I. Introduction
The result of six years work by the United Nations (UN) Special Representative of the Secretary-General (‘SRSG’) on human rights and transnational corporations and other business enterprises, the UN Guiding Principles on Business and Human Rights (UNGPs)Footnote 1 were endorsed by the Human Rights Council in June 2011.Footnote 2 Elaborating the general elements that were set out in the 2008 ‘Protect, Respect and Remedy’ Framework for Business and Human Rights (‘UN Framework’, likewise developed by Professor John Ruggie in his capacity as SRSG),Footnote 3 the UNGPs provide operational guidance to States as well as businesses under three Pillars: (1) the State Duty to Protect; (2) the Corporate Responsibility to Respect (CR2R); and (3) Access to Remedy. For the current purposes, Pillars One and Two are relevant due to their shared emphasis on due diligence (DD) and several aspects of communication as elements in promoting the CR2R.
Under Pillar One, the UNGPs set out a State’s Duty to Protect against human rights abuses by third parties, including business organizations. The UNGPs do not develop new human rights, but affirm States’ existing obligations under international human rights law. This reminds States of the scope of those obligations as well as the range of State bodies to which they extend. In accordance with international human rights law theory on horizontal obligations, States are required to prevent or punish private sector human rights abuse through regulation, policy-making, investigation and enforcement. The UNGPs observe that States should encourage or require business enterprises to communicate how they address human rights, noting that communication can range from informal engagement with affected stakeholders to formal public reporting, and that communication is important in fostering business respect for human rights.Footnote 4
Under Pillar Two, the UNGPs set out what the CR2R entails in terms of honouring obligations and social expectations. Applying to all businesses regardless of legal form, this requires a series of interconnected practical steps: a policy commitment to human rights; undertaking human rights due diligence (HRDD); and ensuring remedy. Communication is highlighted as an element in providing transparency and accountability for how companies address their human rights impacts, i.e., take action based on HRDD. Communication is noted to take a variety of forms, including in-person meetings, online dialogues, consultation with affected stakeholders, and formal public reports.Footnote 5 Thus, formal reports are at one end of the spectrum of communication, after other steps that aim at identifying, preventing and mitigating harm.
A resolution adopted in June 2014 by the UN Human Rights Council initiated a process towards a treaty regulating business and human tights (BHR).Footnote 6 Pending the outcome of this process, the UNGPs constitute advanced detailed normative guidance on what responsibilities firms have for human rights, and what States must or are encouraged to do to promote business respect for human rights. The UNGPs may complement a treaty with regard to issues not covered by that instrument.Footnote 7 The UNGPs therefore remain relevant to the emergent BHR regime and its uptake with businesses and governments.
Because of their focus on two essentially different types of organizations – public and private –Pillars One and Two are often treated as distinctFootnote 8 rather than integrated and complementary. However, for purposes of implementation of the UNGPs, the two Pillars embody several closely connected elements. These relate particularly to methods for States (whether acting on their own or based on their obligations as members of international organizations) to promote the CR2R by requiring or recommending specific business activities. In other words: how public authorities may deploy Pillar One modalities such as regulation, policy-making and enforcement to promote Pillar Two relevant activities. With corporate social responsibility (CSR) increasingly becoming ‘juridified’,Footnote 9 the EU’s 2014 Non-Financial Reporting (NFR) DirectiveFootnote 10 introduces mandatory communication, including on DD processes by the company and its supply chain. Other jurisdictions are introducing or debating explicit DD obligations with or without legal sanctions.Footnote 11 As such legislation is experimental in the objective of promoting the CR2R and the methods of doing so and carve the paths for future initiatives in other jurisdictions, it is pertinent for the BHR literature to critically engage with the appropriateness of the adopted regulatory strategy. This pertinence is highlighted by two factors. First, effects of corporate human rights violations are often irremediable. This underscores the need to induce organizational change and encourage managers to prevent human rights abuse. Second, past efforts at social engineering through mandatory non-financial disclosure have mainly targeted environmental impacts.Footnote 12 Whereas human rights impacts are typically qualitative and often escape the financial bottom lineFootnote 13 and in regard to community or supply chain labour impacts are often outside the company’s direct control, environmental impacts and steps to reduce harm lend themselves well to quantification (e.g., kWh spent/saved, CO2 emitted/reduced) or financial bottom line measures (energy costs spent/saved), and are typically within the company’s direct control. Direct control reduces the company’s risk of reputational damage as it enhances its control of all critical information, including from stakeholders.
Studies show that where companies have discretion in reporting on environmental or social impacts, they privilege the former.Footnote 14 They also show that mandatory disclosure of environmentally harmful emissions provide a strong stimulus for companies to reduce the generation.Footnote 15 However, analysis of the few mandatory disclosure requirements to reduce social harm does not convincingly suggest similar effects,Footnote 16 suggesting that it is not possible to assume that the effectiveness of mandatory environmental disclosure applies to social issues disclosure.
This begs an analysis of socio-legal and organizational theory-based conditions for regulatory strategies to be effective for the social-engineering aim of mandatory non-financial disclosure as to stimulating organizational change in firms and influencing managers to change their practices to enhance respect for human rights. The EU’s NFR Directive offers a case for a discussion of regulatory strategy to induce organizational change for advancing the CR2R. Adopted in 2014, the Directive is currently being implemented, with first reports due in early 2018. Due to its novelty, its effects are likely to be closely scrutinized in the coming years by non-governmental organizations (NGOs), companies and regulators with a view to revisions, strengthening and lessons for other jurisdictions. This article offers suggestions for those observations, which can feed into further governmental regulatory initiatives to promote the CR2R, exploring HRDD and communication from the perspective of how Pillar One action may stimulate Pillar Two implementation.
While mandatory corporate disclosure on CSR issues is not a novelty, the NFR Directive stands out by introducing an explicit requirement of DD disclosure. The UNGPs emphasize communication and due diligence, and on accounting for such activities, offers a number of opportunities as well as challenges for promoting the CR2R. While the conventional focus of disclosure is ex-post Footnote 17 (accounting for actions in the past), the urgency of preventing human rights abuse requires an ex-ante focus in order to stimulate organizational change for managers to avoid causing human rights abuse. Accordingly, an analysis calls for a combination of socio-legal and organizational theory on stimulating changed conduct. A series of regulatory theories dating from the regulatory crisis in the 1980s to 1990s have offered suggestions for how to transform societal needs and public policy social and environmental objectives into corporate action. Ayres and Braithwaite’s ‘responsive regulation’ theorizes on how a plurality of motivations for compliance interact, proposing combined use of compliance and enforcement strategies.Footnote 18 Nonet and Selznick’s ‘responsive law’Footnote 19 argues that the law should respond to societal change, reality and complexity by being open, and oriented towards purpose and result. To help stimulate relevant change of conduct, regulation should encourage organizational communicative processes in transforming societal needs into organizational action. Inspired by ‘responsive law’, Teubner’s reflexive law,Footnote 20 a social-engineering theory that has been continually and highlights,Footnote 21 inter alia the role of non-financial reporting,Footnote 22 offers an explicit theory for stimulating organizational change through stakeholder engagement as a modality for learning. This article combines reflexive law with Gond and Herrbach’s theory on conditions for CSR reporting as organizational learning.Footnote 23 Accounting literature on organizational response to mandatory disclosure adds further insights, considered to the extent allowed by space constraints.
The next section introduces the EU’s NFR Directive. Next, the complex regulatory and organizational challenge addressed by the article is framed by drawing on legal, organizational and accounting aspects. The connection between compliance and social expectations and the related complementarity between Pillars One and Two are elaborated, followed by a discussion of HRDD, communication and non-financial reporting, the UNGP emphasis on proactive steps to prevent harm, and the connection to corporate self-regulation and conditions for organizational change. On that basis, the discussion proceeds to identifying opportunities and challenges for authorities in connecting Pillars One and Two through NFR-related components of ‘smart-mix’ regulation. That leads to a critical evaluation of the EU Directive’s potential to induce organizational change to prevent or limit harmful impacts. The conclusion finds that in emphasizing ex-post compliance with disclosure and reporting requirement instead of measures to induce ex-ante organizational change and proactive HRDD and communication as part of a reporting process, the Directive may be neglecting important regulatory opportunities to promote the CR2R. The conclusion also suggests that regulators could improve Pillar One promotion of Pillar Two activities through non-financial reporting by increasing the preventative and learning focus.
II. The EU’s Non-Financial Reporting Directive
The EU’s NFR Directive introduces an obligation on certain firms to report on issues that firms typically refer to as CSR. The Directive applies to so-called ‘public-interest companies’ with more than 500 employees.Footnote 24 This covers around 6,000 large companies and groups across the EU, including listed companies, banks and insurance companies. The Directive’s stated overall objective is to increase the relevance, consistency and comparability of information disclosed by these companies.Footnote 25 Its opening underscores a social-engineering aim of changing business conduct/managers’ conduct: the preamble notes that disclosure of non-financial information is vital for managing change towards a sustainable global economy by combining long-term profitability with social justice and environmental protection, and helps the measuring, monitoring and managing of undertakings’ performance and their impact on society.Footnote 26 The preamble emphasizes preventing adverse impacts and stimulating proactive change within firms in the interest of more sustainable business practices that reduce adverse societal impact, rather than narrowly accounting for processes undertaken and harm done.
Management reports relating to financial year 2017 or later must include a statement on policies, outcome and risks as regards, at least, environmental, social and employee-related matters, respect for human rights, anti-corruption and bribery.Footnote 27 They must provide information on related DD processes of the firm, and where relevant and proportionate also for its supply and subcontracting chains.Footnote 28 Applying UNGP language, the Directive defines DD as steps taken ‘in order to identify, prevent and mitigate existing and potential adverse impacts’.Footnote 29 Testifying to mixed support among the business community, EU-based corporate groups successfully lobbied to have the range of the Directive reduced from originally 18,000 to 6,000 companies.Footnote 30
European civil society played a significant part in the introduction of, amongst others, the DD reporting element.Footnote 31 An NGO involved in the process explains the emphasis on reporting, inter alia, on the assumption that non-financial disclosure will ‘empower people to access information on how they might be affected by business operations, and enable shareholders to hold the management accountable for negative impact’.Footnote 32 The reasoning implies that the risk of the possibility of firms being challenged by civil society groups, investors, consumers and other stakeholders for their business practices will drive change proactively to avoid reputational damage and reactions by stakeholders like investors or consumers that may have economic impacts on the firm.Footnote 33
The Directive addresses human rights issues in several contexts. Issues for suggested coverage in the non-financial report includes the prevention of human rights abuses, mentioned in the same context as anti-corruption and bribery.Footnote 34 Several listed social and employee-related issues have human rights relevance (but are not characterized as such), e.g., working conditions, social dialogue, respect for the right of workers to be informed and consulted, respect for trade union rights, health and safety at work, protection of and dialogue with local communities, implementation of the International Labour Organization (ILO)’s fundamental conventions, and actions to ensure gender equality.
The Directive allows companies a choice between several reporting instruments or schemes (referred to in the Directive as ‘frameworks’). These include national CSR ‘frameworks’, the EU’s Eco-Management and Audit Scheme (EMAS), or international ones like the UN Global Compact, the UNGP, OECD’s Guidelines for Multinational Enterprises, ISO 26000 Social Responsibility Guidance Standard, ILO’s Tripartite Declaration concerning multinational enterprises and social policy, and the Global Reporting Initiative (GRI).Footnote 35 The inclusion of some of these confirms a diversity of interests a play, as only EMAS and GRI are actual reporting or ‘accountability’ schemes. The UNGP, OECD’s Guidelines, UN Global Compact, ISO 26000 and ILO’s Tripartite Declaration are operational guidelines rather than reporting schemes (although private schemes, such as GRI and the RAFI Framework,Footnote 36 have been developed for Global Compact and UNGP reporting).
While the social-engineering objective is clearly set out in the Directive’s (non-binding) preamble, the applied strategy to stimulate such change in the operative (binding) articles is less clearly focused on stimulating organizational change in order to prevent harm from occurring. Little attention is paid to the reporting process as a modality to induce organizational change or self-regulation, nor how social actors may stimulate organizational change through their reactions to CSR reports. Applying a conventional command-and-control approach, the operative articles emphasize compliance with the obligation to deliver a report, formal rights of access to information for stakeholders, and sanctions to be imposed by States for firms’ non-compliance with the reporting obligation. Member States are required to establish means to guarantee disclosure in compliance with the Directive and to enforce this.Footnote 37 Hence, the Directive’s operative focus is limited to formal reporting, access to reports, and sanctions for non-reporting. Audits are limited to whether a report has been provided,Footnote 38 not whether reported information is consistent with actual business activities or impact. The assumption underlying the emphasis on public access to reports is that NGOs will monitor their consistency with reality. A similar approach has been applied by the UN Global Compact since it introduced its Communication of Progress reporting requirement in 2004, with little evidence that this has effectuated corporate change.
III. Framing the Issue: Non-Financial Reporting and HRDD as Agents for Organizational Change
A. Compliance and Social Expectations: the Pillar Two–Pillar One Connection
Organizational change is a significant point in much of the debate on CSR and implicit in much of the legal and political debate on BHR. In the best of worlds, businesses would manage their impact on society so that no harm occurs (and from the ‘political CSR’ aspect,Footnote 39 contribute to human rights fulfilment). In the real world, decades of documented human rights abuse demonstrate that businesses are able to and in practice do cause abuse of all human rights.Footnote 40 The 1984 Bhopal Disaster and the 2013 Rana Plaza collapse as well as many other documented business-related human rights abuses have led to increased attention with a need for businesses to change their practices in order to prevent or, at least, reduce their adverse impacts on human rights and other sustainability concerns. Organizational change is needed for companies to recognize that they cause risks to society, and for managers to become aware of such risks so that the necessary steps may be taken to prevent further damage. In their recommendations for States and businesses, the UNGPs combine legal and economic sanctions as well as pre-damage steps, including due diligence, to stimulate such preventative business practices.
Like the UN Framework, the UNGPs do not establish new human rights but explain the implications of existing human rights with regard to impact caused by business. (The term ‘impact’ was adopted to distinguish business-related human rights abuse from States’ violations of human rights.) The UN Framework and UNGPs explain that respecting the International Bill of Human Rights and the ILO’s fundamental conventions (freedom of association and collective negotiation, non-discrimination, and elimination of child labour, forced labour and slavery) is a baseline expectation of firms,Footnote 41 and that their human rights impact is assessed by social actors against the standards in those instruments.Footnote 42 The ‘baseline expectation’ therefore makes human rights observance relevant to firms whether on legal compliance grounds or on economic grounds based on potential risks of economic sanctions administered by consumers, investors and other stakeholders.
The CR2R consists of both the obligation to comply with applicable law and a responsibility to respect social expectations. The compliance element tends to be overlooked in discussions on the UNGPs, perhaps because it was more explicit in the UN Framework.Footnote 43 Compliance and social expectations connect, because compliance relates directly to statutory obligations that may be introduced by States, and because the boundary between what is a compliance obligation and what is a social expectation is dynamic. Governments may develop statutory law that changes a social expectation into law. Issues subject to social expectation in some jurisdictions may be subject to statutory regulation and therefore compliance obligations in others. Whereas binding law often limits requirements to minimal standards, social expectations may work to drive up the performance. They may therefore serve to raise the bar for firms’ active steps to respect human rights, not just in terms of business ethics but also through soft law that may gradually evolve into hard law.
From a legal perspective, the responsibility to observe social expectations may appear weaker than the obligation to comply with applicable law. Yet from the economic perspective, the assessment may be different. Social expectations may be coupled with social or market-based sanctions, which can be considerable in financial terms.Footnote 44 As researched by Professor John Ruggie in his capacity as UN SRSG, such sanctions can be significant to a company, despite often being treated or even hidden as general operational costs.Footnote 45
HRDD in general and communication in the specific form of non-financial reporting can be subject to statutory obligations on companies (for example, introduced by States as part of their activities to fulfil their duty to protect) or to social expectations (i.e., external expectations that help frame the activities that firms should undertake under Pillar Two). Several EU states already introduced forms of mandatory CSR reporting prior to EU’s NFR Directive. The rationale is that non-financial reports provide transparency on firms’ policies, implementation and responses to incidents, such as alleged or documented human rights abuse. It exposes firms to scrutiny by outsiders, including critical stakeholders.Footnote 46 Some may exercise assessments of the firm’s legal compliance and many serve as ‘courts of public opinion’,Footnote 47 generating responses that economically punish a firm for insufficient response to or observance of social expectations. From the reflexive law perspective, the reporting process provides the firm with information on stakeholder expectations. To the firm, this is meaningful when it helps it understand threats or opportunities to the firm’s economic situation.Footnote 48 Thus, even when firms undertake Pillar Two activities such as HRDD or non-financial reporting based on statutory obligations, from the firm’s perspective the activity may in practice have to deal with social expectations. Indeed, reflexive law assumes that that the firm’s understanding of the implications of its societal impact in economic terms rather than as a legal compliance issue is a condition for organizational change.Footnote 49 However, as explained below the effectiveness of disclosure reporting per se to generate change in corporate conduct is uncertain.
B. Human Rights Due Diligence
The UN Framework and UNGPs offer overall guidance for HRDD.Footnote 50 HRDD is focused first and foremost on risks caused by the firm to society (as opposed to risks to the firm),Footnote 51 and entails a process that continues as long as the activity/activities to which it is related. In respect to remedy it even extends beyond those activities. The aim of the HRDD process is to identify, prevent and mitigate adverse human rights impacts and provide remedy. Accounting for these actions by communicating how impacts are addressed forms part of HRDD.Footnote 52 The HRDD process should cover the firm itself and impact linked to its operation or products through the supply chain and business partners.Footnote 53 HRDD must be exercised in such a way as to dynamically take account of changes in human rights risks caused by the firm as the firm’s operations and operating context evolve.Footnote 54
HRDD differs from due diligence commonly deployed as a business practice and by corporate lawyers, typically in the context of mergers, acquisitions and related corporate activities. That due diligence aims at identifying possible financial risks to the company or legal liabilities that may flow from such a corporate activity.Footnote 55 By contrast to HRDD, it is therefore both oriented at direct risks to the firm and typically static in the sense that due diligence ceases when the decision is made on an activity.
In reducing adverse social impact, the firm also reduces the risk to itself that may flow from reputational damage or economic sanctions by stakeholders. Thus, a well-performed HRDD process may also serve as a risk management tool for the firm in regard to reputational damage and ensuing economic loss due to social actors’ responses.Footnote 56
The UNGPs address HRDD under Pillar One as well as Pillar Two. Pillar One encourages States to introduce HRDD recommendations or even requirements on businesses as part of the Duty to Protect.Footnote 57 This may form part of a State’s provision of guidance to firms on how to respect human rights, which is also encouraged by the UNGPs.Footnote 58 HRDD requirements may be particularly relevant with regard to firms owned or controlled by or otherwise connected to the State, but are not limited to those.Footnote 59 That message has been taken up by current French and Dutch initiatives for mandatory due diligence,Footnote 60 and by guidance for several sectors developed by the OECD as well as the EU, which apply the UNGPs’ HRDD approach to social issues in general under the term risk-based DD.Footnote 61
Despite its potential to increase firms’ respect for human rights, HRDD has received somewhat limited attention and mixed responses in the literature. Some scholars welcome the terminological link between HRDD and well-known business practices deployed as financial risk management as an ingenious way to generate support among business organizations.Footnote 62 Others critique the DD concept introduced by the UN Framework and elaborated with the UNGPs for a flawed inner logic that confuses two meanings of due diligence: a standard of conduct (to discharge an obligation), and a process (to manage risks to businesses).Footnote 63 Yet others argue that the UNGPs mix risk to society and risk to the firm in ways that can be hard to align for managers.Footnote 64 However, that connection may also be precisely why the concept appealed to business interests in a way that decreased lobbying against the UN FrameworkFootnote 65 such as that which contributed to the demise of the Draft UN Norms.Footnote 66 From the philosophically informed business ethics perspective, it has been claimed that there is a tension between the philosophical approach to human rights observance as a ‘perfect moral duty’ and flexibility inherent in the HRDD process prescribed by the UNGPs.Footnote 67 However, while dilemmas are recognized for practical business application,Footnote 68 scholars generally welcome the HRDD approach as a technique for firms to identify and limit adverse impact on human rights. Legal analyses recognize HRDD as useful for making firms assess and take account of potential harmful impacts in time to prevent or mitigate thoseFootnote 69 despite a tension between the public and private approaches to due diligence as an obligation and a risk management tool, respectively.Footnote 70 Normally concerned with the private side of business conduct, business ethics scholars have also found that governmental regulation plays an important role for firms’ application of HRDD.Footnote 71 Law-informed analyses of private or public due diligence initiatives for businesses indicate the emergence of a culture of HRDD in the responsible sourcing of ‘conflict-free’ minerals, acting as a precursor to the hardening of the soft or ‘social expectations’ element of UNGP Pillar Two.Footnote 72
Testifying to its appeal with both public and private actors, the UNGPs’ HRDD concept has not only informed the EU’s NFR Directive, but also influenced leading and global instruments for transnational business governance, including ISO’s 26000 Social Responsibility Guidance Standard and the UN Global Compact. Of particular relevance to Pillar One–Pillar Two complementarity, OECD’s Guidelines for Multinational EnterprisesFootnote 73 adopted the HRDD approach not only for its human rights chapter (added in 2011 to ensure coherence with the UNGPs) but to most issue areas covered by the Guidelines, including labour/industrial relations, environment and anti-corruption.Footnote 74 While OECD’s Guidelines express an expectation of firms to exercise DD (i.e., a Pillar Two activity), the enforcement structure of the Guidelines means that the exercise and effectiveness of DD may be monitored and assessed through National Contact Points (NCPs). State-based non-judicial remedy institutions established in countries that adhere to the Guidelines, NCPs have extraterritorial powers in that an alleged violation occurring in a country without an NCP can be examined by the NCP of the company’s home State. An emerging jurisprudence among the (currently) 48 NCPsFootnote 75 potentially adds to the complementarity between firms’ HRDD and States’ obligations.Footnote 76 Thus, while States requiring non-financial reporting is a Pillar One activity to stimulate change in firms proactively and help stakeholders hold firms economically to ‘account’ re-actively, NCPs are a Pillar One-based institution that serves to ‘enforce’ Pillar Two action. Non-financial disclosure may help inform future complaints with NCPs, as well as NCP assessments of firms’ DD.
C. The UNGPs’ Broad ‘Communication’ Focus and Non-Financial Reporting
Human rights reporting relates to non-financial reporting and in particular to CSR reporting, which exist both in voluntary and mandatory forms. In line with a surge in public requirements on private CSR activities, the ‘voluntary-mandatory’ dichotomy that previously dominated much debate on CSR has receded,Footnote 77 partly under influence of UN Framework’s and the UNGPs’ elaboration of an explicit connection between corporate responsibilities and States’ duties. Besides being reflected in the literature, this is also evident in the EU’s radical 2011 revision of its definition of CSRFootnote 78 (deleting previous reference to ‘voluntary’ action or action ‘beyond the requirements of the law’), and the simultaneous announcement that the EU would introduce mandatory CSR reporting.Footnote 79
Whereas non-financial reports often focus on external readers,Footnote 80 the UNGPs treat communication as a broad practice that has an important connection to actually or potentially affected stakeholders (victims). The UNGPs see communication not only as the issuance of the report for ‘accountability’ purposes, but as part of the full HRDD process. Communicating through reporting has an ex-post perspective to the action done or impact caused, and the UNGPs recognize that external communication on how impacts are addressed is particularly important when there are alleged or reported victims (‘affected stakeholders’) of the firm’s activities.Footnote 81 Communication as part of the ongoing HRDD process has an ex-ante focus that helps identify, prevent or if necessary mitigate adverse impact before it occurs or grows. Formal public reporting (often in the name of a sustainability/CSR report) is part of HRDD, especially in high-risk contexts.Footnote 82 However, from the Pillar Two perspective, ‘communication’ as part of the HRDD process also includes in-person meetings, (online) dialogues and consultation with affected stakeholders.Footnote 83
Three key points emerge from this. First, in line with the overall objective of the UN Framework and UNGPs that firms should ‘do no harm’, communication is not just about accountability but largely about prevention. Secondly, the UNGPs do not treat non-financial reporting as an end in itself but as part of a range of practices intended to avoid or reduce harmful impact and establish accountability with stakeholders. Third, firms’ communication may be formal or informal, but the higher the risk or the more severe the impact, the stronger the case for formal reporting, whether voluntary or mandatory.
It follows from this that for communication as part of HRDD and therefore non-financial reporting to serve the objective of prevention of harm, the process needs to be undertaken from a broader approach that emphasizes understanding stakeholder perceptions of impacts both before they occur, and after the firm has sought to address them. As will be discussed in the next sub-section, literature on accounting and organizational learning offers.
D. Reporting as a Learning Process for Organizational Change
Because it offers transparency, non-financial reporting is often treated as a disclosure practice, both in researchFootnote 84 and in regulatory practice. Reporting what has already occurred, the disclosure approach is mainly ex-post, in contrast with an ex-ante organizational change approach aiming at adapting a firm’s practices to reduce adverse impact before it occurs. The ex-post disclosure approach is evident in the EU’s NFR Directive and several other non-financial reporting statutes, such as US and EU requirements on firms to disclose payments to governments for natural resource concessionsFootnote 85 and conflict minerals disclosure introduced in the US through the Dodd-Franck reform.Footnote 86
The NFR Directive signals an assumption that non-financial disclosure will induce change in business organizations, because shareholders will hold firms’ management to account for their impact on society based on information in the report. This in turn assumes that organizational change will occur because firms will seek to pre-empt stakeholders’ reactions to perceived discord between social expectations and disclosed information. However, the socio-legal, organizational and accounting literature on non-financial reporting does not in general bear these assumptions out, and indeed suggests that in many cases mandatory non-financial disclosure has little effect on organizational decision-making to reduce adverse impact on society.Footnote 87 The Danish mandatory CSR-reporting Act on which the EU NFR was partly modelled originally aimed at stimulating organizational change.Footnote 88 However, monitoring has focused solely on compliance in the sense of submitting reports,Footnote 89 partly due to a failure by the authorities to effectively explain the importance of the learning objective to companies, media, scholars and NGOs.Footnote 90 Corporate engagement research suggests that whereas firms that engaged in voluntary CSR-reporting prior to reporting becoming mandatory did so with a learning objective, those that did not previously develop CSR-reports mainly focused on compliance.Footnote 91 While some studies indicate a positive relationship between disclosure and changed business practices in the environmental field,Footnote 92 as noted above there are significant differences between environmental and human rights impacts for reporting purposes. Like environmental disclosure can help the firm save costs, the United States Federal Sentencing Guidelines, which have also been discussed as reflexive law,Footnote 93 have consequences for firm internally rather than externally. The Guidelines enable judges to offer managers leniency for corrupt practices if firms have preventative processes in place for organizational integrity.Footnote 94
Interestingly, the literature does offer advice for how disclosure, whether mandatory or voluntary, can stimulate organizational self-regulation and change. Some organizational studies indicate that the objective of the firm when undertaking non-financial reporting is crucial for generating change in the organization and its practices, and hence its impact on society. The key is whether the firm’s focus is strategic, applying reporting as a modality to understand how the firm and its impact are perceived by stakeholders and on that basis to proactively align internal procedures with societal needs and expectations.Footnote 95 By focusing on the internal decision-making process rather than external coercion, the process of collating information for the report and assessing the information against stakeholders’ needs may help the firm learn about and understand social expectations and change its practices accordingly.Footnote 96 Without such awareness tuned to explicit organizational learning and self-regulation, or when reporting is undertaken with a compliance perspective, the likely result is a report offering the picture that corresponds to stakeholders’ ideal image of the firm without generating learning for the organization, nor necessarily sharing information that critical social actors need in order to hold firms to account for their impacts, policies, and reported information.Footnote 97 Indeed, non-financial disclosure has been found to be applied by firms to reduce exposure to critique and social or economic accountability rather than providing meaningful information and transparency on their social and environmental impact, policies and strategies.Footnote 98 Corporate practitioners, too, recognize that reporting is ‘only the tip of the iceberg’, and that what really matters occurs within the organization through practices and corporate culture shaped by internal corporate regulation, such as management oversight, monitoring and incentives.Footnote 99
Consistent with this, reflexive law studies find that social reporting may stimulate firms’ understanding of stakeholder expectations and needs, leading to self-regulation and ensuing organizational change.Footnote 100 In line with reflexive law’s foundational idea that regulators and other external actors need to communicate in a manner that speaks to the rationale of the organization in which change is desired, in order to induce change in a business organization a regulatory strategy should work through the economic interests of the firm. This is best activated by addressing that interest directly.Footnote 101 Insisting on legal compliance is not insignificant, but by the firm may be perceived as external action inviting tick-box exercises without much relevance for the core business.Footnote 102
A strategic learning approach to reporting would enhance a firm’s ability to identify, prevent and mitigate adverse human rights impact, and therefore to honour HRDD. By stimulating internal change to (ideally) avoid or reduce adverse impact, the focus of the learning approach is ex-ante and proactive. A regulatory strategy applying this approach is not outside the scope of legal thinking. According to reflexive law theory, organizational change may be enhanced by pressure or ‘irritation’ from the outside. Information, communication and indeed reporting as process may stimulate organizational learning and lead to self-regulation and change. Studies of non-financial reporting confirm that taking a learning approach to the reporting process, as opposed to a mainly externally oriented disclosure or branding approach, may significantly enhance the firm’s organizational change.Footnote 103
This is not to say that the ex-post focus of disclosure, providing stakeholders with information on a company’s practices after they have taken place, is not important; but to reduce adverse social impact, disclosure cannot stand alone. Like due diligence is primarily about avoiding risk, reporting as a process should support decision-making to avoid risk, including by stimulating proactive DD to prevent harm. Unfortunately, the EU’s NFR Directive skews the balance in favour of reporting for compliance in which reporting on a DD process also becomes a technical disclosure issue rather than stimulating internal learning and cultivating stakeholder engagement as part of the DD process.
As claimed by French sociologist Pierre Bourdieu, legal traditions, education and professions frequently produce a legal ‘habitus’ dominated by juridical and economic values. The result is a blind spot for dynamics such as culture, human resources or responsibilities beyond what is mandated by the law,Footnote 104 such as in the current context: what spurs change within organizations.
Regulators often seek to change organizational practices through regulatory means that do not speak to the interest that will generate change in the organization addressed. The EU’s NFR Directive is an example, as elaborated in the following.
IV. Connecting the Dots: Opportunities and Pit-falls for Authorities in Stimulating Organizational Change Through Reporting and Due Diligence
A. The Significance of Reporting as Process and Communication to Identify Risks to Stakeholders
It follows from the previous sections that while communication according to the UNGPs is part of HRDD in order to account for other elements of the HRDD process, reporting as process serves a purpose of its own in avoiding future or current adverse human rights impacts. A finished non-financial report may form part of ex-post accountability. Like disclosure it is activated after other HRDD elements have taken place, and particularly when adverse impact has been identified, prevented and/or mitigated or remedied. While this aspect is reactive, the reporting process has an important proactive aspect to it. The process may support learning within an organization in order to stimulate change to avoid or reduce future human rights risks, for example based on understanding of the concerns of local communities and NGOs.
This is a significant distinction when considered at the backdrop of HRDD being proactive and not only reactive: if effective, HRDD prevents or reduces adverse impacts. Communication in the spirit of the UNGPs is not just a matter of ex-post reporting, but also part of a HRDD process that connects the firm with its stakeholders, in particular (potential) victims, to prevent harm. HRDD has been named a game changer for companies: from ‘naming and shaming’ to ‘knowing and showing’.Footnote 105 The important shift is from companies being ‘named and shamed’ ex-post as culprits associated with breaking social expectations and escaping the law in areas of weak public governance: the ‘knowing and showing’ company understands its impact on human rights ex-ante, takes responsibility, and shows this. Thus, ‘knowing and showing’ is not simply to disclose information (‘showing’ and providing accountability), but as importantly about organizational learning to avoid adverse human rights impact (‘knowing’). This is supported by the UNGPs’ description of HRDD steps like consultation, impact assessments and tracking performance. ‘[M]eaningful consultation with potentially affected groups and other relevant stakeholders’ should be conducted to gauge human rights risks before they occur. Tracking performance ‘is necessary in order for a business enterprise to know if its human rights policies are being implemented optimally, whether it has responded effectively to the identified human rights impacts, and to drive continuous improvement’. Assessing human rights risks helps prevent and mitigate adverse human rights impacts, and firms should look for both actual and potential adverse impacts.Footnote 106
Constituting ‘a process whereby companies not only ensure compliance with national laws but also manage the risk of human rights harm with a view to avoiding it’,Footnote 107 the UN Framework proposed HRDD as a process for firms to avoid adverse human rights impact. In the BHR context, remedy institutions are highly important, but the need for remedy is ideally avoided. Human rights damage is rarely fully remediable: an arm lost in an occupational health and safety accident cannot be replaced; a childhood lost to factory labour cannot be relived; lethal chemicals polluting drinking water or agricultural land cannot disappear overnight; and the impacts of environmental damage to the possibilities for farmers or fishermen to provide for themselves and their families may persist for a long time. Studies indicate that even where remedy is available, its effectiveness is questionable,Footnote 108 thus further underscoring that however important remedy is, prevention of harm is preferable.
Thus, while ex-post accountability is a common judicial method to restore damage, in the BHR field ex-ante modalities preventing harm are preferable. Because firms’ decisions are ultimately driven by economic considerations (as recognized by reflexive law theory), ex-ante oriented communication, including reporting as a learning process, is more likely to prevent adverse human rights impact if the firm risks economic sanctions. The UN Framework and the UNGPs express this through references to social expectations with economic implications: ‘[O]ver and above compliance with national laws’Footnote 109 the responsibility to respect is ‘defined by social expectations – as part of what is sometimes called a company’s social license to operate’.Footnote 110 Regulators, therefore, need to consider whether reporting is likely to make a business enterprise review its policies and implementation steps to avoid the risk of economic sanctions administered by consumers, investors and other stakeholders. Mandatory disclosure that fails to stimulate organizational learning and self-regulation may effectively be a missed opportunity to induce change for the benefit of human rights.
Against the EU Directive it is worth noting that the UNGPs do not refer to disclosure, but to reporting and communication.Footnote 111 Absent in the UN Framework’s presentation of HRDD, the communication or ‘showing’ part was added by the UNGPs. The importance of communication as a modality not only to account for past steps but also prevent future adverse impact is underscored when reading the UNGPs’ elaboration of Pillar Two on the backdrop of the UN Framework, which describes the CR2R as basically to ‘do no harm’.Footnote 112 Listing the International Bill of Rights and ILO’s fundamental conventions as the normative baseline for the substantive contents of HRDD whether oriented at social expectations or legal compliance, the Framework and UNGPs intend the HRDD process and its communication elements to aim at identifying and managing adverse impact, as well as accounting for steps taken for those purposes.
This translates into a critical assessment of the predominant disclosure focus of the EU’s NFR Directive. Because the EU has been an early mover in introducing mandatory non-financial reporting, the observations have relevance for other governmental organizations that wish to promote the CR2R. This is elaborated in the following.
B. Promoting Organizational Learning through Corporate Communication and HRDD: Theory-Based Lessons from the EU Directive
The UN Framework introduced HRDD by noting that many companies already apply comparable processes based on national law requirements of systems to assess and manage financial and related risks.Footnote 113 While this partially served to invite acceptance and underscore the internal risk management corollary of the process,Footnote 114 it also indicated that HRDD may be or is becoming a process required by law in firms’ home or host countries. The UNGP Commentary applies the term regulatory ‘smart mix’ in explaining how authorities may combine a variety of national and international, mandatory and voluntary measures to foster business respect of human rights. A ‘smart’ combination of mandatory and voluntary measures enables regulators to combine the compliance and social expectations element of the CR2R in order to induce change. The term ‘smart-mix’ was adopted by the EU in its 2011 CSR Communication on CSR, announcing the NFR Directive and encouraging Member States to implement the UNGPs.Footnote 115
The UNGPs establish a firm connection between Pillars One and Two in recommending that States clarify what is expected of firms by providing guidance on HRDD, and encourage or require firms to communicate or issue formal reports on how they manage their responsibility to respect. It clearly forms part of the State’s Duty to Protect to not only (reactively) enforce laws requiring business to respect human rights, but also to (proactively) provide effective guidance to firms on how to respect human rights throughout their operations; and encourage and ‘where appropriate’ require enterprises to communicate how they address human rights impact.Footnote 116
Hence, while the UNGPs encourage authorities to promote Pillar Two implementation through Pillar One activities, the effect depends on the steps that authorities require or recommend. Promoting the generally proactive HRDD process and communication as a learning process gives States an opportunity to honour their Duty to Protect by stimulating business respect for human rights. Conversely, neglect of the proactive approach in favour of ex-post disclosure entails a risk that firms do not sufficiently engage in ex-ante communication or learning, i.e., assessing impacts and tracking responses in order to identify, prevent or reduce adverse impact.
As EU-based firms begin to adopt the new disclosure requirements introduced by the NFR Directive it will be important for observers within and outside these firms to consider whether the Directive has the intended effects. Based on socio-legal, organizational and accounting studies the observations above offer a critical approach for such observations with a view to enhanced understanding of what constitutes appropriate regulatory strategies to stimulate organizational change in BHR and other complex sustainability fields with often irremediable impacts.
With its policy basis in the EU’s 2011 CSR Communication, the NFR Directive originated as an innovative attempt at applying smart-mix regulation to promote social responsibility among EU-based firms. However, while the smart-mix approach as recommended by the UNGPs assumes a mix of hard and soft law and incentives to induce organizational change with a proactive focus to identifying and preventing adverse impact, the emphasis of the adopted Directive is on hard and reactive law. The objective of increasing the relevance, consistency and comparability of information provided through firms’ non-financial reports testifies to a disclosure orientation that leans on ex-post accountability. This is clear even in the preamble’s reference to managing change towards sustainability and combining long-term profitability with social justice and environmental protection: here too, the language refers to disclosure for managing firms’ impact on society.Footnote 117 Due diligence is the only element in the reporting requirement that would appear geared to strengthen firms’ proactive assessment of their impact. Yet due diligence, too, in the Directive is targeted with a disclosure orientation. This raises the important question whether the Directive’s ex-post orientation is sufficiently strong to stimulate other forms of communication than ex-post reporting, especially those that are form part of HRDD to prevent harm ex-ante.
The Directive signals an assumption that disclosed information on measures that are deemed by social actors to be insufficient to off-set adverse impact will lead to sanctions (whether legal or economic). This approach is explicitly ex-post in that it presumes the existence of the information as a condition for the sanction. The Directive’s effectiveness in generating organizational learning and internal change to identify and prevent adverse impact is undermined by the emphasis on legal compliance and sanctions for non-reporting, both of which are limited to the disclosure requirement and not the extent and quality of the information disclosed.
The inclusion of due diligence on the list of issues subject to reporting is significant for the Directive’s potential to push firms towards a proactive approach. However, this does not alter the overall approach of the Directive as having a reactive rather than a proactive orientation. The applied regulatory strategy is not well suited to unleash the potential of HRDD to help a firm identify, prevent and mitigate human rights impact. Whether a due diligence process is adequate will be assessed by social actors based on available information on whether adverse impact occurred, or whether steps to identify stakeholder concerns and manage adverse impacts were sufficient. The motivation for a firm to fully disclose such information may be limited in such a context. The Directive does little to explain the benefits of the proactive approach to firms, and a firm with little previous insight into the BHR field might believe that it will clear itself of societal expectations as well as compliance issues by disclosing required information in its non-financial report.
This weakness is augmented by the Directive’s limiting audit requirements to a check that the non-financial statement has been provided,Footnote 118 not that the information disclosed is correct. The effectiveness of a reporting process to generate change is likely to be limited when enforcement and audits are directed at disclosure with the objective to increase the relevance, consistency and comparability of information rather than to document organizational learning and decision-making to reduce impact, as well as consistency of action across risks, impact and due diligence processes.
The ‘smart-mix’ regulatory approach opens opportunities for States to promote business respect for human rights by carefully considering how they may transform public policy needs and social expectations of firms into detailed guidance, whether in form of explicit HRDD guidance or requirements, or in the form of explanations of why and how business respect for human rights matters. Given its unique character as a supranational organization, the EU functions as a regulator on a par with a State based on powers conferred by Member States. However, contrary to the smart-mix approach, Member States are required by the Directive to ensure that compliance and enforcement procedures are in place. The focus remains judicial or based on assumptions that ex-post economic accountability by investors, buyers or consumers will shape business action sufficiently for the desired change to materialize.
In sum, the regulatory strategy deployed by the EU Directive fails to provide an explicit connection between proactive and reactive measures to ensuring that transparency through disclosure results in effective learning, due diligence and market-based sanctions. It does not stimulate timely adaptation of business practices to identify, prevent or mitigate adverse impact. This reduces the potential influence of public regulators, in casu EU Member States and their authorities implementing the Directive, to promote the CR2R for human rights. In subscribing to a conventional command-control approach to law and ex-post accountability in implementing their Pillar One obligations, rather than emphasizing the process aspect conducive to learning and organizational change, the EU Directive appears to have missed out on an important opportunity to create an innovative model for advancing corporate self-regulation and further the objectives of Pillar Two for firms to ‘do no harm’. One may question whether the EU fully honours its own (conferred) State Duty to Protect, because the Directive neglects to proactively prevent business-related human rights harm.
V. Conclusion
The CR2R entails for firms to know about and observe social expectations to respect human rights, and to comply with national law to respect human rights in their countries of operation (home and host states). To promote the CR2R, States may encourage or even require activities by firms to ensure their respect for human rights. The UNGPs specifically recommend that States do so with regard to HRDD and non-financial reporting. Mainly referring to or relating to activities that organizations have already undertaken, the issuance of a non-financial report is primarily a reactive measure. HRDD, by contrast, is proactive in seeking to identify human rights risks and to avoid or mitigate those. HRDD and the process of developing a non-financial report may mutually support and reinforce each other in relation to understanding what is required or expected of business organizations with regard to human rights. Socio-legal reflexive law studies suggest that organizational change turns on learning and reflection, which brings forth insights that may induce organizational change to adapt practices to social expectations. Similarly, organizational studies suggest that non-financial reporting has the potential to drive changed business conduct, but only or mainly when undertaken as an explicit organizational learning strategy. Accounting literature suggests that mandatory disclosure can lead to reporting that does not provide full transparency of organizational practices and their societal impacts. Across their disciplines, these points call for policy makers and regulating authorities to carefully consider appropriate regulatory strategies, when the aim is to comprehensively reduce adverse business impacts on society through non-financial reporting.
The possibility to stimulate respect for human rights through reporting and HRDD creates important opportunities for authorities to promote the CR2R. The UNGPs encourage States to deploy a regulatory ‘smart-mix’ for this purpose. Because legal ex-post accountability is rarely able to fully remedy human rights harm done, a regulatory approach needs to enhance learning within the firm to understand about its adverse human rights impact and manage that impact proactively, so as to avoid and reduce harm. Ex-post transparency remains important to complement ex-ante steps. To be effective, both should be designed to result in responses that resonate with the firm’s logic, either as strategic learning for risk management, or as sanctions that are economically significant, including by affecting the firm’s social license to operate.
The EU’s NFR Directive emphasizes compliance with the disclosure requirement, national law sanctions and assumed economic ‘social-actor’ sanctions. It prioritizes such compliance over measures to ensure organizational change and proactive HRDD. The Directive adopts an ex-post accountability focus, whether accountability is legal or administrative through authorities, or economic through social actors. Sanctions are applied to non-disclosure, not accuracy. The assumption that disclosure-based transparency will generate change through social actors’ sanctions is not supported by the literature or evidence that disclosure allowing stakeholders to understand the societal impacts of companies’ activities results in effective sanctions.
A more sound regulatory approach might clarify the importance of HRDD or management-anchoring of reporting as learning opportunities for firms to reduce not only risks to society but also those to themselves that follow from social sanctions. A smarter ‘smart-mix’ Directive would explicitly require or at least recommend steps to ensure organizational change conducive of proactive impact awareness, for example through a fuller account of operational steps suggested by the UNGPs. It would emphasize the learning aspect of the reporting process through interaction between firms and stakeholders, and it would enlist guidance for firms on what constitutes a comprehensive due diligence process to prevent harm. Such guidance could be developed in collaboration with NGOs and others who have expert knowledge on the impacts that business activities cause on the ground. It would emphasize that due diligence and NFR reporting entail substantive processes targeted primarily to avoid harm, rather than technical compliance with formal requirements.
The EU Directive is scheduled to be reviewed based on a report from the Commission to be submitted in December 2018.Footnote 119 The review means an opportunity for the EU to shift focus from ex-post accountability to ex-ante measures that emphasize corporate change to pre-empt adverse impact through learning and comprehensive due diligence risk management. In preparing for the Directive’s revision, EU law makers, social actors and other stakeholders – including firms, being those who should apply the requirements with a view to generating insights for themselves – would do well to study socio-legal, organizational and accounting literature on processes that induce such learning. That would enable such actors to grasp the complexity and to call on relevant expertise to debate and possibly test options in time to include the most effective measures to stimulate corporate learning in a revised Directive. It would be advisable for the Commission to not only include envisaged key performance indicators with a view to ex-post transparency, but to consider how the collation of information to be disclosed can support organizational change and management processes. Those recommendations apply equally to public regulators elsewhere who may be contemplating mandatory human rights (or general non-financial) reporting with an aim to prevent harm.
Unless regulators approach non-financial reporting not only as disclosure, but also as a modality to stimulate organizational change, a tension will remain for such reporting to generate corporate learning and therefore adequately promote the CRSR. Without a clear focus on the learning and self-regulatory aspect inherent in reporting as process, rather than the information in the published report itself, it is doubtful whether NFR reporting as a business practice and reporting requirements issued by regulators will fulfil the potential as ‘smart’ regulation to adequately stimulate management decisions to reduce adverse impacts. In this light, the EU Directive appears a neglected opportunity to promote the implementation of Pillar Two through activities under Pillar One.
As governments in jurisdictions around the world are contemplating ‘smart-mix’ regulation to translate their State Duty to Protect into enhanced CR2R, they should consider whether and how the EU Directive serves as a model to replicate. The alternative is a risk that companies produce a series of not very informative reports unaccompanied by the intended enhancement of responsible business practices.
