Due diligence policy mapping

Step 2 addresses how enterprises identify, assess and prioritise risks and impacts for action, focusing on the criteria of severity and likelihood. A high-level scoping exercise ensures that enterprises first identify general areas of the enterprise, across their operations and business relationships, where risks are most likely and severe, based on “risk factors” (e.g. geographic, sector, product, or entity level risk factors). Based on the scoping, enterprises prioritise specific operations, business relationships or areas of activities for in-depth assessments.

Step 3 focuses on how enterprises should cease, prevent and mitigate risks and impacts that they have identified. Responsibilities differ according to the enterprise’s level of involvement with the risk or impact, with heightened responsibilities where an enterprise causes or contributes to (or may cause or contribute to) an adverse impact through its own activities, compared to where it is “directly linked” (i.e. a business relationship causes the impact).

Step 4 focuses on whether enterprises have systems to track and evaluate progress on prevention and mitigation and assess the effectiveness of their due diligence. Monitoring activities should be tailored to the nature and severity of the impacts and relevant stakeholders should be engaged. Lessons learned should be used to improve future due diligence efforts and outcomes.

Step 5 recommends enterprises publicly communicate relevant information on due diligence, including on prioritised risks and impacts, actions to prevent and mitigate them (where possible, with estimated timelines and benchmarks for improvement and their outcomes), and any remediation. For human rights impacts, it is recommended that enterprises communicate relevant information to actually or potentially impacted rightsholders.

Step 6 expects enterprises to provide or contribute to remediation where they have caused or contributed to adverse impacts. Remedy aims to restore affected individuals or the environment to the situation they would have been in had the impact not occurred. Steps 6 recommends that enterprises provide for or co-operate in effective grievance mechanisms, through which impacted stakeholders can raise complaints and obtain remedy. Grievance mechanisms should be consistent with the effectiveness criteria for non-judicial grievance mechanisms set out in the United Nations Guiding Principles for Business and Human Rights (UNGPs).

Meaningful stakeholder engagement is a key component of the due diligence process. OECD RBC standards recommend engaging in a two-way, good faith process, with relevant stakeholders throughout the due diligence process. Relevant stakeholders may include impacted and potentially impacted rightsholders, worker representatives, trade unions, community organisations, human rights defenders and civil society groups.

OECD RBC standards address the role of collaboration, including through multi-stakeholder and industry-led initiatives, to support enterprises’ due diligence. Collaboration can be beneficial in pooling knowledge on sector risks and solutions, increasing leverage with shared business relationships, and promoting efficient approaches. However, the standards also make clear that enterprises retain ultimate responsibility for their due diligence. Where enterprises participate in or use third party initiatives they should assess their relevance, quality and credibility.