Human rights due diligence is a continuous process for identifying and addressing how a business may affect people through its own activities, products, services, and business relationships. In a supply chain, it helps you find actual and potential impacts on workers and communities, prioritize the most severe impacts, act to prevent or mitigate harm, track whether the response works, communicate what is being done, and support remedy where appropriate.
The most important point is simple: human-rights risk is a risk to people. It is not the same as financial, legal, or reputational risk to the company. Those business consequences matter, but they should not replace an assessment of how seriously people could be harmed.
What Is Human Rights Due Diligence?
Human rights due diligence, often shortened to HRDD, is the process a business uses to identify, prevent, mitigate, track, and communicate how it addresses actual and potential adverse human-rights impacts. It also informs remediation when the business caused or contributed to harm.
The UN Guiding Principles on Business and Human Rights establish the global reference point. They expect businesses to assess impacts, integrate and act on findings, track responses, and communicate how impacts are addressed. The process should cover the impacts the business may cause or contribute to, as well as impacts directly linked to its operations, products, or services through business relationships.
The OECD Due Diligence Guidance for Responsible Business Conduct turns this into a practical six-part cycle:
1. embed responsible business conduct into policies and management systems;
2. identify and assess actual and potential adverse impacts;
3. cease, prevent, or mitigate adverse impacts;
4. track implementation and results;
5. communicate how impacts are addressed; and
6. provide for or cooperate in remediation when appropriate.
This is not a straight line that ends after supplier approval. New products, locations, labor providers, production peaks, conflicts, regulations, complaints, and operating changes can alter the risk. Human rights due diligence should therefore be repeated and updated when the context changes.
How Is Human-Rights Risk Different From Business Risk?
Traditional enterprise risk assessments ask how an event could affect the organization. Human-rights assessments ask how business activity could affect people. The same issue can appear in both views, but the priority may be different.
| Risk view | Main question | Example |
| Human-rights risk | How severe could the harm be for workers or communities? | Migrant workers pay recruitment fees and cannot freely leave employment |
| Business risk | How could the issue affect the company? | Customs detention, contract failure, litigation, loss of customer trust, or production interruption |
If the assessment begins only with spend, revenue, media attention, or probability of enforcement, serious impacts on a small or distant group can be underrated. A low-spend supplier can create severe harm. A large commercial relationship can present lower human-rights risk if the relevant impacts are limited and well controlled.
This distinction also prevents confusion with the wider supplier-risk process. A supplier risk assessment checklist can bring financial, operational, compliance, cyber, environmental, and social risks into one decision. Human rights due diligence goes deeper into impacts on people and applies a severity-led prioritization method.
Where Should the Assessment Begin?
Begin with scope, operating context, and people, not a standard document request.
Map the products, services, countries, sites, sourcing routes, materials, labor models, and supplier tiers connected to the decision. Use existing procurement, compliance, audit, grievance, performance, and sustainability information. Record where visibility stops and which assumptions remain unverified.
A reliable current-state view is essential. VECTRA’s guide to baseline assessment versus readiness assessment explains how to separate present evidence from a judgment against a defined requirement. In HRDD, the baseline should identify affected groups, known issues, credible indicators, management controls, and evidence gaps before the team claims readiness or progress.
Do not confuse delivery capability with human-rights performance. A supplier capability assessment tests whether a supplier can meet a defined volume, quality, cost, and delivery requirement. HRDD tests how business activity may affect people. Both can inform supplier approval, but they require different criteria, evidence, and expertise.
The mapping should consider people who may be affected directly or indirectly, including:
• permanent, temporary, migrant, agency, seasonal, informal, and home-based workers;
• women, children, Indigenous Peoples, minority groups, and people with disabilities;
• workers in subcontracted transport, security, cleaning, recruitment, and accommodation;
• smallholders, land users, and communities near farms, factories, mines, warehouses, or infrastructure; and
• human-rights defenders, worker representatives, and people using grievance mechanisms.
This is not a universal list. It is a prompt to look beyond the employees named on a direct supplier’s payroll. The people facing the greatest harm may sit outside the tier or category that procurement normally sees.
Which Human-Rights Impacts Should You Assess?
Use recognized international human-rights and labor standards, then translate them into issues relevant to the supply chain. The ILO MNE Declaration provides guidance for enterprises on employment, training, conditions of work and life, and industrial relations.
Common assessment areas include:
Forced Labor and Responsible Recruitment
Look for recruitment fees, debt, document retention, deposits, restricted movement, threats, wage withholding, deceptive contracts, excessive dependence on an employer, and barriers to leaving work. Examine the role of labor agencies and sub-agents, not only the workplace that receives the workers.
Supplier statements should be tested against recruitment contracts, worker-paid costs, payslips, interviews, grievance records, dormitory arrangements, and freedom to retain identity documents. VECTRA’s article on UFLPA evidence and supply-chain traceability shows why declarations alone may not establish the origin and conditions connected to goods entering a regulated market. Vectra’s analysis of the June 2026 EU forced-labor guidance also explains why reasonable due diligence depends on evidence, context, and a defensible process rather than one standard supplier declaration.
Child Labor and Young Workers
Assess age-verification methods, access to reliable records, recruitment practices, hazardous work, working time, schooling, family livelihoods, and informal or home-based production. A simple “no child labor” policy does not show how underage work is prevented, identified, and remediated without causing further harm.
Wages, Working Time, and Employment Security
Review whether workers receive lawful and agreed wages, overtime, deductions, benefits, contracts, rest, and leave. Examine production planning and purchasing practices that may contribute to excessive hours or unstable employment. A supplier may have a time-recording system but still face impossible lead times or last-minute order changes that undermine the control.
Health, Safety, and Well-Being
Consider physical, chemical, ergonomic, psychosocial, and emergency risks. Look beyond injury totals. Review hazard identification, worker participation, training, protective measures, maintenance, accommodation, transport, heat stress, and access to medical support. Data should be disaggregated where lawful and useful so serious patterns are not hidden by a site-wide average.
Discrimination, Harassment, and Vulnerable Groups
Assess hiring, pay, promotion, pregnancy, dismissal, harassment, violence, accommodation, and access to remedy. Consult people who may experience the workplace differently. A grievance channel that exists in one language or requires a supervisor’s approval may not be accessible to everyone.
Freedom of Association and Worker Voice
Examine whether workers can organize, elect representatives, bargain collectively, raise concerns, and participate in safety or workplace processes without retaliation. Where law restricts independent unions, assess whether alternative worker-representation arrangements are genuinely chosen, trusted, and effective rather than treating any committee as equivalent.
Community, Land, Security, and Environmental Impacts
Supplier impacts can extend beyond workers. Consider land acquisition, livelihoods, water, pollution, security arrangements, cultural heritage, community health, and the rights of Indigenous Peoples. Assess cumulative effects where several facilities or projects affect the same community.
These issues should be tailored by sector and context. Agriculture may require closer attention to seasonal labor, smallholders, pesticides, and land. Mining may require deeper assessment of security, community impacts, resettlement, and water. Manufacturing may emphasize recruitment, working time, chemical exposure, subcontracting, and dormitories. Technology and services may involve content moderation, surveillance, privacy, discrimination, and worker classification.
What Evidence Should You Collect?
Use several sources because every source has limits. Policies describe expectations. Management interviews explain the intended system. Records show transactions and decisions. Worker and community engagement reveals lived experience. Observation shows what happens in practice.
A useful evidence plan may include:
• supplier and site profiles, ownership, locations, and workforce composition;
• recruitment channels, contracts, fees, and labor-provider agreements;
• wage, working-time, age, health-and-safety, and disciplinary records;
• grievance, investigation, remedy, and non-retaliation evidence;
• audit reports, corrective actions, certifications, and regulator findings;
• purchasing forecasts, order changes, prices, lead times, and payment practices;
• sub-tier maps, raw-material origins, transport routes, and traceability evidence;
• interviews or engagement with workers, representatives, communities, unions, civil-society organizations, and local experts; and
• credible public information about sector, geography, conflict, law, and enforcement.
Engagement should be safe, accessible, and appropriate to the people involved. Do not ask suppliers to select only the most confident workers. Consider language, gender, literacy, immigration status, disability, shift, location, digital access, and fear of retaliation. Protect confidentiality and explain how information will be used.
An audit can contribute useful evidence, but it is a snapshot. It may miss informal work, off-site recruitment, unauthorized subcontracting, night shifts, community impacts, or conditions that change during production peaks. Where audit findings exist, VECTRA’s guide to post-audit corrective action plans explains why closure should be based on implementation and effectiveness evidence, not a status label alone.
How Should You Prioritize Human-Rights Impacts?
When it is not possible to address every potential impact at once, prioritize by severity. For potential impacts, consider likelihood as well. Severity is commonly assessed through three connected factors:
• Scale: how serious the harm would be for each affected person.
• Scope: how many people are or could be affected.
• Irremediability: how difficult it would be to restore people to a situation equivalent to the one before the harm.
Do not average these factors mechanically. One extreme factor can make an impact severe. A fatal safety risk may affect fewer people but remain a top priority because the scale and irremediability are extreme. Widespread underpayment may rank highly because many workers are affected and the harm is continuing, even where repayment is possible.
Likelihood helps order potential impacts with similar severity. It should reflect credible context, exposure, past incidents, control performance, worker testimony, and changes in operations. Low-quality data should not automatically produce a low likelihood. Record uncertainty and investigate where the potential severity is high.
Use a prioritization table that preserves the reasoning:
| Field | Question to answer |
| Affected people | Who is or could be harmed, including vulnerable or marginalized groups? |
| Impact | What right or condition is affected, and how? |
| Status | Is the impact actual, potential, ongoing, or historical? |
| Scale | How serious is the harm for an individual? |
| Scope | How many people are or could be affected? |
| Irremediability | Can the harm be restored, and how difficult would that be? |
| Likelihood | For a potential impact, how probable is it under credible conditions? |
| Connection | Did the company cause, contribute to, or become directly linked to the impact? |
| Existing action | What is already being done, and what evidence shows that it works? |
| Priority and owner | What must happen first, who owns it, and by when? |
A color-coded heat map can support communication, but it should not replace the written rationale. Human-rights judgments involve context. Teams must be able to explain why an impact received its priority and whose perspectives informed the conclusion.
How Does Connection to the Impact Affect the Response?
After prioritizing the impact, determine how the company is connected to it. The action differs depending on whether the company caused the impact, contributed to it, or is directly linked through a product, service, or business relationship.
If the Company Caused the Impact
Stop the harmful activity, prevent recurrence, and provide for or cooperate in remedy. The response should address the people affected, not only the control failure inside the management system.
If the Company Contributed to the Impact
Stop or prevent the contribution, use leverage to mitigate remaining harm, and provide for or cooperate in remedy. Contribution can involve the company’s own decisions and practices. For example, purchasing terms, last-minute changes, or unrealistic lead times may interact with supplier practices that produce excessive working hours.
If the Impact Is Directly Linked Through a Supplier
Use leverage to seek prevention or mitigation, monitor the result, and consider how important the relationship is, how severe the impact is, and whether responsible disengagement would create further harm. Direct linkage does not mean the company caused the impact, but it does require a reasoned response.
The category should not be used to minimize attention to severe harm. It clarifies responsibility and the appropriate form of action. Document the facts, assumptions, internal decisions, stakeholder views, and legal advice where needed.
What Actions Can Prevent or Mitigate Supplier Impacts?
Choose actions that address the impact and its drivers. Options can include:
• changing the company’s purchasing, design, forecasting, pricing, or payment practices;
• requiring the supplier or labor provider to stop a harmful practice;
• revising contracts, incentives, specifications, or production schedules;
• building supplier capability and worker-management systems;
• increasing worker participation and access to trusted grievance channels;
• reimbursing recruitment fees or unpaid wages through a controlled process;
• improving traceability and oversight of subcontractors or labor agents;
• collaborating with buyers, industry initiatives, unions, or civil society to increase leverage;
• commissioning focused independent verification; and
• suspending or ending the relationship through a responsible process when necessary.
The action plan should state the affected group, intended outcome, owner, resources, due date, interim protection, completion evidence, and method for checking effectiveness. VECTRA’s ESG gap analysis and pre-audit remediation plan provides a clear structure for turning findings into prioritized, accountable actions.
How Should You Track Whether the Response Works?
Track outcomes for people, not only completed activities. Training delivered, policies signed, audits closed, and committees created are activity measures. They may be necessary, but they do not prove that harm has stopped or that people can obtain remedy.
Use disaggregated data where it is lawful, ethical, and necessary to understand unequal effects. Combine indicators with engagement and case review. A falling grievance count may mean conditions improved, or it may mean people stopped trusting the channel. Interpretation matters.
Define reassessment triggers. These can include new countries, sites, products, materials, labor agents, acquisitions, conflict, regulatory change, allegations, complaints, severe incidents, rapid production growth, or changes to purchasing practices. A dated annual review should not be the only way the process notices change.
A Practical 60-Day HRDD Implementation Plan
Days 1–10: Set Governance and Scope
Assign an accountable executive and a cross-functional owner. Define the products, services, locations, suppliers, tiers, and people in scope. Agree how severe impacts will be escalated and how confidential information will be protected.
Days 11–20: Map People and Potential Impacts
Combine procurement and supplier data with sector, country, labor, community, and regulatory information. Identify groups that may be overlooked. Record evidence gaps and high-severity assumptions that need testing.
Days 21–30: Engage and Validate
Review records, speak with relevant experts, and engage workers, representatives, communities, or civil-society organizations through safe methods. Compare formal controls with lived experience and operating conditions.
Days 31–40: Prioritize and Determine Connection
Assess scale, scope, irremediability, and likelihood. Determine whether the company caused, contributed to, or is directly linked to each priority impact. Document the rationale and review high-severity judgments with qualified people.
Days 41–50: Act and Assign Remedy
Set prevention, mitigation, leverage, and remedy actions. Identify changes required from the business as well as the supplier. Give every action an owner, due date, interim protection, resource, and verification method.
Days 51–60: Track, Communicate, and Set Triggers
Choose outcome indicators and engagement methods. Decide what can be communicated and to whom. Establish periodic and event-based reassessment triggers. Review whether the process itself is accessible to affected people.
Organizations that need to turn this cycle into operating controls can use VECTRA’s Compliance, Risk & Due Diligence service for risk mapping, supplier evidence, due-diligence design, and mitigation planning. Where teams are preparing for an external review, Audit Assistance can help test whether the evidence, ownership, and corrective actions are ready for scrutiny.
In Brief
Human rights due diligence starts with impacts on people. Map the relationship and affected groups, identify actual and potential impacts, prioritize by severity and then likelihood for potential impacts, determine how the company is connected, and act in a way that prevents, mitigates, and remedies harm.
Do not let spend, reputation, or supplier averages replace severity. Use multiple evidence sources and safe stakeholder engagement. Track outcomes for people, not only activities completed. Repeat the process when the relationship or operating context changes.
Frequently Asked Questions
What are the main steps in human rights due diligence?
Embed responsible business conduct into policies and systems; identify and assess actual and potential impacts; cease, prevent, or mitigate impacts; track implementation and outcomes; communicate how impacts are addressed; and provide for or cooperate in remediation when appropriate.
How do you prioritize human-rights risks in a supply chain?
Prioritize adverse impacts by severity. Assess severity through scale, scope, and irremediability. For potential impacts, consider likelihood as well. One extreme severity factor can justify a high priority, so avoid relying only on an average score.
Is human rights due diligence the same as a social audit?
No. A social audit can provide evidence about conditions at a site at a point in time. Human rights due diligence is a wider, ongoing process that covers policy, impact assessment, action, tracking, communication, remedy, business relationships, and changes in context.
Does HRDD apply only to direct suppliers?
No. The process should consider relevant impacts connected to operations, products, services, and business relationships. Prioritization can help a company focus where impacts are most severe, including deeper tiers or indirect relationships.
Should companies stop working with a supplier when an impact is found?
Not automatically. The response depends on severity, the company’s connection to the impact, available leverage, the supplier’s response, and the likely effects of disengagement. Severe unresolved harm may require suspension or exit, but the decision should consider whether disengagement could create additional harm.
What evidence shows that HRDD is working?
Look for changes in outcomes for affected people, supported by records and engagement. Examples include stopped recruitment fees, corrected wages, safer work, effective grievance resolution, reduced recurrence, controlled subcontracting, and remedy that affected people can access.
Which regulations require human rights due diligence?
Requirements differ by jurisdiction, company size, sector, product, and market. Examples include corporate due-diligence laws, forced-labor import controls, modern-slavery reporting, and sector-specific rules. The European Commission’s corporate sustainability due diligence page is one primary source for current EU information. Confirm the law and timeline that apply to your organization rather than treating HRDD as one universal legal checklist.
View Related Posts
• Responsible Purchasing Practices: 7 Buyer Decisions That Shape Supplier Performance
• Why Is Ownership the Missing Link in Your 2026 ESG Audit Results?
• How China’s 2026 Supply Chain Regulations Affect ESG Compliance and Supplier Due Diligence
VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.
Chaussée de Wavre 1517B, 1160 Brussels, Belgium.
A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.
