Business & Human Rights QuickCheck

The human rights imperative for businesses

The expectation on businesses to have regard to their social and environmental impacts is familiar to many corporates, especially those with a prominent public profile which depends on a strong reputation. Increasingly, however, companies are under scrutiny from regulators, investors, shareholders, customers, employees, the public and other stakeholders to demonstrate respect for human rights.

This means the onus is now on businesses to identify, prevent, mitigate and account for how they address their adverse human rights impacts. This, in turn, requires the implementation of governance processes and reporting mechanisms which take into account the most pertinent human rights issues which might arise due to a business’ operations, including those occurring in its supply chain.

In the absence of these controls, businesses in many sectors will find it progressively more difficult to satisfy the due diligence requirements of investors and potential customers, as well as increasing regulatory human rights reporting obligations which apply to them.

The regulatory context in brief

The UN Guiding Principles on Business and Human Rights were the primary catalyst for the shift towards the consensus that businesses need to proactively manage the risk of human rights abuses occurring due to their activities. The UN Guiding Principles emphasise that businesses need to ‘know and show’ that they respect human rights through policy commitment, human rights due diligence, the provision of remedy for those whose rights have been infringed and external reporting on human rights impacts. Since 2011, similar language has been incorporated into various other standards including the OECD Guidelines for Multinational Enterprises and the IFC Performance Standards on Environmental and Social Sustainability.

Reporting requirements

To date, new legislation has centred on promoting transparency through human rights related reporting requirements. Examples include the 2013 amendments to the 2006 UK Companies Act requiring directors to include information on human rights in their strategic reports, the UK Modern Slavery Act, EU Directive 2014/95 regarding the disclosure of non-financial and diversity information by certain large undertakings and groups, and the 2010 California Transparency in the Supply Chains Act. We have developed Business & Human Rights QuickCheck to assist you in identifying the requirements placed on your company by the latest legal and regulatory requirements in the area of business and human rights.

What is Business & Human Rights QuickCheck?

The Business & Human Rights QuickCheck is an independent and confidential review of the design of your business’ human rights compliance programme, carried out by our business and human rights lawyers, who combine their experience in designing and implementing business ethics compliance programmes with knowledge of key international standards, including the UN Guiding Principles, UN Guiding Principles Reporting Framework and OECD Guidelines for Multinational Enterprises. Further detail about how the QuickCheck works appears on page 5.

Key challenges

Any member of senior management should be able to answer the questions set out below regarding how his or her business manages its human rights impacts.

Public commitment and policies

• Can you demonstrate a strong, public commitment to respect human rights, and specific policies which identify and seek to address the human rights impacts which are most pertinent to your business across all geographies?
• Do you know if and how the public commitment and these policies apply to other organizations with which you do business?
• Can you demonstrate the use of regular and effective communication to convey the public commitment and policies to employees, suppliers, business partners and stakeholders?

Risk and impact assessment

• Do you have a documented, systematic process to identify all of the company’s most severe human rights issues and their potential impacts?
• Are these identified human rights issues and potential impacts, and their nature, monitored and kept under regular review?
• Does senior management know what the business’ most severe human rights impact risks are and what the company’s strategy is for mitigating them? Is the strategy documented?

Internal management and controls

• How is responsibility for the day-to-day implementation of the organisation’s human rights controls assigned and delineated?
• Do you monitor whether the company’s internal human rights controls are sufficient to address the risk of adverse human rights impacts occurring? Is this documented?
• Do you have a process for ensuring that identified weaknesses are used to develop and further improve the existing human rights compliance programme? Is this documented?

Governance

• Does senior management regularly discuss the effectiveness of the company’s human rights procedures? Is this documented?
• Is human rights compliance and the public commitment reinforced by the tone and actions from senior management? How?

Training and education

• Do you have a risk-based approach to human rights training and education informed by impact assessments? Is employee attendance monitored, and non-attendance disciplined?
• Do you have a plan for an ongoing human rights related training regimen and an approach to further define riskbased target audiences?

Engaging external and internal stakeholders

• Is there a documented process for identifying potentially affected stakeholders?
• What is your strategy for engaging with internal and external stakeholders in order to mitigate the risk of adverse human rights impacts occurring in connection with your business operations?
• Can you evidence how your business activities have been shaped in the recent past by stakeholder engagement processes?

Third parties and supply chain

• Have you mapped and documented your supply chain, and categorised all third parties according to the human rights impact risk which they present? What steps have been taken to verify information provided by third parties?
• Have you implemented any capacity building initiatives designed to enable third parties to conduct their own human rights diligence?
• What steps does the company take to require compliance by third parties with the company’s public human rights commitment and policies? How does the company monitor adherence to these requirements? In the event of non-compliance, does the company have a documented, systematic disciplinary process?

Complaints, investigations and remedy

• Do you know what mechanisms exist to receive complaints about adverse human rights impacts? What steps have been taken to verify their effectiveness and accessibility?
• Is there a documented process for handling and investigating reports of adverse human rights impacts? What steps have been taken to ensure that this process leads to rights compatible outcomes which are transparent, equitable, predictable, engender trust, and involve appropriate consultation with stakeholders?
• Have you implemented mechanisms of redress where adverse human rights impacts arise in connection with the company’s activities? Are you confident these processes enable those who have been adversely affected to secure effective remedy?

Role of the Board

• Does the Board or equivalent body make an independent assessment of the adequacy of the human rights programme and disclose its findings in the Annual Report?
• Does the Board receive adequate qualitative and quantitative information to allow it to interrogate the business on human rights issues? Is this documented?
• Can each of the directors competently answer the following questions:
  • What are the inherent human rights impact risks my company faces?
  • What controls are in place to manage those impact risks?
  • How are these controls working in practice?

Taking you from where you are now to where you want to be

We would aim to dedicate one or two of our professionals to work alongside your company personnel for a week.

By way of example, a typical Business & Human Rights QuickCheck would involve the following:

• Performing a desktop review of the company’s existing human rights management programme by collecting and reviewing relevant documentation
• Identifying obvious programme gaps or deficiencies based on the desktop review, to formulate an initial risk profile, ascertain red flags and inform the interview process
• Conducting interviews with key members of staff
• Analysing the available information to prepare a highlevel risk assessment, maturity analysis, policy feedback and tailored recommendations
• Reporting on the human rights management programme and, where relevant, making recommendations for better alignment of your business and human rights programme with best practice.

The purpose of the Business & Human Rights QuickCheck is to enable you to meet these challenges, by identifying how your company’s human rights management programme measures up against emerging best practice, within an agreed time frame and with cost certainty.

We aim to provide recommendations and solutions which are both practical (taking into account your business’ culture, operating model and commercial realities), and informed by our ongoing research into human rights due diligence undertaken together with the British Institute of International and Comparative Law, described below.

Norton Rose Fulbright has embarked upon a research project in collaboration with the British Institute of International and Comparative Law with the aim of clarifying how businesses ought to be conducting human rights due diligence in light of emerging regulatory requirements. You can find out more about the project, including details of how you can get involved, by visiting nortonrosefulbright.com/bhrddproject.