Why Assess Human Rights Risks?
Identifying the human rights risks associated with business is the first critical step in preventing and mitigating harm to people due to business activity.
The UN Guiding Principles on Business and Human Rights (UNGPs) lay out the expectation that companies should avoid infringing on the human rights of others and should address adverse impacts with which they are involved.1 To achieve this, businesses should carry out human rights due diligence, which is a four-step process for identifying and assessing actual and potential impacts, implementing measures to prevent and mitigate impacts, tracking the effectiveness of these measures, and reporting on how impacts are being addressed.2 Human rights assessment is the first step in this process.
At its core, any human rights assessment should enable a company to identify and prioritize impacts on people based on the severity of the impact. The findings are then used to inform subsequent phases of human rights due diligence. Additional objectives may include soliciting input from affected stakeholders about effective prevention and mitigation measures or appropriate remedy,3 deepening stakeholder relationships through dialogue, building internal capacity in human rights management, and ensuring ongoing context monitoring to position the business for crisis management and response to evolving trends.
At BSR, we conduct human rights assessments to inform strategy and position companies to fulfill their responsibility to respect human rights. Our aim is to provide forward-looking, decision-useful information about salient human rights risks to guide companies in the design of measures to prevent, mitigate, and remedy actual and potential adverse human rights impacts.
BSR’s Approach to Human Rights Assessment
According to the UNGPs, a credible human rights assessment should:
- Assess impacts on people, not impacts on business;
- Assess impacts against all internationally recognized human rights;
- Draw on internal or independent external human rights expertise; and
- Highlight the concerns of affected stakeholders.
Within these parameters, there is flexibility to determine how to conduct the human rights assessment. This allows for adaptation to different industries, issues, and geographies while prioritizing attention to risks to people rather than risks to the business. This has permitted the proliferation of different methodologies,4 any one of which may be appropriate depending on the specific objectives of the assessment.
BSR’s approach to human rights assessment is grounded in the UNGPs, including a consideration of the human rights principles, standards, and methodologies upon which the UNGPs were built.
Our human rights assessment tool and accompanying methodology provide a structure to record information about human rights risks and guide analysis of salience and prioritization of risks. In our experience, the most effective human rights assessments harness the findings of the assessment to drive policies and programs to manage human rights risks. Our approach therefore goes beyond the identification and prioritization of human rights risks, actually assessing the company’s ability to manage such risks5 and to develop recommendations about appropriate actions6 to prevent and mitigate potential harm as well as to remedy actual harm.7 By grounding our approach in the UNGPs, we are able to ensure rigor and consistency across our assessments, even as we tailor our methodology to the industry, scope, and other contextual elements of the assessment.
BSR’s methodology identifies and prioritizes actual and potential human rights impacts, drawing from the full universe of international human rights instruments, and centering impacts on rightsholders.
Salience assessment: BSR assesses the severity of human rights impacts in alignment with criteria outlined by the UNGPs. Severity, as described in Guiding Principle 14 of the UNGPs, is a combination of three factors focused on impact on people, rather than impact on the business, including scope, which considers how many people may be impacted by a harm; scale, which assesses the gravity of the impact on the rightsholder; and remediability, which looks at the possibility of restoring the victims to their prior state of well-being. We also assess the likelihood of each risk to determine salience. Salience is the combination of severity and likelihood and is intended to help focus a company’s resources on managing human rights risks that have the potential to do severe harm or that are most likely, with the important caveat that severity trumps likelihood and that high-severity/low-likelihood risks should be prioritized for action.
The output of the salience assessment is a prioritized list of the company’s salient human rights risks, typically grouped into tiers denoting different levels of risk. This output can then be used to inform strategy, to function as a human rights risk register for the company, and to identify risks to enterprise value that may have been missed in the enterprise risk management (ERM) system.
Management assessment: BSR then conducts a management assessment to identify gaps in company human rights policies, procedures, and practices. Using factors contained in Principle 19 of the UNGPs, we assess the company’s ability to manage salient human rights risks. These factors include:
- Attribution considers how closely the company is connected to the human rights impact, assessing whether the company is causing or contributing to the impact; whether the impact is directly linked to its operations, products, or services through a business relationship; or whether the company is not linked to the impact. The assessment of attribution is highly contextual, case specific, and may evolve over time.
- Leverage considers the company’s ability to effect change in the wrongful practices leading to harm.
- Current management looks at how well the company is currently managing the risk through existing policies, procedures, and practices in order to identify gaps in human rights management and inform decision-making about action and resourcing to fill these gaps.
The output of the management assessment is a list of the salient human rights risks that the company should prioritize for action, based on both the salience of the risk and current management, and the risks are typically grouped into tiers denoting different levels of prioritization for action.
Following the management assessment, BSR develops recommendations for appropriate actions that the company should take to strengthen existing management systems or to develop new ones to effectively prevent and mitigate prioritized human rights risks; to remedy impacts that have already occurred; or to strengthen overall human rights governance and management, with a focus on integrating measures across relevant functions, business units, and/or operating companies. These actions are prioritized to guide allocation of resources to the most impactful prevention and mitigation measures.
Human rights assessments may be conducted either by companies themselves or by independent third-party experts. Our view is that capacity for internally led human rights assessment is critical to ongoing monitoring and management of human rights risks. We build awareness raising and capacity development into our approach in order to position company human rights leads to implement recommendations and to conduct future assessments, and we support company-led self assessments through development of tools (e.g., interview guides, analytical guidelines and frameworks), training for staff, and analysis of findings.
BSR takes a modular approach to human rights assessment, with each phase building successively on the previous phase. While always tailored to meet the specific needs of the company, a typical BSR human rights assessment will include these four phases:
Immersion: Building background knowledge
In this phase, the BSR team builds background knowledge about the company (e.g., products, services, operations, policy and decision-making context), the human rights context (e.g., human rights risks associated with relevant geography and sector), relevant industry standards, and key stakeholders and rightsholders. This typically includes a review of internal company documents as well as an external literature review of recent news coverage, civil society reports, analysis from think tanks and industry associations, etc.
Mapping: Identifying impacts
Building on the literature and document review conducted in the first phase, the BSR team conducts interviews8 with (1) affected stakeholders and independent experts to identify specific human rights impacts as well as suggested prevention and mitigation measures and (2) company employees and decision makers to identify perceived areas of risk as well as strengths and weaknesses in current management. Drawing from the full universe of internationally recognized human rights,9 the BSR team develops a shortlist of human rights risks relevant to the company’s business activity and drafts concise, practical descriptions of each risk, including the ways in which specific human rights are impacted by the company’s business activity and the impacts on specific rightsholder groups. Where possible, we integrate futures methodologies, such as trend analysis and scenario planning, to identify impacts that may emerge in the future.
Prioritization: Assessing salience of impacts
In this phase, the BSR team conducts the salience assessment, using the BSR Human Rights Assessment tool to analyze the severity and likelihood of shortlisted human rights risks and prioritize salient risks.
Management: Developing recommendations for appropriate actions
Finally, the BSR team conducts the management assessment, drawing on learnings from the internal document review and interviews with internal company stakeholders to analyze the company’s current ability to address salient human rights risks by evaluating factors like attribution, leverage, and existing management systems, policies, processes, and practices. Based on both prioritization of salient risks and identification of gaps in management, the BSR team develops recommendations for action.
Strengthening the management of human rights risks and preventing and mitigating real-world harm is a progressive, step-by-step journey. BSR works with companies at all phases, and we tailor our approach to meet companies where they are and help them advance to the next phase.
BSR typically recommends that companies begin with a corporate-level human rights assessment to identify human rights risks across the entire business value chain and to guide strategy and action to address the most salient risks. However, we have observed that some companies prefer to start with a market- or product-focused assessment to demonstrate value internally and establish guidelines that can immediately inform fast-moving business development decisions.
Companies typically undertake one of the following—a human rights scan, a human rights salience assessment, or a full human rights assessment—to begin to identify human rights impacts connected to their business, products, or services. These three options vary in depth, beginning with a high-level immersion and mapping and progressing all the way through the prioritization of identified impacts and the management of those impacts based on the company’s connection to the harm and existing management practices. We view human rights impact assessments as a subset of human rights assessment involving substantial and meaningful rightsholder engagement.
Stakeholder engagement is an integral component of BSR’s human rights assessment approach. We define rightsholders and stakeholders as follows:
- Rightsholders: Individuals whose rights could be directly impacted by the company. Rightsholders interact with the company and its products and services, typically as a worker, customer, or user.
- Stakeholders: Organizations informed about and capable of speaking on behalf of rightsholders, such as civil society organizations, activist groups, opinion formers, policy makers, or regulators.
Effective human rights due diligence requires meaningful engagement with rightsholders whose human rights may be impacted by the company or reasonable alternatives, such as independent experts, human rights defenders, and others from civil society. Particular attention should be paid to human rights impacts on individuals from groups or populations that may be at heightened risk of vulnerability or marginalization.
BSR’s approach incorporates dedicated attention to diversity, equity, and inclusion to ensure that we identify differentiated human rights impacts on different groups of people and develop recommendations that address these impacts appropriately. In accordance with a human rights-based approach and the UNGPs, BSR uses a “vulnerable group” lens to ensure that the voices of vulnerable groups and marginalized populations are heard during a human rights assessment. Rather than starting with a pre-determined list, vulnerable groups are identified through four interconnected dimensions, recognizing that vulnerability is intersectional: formal discrimination, societal discrimination, hidden groups, and practical discrimination.
Human rights assessment is just the first step in human rights due diligence. The human rights due diligence process laid out in the UNGPs provides a roadmap for what follows a human rights assessment. UNGPs Principle 19 sets out the expectation that companies integrate assessment findings across relevant internal functions and processes and take appropriate action. This requires assigning responsibility for addressing impacts to the appropriate level and function within the company; allocating sufficient financial and human resources to design, implement, and monitor prevention and mitigation measures; and establishing accountability and oversight processes.
As we look ahead to the next decade of business and human rights, the key urgency is around closing the gap between aspiration and impact—between stated corporate human rights commitments and a real reduction in human rights abuses on the ground. Human rights assessment lays the crucial groundwork for this.