What does effective
human rights risk
management look like?
5 insights from practice
INSIGHTS SERIES –Keys to effective human rights due diligence

HUMAN RIGHTS &LABOURW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

2Background
Business and human rights has become an increasingly important topic on the corporate
sustainability agenda. The German Network of the UN Global Compact has been
assisting companies to live up to their human rights responsibilities since its inception
20 years ago. The 10th anniversary of the UN Guiding Principles on Business andHuman Rights (UNGPs) – celebrated in June 2021 – provides an opportunity to reflect
on some of our key insights for effective human rights due diligence. This series offers
companies food for thought, highlights inspirational practice and shares valuable lessons
learned to stimulate business managers and decision-makers towards an ambitious,transformational approach to respecting human rights in line with the UNGPs. ​The publications in this series give emphasis to approaches, strategies and mindsets that:• are effective and meaningful• grow legitimacy and increase transparency across corporate human rights practices• help to raise trust between stakeholders.
The insights shared in the series are based on the experience of Global Compact Network
Germany in supporting business practitioners to implement human rights due diligence.
They include knowledge gathered through engaging with businesses, and the know-how
of our partners and experts over the years.

WHAT THIS INSIGHTS SERIES IS …
The Insights Series aims to present a selection of key lessons learned andsuccess factors for respecting human rights in the spirit of the Ten Principles of
the UN Global Compact and in line with the UNGPs, providing companies
with inspiration for effective and meaningful human rights due diligence andcontinuous improvement.
… AND WHAT IT’S NOTThe Insights Series does not provide guidance on how to ‘comply’ with the UNGPs,
nor does it constitute a step-by-step guide to human rights due diligence or
meeting legal requirements. Reference to existing guidance is included at the endof this publication.

W HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

3

The corporate responsibility to respect human rights
In 2011, the UNGPs established the first internationally recognised, comprehensive
framework defining the roles of states and companies in addressing the negative
impacts of business on people’s rights. Developed by John Ruggie, the then Special
Representative of the UN Secretary-General on Human Rights and Transnational
Corporations and Other Business Enterprises, and his team, the UNGPs’ ‘Protect,
Respect, Remedy’ framework says that• states have a duty to protect human rights against human rights abuses by third
parties, including by business;• businesses have a responsibility to respect human rights and address risks
associated with their business activities and relationships; and• people whose rights have been impacted by business must have access to remedy.
In spelling out the corporate responsibility to respect human rights, the UNGPs also
operationalised the human rights-related expectation contained in the Ten Principlesof the UN Global Compact: that businesses shall respect human rights and ensure
they are not complicit in human rights abuses by others. The OECD Guidelines forMultinational Enterprises, in turn, were updated in 2011 to include stronger reference
to human rights and provide detailed guidance on human rights due diligence in linewith the UNGPs.
These three frameworks share an underlying idea: business respect for human rights
can only be achieved by putting people at the centre of a risk-based approach, changing
the perspective from risk to business, to risk to people. This fundamental shift ofperspective is what defines human rights due diligence – and also constitutes a
crucial contribution business can make to the sustainable development agenda
more broadly.1

The UN Working Group on Business and Human Rights – tasked with promoting
the implementation of the UNGPs – asks states to publish National Action Plans
on Business and Human Rights (NAPs) to detail their priorities and actionsin implementing the UNGPs. The Working Group also encouraged states to adopta ‘smart mix’ of measures – including voluntary and mandatory, national andinternational – to ensure and encourage businesses to respect human rights.
In recent years a growing number of countries adopted legislation – such as
Germany’s Supply Chain Due Diligence Act and France’s Loi sur le Devoir deVigilance – that implicitly build on or explicitly refer to human rights due diligence
as set out in the UNGPs.

1

The UN Global Compact describes the principles-based approach to the Sustainable Development Goals (SDGs),

including the ways in which the Ten Principles and the UNGPs interact with the SDGs, in its 2016 White Paper
The UN Global Compact Ten Principles and the Sustainable Development Goals

W HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

4

Effective human rights
risk management
Companies have access to plenty of technical, step-by-step guidance on how to
implement the UNGPs, including: how to identify, assess and prioritise human rights
risks, acting upon them, tracking the effectiveness of their efforts and providing forremediation of negative impacts.2
This publication takes a different approach. Building on Global Compact Network
Germany’s experience in raising awareness on and building capacity for humanrights due diligence, it highlights selected success factors that can help makehuman rights risk management truly effective. Effectiveness here is understoodas achieving two goals:
1) benefitting people at risk and2) helping to build a stronger business in the long term.

Human rights risk management at a glance
In business, risk management is the process of identifying, assessing and controllingrisks to a company, most commonly this relates to financial or operational risks. Humanrights risk management on the other hand is the practice of identifying, assessing andresponding to human rights risks, defined as risks that business activity may poseto the rights and freedoms of people.
Managing human rights risks is an essential part of the UNGPs’
concept of human rights due diligence. It is therefore funda­
mental for businesses to fulfil their corporate responsibility torespect human rights. Companies are expected to conduct
their human rights due diligence in a way that is risk-based
and adequate in relation to their potential and actual impacts.
Therefore, managing human rights risks means knowing
how business activities can directly and indirectly impact people, assessing risksof negative impacts according to the severity and likelihood of their actual
occurrence and acting upon them with the objective of preventing, mitigating andremediating impacts.

The objective of human rights
risk management is to prevent,mitigate or end negative impactsof business activity on people.

For businesses to effectively manage risks to people, the UNGPs ask companies tointegrate human rights risk management into their strategy and operations. Recent due
diligence legislation and consumer and investor interest in companies’ human rights
performance reinforce this expectation.

Five insights on effective human rights risk management
There are many elements to making human rights risk management ‘effective’. The
following insights highlight five selected considerations that, based on our experience,play a particularly important role. Accordingly, effective human rights risk management
is strategic, incremental, embedded, collaborative and rightsholder-focused.
The insights build on the experience of companies when implementing human rights
due diligence and aim to stimulate reflection and ideas.

2

A selection of examples is referenced in Annex 2 of this paper.

INSIGHTW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

1

5

Human rights risk management
becomes effective when it isused strategically
It is important to understand the strategic relevance of human rights for business.
Interest in how a company is embedding human rights into business strategy ison the rise: human rights due diligence legislation is growing, financial institutions
are increasingly linking investment decisions to human rights considerations, and civilsociety and consumers are progressively putting pressure on companies to accountfor their social impacts.
At the same time, corporate board members are interested in growing their business,ensuring competitiveness, improving customer loyalty, attracting and retaining talent,shielding their business against legal and regulatory risk, and ensuring access tomarkets and investments.
Yet cases of adverse human rights impacts directly translating into disrupted business
operations, higher costs, litigation, frozen assets or reputational damage are numerous
and increasing. A fully embedded human rights risk management process is thereforeof strategic relevance, as it can both support business growth and reduce risks tobusiness.
A key factor in successfully mainstreaming human rights into business strategy isleadership from the top. It ensures human rights considerations are integrated into
the business strategy and operations, it sets the expectations of employees, suppliers
and partners and creates the right level of resources, incentives, measurement andtransparent reporting that is needed. This is addressed further in Insight 3.

BRINGING IT TO LIFE
Increasingly, companies are integrating human rights risks into strategy development by understanding
the reduction of risks to people also as opportunities for the business. What does this mean in practice:
By reviewing their business models, governance, core products and services with respect for humanrights in mind, they future-proof and ensure long-term business success. By using social and environmental insights, companies are able to both grow their own business in innovative ways and tackle
industry-wide challenges in partnership with others. Human rights insights become an integral part ofthis reset and a useful input for leadership teams to develop new ideas.

INSIGHTW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

2

6

Human rights risk management
becomes effective when it is
implemented incrementally
The scope of human rights risk management is broad: The UNGPs expect a businessto look at all its human rights risks in their business operations as well as relationships
and supply chains. At the same time, it is hard to fully assess all the implications ofbusiness decisions and activities and to address all risks at the same time.
An emerging response to this challenge is to move quickly from identifying to prioritisingrisks. This enables a company to rapidly focus its attention and resources on a few, but
selected risks and to act on them. With experience and growing capacity, the company
will be able to incrementally expand the range of risks acted on.
A second approach is to decentralise human rights risk management. Different
business units or functions manage human rights risks that exclusively relate to theirpart of the business, whilst the central human rights and top management teams act
as an oversight board, identifying systemic patterns, root causes, blind spots and ensure
lessons learned are exchanged across the business. Here too, an emerging practiceconsists in starting with a few selected functions – such as procurement, HR, logistics –or business units, such as country operations or specific products with a high-risk
profile. Over time, leveraging experiences and lessons learned, companies can incrementally grow the range of units engaged in proactively managing human rights risks.

BRINGING IT TO LIFE
Companies with a robust risk assessment approach have found a way to do both: identify relevant risk
data that is often scattered across the organisation without being ‘labelled’ as human rights risk data(such as HSE, HR or supplier audits), and use this data to create a business-wide human rights risk profile.
This helps companies to get a complete view of a broad range of topics and swiftly move on to prioritiserisks based on where action is needed most. On the other hand, decentralising the management of theseprioritised risks to the teams best placed to address them enables companies to accelerate action andaddress a broader range of risks in parallel.

INSIGHTW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

3

7

Human rights risk management
becomes effective when it isembedded across the business
Embedding respect for human rights across a business is a recurring theme in the
UNGPs. Growing experience of companies implementing human rights risk management shows that embedding is most successful when it happens in a variety of ways
and through different means. From having clearly assigned responsibilities, building on
existing processes and improving internal exchange of information to leveraging thelinks across the full spectrum of sustainability – environment, social and governance.
The proverbial breaking down of silos is essential to effective human rights risk
management. This starts with a common understanding of what human rights mean forthe business, how this translates into the work of different functions (HR, procurement,
sales, sustainability, etc) and which existing management systems can be adapted tointegrate human rights aspects.
Thinking and working in silos also affects sustainability efforts where different
agendas and topics run in parallel or even compete with each other, instead of informing each other. A classic example is creating separate systems for environmental andhuman rights risk management, especially with regard to supply chains. Recognising how
closely impacts on nature and people relate to each other, companies have benefitted
from treating human rights risk management as an integral part of their broader sustainable business agenda. This can help companies successfully embed human rights
insights into their processes and operations, pool resources and create synergies. Withlegislation starting to combine due diligence around social and environmental themes(e.g. France, Germany) and the emerging recognition of a human right to a healthy
environment, companies that understand the connections and embed this understanding in their governance, processes and risk management systems will also be better
prepared to respond to evolving regulatory requirements.
Assigning responsibilities and related KPIs to employees at different levels – forexample by integrating human rights risk management in role descriptions – is one of
the most useful tactics to embedding human rights across a business. This creates
accountability and builds awareness and ownership of human rights risk management
at all levels from head office to operations.

BRINGING IT TO LIFE
Companies with advanced due diligence approaches are increasingly bringing knowledge and responsibilities traditionally held by corporate affairs functions down to the operational teams that liaise directlywith (small) suppliers, contractors or smallholder farmers. This is where risks and impacts are mostobvious and where teams have deep insights into the reality on the ground. Raising human rights awareness for all employees and educating them on how to recognise and report issues can be a highly effective(and efficient) way of managing risks, especially for those working in the supply chain teams. For example,
quality or technical staff who hold relationships with suppliers and engage with sites regularly are wellplaced to pick up risk indications ‘on the go’. Often, just keeping eyes and ears open and asking a few
targeted questions can help make observations on more and perhaps less obvious human rights risks.

INSIGHTW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

48Human rights risk management
becomes effective when it is
supported by collaboration withbusiness partners and peers
Building trust and working with suppliers, peers and stakeholders to manage humanrights risks may still seem to require excessive resource and capacity investment.
However, approaches based on partnerships enable companies to not just manage
human rights risks, but to manage them well and work towards addressing root causes.
While this insight focuses on business-to-business collaboration, Insight 5 deals withengagement of rightsholders and their representatives.
There are many ways to collaborate with peers on human rights risk management,
both formal – through industry associations, engaging in sustainability networks or
multi-stakeholder initiatives (including the UN Global Compact) – and informal throughdirect engagement. Human rights risks are often systemic in an industry, region, or
supply chain. By collaborating with peers, companies can create a bigger impact, perhaps
increasing the leverage over high-risk clients and suppliers, or co-creating solutions
that address not just the symptoms but also the root causes of human rights issues.
Collaboration enables management of human rights risks to become sustainable,
be more efficient for individual companies, and to continuously innovate and improve.
It can also increase transparency and provide a platform to raise industry standards,
for instance through engagement, membership criteria, or coordination of goals andincentives that create an industry-wide race to the top on human rights performance.
Building trust with suppliers and business partners is not only important forstrong business relationships, but equally important to best manage human rights risks.
Relationships based on a partnership mindset have proven to be more effective and toprovide business benefits for both the client and supplier companies. Improvements inhuman rights risk management move the agenda from compliance to joint investmentsthat both partners commit to and prosper from. It also makes effective human rights
risk management part of a shared understanding of quality. In trust-based relationshipmodels, challenges and setbacks are voiced and discussed openly, and solutions are
co-created for the benefit of both business partners and people.

CONSIDERATIONS TO MOVE FROM TRANSACTIONAL RELATIONSHIPSTO PARTNERSHIPS WITH SUPPLIERS• Share responsibility with suppliers to prevent and mitigate human rights risks and address root
causes. Consider how your business decisions and practices may support or hinder socially responsible
practices in your supply chains.
• Identify opportunities to support suppliers to build their capacity in human rights risk management.
• Co-create action plans and solutions to improve risk management and address human rights issues.
A joint approach respects both organisations’ perspectives, goals and needs in implementation.

INSIGHTW HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

5

9Human rights risk management
is effective when it proactively
takes into accountrightsholders’ perspectives
Changing the perspective from ‘risk to business’ to ‘risk to people’ is a fundamental
mindset shift to enable business respect for human rights. This rightsholder-focus isa non-negotiable element of human rights risk management in line with the UNGPs.
Too often human rights programmes are still driven primarily by ‘risk to business’
considerations, such as reputational risk or supply chain disruption. In addition, humanrights programmes are often developed in central functions, far removed from theoperations in which people are impacted. This is why this last insight reiterates the
crucial significance of rightsholders’ views and perspectives.
The effectiveness of human rights risk management relates to how well the businessprevents or mitigates impacts on people, or remediates them in the event that impacts
occur. It is therefore crucial to consider and understand people’s realities and perceptions of how business operations and relationships may affect or have actually impacted
their lives.
Human rights risks are highly contextual and influenced by local culture. Dedicatedrightsholder engagement can help companies identify how to respond to challenges
within a specific context. One-size-fits-all-approaches rarely work. Experience showsthat meaningful rightsholder engagement can be resource-intensive and challenging.
Yet companies report that once initiated, they benefit from new insights and a deeper
understanding of the risks and impacts. On the one hand, truly taking into accountrightsholder views allows them to develop solutions that are effective in reducing risks
to people. At the same time, they are able to effectively reduce risks to business by
preventing the escalation of human rights-related conflicts and grievances.

CONSIDERATIONS FOR BRINGING IN RIGHTSHOLDER VIEWS• Engage rightsholders throughout the process of human rights risk management, not only during risk
assessment but also when identifying solutions and following up on their effectiveness.
• Be open to a diversity of channels for bringing in rightsholder views, such as roundtables and forums,
engagement with trade unions and NGOs, focus groups, surveys and worker voice tools, grievancechannels and worker interviews. They differ in level of engagement and depth, but all have their place.
• Seek out legitimate representatives of rightsholders, such as work councils, trade unions, civilsociety organisations, or human rights defenders, who can translate risks and needs of the people they
represent. Ensure that the company engagement does not put them at risk.
• Build on the expertise of local staff, who have first-hand, practical insights into the working and living
conditions in their operational context and can help head office teams understand risks and design
responses.
• Engage with purpose by clarifying the goals of rightsholder engagement and share the outcome ofyour findings and efforts with the rightsholders you engaged with, providing meaningful opportunities
for them to feed back.

W HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

10

Key takeaways
As presented above, there is no one-size-fits-all solution to effective human rights risk
management. There are, however, a number of success factors that facilitate it, as havebeen highlighted in this publication.
Recognising the strategic importance of business respect for human rights in all
operations is powerful in setting the tone across an organisation and in relationships
with its partners and other stakeholders.
Taking an incremental approach allows a company to familiarise itself with humanrights risks and grow into a robust set of systems and actions with a human rights
mindset. This also helps to increasingly embed human rights into all levels and acrossall functions of a business without ‘shocking the system’.
Moving from transactional relationships to partnerships with suppliers and entering into
wider collaborations with peers are powerful ways to take stronger action to addresshuman rights risks and their root causes.
Finally, effective human rights risk management is guided by proactively considering
the perspective of rightsholders. Keeping the focus primarily on risk to business inhibits
the thorough understanding of how business may affect people and limits the effectiveness of efforts to manage human rights risks.

W HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

11Annex 1
Legal frameworks
A growing number of jurisdictions are adopting legislation that implicitly builds on or
explicitly refers to human rights due diligence in line with the UN Guiding Principles on
Business and Human Rights, such as• Germany’s Supply Chain Due Diligence Act – adopted in July 2021 – which specificallydefines due diligence obligations as well as expectations towards risk management
in relation to defined human rights and environmental aspects;• France’s Loi sur le Devoir de Vigilance (in French), which was one of the first combining
requirements on environmental and human rights due diligence;• the European Union’s Conflict Minerals Regulation, which defines supply chain
due diligence obligations for Union importers of certain minerals originating fromconflict-affected and high-risk areas; or• Switzerland’s responsible business legislation (in German), requires companies inscope to exercise due diligence in relation to conflict minerals and to child labour.
• Additionally, in 2020 the European Commission announced the development of
mandatory human rights and environmental due diligence legislation.

W HAT DO ES EFF ECT I VE H U M A N RI G H TS RI S K M A NAGEMEN T LOOK L I KE? — 5 I N SI GHTS F R OM PR ACTI CE

12Annex 2
Selected sources of useful informationand practice-oriented guidance
Readers interested in learning more and looking for practice-oriented guidance onhuman rights risk management are invited to explore the following selection of tools
and resources.
 lobal Compact Network Germany offers a wide range of guidance notes, tools andGother resources on business and human rights and the UNGPs, including:• The Human Rights Capacity Diagnostic Tool, enabling companies to assess thelevel of maturity of their human rights due diligence and risk management systems• A Five Step Guide on how to get started on human rights due diligence with lots ofpractical examples• A selection of in-depth case studies on Human Rights Risk and Impact Assessments
The UN Global Compact also offers a variety of practical tools and resources tosupport companies in implementing human rights due diligence, including:• An E-Learning Course on Operationalising the UNGPs, jointly developed with the
Office of the UN High Commissioner for Human Rights and Shift• The Decent Work Toolkit for Sustainable Procurement, helping companies tointegrate decent work considerations into procurement systems• A variety of on-demand webinars on business and human rights topics as part of
the UN Global Compact Academy
A range of helpful resources – including guidance notes, online tools and e-learnings –are also provided by:• Office of the UN High Commissioner for Human Rights, in particular interpretive
guides on the UNGPs• OECD, in particular the Due Diligence Guidance for Responsible Business Conduct• Business and Human Rights Resource Centre• German Federal Government’s Helpdesk on Business and Human Rights,
in particular the SME Compass• ILO Helpdesk for Business on International Labour Standards

IMPRINTThe UN Global Compact and the Global Compact Network Germany
The UN Global Compact is the world’s largest initiative for sustainable and responsible business. Based on
the Ten Universal Principles and the Sustainable Development Goals (SDGs), the UN Global Compact pursues
the vision of an inclusive and sustainable society. More than 18,000 participants at the UN Global Compact,
among them 14.000 companies, contribute to the global vision. The Global Compact Network Germany is one of
the largest of the UN Global Compact’s 70 Local Networks. It currently comprises 760 participants – including
700 companies, ranging from DAX to SMEs – as well as 60 representatives of civil society, academia and politics.
Aiming to induce change processes within companies and support the strategic integration of sustainability, theGlobal Compact Network Germany focuses on the topics of human rights & labour standards, environment &climate, the prevention of corruption, reporting as well as on promoting the business contribution to the SDGs.

Publisher
Global Compact Network Germany
Globalcompact.de LinkedIn Twitter
Project Lead
Laura Curtze | Global Compact Network Germany
Original text edited and drafted by
Nora Böggemann, Davide Fiedler, Waleria Schüle | twentyfifty Ltd.
Photo Credits
Ricardo Gomez Angel on Unsplash
DesignAnna Risch . Grafische Gestaltung | www.annarisch.deThis paper is intended for general information purposes only. Publisher and authors give no guarantee
regarding the validity, completeness or accuracy of the information provided and accept no liability for damage
or loss arising directly or indirectly from the use of this publication.

© Global Compact Network Germany
December 2021

On behalf of

Stiftung

Deutsches Netzwerk