I Introduction
In policy statements and public positions on human rights, multinational corporations have acknowledged a responsibility to do no harm, either in their operations or through their business relationships. A recent study by the law firm of Norton Rose Fulbright found that 50 per cent of surveyed companies had conducted some form of due diligence to evaluate their human rights impacts, 70 per cent of which identified issues with their business relationships. However, when those companies identified issues with business relationships, 77 per cent of the time they attempted to address them solely by changing contractual conditions.Footnote 1
This approach is not in line with the UN Guiding Principles on Business and Human Rights (UNGPs), which requires the direct engagement with affected stakeholders.Footnote 2 Contractual language that aims to increase protection for affected people frequently faces challenges in enforcement, and field-level due diligence often reveals conditions out of alignment with the documents signed. Economic infeasibility,Footnote 3 technical incapacityFootnote 4 and lack of incentive or repercussions are leading reasons why suppliers and other businesses fail to uphold the human rights standards in their contracts.Footnote 5 Financial institutions or large-scale infrastructure contracting entities, for example, lose leverage once a loan is funded or an infrastructure project begins construction.Footnote 6 The World Bank has recently partially internalized this reality by changing its procurement guidelines to permit it to consider factors beyond lowest bid price (such as risk and in-country experience) when awarding contracts.Footnote 7
To ensure that companies are being ‘duly diligent’ in their evaluation of human rights risks, the UNGPs call on them to assess ‘their actual and potential human rights impacts’ as pertinent to the ‘adverse human rights impacts that the business enterprise may cause or contribute to through its own activities, or by which may be directly linked to its operations, products or services by its business relationships’.Footnote 8 HRDD is a broad and ongoing process, and it is expected to be carried out differently by different entities, to address different business enterprises and business relationships.
However, what HRDD really means in practice is complicated. Early in his mandate, the former Special Representative of the Secretary-General on the issue of human rights and transnational corporations and other business enterprises (SRSG) focused on the language of ‘impact assessment’. He did a detailed study of impact assessments in recognition that the ‘societal impacts of business activity are complex. Such impacts can be positive and negative, direct and indirect, singular and cumulative, highly specific to local circumstances, and have multiple interrelated factors.’Footnote 9
It seems, however, that the final text of the UNGPs uses the ‘risk assessment’ language and approach, although reference is made to ‘the business enterprise’s potential adverse human rights impacts’ (emphasis added) in Principle 17 as a term of art. The Commentary on Principle 17 explains: ‘Human rights due diligence can be included within broader enterprise risk management systems.’ Conflating impacts and risks under a single umbrella would resonate with companies operating infrastructure-intensive projects; the World Bank’s private lending arm, the International Finance Corporation, has been linking assessment processes and management systems since at least 2006 in the Performance Standards for Social and Environmental Sustainability.Footnote 10 However, the assessment and management standard is only triggered for large footprint projects. The approach is not common for operations outside of construction, engineering and extractive sectors. For many industries, there is little or no relationship between risk management processes and ground-level assessment of impacts.
The distinction between human rights impact assessment (HRIA) and human rights risk assessment (HRRA) is not currently well defined, but risk assessment and impact assessment have quite distinct histories in corporate decision-making. Corporations view risk assessment as oriented toward negative outcomes as pertinent to management decisions, while they view impact assessment as oriented towards both risks and opportunities associated with operational design and implementation. Risk assessment is a term rooted in enterprise management, rather than operations development. As defined by Dickinson, ‘[e]nterprise risk is the extent to which the outcomes from the corporate strategy of a company may differ from those specified in its corporate objectives, or the extent to which they fail to meet those objectives (using a “downside risk” measure).’Footnote 11 Impact assessment, in contrast, is a tool to establish a strategy. It is a term derived from the environmental movement, and related to the well-established concept of environmental impact assessment (EIA), which is a comprehensive, data-driven analysis. As defined by the UN Environmental Programme, it ‘is a process of evaluating the likely environmental impacts of a proposed project or development, taking into account inter-related socio-economic, cultural and human-health impacts, both beneficial and adverse.’Footnote 12
It appears that the concept of impact assessment was ultimately excluded from the UNGPs, in part because impact assessment methodologies are not applicable to business relationships. Instead, impact assessment methodologies are appropriate for a ‘business activity and its direct impacts’, particularly ‘for projects with a significant physical footprint’. The former SRSG might have employed the ‘risk assessment’ language specifically to ensure that ‘business relationships’, inclusive of the relationships between financial backers and project implementers, were covered under the umbrella of HRDD.
This piece is concerned with HRRA, a specific component of HRDD, particularly as applied to the business relationships of entities removed from field operations (e.g., financial institutions vetting loans, or corporate entities vetting suppliers). To be fit-for-purpose, efficient and streamlined, such HRRA must be designed to be carried out quickly and relatively affordably.Footnote 13 Its findings must be sufficiently pointed so that rapid follow-up and remediation is triggered.2 Yet it must also incorporate the contextual analysis that characterizes impact assessment.
At present, it is unclear what HRRA looks like when implemented. Companies do not publish their risk assessments and management processes. Sometimes they report that processes exist, and some corporate social responsibility reports describe a small number of interventions tackling single human rights issues, yet neither of these limited disclosures clarify whether companies recognize the interconnections among human rights risks or the approaches needed to manage them holistically.Footnote 14
To address this gap and to determine whether targeted HRRA can add value, NomoGaia conducted pilot HRRA on business relationships. The first case study considered the relationship between a lender and a borrower in the form of a World Bank loan to a gas-fired power plant in Myanmar (Burma). The second case study considered the relationship between a parent company and a subsidiary supplier in the form of the acquisition by Kuala Lumpur Kepong Berhad (KLK) of Equatorial Palm Oil’s Palm Bay palm oil plantation in Liberia. This piece first explains the methodology used and then describes the findings and outcomes of the two case studies. It concludes by considering the successes and limitations of the approach used to propose next steps for HRRA and the advancement of HRDD more generally.
II Methodology
NomoGaia personnel employed a HRRA methodology developed by NomoGaia on two operations. The NomoGaia methodology is available in full online,Footnote 15 but can be summarized as a four-phase approach to assessment – scoping, data accrual, analysis and iterative finalization (see Fig. 1) – which culminates in a risk matrix linked to actionable mitigation, management and monitoring items.
Figure 1 Phases of human rights risk assessment (HRRA)
Scoping involves defining the geographical and human boundaries of investigation and carrying out an initial categorization of rights holders. Data gathering involves a blend of literature review and a brief fieldwork (3–5 days). Literature review covers basic contextual conditions (e.g., socio-economic, political, labour and health-related), contractual terms between the operation and the relevant ‘business relationship’, and actual project descriptions, such as existing EIAs. Fieldwork involves interviews with stakeholders, affected people (‘rights holders’) and company personnel, as well as direct observation of conditions on the ground. Risk analysis entails the implementation of a conventional risk matrix evaluating the likelihood of a risk occurring and the severity of the impact associated with the risk. Finalization is the process of prioritizing action items to prevent or remedy identified risks and adverse impacts.
The case studies presented here were selected through a screening process that aimed to identify high-risk contexts where operations subject to high social and environmental standards were planned or ongoing. Our work was not paid or commissioned by the operations, which is unique for HRRA but, at present, necessary to be fully transparent.
For this piece, we considered high-risk contexts as conditioned on being: (i) recently post-conflict, and (ii) characterized by a recent influx of foreign direct investment (FDI) that was substantial enough to affect the general national economy. A beta-version risk screening tool made available in open source by NomoGaia was used to determine human rights risks as indicated by 13 leading indices tracking civil/political, social/cultural, labour, corruption, security and economic rights.Footnote 16
We defined operations subject to high social and environmental standards as being those with: (i) internal company standards that include environmental and social due diligence, and (ii) membership in certification bodies or adherence to sustainability standards.
The projects evaluated were from the financial and food and beverage sectors. In the financial sector, we selected a World Bank loan in Myanmar. The investment was a refurbishment of the Thaton Power Plant, which was already connected to Myanmar’s existing electric grid. The World Bank operates according to its Environmental and Social Safeguards, a framework for lending that mandates attention to an array of risks to affected communities. In the food and beverage sector, we selected a KLK palm oil plantation in Liberia. The Palm Bay Estate, a plantation abandoned during the civil wars, was being re-established by a small UK company, Equatorial Palm Oil (EPO), under a continuation of the pre-war (1960s) concession agreement with the government. KLK had recently procured control of EPO. EPO is subject to KLK’s social and environmental policies, as well as the standards set by the Roundtable on Sustainable Palm Oil (RSPO), of which EPO has been a member since 2007 and KLK since 2004.
Each operation involved no more than two field visits. The first visit to Liberia enabled the authors to scope the project to ensure its feasibility (not too big) and legitimacy (not fabricated complaints). Actual risk assessment was conducted on the second visit. The Myanmar assessment only necessitated one site visit, although extra days were built in for scoping (7 days in total). Risk assessment in both cases involved meetings and interviews with between 40 and 60 individuals, including company personnel, government personnel, civil society groups, employees, community members and inclusion of men, women and a broad age range. Group sessions and interviews complemented a review of national, local, international and company literature regarding contextual conditions and operations plans.
Assessments were presented directly to the World Bank and KLK, as the parties with the most effective leverage over the operations under assessment. The World Bank and KLK were given an opportunity to provide feedback before assessments were made publicly available. The Myanmar HRRA (concerning the World Bank) was completed in July 2014, and the Liberia HRRA (concerning KLK) was completed in October 2016.
III Findings: What Human Rights Risk Assessment Revealed
Both assessments exposed gaps in human rights risk management regarding business relationships.
At the World Bank-funded Thaton Power Plant in Myanmar, despite the existence of strong social and economic safeguards mandating broad engagement with surrounding populations and thorough EIA, no actual engagement was conducted in the locally dominant Karen language. The electric grid was not considered for modification, although (Burmese-speaking) stakeholders engaged during the social impact assessment voiced concerns that they would receive no benefits from the power plant upgrade, while continuing to be affected by its presence. The grid had been designed specifically to benefit military installations and crony business. There was no electrification of the communities surrounding the power plant. There had also been no record of evaluation of downstream impacts on farmers who would be affected by construction on a historically polluted site. In the fifty years since the power plant had been established, chemical storage had been inadequate, as documented in photos taken by the EIA team. Fuel and chemical leaks were visible around the property.
At KLK’s investment in Liberia, an array of pro-human rights policies and commitments ranging from housing quality, to working conditions, to dependent care to human rights were in place. Additionally, the operation was a member of the RSPO and thus held to RSPO standards. Our research found that, on several counts, the operation was meeting neither KLK standards nor human rights standards as laid out in the International Bill of Human Rights or the International Labour Organization (ILO) Core Conventions. Boreholes used for drinking water in several locations were found to be non-functioning. At one camp, assessors observed no water source at all. Latrines were absent or poorly maintained at camp and in the field. Protective gear was not in use for workers spraying hazardous chemicals – the company could not supply purchase logs of protective gear to demonstrate that such gear was available. Child labour, not confirmed by assessors, was repeatedly alleged by workers and community members. Additionally, a successful RSPO complaint in 2015 against the company’s land use practices identified problems in the concession agreement, which did not recognize local landholding or land usage. This resulted in conflict with some local populations who opposed the plantation’s expansion into land they considered rightfully their own.
IV Outcomes: What was Done About Business Relationships
Risk assessments in general, and HRRAs in particular, are not often public documents. On the rare (and laudable) occasions that companies report on the risks they have identified, it is often in tandem with management strategies on how they are addressing those risks. The World Bank and KLK were informed about field visits and report publication in advance and were provided access to advance versions to provide input. However, there is no monitoring phase for risk assessment. As such, assessors have not returned to either location to track improvements in human rights risk management. Nevertheless, both the World Bank and KLK (through its subsidiary, EPO) have been responsive to the findings of the risk assessment.
In Myanmar, the World Bank put out a tender for an Environmental and Social Monitoring consultant and committed to detailed environmental monitoring. In the ensuing months, further engagement (in Burmese language) and field validation of general findings was carried out by World Bank consultants. In direct response to local concerns that the power plant would continue to generate benefits only for the country’s elite, the operation supplied power lines directly into surrounding communities (although only along roadsides, where the wealthiest and most integrated live). Perhaps more importantly, in recognition of the history of conflict associated with the existing power plant, and the extreme disempowerment of surrounding communities, the World Bank pushed for consideration of the Thaton population in Myanmar’s nation-wide National Electrification Plan. The HRRA remains part of the permanent file on the Thaton plant and electrification plans generally, and it was recently reviewed by World Bank social specialists (three years after its publication) charged with the regional development portfolio. To improve engagement with affected communities, a range of strategies are now under consideration at the World Bank.
In Liberia, KLK and its subsidiary have had a shorter timeline for response but have already made efforts to validate the findings of the HRRA and investigate further. KLK procured the Palm Bay Estate through the majority acquisition of EPO shares. Liberia is recognized as having an ideal climate for palm oil, as well as a low-wage workforce with high unemployment and thus competition for unskilled jobs. These conditions are often considered advantageous for companies looking to expand operations, but they are not without complications. The HRRA revealed to KLK that many of the workplace conditions that are normal on KLK plantations in Malaysia would require costly inputs to achieve in Liberia. KLK learned that housing was inadequate, sanitation was not readily available, adequate wages were not being paid to sub-contracted workers, and protective gear was not being allocated sufficiently. The company, through its subsidiary (EPO), committed to investigate the potential of child labour and has indicated that there are plans to improve worker housing. In February 2017, EPO selected a consultant to conduct an HRIA on its Palm Bay Estate, who began fieldwork in June 2017. The HRRA authors were invited to collaborate and provide feedback on preliminary findings in September 2017. HRIA validated findings from HRRA and identified additional human rights challenges on site. The company has started developing a management plan to address identified adverse impacts. This may be the first instance of HRDD at the business relationship level being complemented by HRDD at the operations level.Footnote 17
HRIA benefits from being conducted in collaboration with operations-level personnel in an ongoing manner for tracking impacts over time. It is internally driven by the exigencies of managers and personnel who interact on a daily basis with impacted rights holders (in the workforce and communities). However, HRIA is vulnerable to manipulation if headquarters is not receptive to findings that would necessitate increased expenditure or modified design components. HRRA, in contrast, benefits from being conducted by a neutral third party which has no vested interest in maintaining a status quo that generates business and human rights risks. Its external nature makes it less susceptible to the biases of company personnel wishing to demonstrate only the positive dimensions of an operation. It also supplies external pressure to an entity that might otherwise resist change, using the leverage of severed contracts or denied loans.
The speed with which an HRRA can be conducted and published gives it a clear advantage over more in-depth due diligence processes, such as HRIA. The Global Compact Network of Germany has recently published findings from the HRDD processes of five companies, which repeatedly identified the time- and cost-constraints of HRIA as a barrier to implementation.Footnote 18 These company reactions mirror previous findings about HRIA.Footnote 19 In contrast, a single 3–5 day site visit for HRRA enables assessors to glean key information to identify risks, which can be used by companies to evaluate the adequacy of their own management policies and processes for identifying and addressing human rights risks. As a mechanism for both pinpointing problematic conditions and for alleviating concerns about past complaints, it is low-cost and efficient.
While checklists and audits are certainly quicker, they lack the essential human rights lens that pinpoints issues not often predicted by pre-written checklists.Footnote 20 Additionally, HRRAs allow the flexibility to go beyond the pre-scripted audits that have systematically failed to identify human rights shortcomings,14 including the recent revelations of Syrian children sewing garments for certain UK brands.Footnote 21 The field component of HRRA builds on human rights engagement methodologies, including semi-structured interviews with vulnerable populations, gaining perspectives that are not often shared by workers on the factory floor or community members in a company meeting. Thus, HRRA can be regarded a useful middle ground between HRIA and audits to manage risks arising through business relationships.
V Next Steps
Further research is needed to explore where commonalities can be built across the HRRA process, as well as through the broader HRDD processes. Companies have been developing screening processes to identify high-risk relationships (see, e.g., Coca-Cola, Unilever and BlackRock).Footnote 22 It makes sense for them to also systematize the way they engage with those high-risk relationships once those relationships have been identified. HRRA can never be a one-size-fits-all approach: identifying and categorizing risks will always hinge on contextual peculiarities, rights-holder engagement will always require tailoring, and the availability of data will always be a limiting factor on understanding risks. The availability of data is particularly pertinent in a corporate climate where HRIA conducted for, and implemented by, operators remain rare. The third-party entities lending to or procuring from rights-risky operations cannot monitor conditions on the ground and remain reliant, to an extent, on the good faith representations of the operations with which they work. HRRA conducted by third parties associated with operations through business relationships are likely to be most effective when conducted alongside HRIA commissioned by the operating entity itself. To date, there are perhaps no public examples of such a complete due diligence chain.
