Companies and business leaders are facing some of the most significant changes to regulatory requirements concerning just and sustainable business. Yet, there is a risk that companies will seek a narrow focus on compliance, risk-averse actions, and overly cautious communications and stifle efforts aimed at more ambitious and meaningful human rights due diligence. However, the absence of consistent and structured human rights due diligence at companies today means that regulation is merited. The task ahead—with a key role played by the Chief Sustainability Officer (CSO)—is to ensure that both the spirit and the letter of the laws are followed, and that ambition is not sacrificed to achieve compliance. Companies are expected to stay focused on actions that will be considered credible, not merely compliant.

No, a human rights assessment is only one part of human rights due diligence. According to the UNGPs, human rights due diligence has four elements:

• Assessment: Assessing actual or potential adverse human rights impacts with which the company may be involved.
• Action: Taking appropriate action to avoid, prevent, mitigate, and / or remedy actual or potential adverse human rights impacts identified in assessments.
• Tracking: Tracking the effectiveness of the company’s response to human right impacts, including via qualitative and / or quantitative indicators and feedback from stakeholders.
• Communications: Communicating externally in a form and frequency such that the company’s approach can be effectively evaluated.

A human rights assessment is typically forward looking, identifies and prioritizes actual and potential human rights impacts, and recommends appropriate action to address them. By contrast, a human rights audit is typically historical, determines compliance against a standard, investigates the root causes of prior harms, and recommends corrective actions.

• Assessment: Assessing actual or potential adverse human rights impacts with which the company may be involved.
• Action: Taking appropriate action to avoid, prevent, mitigate, and / or remedy actual or potential adverse human rights impacts identified in assessments.
• Tracking: Tracking the effectiveness of the company’s response to human right impacts, including via qualitative and / or quantitative indicators and feedback from stakeholders.
• Communications: Communicating externally in a form and frequency such that the company’s approach can be effectively evaluated.

Human rights assessments can be included within broader enterprise risk assessments and risk management systems, provided it goes beyond identifying material risks to the company and includes risks to people as well.

The emerging concepts of “double materiality” (the notion that companies should report on matters that influence enterprise value and matters that affect wider society) and “dynamic materiality” (the notion that the relative materiality of an issue may change over time) make it likely that the connectivity between enterprise risk assessment and human rights assessment will grow over time.

• Assessment: Assessing actual or potential adverse human rights impacts with which the company may be involved.
• Action: Taking appropriate action to avoid, prevent, mitigate, and / or remedy actual or potential adverse human rights impacts identified in assessments.
• Tracking: Tracking the effectiveness of the company’s response to human right impacts, including via qualitative and / or quantitative indicators and feedback from stakeholders.
• Communications: Communicating externally in a form and frequency such that the company’s approach can be effectively evaluated.

Some groups may face increased risks of negative impact from business activities. Those that are already marginalized or excluded in society, as is often the case for women, minorities, migrants, persons with disabilities or indigenous peoples, may be more vulnerable to adverse impact or may experience impact differently. Other groups, such as children, may also be vulnerable in certain circumstances and require different protection. The UNGPs explicitly state that the principles should be implemented in a non-discriminatory manner, with particular attention given to the rights and needs of individuals from such groups.

The emerging concepts of “double materiality” (the notion that companies should report on matters that influence enterprise value and matters that affect wider society) and “dynamic materiality” (the notion that the relative materiality of an issue may change over time) make it likely that the connectivity between enterprise risk assessment and human rights assessment will grow over time.

• Assessment: Assessing actual or potential adverse human rights impacts with which the company may be involved.
• Action: Taking appropriate action to avoid, prevent, mitigate, and / or remedy actual or potential adverse human rights impacts identified in assessments.
• Tracking: Tracking the effectiveness of the company’s response to human right impacts, including via qualitative and / or quantitative indicators and feedback from stakeholders.
• Communications: Communicating externally in a form and frequency such that the company’s approach can be effectively evaluated.

If a potential adverse impact could not be prevented or adequately mitigated, the company would be required to refrain from entering into new or extending existing relations with the partner in connection to or in the value chain of which the impact has arisen. In addition, where the law governing the relationship entitles the company to do so, it would be required to take the following actions:

• Temporarily suspend commercial relations with the partner in question, while pursuing prevention and minimization efforts, if there is a reasonable expectation that these efforts will succeed in the short term.
• Terminate the business relationship with respect to the activities concerned if the potential adverse impact is severe.
• There is an exception for regulated financial undertakings that provide credit, loan, or other financial services, which would not be required to terminate their contracts if this would reasonably be expected to cause substantial prejudice to the counterparty. Under the Directive, Member States would be required to provide for the availability of an option to terminate the business relationship in contracts governed by their laws.