formally approves high-level targets for addressing salient human rights risks and evaluating the company’s progress in that regard.”
• … “ensures that company leadership is accountable for addressing the company’s salient human rights issues, including through performance incentives where those are used for other aspects of performance.”

2. Meaningful engagement with affected stakeholders

• “The company identifies which stakeholders in which settings are likely to be the most vulnerable to impacts in connection with its operations and value chain and seeks insight into their perspectives.”
• “The company has structures or processes to hear and respond to the perspectives of affected stakeholders and/or their legitimate representatives, including at senior levels, whose use is not limited to the company’s own needs or transactions.”
• “The company’s decisions and actions with regard to identifying, assessing and prioritizing risks, and tracking how effectively it addresses them, are informed by the perspectives of affected stakeholders and/or their legitimate representatives.”
• “The company engages with affected stakeholders and/or their legitimate representatives to identify whether they are aware of and trust existing structures or processes as a way to raise concerns or grievances and have them addressed.

3. Identifying and prioritizing risks

• “The company’s processes for identifying human rights risks: a) Encompass its operations and business relationships throughout its value chain; b) Include impacts the company may cause, contribute or be linked to; c) Include risks inherent in its business model and strategy; d) Go beyond identifying impacts that the company considers it can control or impacts that could lead to liability for harms; e) Draw on a variety of well-informed sources to identify relevant risks; f) Are iterative and responsive to changes in the risk environment.”
• “The company’s prioritization of its salient human rights risks: a) Is determined by the severity of the potential impacts on people, not by risk to the business; b) Is not determined by where the company has leverage or what it considers easiest to address; c) Is updated in light of new or emerging risks.”
• “Where the company focuses its initial assessment of risks on certain parts of the business, these are selected based on the severity and likelihood of the risks to people, and the company progressively expands its focus into other parts of the business.”
• “Where the company has a broader risk management system, the company ensures that its salient human rights risks are appropriately reflected in that system.”

4. Taking action on identified risks

• “The company’s main activities to prevent or mitigate human rights risks: a) Are focused on outcomes for affected stakeholders; b) Directly relate to the company’s salient human rights risks and are proportionate to them; c) Directly engage those parts of the business whose actions or omissions can influence outcomes for affected stakeholders; d) Include measures to address any contribution of the company’s own activities to its salient risks.”
• “The company takes deliberate steps to build leverage to influence others where its existing leverage is insufficient to prevent or mitigate risks, including considering the role of disengagement as a form of leverage.”
• “The company identifies where collective leverage with others is needed, and collaborates with relevant stakeholders, peer companies and/or experts to advance outcomes for affected stakeholders through processes that demonstrably align with international human rights standards.”
• At the same time, “[s]eeking to use collective leverage is not a replacement for the company using whatever individual leverage it has.”

5. Monitoring and evaluating progress in addressing risks

• “The company sets both high-level and operational targets that are: a) Articulated in terms of the intended outcomes for affected stakeholders; b) Relevant to addressing the company’s salient human rights risks as well as specific, measurable, achievable and timebound; c) Developed with input from internal or external subject-matter experts and, wherever possible, from affected stakeholders and/or their legitimate representatives.”
• “The company monitors and evaluates progress towards the targets based on a set of indicators that together: a) Are used to evaluate progress towards the targets; b) Enable analysis of the reasons for progress or setbacks; c) Factor in feedback from affected stakeholders and/or their legitimate representatives.
• “The company discloses progress towards at least its high-level targets, including explanations of any setbacks and resulting changes in strategy.”

6. Providing and enabling remedy (specific to remedy provided by the company)

• “The company engages constructively when there are allegations of human rights-related impacts in its operations or value chain to understand the issues being raised and the perspectives of affected stakeholders.”
• “When providing remedy for impacts it has caused or contributed to, the company goes beyond measures to prevent the impact recurring to consider what other forms of remedy to can best address the harms to affected stakeholders, taking into account their perspectives.”
• “The company evaluates its actions to provide remedy for their effectiveness in delivering outcomes that are satisfactory to affected stakeholders.”
• “The company uses its leverage to support the development and implementation of effective grievance mechanisms in its value chain that are capable of providing remedy to affected stakeholders.”
• “The company draws on information from its own grievance mechanisms to inform the early identification and mitigation of risks to people and to continuously improve its due diligence processes.”

There is more detail on each of these six indicators in the draft report. Shift is also seeking feedback on the draft, available here: Shift, Signals of Seriousness for Human Rights Due Diligence: How Can Regulators Best Assess the Quality of a Company’s HRDD Efforts Under Potential EU Legislation? (February 2021)