Human Rights Due Diligence: A Practical Guide for Businesses
Human rights due diligence (HRDD) is the ongoing process a business uses to find, prevent, reduce and report on harm its activities and supply chains can cause to people. It is not a one-off audit or a policy document. It is a cycle of assessing risks, acting on them, checking whether the action worked and telling stakeholders what you found. This guide explains the process step by step, shows where social compliance audits fit, and sets out what the EU’s CS3D Directive now asks of larger companies.
Key Takeaways
HRDD focuses on risks to people, not risks to the company, and it applies to harm a business causes, contributes to or is linked to through its business relationships.
The process has four core components: identify and assess impacts, integrate findings, track effectiveness and communicate how impacts are addressed.
A social compliance audit is a useful snapshot of one site, but it cannot replace continuous due diligence, worker voice and remediation.
Under the EU CS3D, the largest companies (more than 5,000 employees and above €1.5 billion net turnover) must comply with the new measures by July 2029.
Start with your most severe risks and your most exposed suppliers, then build outwards. Perfect coverage on day one is not the standard.
What human rights due diligence actually means
The idea comes from the UN Guiding Principles on Business and Human Rights. The UN’s guidance on the corporate responsibility to respect human rights describes HRDD as an ongoing management process that a prudent business undertakes in light of its own circumstances. Its scale and complexity vary with factors such as the size of the business and the severity of its impacts.
Three points separate HRDD from ordinary corporate risk management.
The risk is to people. The OHCHR’s interpretive guide explains that the aim is to prevent and mitigate adverse impacts on people, rather than to focus on risks to the enterprise. A supplier fire that harms workers is a human rights issue even if it never touches your balance sheet.
It reaches beyond your own sites. HRDD covers impacts the business may cause or contribute to, and those directly linked to its operations, products or services through business relationships. In practice that means tier-one suppliers, but also labour agencies, logistics providers and, where the risk is high, deeper tiers of the chain.
It is continuous. Switzerland’s State Secretariat for Economic Affairs describes HRDD as continuous, company-specific and risk-based. Suppliers change, countries change, and new risks appear. A process that runs once a year at best will not keep up.
The human rights involved are broad: freedom of association, a living wage, safe working conditions, the absence of forced and child labour, non-discrimination, land rights, and the rights of communities near mines, farms and factories. For European and African operations alike, the starting point is the same: ask who could be harmed, how badly, and what you are doing about it.
The four core components of the HRDD process
The UN guidance sets out four core components, and most national laws and industry frameworks follow them closely.
Identify and assess impacts. Map your operations and relationships, then work out where actual or potential harm sits.
Integrate and act on the findings. Put responsibility in the right internal functions, such as procurement, operations and legal. Adjust the way you buy, price and plan so that the findings change behaviour.
Track effectiveness. Use indicators, worker feedback and grievance data to see whether your actions are working.
Communicate. Explain how you address impacts, in a form that the people affected and other stakeholders can reach.
Remedy runs through all four. Where you have caused or contributed to harm, you are expected to provide or cooperate in remedy. Where you are only linked to it through a supplier, your role is to use your influence to get the supplier to prevent or mitigate it.
This distinction between causing, contributing and being linked to harm matters because it decides what you should do. If your own rush orders push a factory to impose unpaid overtime, you are contributing, and changing your ordering pattern is part of the fix. Simply telling the factory to comply would not be enough.
How to run a human rights risk assessment
A human rights risk assessment is the first component in action. The method below follows the logic of the BSR guidance on effective human rights impact assessment and the OECD’s due diligence approach.
Step 1: Map where harm could occur
List your own sites, your main suppliers by spend and by category, the countries and sectors they sit in, and the types of labour used (migrant, agency, seasonal, informal). Use public indices, trade union reports, civil society research and your own grievance data to flag high-risk combinations, such as a labour-intensive process in a country with weak enforcement.
Step 2: Identify actual and potential impacts
For each hotspot, describe the specific impact: for example, recruitment fees charged to migrant workers, excessive hours at peak season, or restrictions on workers joining a union. Be specific. “Labour rights risk” is a category, not an impact.
Step 3: Prioritise by severity
BSR advises prioritising impacts by severity to the rights-holders, and severity combines scale, scope and remediability. In other words: how grave is the harm, how many people does it touch, and could the damage be put right afterwards? Forced labour scores high on all three. The OECD likewise says that enterprises should prioritise the most severe risks and tailor their measures to the nature, severity and likelihood of the impacts they find.
The key discipline is to rank by risk to people. A low-cost, low-visibility problem for the company can still be a severe problem for workers.
Step 4: Decide your response
Match the response to your role. If you cause harm, stop it and remedy it. If you contribute, change your own practices and use leverage on others involved. If you are linked, use leverage over the supplier and consider the terms on which you continue the relationship.
Step 5: Record, review and repeat
Keep a risk register that shows what you found, how you ranked it, who owns the action and the date you will review it. Reassess when something changes: a new sourcing country, a new product line, a major supplier switch or a reported incident.
Social compliance audits: what they reveal and what they miss
Many businesses begin with a social compliance audit, and the search interest in the term is a good indicator of how common that is. An audit examines a specific worksite against national law and the company’s code of conduct. Used well, it is a valuable input.
Switzerland’s SECO explains that a typical social audit involves an on-site visit, a review of documents and a limited number of worker interviews. The result is a list of gaps and a corrective action plan. Audits are good at systematically checking measurable issues such as wages and working hours.
The limits are just as well documented:
A snapshot. SECO describes an audit as a momentary picture that cannot guarantee respect for human rights over time.
Announced visits can be gamed. The same source notes that announced or semi-announced audits may allow temporary improvements or hide risks.
Little worker voice. Limited time and resources usually prevent meaningful engagement with the people affected.
Symptoms, not causes. A peer-reviewed analysis in the Netherlands International Law Review finds that social auditing gathers information on symptoms rather than root causes, and should not be the main means of implementing HRDD.
Auditors cannot force change. Human Rights Watch notes that auditors can report findings and recommend corrective action, but remediation depends on suppliers and on the brands that buy from them acting on the findings and giving support. It also points out that audits can miss structural causes such as buyers’ unfair purchasing practices.
One part of a system. The U.S. Department of Labor says an audit does not solve the problems it finds and should not be the only process used to determine exploitative labour across a supply chain. Effective grievance mechanisms, worker voice and remediation are what turn a detected problem into an end to the abuse.
Using audits well
Treat the audit as a diagnostic tool inside your HRDD system, not as proof of compliance. In practice that means:
Choosing audit sites by risk, not by habit or convenience.
Using unannounced visits and off-site worker interviews where the risk justifies them.
Following every finding with a corrective action, an owner and a verification date.
Looking at your own conduct: lead times, price pressure and last-minute order changes that make compliance harder for the supplier.
Combining audit results with grievance data, worker surveys and input from trade unions.
The same reasoning applies if you search for an ethical sourcing audit or an ethical supply chain audit. The label changes, but the logic is the same: the audit tells you what was visible on one day, and your due diligence has to cover the rest.
Engaging workers and affected communities
The strongest due diligence systems listen to the people at risk. The OHCHR’s B-Tech guidance on identifying and assessing human rights risks treats stakeholder engagement, grievance mechanisms and trade unions as essential complements to audit-based approaches.
Practical ways to do this include:
Worker surveys run outside the factory floor and outside management earshot, in the workers’ own languages.
Grievance channels that workers trust, such as a hotline, a worker committee or a trade union route, with clear rules against retaliation.
Trade union and civil society dialogue, especially in sectors or countries where workers cannot easily speak freely.
Community consultation before you open or expand a site, and when land, water or air quality could be affected.
SECO makes the same point from a regulatory viewpoint: measures should address the most severe issues through meaningful stakeholder engagement. Engagement is not a box to tick at the end. It is how you find out whether your assessment matches reality.
What the EU CS3D Directive requires
The Corporate Sustainability Due Diligence Directive, known as CS3D or CSDDD, turns HRDD into a legal obligation for the largest companies operating in the EU. The European Commission explains that in-scope companies must identify and address actual and potential adverse human rights and environmental impacts in their own operations, those of their subsidiaries and in their chains of activities.
The rules have been narrowed and delayed through the EU’s simplification process. Following the Council’s sign-off in February 2026, the key points are:
Question | Answer |
|---|---|
Who is in scope? | Companies with more than 5,000 employees and above €1.5 billion net turnover |
What must they do? | Risk-based due diligence on human rights and environmental impacts |
Transposition deadline for member states | 26 July 2028 |
Company compliance with the new measures | July 2029 |
Maximum penalty | 3% of net worldwide turnover |
Further guidance | To come from the European Commission |
If you want the story of how the directive was approved and then reshaped, our news coverage explains the original green light for the CSDDD and the EU’s delay of the new rules.
Why smaller companies still need HRDD
Most businesses fall below the thresholds, and many will never be directly regulated by CS3D. They can still be affected indirectly. Large customers in scope need information from their suppliers, and they tend to pass requirements down contracts through questionnaires, codes of conduct and audit requests. If you supply a large EU buyer, or if your own turnover in the EU might bring you into scope, check the current position with a qualified lawyer. National laws, such as Germany’s supply chain act (LkSG), may also apply to you or to your customers, so confirm the requirements with the relevant authority.
Building a proportionate HRDD process now means you can answer buyer questions with evidence rather than assurances.
How EU law relates to the UN and OECD standards
The EU rules sit on top of the international standards rather than replacing them. The UN Guiding Principles set the global expectation that all businesses respect human rights, and the OECD’s responsible business conduct guidance turns that into a practical, risk-based process. The OECD has itself published material on translating a risk-based due diligence approach into law, which describes due diligence as identifying, preventing, mitigating and accounting for adverse impacts on people, society and the planet.
The practical lesson is that a process built on the UN and OECD steps is a strong foundation for any legal regime. The details differ by jurisdiction, for instance on scope, liability and penalties, but the underlying cycle of assess, act, track and communicate stays the same.
Support from Exereco
HRDD touches procurement, legal, operations and sustainability teams at once, and it is easy to lose track of findings and actions. Exereco brings together sustainability news, ESG advisory, training and reporting software, with a focus on organisations working across Europe and Africa. If your team needs to build the skills to report on human rights, our Human Rights Reporting course is a good place to begin.
To discuss advisory support, reporting software or training for your organisation, visit Exereco. You can also follow our coverage of SDG 8 on decent work and economic growth and SDG 16 on peaceful, just and inclusive societies, which are closely tied to this topic.
A practical first 90 days
If you are starting from scratch, a realistic plan looks like this.
Days 1 to 30: scope and commit. Name an executive owner. Publish a short human rights policy commitment. Map your suppliers by spend, country and category, and mark your own sites. Decide what you know and what you do not.
Days 31 to 60: assess and rank. Run the risk assessment described above on your highest-risk categories. Rank impacts by severity to people, and write down your role in each: causing, contributing or linked. Pick the top three to five for immediate action.
Days 61 to 90: act and set up feedback. Agree actions with owners and dates. Review your own purchasing practices for anything that drives harm. Open or strengthen a grievance channel and plan worker engagement at your highest-risk suppliers. Schedule audits only where they add value, and decide how you will verify that fixes happened.
After 90 days you will not have solved every problem, but you will have a documented, defensible process that you can improve each cycle. That is what regulators, buyers and, most importantly, workers will look for.
Frequently asked questions
What is the difference between human rights due diligence and a social compliance audit?
HRDD is the continuous management process for finding and addressing harm to people across your operations and relationships. A social compliance audit checks one site against laws and a code of conduct at a single point in time. The audit can feed into HRDD, but it cannot replace it.
Does the CS3D Directive apply to small and medium-sized businesses?
Not directly. The directive covers companies with more than 5,000 employees and above €1.5 billion net turnover. Smaller firms can still receive due diligence requests through contracts with in-scope customers, so a proportionate process is worth having.
When do companies have to comply with the EU due diligence law?
Member states have until 26 July 2028 to transpose the directive, and companies must comply with the new measures by July 2029. Because the rules have already changed once through simplification, check the European Commission’s page for the current position before you plan.
How do I prioritise human rights risks?
Rank them by severity to the people affected, looking at scale, scope and how far the harm could be put right. Then consider likelihood. Start action on the most severe risks first, even if they are not the ones that cost your business the most.
Can an audit certificate prove my supply chain is free of abuse?
No. An audit is a snapshot of one site and may miss systemic issues such as forced labour or the effects of your own purchasing practices. Pair audits with worker voice, grievance mechanisms and root cause analysis, and follow every finding through to remedy.
Recommended
Comments