II. Human Rights Due Diligence and Risk Management

In the preparatory work for the UNGPs, business-related human rights issues were regularly expressed in terms of risk and risk management.Footnote ⁹ Risk management was viewed as the ‘foundation’ of corporate responsibility and access to effective remedy.Footnote ¹⁰ Therefore, the human rights due diligence standard of the UNGPs is at least not primarily to be understood as a liability standard that exerts a certain standard of care, against which a business enterprise’s actions are judged in order to attribute ex-post responsibility. Human rights due diligence under the UNGPs consists of a managerial process that is to operate as a prophylactic measure, whereby the term ‘responsibility’ is forward-looking. John Ruggie is quite clear on this point when he explains that the UNGPs preferred a prevention-orientated ‘risk management’ approach over the ‘enterprise liability model’.Footnote ¹¹ The UNGPs due diligence requirement, despite its voluntary nature, could be associated with enhanced risk-based approaches to regulation that provide for mandatory obligations of companies to implement risk management processes.Footnote ¹² Such risk-based regulatory approaches seek to leverage on a regulated entity’s internal control processes and governance systems for solving public interest problems.Footnote ¹³ With regard to norm design, the UNGPs due diligence provisions resemble international standards that stipulate holistic approaches to risk management, notably the standards put forward by the International Standards Organization (ISO) and the Committee of Sponsoring Organizations of the Treadway Commission.

The ISO defines ‘risk’ in risk management processes as the ‘effect of uncertainty on objectives’, where ‘uncertainty’ is understood as a ‘state, even partial, of deficiency of information related to a future event, consequence or likelihood’.Footnote ¹⁴ While this risk definition might raise questions,Footnote ¹⁵ it does make clear that risk management essentially provides a system that establishes a relevant knowledge base for managers who are held to make informed decisions in the interest of the organization they are serving. Just as risk management techniques are designed to increase knowledge about risk so that the managers of an organization can better pursue its objectives in the light of this knowledge, human rights due diligence is designed to increase knowledge about human rights violations so that managers better know how to prevent and mitigate them.Footnote ¹⁶

Human rights due diligence, as it is set out under UNGP 17, was modelled on existing practices by which companies manage risk, in particular with regard to social and environmental issues.Footnote ¹⁷ The parallels between human rights due diligence and ERM become conspicuous, if you compare the constituent elements of human rights due diligence with renowned ERM frameworks. UNGP 17 names the four elements that constitute ‘human rights due diligence’: (a) assessing actual and potential human rights impacts, (b) integrating and acting upon the findings, (c) tracking responses, and (d) communicating how impacts are addressed. Each of these steps could be matched up with one of the elements of the COSO ERM framework that is comprised of ‘event identification, risk assessment and response, control activities, information and communication and monitoring’.Footnote ¹⁸

Risk management frameworks that deal with social and environmental risks are also like human rights due diligence in the sense that both must employ risk management methods other than conventional ones to be effective. Risks stemming from social concerns often arise in complex and, at times, unpredictable environments, possibly resulting in unforeseeable consequences. Conventional risk management methods that are employed for dealing with known probabilities of frequently occurring events are generally inadequate in this respect.Footnote ¹⁹ With regard to social risks, a business corporation is well advised to use enhanced, qualitative analytical risk management tools such as ‘scenario planning’, ‘trial and error learning’ and ‘selectionism’ that address rare, unforeseeable or complex events.Footnote ²⁰ In these contexts stakeholder engagement could play a central role. ‘Stakeholder engagement’ can be considered to be a risk management technique or at least supportive of risk management insofar as communication and dialogue with stakeholders increases relevant knowledge about stakeholders, making their behaviour more predictable, or enabling the corporation to better influence them, both of which would reduce uncertainties that give rise to stakeholder-related risk.Footnote ²¹ The UNGPs, likewise, do not consider conventional risk management techniques to be sufficient for carrying out human rights due diligence. UNGP 18 states that meaningful consultation with affected people and other stakeholders is necessary for human rights risk assessment. Ruggie points out that the integration of human rights risk management would necessitate ‘an inherently dialogical process that involves engagement and communication, not simply calculating probabilities’.Footnote ²²

These parallels between human rights due diligence and social risk management (in so far as the latter is enhanced by techniques that more appropriately deal with social concerns) point to the conclusion that human rights due diligence pursuant to UNGPs 17–19 could be essentially viewed as a risk management framework. However, its integration into an ERM system, whose principal purpose is to address a business corporation’s vulnerabilities, faces a set of difficulties that will be specified in the following sections.

III. Human Rights Risk Unlike Social Risk

While risk management uses positive techniques, it is not normatively neutral.Footnote ²³ Risks emerging from complex human activity give rise to social expectations of risk managementFootnote ²⁴ that influence the decision, which risk to manage and how to delineate it. The definition of risk implies a host of moral choices and policy priorities that encode the process and affect the decisions that that process will recommend.

‘Social risk’, defined here as the actual and potential leverage that people or groups of people with a negative perception of corporate activity have on the business’s (financial) value, is a determinant of risk exposures for the business corporation.Footnote ²⁵ The normative justification for social risk management, thus understood, is that managers fulfil responsibilities that they owe to the stakeholders that have a legitimate interest in the perenniality and profitability of the business corporation. Business management has since long acknowledged the importance of managing social risk. This is particularly true for the extractive sector, in which activities tend to take a heavy toll on communities located in the vicinity of the business’s operations. Social risk management’s objective in such cases is to secure the acceptance or approval by local communities and stakeholders of a business enterprise’s operations or projects in a certain area. In practice, businesses claim to have obtained a ‘social license to operate’ (SLO) to indicate that their activities are considered as legitimate in the eyes of society.Footnote ²⁶ The purpose of managing social risk is to facilitate business activity, in particular when and where it could be perceived as socially contentious.

While the UNGPs have been drawn up against the backdrop of corporate risk management practice, the corporate responsibility to respect human rights has a different normative trajectory than mandating social risk management. The relevant risk for fulfilling corporate responsibilities under the UNGPs is ‘human rights risk’, which is defined as a business enterprise’s potential adverse human rights impacts. Since an ‘adverse human rights impact’ occurs when an action removes or reduces the ability of an individual to enjoy his or her human rights,Footnote ²⁷ the assessment of human rights risk not only requires analyzing potential harm, but also makes necessary a normative judgment whether such harm qualifies as a human rights violation. Human rights risk therefore determines normatively qualified exposures for people who do not necessarily have any stake in the business. The raison d’être of human rights risk management is not to fulfil responsibilities owed to persons who have an interest in the corporation’s success, but to meet responsibilities owed to people, whose human rights could become exposed due to or in the context of a business corporation’s activities.

That the conceptual differences between social risk and human rights risk have strategic and operational implications for managers, who have to assess and judge issues on the ground, will be demonstrated in the following sections.

IV. The Problem of Policy Integration

As mentioned, ERM frameworks help an organization integrate fundamental policies throughout all of that organization’s operational functions. The International Organization for Standardization recommends integrating the risk management process into an organization’s overall governance, strategy and planning, management, reporting processes, policies, values and culture.Footnote ²⁸ Under an ERM approach, the function of risk management is not only to create a common risk terminology throughout the organization, but also to support organizational objectives that are determined by organizational culture and values.Footnote ²⁹

The implementation of human rights due diligence through a comprehensive ERM system offers an appealing prospect: ERM could become instrumental for making human rights respect a routine managerial process that permeates the entire organization. An ERM system, which requires an internal environment that is conducive to better enterprise risk management, could principally include the adoption of a dedicated human rights policy, provided, however, that such policy becomes ingrained in the organization’s ultimate objectives. This is a consequence of the ERM’s general purpose, which is to provide a coherent and comprehensive system of risk management that is informed by the business’s goals and strategy.Footnote ³⁰ The promise of regulating corporate behaviour by asking businesses to implement risk management processes lies precisely in leveraging managerial routines that are compatible with a business corporation’s strategy to achieve desired prophylactic effects.Footnote ³¹ Now, nothing in an ERM framework prevents an organization from paying adequate respect to human rights even if this does not create value. In the specific case of a business corporation, however, this would mean that its supposed value maximization objective would become subject to the condition of adequate human rights respect, possibly as a ‘necessary cost of doing business’.Footnote ³² In theory, business managers could establish human rights respect as a corporate goal and determinant of corporate strategy beyond regarding human rights respect as a mere operational issue.Footnote ³³

Consider a construction company that seeks to establish a branch office in a target country, because the company sees great potential to develop its business there, and suppose that the application of the target country’s laws effectively result in a denial of freedom of association. If human rights respect were treated as an operational issue only, the human rights issue would be addressed once the branch is operating and the contradictions between compliance with local laws and human rights respect practically surface. Treated as a strategic issue, the company would query the human rights situation of the target country prior to the investment decision and could come to the conclusion that the unavoidable conflict between human rights respect and local law would weigh heavily against the otherwise lucrative investment. By contrast, if human rights respect was viewed through the lens of social risk only, the company would hardly reconsider its decision to invest in the target country, as long as the absence of effective freedom of association does not endanger the company’s assets or reputation.

The question whether or not human rights respect should become a strategic consideration for a business corporation is circumvented by the popular notion that there would be a ‘business case for respecting human rights’, meaning that managing human rights risk would eventually and systematically lead to a better management of social risks.Footnote ³⁴ If this was true, there would be no need to have human rights issues determine corporate strategy, because respecting human rights would already be instrumental to achieving a corporation’s value maximization objectives. The ‘business case for human rights respect’ is predicated on the premise that a corporation’s strategic interests with regard to maximizing value and the interest of the rights-holder not to have human rights violated would, at least in the long term, be largely aligned. Some organizations and authors have expressed a fair amount of optimism in this respect. The Institute for Human Rights and Business (IHRB) conducted interviews with several business managers and found that most of them understood that while traditional business risk approaches were not adequate in understanding the risks the most vulnerable people face, they believed that in the ‘medium’ or ‘long-term’ business risks and human rights risks would converge.Footnote ³⁵ We find similar expectations expressed in some human rights recommendations for businesses.Footnote ³⁶ The Human Rights Reporting and Assurance Frameworks Initiative (RAFI) states that human rights respect would improve a business corporation’s risk management ‘with less chance of business disruptions, public campaigns and criticism, litigation, reputational harm, and harm to employee retention and recruitment’.Footnote ³⁷ In their ‘sustainable approach’ to risk management, Spedding and Rose argue that managing human rights risk reduces a business’s value at risk.Footnote ³⁸ Taylor et al contend that human rights due diligence could result in lower costs and higher profits for the corporation.Footnote ³⁹ These views are seconded by the view that the integration of human rights due diligence into risk management processes could bring to the surface hidden costs to the business by introducing new forms of gaining knowledge and assessing risk, such as dialogue with local communities, and cooperation with NGOs.Footnote ⁴⁰ Business for Social Responsibility (BSR) contends that there is actually ‘increasing evidence that risks to human rights frequently converge with risks to business’ and that ‘where the most severe human rights impacts are concerned, this convergence is particularly strong’.Footnote ⁴¹

Strikingly, none of the abovementioned positions provide, or are built on, evidence that would reliably confirm their hypothesis that a business’s social risk and human rights risk tend to converge in the long run. To date, the evidence that negative human rights impacts regularly affect firm value negatively is in fact quite thin, and where there is some evidence, it is at most indirect.Footnote ⁴² For example, when Davis and Franks exemplify ‘social costs’ for extractive industries in terms of lost productivity due to temporary shutdowns or delay, presenting a list of 33 different types of cost, they do not measure the costs that a human rights violation would generate for a business corporation, but rather the financial consequences of a business’s conflict with local communities.Footnote ⁴³ Follow-up research would have to prove the linearity between such ‘costs of conflict’ and costs that human rights violations represent to the business. While it is entirely plausible that business-related human rights violations could eventually result in losses for a business corporation, the contrary view, namely that a lucrative business opportunity or the effective prevention of financial harm to the business, even in the long term, comes at the cost of tolerating or contributing to human rights abuse, does not appear implausible.Footnote ⁴⁴

For the moment, talking about how human rights violations may result in losses to the business, or insisting that human rights due diligence could effectively reduce a business corporation’s operational risk,Footnote ⁴⁵ could be considered in some cases to be a supporting argument to persuade business managers to adopt human rights due diligence routines, rather than an accurate representation of the current level of empirical evidence.Footnote ⁴⁶ While evoking the business case as a supportive argument might be a pragmatic way to convince business managers to actually implement the UNGPs, it tends to evade potential conflicts, even long-term, between corporate value-maximization objectives and human rights respect.Footnote ⁴⁷

Without addressing these conflicts on a business corporation’s highest strategic level, ERM frameworks can hardly integrate the management of risks for rights-holders and the management of social risks to the business in a coherent system, as will be shown in the following sections.

V. Risk Identification: Relevant Knowledge

The definition of risk has consequences for the entire risk management process. Risk and the ‘exposures’ that are at peril are determined in the light of a clearly defined set of objectives.Footnote ⁴⁸ Therefore, the decision as to which objective to pursue determines the concrete issues on which an organization will focus its risk management efforts. In other words, only knowledge deficiencies pertaining to future events, consequences or likelihoods that may impinge upon organizational objectives become relevant for the risk identification process.

The integration of a human rights impact assessment into a risk management system that aims at a business corporation’s value maximization would assume that adverse human rights impacts could become causal drivers or are in some way correlated to losses that result in risk costs for the business. This assumption is problematic in two respects. First, as mentioned, in order to observe adverse human rights impacts, not only must one investigate facts, but also qualify these facts normatively. While the facts underlying the normative assessment could become causal for financial loss, not so the assessment itself. For example, where a company’s actions prompt social unrest, in the absence of court proceedings, the potential financial losses for a company do not depend on the question whether or not the company’s actions amounted to a human rights violation. The social unrest’s factual consequences are all that count.Footnote ⁴⁹ Second, facts that underlie a business enterprise’s adverse human rights impacts represent, at most, an indirect cause for losses. The direct causes of losses to firm value—and consequently the sources of uncertainty most relevant to a business corporation’s risk management system—are the potential reactions or resistance from people, groups or organizations against the corporation’s operations.Footnote ⁵⁰ Only to the extent that the normative conclusions of such persons (that corporate behaviour would have an adverse human rights impact) add to the intensity of negative response, will it be taken into account by a business corporation’s social risk management. If a business corporation seeks to optimize its social risk management processes, it will largely confine itself to understanding the immediate social context of its operations and reduce uncertainties related to direct causes for losses. To this end, social risk management will concentrate its efforts on eliminating deficiencies of knowledge about such persons or groups of persons, upon whom the success of a business operation concretely depends (these persons will in the following be referred to as ‘stakeholders’Footnote ⁵¹ ). Business corporations have an interest in engaging with stakeholders in order to gain knowledge about their behavioural patterns so that their reactions may be better predicted. Yet business corporations will not necessarily engage with rights-holders, i.e., people who might become victims of a business-related human rights violation. Instead, they will try to identify when and which stakeholders have leverage to effectively impose social sanctions upon a business enterprise’s actions that they do not approve of (social sanction would include taking legal action). As a result, social risk management is principally concerned with the effective management of power relations with stakeholders. The more influential the stakeholder, the more corporate risk management will prioritize engagement with that stakeholder. Rights-holders’ interests will be sufficiently addressed only to the extent they have leverage over the business (for example through effective access to justice and available legal remedies), are sufficiently represented through influential stakeholders, or, with the help of such stakeholders, can effectively pressure business corporations into taking their concerns into account. To the extent that human rights respect is not an effective factor of corporate strategy, business corporations tend to discount information about vulnerable, unrepresented rights-holders who have no leverage over the business—in other words, those who are probably in most need of human rights protection.Footnote ⁵² Such an outcome would run contrary to the aims of the UNGPs, pursuant to which, as John Ruggie writes, human rights due diligence must ‘meaningfully engage rights-holders or others who legitimately represent them’, meaning independently of a rights-holder’s leverage over the business’s success or failure.Footnote ⁵³

By contrast, if human rights due diligence was not exercised as social risk management, ‘loss’ would not be defined in terms of a corporation’s loss of value, but instead be equivalent to ‘adverse human rights impact’. Consequently, ‘risk’ would stem from the deficient knowledge about a business’s potential negative impact on human rights. The knowledge deficiencies requiring attention would relate to circumstances leading to adverse human rights impacts. In this case, risk management does not assess stakeholder reactions to business activity as causal drivers, but rather it seeks to obtain knowledge about the effects of the business corporation’s activities on rights-holders, normatively assessing such effects. The prioritization of risks to be identified would not occur according to a stakeholder’s potential leverage over the business, but according to the severity of the potential harm inflicted upon rights-holders.Footnote ⁵⁴

To conclude, the information required by human rights due diligence to reduce and manage knowledge deficiencies differs in content and nature from information that is relevant for a business corporation’s social risk management.

VI. Risk Assessment: The Problem of Measure and Commensurability

Under any risk management framework managers are expected to be able to quantify risk, since the mode of rational decision-making in risk management is one that is based upon the assessment of operational indicators.Footnote ⁵⁵ This does not mean that qualitative assessments are ignored by risk management, but it presupposes that qualitative assessments can in some manner translate into quantifiable terms so that managers can compare alternative courses of action using a single measure. Therefore, by adopting a risk management approach to corporate responsibility, the UNGPs imply that ‘adverse human rights impacts’ can in fact be measured. This premise alone is challenging, because convincing methodologies for measuring ‘adverse human rights impact’ have yet to be developed or disclosed.Footnote ⁵⁶ Indicators for gauging human rights risk should not be confused with benchmarks that seek to exhibit so-called ‘human rights performance’. The latter are established in order to help third parties (for example investors that take social, environmental and governance concerns into account when making investment decisions) evaluate an organization’s efforts regarding human rights issues, and not to measure human rights risk. For example, the ‘Corporate Human Rights Benchmark’ (CHRB) falls into this category of ‘measure’.Footnote ⁵⁷ Such benchmarks could provide additional motivations or pressures for business corporations to implement the UNGPs’ human rights respect, but they do not provide assistance to managers to actually evaluate human rights risk.

The interpretative guide to the UNGPs provides essential criteria with regard to developing a measure for human rights risk: First, any such measure should not be a mere function of probability and severity but emphasize the latter.Footnote ⁵⁸ Second, the measure would have to take into account the necessary normative assessment regarding a corporation’s actions and links to a human rights violation because, unlike tornadoes and earthquakes, human right violations are acts or omissions for which ultimately some persons may be held responsible based on a normative judgment of their behaviour. The framework for normatively assessing the link between business operations and human rights violations is set out under UNGP 19(b), which differentiates between causation, contribution and direct links. The interpretation and translation of these terms into quantifiable parameters useful for risk management purposes is the implicit task that the UNGPs have assigned to future applied academic researchers. To illustrate the point, if a business corporation is granted a concession to exploit a gas field under the condition that it enters into a joint venture with a government that continuously perpetrates severe human rights violations, there is no uncertainty about the corporation’s business operations being linked with a government that neither respects nor protects human rights. The relevant question for gauging human rights risk in such a case is whether the corporation’s involvement with the regime, after analysis of the involvement’s nature, effects and intensity, entails an adverse impact that is related to the business’s operations. In this example, it becomes clear that analyzing uncertainties related to the effects of corporate behaviour is only part of the human rights risk assessment. The other part consists in normatively evaluating the link between the corporation’s activity and human rights violations according to UNGP 19(b).

Even if there were methods of adequately measuring ‘adverse human rights impact’ in the form of operational indicators, the integration of human rights due diligence into a comprehensive corporate risk management system would have to deal with the ensuing issue of what a certain level of human rights risk would mean for the business corporation and consequently for managerial decision-making. For example, how does a manager decide to carry out a project that receives a poor human rights risk ‘score’, if the project ‘scores’ very well on other corporate objectives such as profitability or market share, or if the project is essential to avert a massive loss of business and resulting lay-offs?

Comprehensive risk management systems such as ERM are supposed to provide a structure that combines all risk management activities into one integrated framework that accounts for interdependencies between various corporate objectives,Footnote ⁵⁹ and in doing so, this structure must consolidate multiple measures of risk into a coherent system that enables rational decision-making. As mentioned, the method of rational decision-making in risk management is based on assessing quantifiable indicators. In order to measure losses, risk managers must analyze the probability of peril to an exposed resource, and finally assess the expected severity of such peril to the organization’s objectives. Such a method presupposes that all risks relevant to an organization’s objectives and strategy can be ultimately rendered in strongly commensurate terms.Footnote ⁶⁰ For example, if a business corporation ultimately pursues a single objective of maximizing value, the common risk measure must consequently be ‘value at risk’. An example for a human rights risk assessment that operates in this sense is offered by Spedding and Rose.Footnote ⁶¹ They break down various non-financial risks (including risks stemming from human rights issues) into estimations of ‘risk to market value’ that are based on research and analysis of publicly accessible records. They estimate ‘human rights risk outside the workplace’ at an average of 0.3 per cent of risk to market value, and human rights risks inside the workplace at 0.7 per cent of risk to market value, their sample being the top 500 US and EU companies. They assert that good risk management techniques have reduced risk exposure to 0.4 per cent of risk to market value (concerning external human rights risks) and 1.1 per cent of risk to market value (concerning internal human rights risks).Footnote ⁶² Such a risk assessment is appropriate for what this article refers to as management social risk, but not to the assessment of human rights risk. Indeed, the only conceivable way to make a human rights score commensurable with other risk assessments under a ‘value at risk’ yardstick is to contemplate human rights risk as equivalent to social risk to the business corporation—which, as has been argued above, is not what the UNGPs aim for.

Once again, the only way to overcome this difficulty is for a business corporation to elevate human rights respect to a strategy-determining corporate objective, where exposure of rights-holders to business-related human rights risk would be considered not only to affect vulnerabilities but to generate corporate vulnerability. However, if this was effectively achieved, a further measurement problem would occur, because ERM or other comprehensive risk management frameworks do not provide any guidance on how to deal with risks that impinge on corporate objectives and underlying values that cannot be expressed in strongly commensurable terms. ERM, as comprehensive as the system may be, faces limits as a rational decision-making method once an organization pursues more than a single ultimate objective. While ERM may work well for single-objective organizations, as business corporations are presumed to be, ERM has weaknesses when it is implemented by other types of organizations or government institutions that typically have to deal with a number of potentially conflicting finalities.Footnote ⁶³

If a business corporation treated human rights risk as a primary risk, meaning that adequate human rights respect would become an ultimate objective for the corporate risk management system and not only a driver that influences other objectives, the current architecture of ERM would only provide partial guidance for decision-making. It would need to be enhanced by a normative decision-making method that makes it possible to judge priorities when various risk management processes recommend courses of actions that are in conflict with each other. Managers would need to know how to resolve conflicts between practically incommensurable values. Instead of ultimately subjecting one objective to the other in order to make objectives commensurable (as in the case of ERM), managers would need to be able to render each corporate objective as effective as possible depending on the concrete situation, for example, by applying proportionality reasoning. For example, where a corporate decision entailed a human rights risk that scored so badly that it was deemed unacceptable, it could not be outweighed by any financial value consideration. However, the more remote or less severe human rights risks become, the more financial value is allowed to play a role. To illustrate this point, consider the following case:

Take a construction company that has secured a contract to build a tunnel. It will, among other things, conduct risk management with the objective of reducing the risk of accidents to construction workers during the construction phase, but it will also control its budget to ensure that performing the contract remains profitable to the company. It may turn out that the implementation of a recommended safety risk reduction measure produces costs that the company had not projected when it submitted its bid. In this situation, the company could forego the recommendable safety measure in order to maintain the profitability of the project. Alternatively, it could try to renegotiate the terms of the contract (if possible) or acknowledge the projection error, put up with the increased project costs and learn how to make better risk assessments before submitting contract bids in the future. A corporation that applied value considerations as its sole risk measure would determine the choice between ‘cutting corners’ on safety, renegotiating, or accepting a loss on the basis of an additional assessment of risk-related costs. One can imagine risk managers calculating the costs to the corporation of the possible consequences of endangering the safety of its employees, and comparing these costs to those incurred by implementing proper safety measures or renegotiating the terms of the contract. Decisions to act would be made on the basis of such cost optimization. This approach would be comparable to the social risk management model discussed above. However, it is also conceivable for a corporation to attribute intrinsic value to the ‘safety of the worker’, meaning that worker safety would determine the limits of maximizing value. In such a case, risk management frameworks that require a common measure of value could no longer propose a single correct course of action, but could only recommend alternatives to choose from. Once the risk assessments had been made, decision-makers would need to arbitrate conflicts between norms that realize corporate strategy. Going back to the above example, managers would need to decide how to dissolve the conflict between two norms: ‘the company ought to provide safety for its workers’ and ‘the company ought to maximize its value’. In such cases managers are hardly able to justify decisions in favour of safety at any cost, but—if the corporation intrinsically values worker safety—they cannot justify a decision that foregoes worker safety just because the cost of preventing accidents and related opportunity costs weigh too heavily. The challenge for the manager here would be to identify the course of action that, in the concrete situation, optimizes the effectiveness of each value that is in conflict with the other. Such a decision can only be made if the normative precepts that the corporation claims as part of its strategy are sufficiently clear. One possible outcome of the above example could be the following: managers will not make decisions that subject workers to illegal safety conditions and not accept any measures that, despite being legally compliant, pose intolerable threats to worker safety on the ground—no matter what the cost. However, the more tolerable worker safety risks become, the more the cost of prevention is allowed to become a decisive factor for determining the right course of action.

VII. Assessment of Human Rights Impacts Calls for Different Risk Reduction Measures

UNGP 19 suggests that human rights risk should be prevented or mitigated by taking appropriate action, which, depending on the corporation’s involvement, ranges from taking the necessary steps to cease or prevent the adverse human right impact to increasing the corporation’s leverage over problematic business partners or terminating business relationships with them. If human rights were managed as social risk to the corporation, risk reduction measures would not be congruent with the prevention and mitigation of human rights risk according to UNGP 19, as will be explained below.

Generally, risk reduction measures aim to reduce or eliminate the effect of uncertainty on objectives.Footnote ⁶⁴ However, preventing or mitigating an adverse human rights impact often has nothing to do with reducing uncertainties that threaten corporate objectives. To illustrate this, if the perpetrator is a business corporation—let us say it systematically discriminates against female employees—the violation of human rights does not happen by chance but is a consequence of the corporation’s decisions and informal policies. A business corporation’s ‘social risk’ does not refer to the discrimination (there is no uncertainty about it) but to the consequences of this policy in terms of financial loss to the corporation. It could be that female employees initiate litigation resulting in the corporation having to pay damages and incur legal costs, that the corporation receives negative media coverage, possibly resulting in loss of sales, and so on. If a business corporation managed its social risk, it would have several risk reduction options: it could of course not discriminate (which would eliminate the exposure to this risk), but it could also focus on various other risk reduction strategies (for example discriminating only in countries where anti-discrimination laws are non-existent or improperly enforced) or invest in anti-discrimination measures, only when and where media exposure is expected to be high or difficult to control.

Or, going back to the abovementioned example of a corporation that is granted a concession to exploit a gas field by a military regime that continuously perpetrates severe human rights violations, it was argued that in order to adequately measure human rights risk, a normative assessment of corporate behaviour would be necessary. Under a social risk management model the corporation has no interest in conducting such an assessment, unless rights-holders can effectively initiate lawsuits against it. Only in this case would the corporation check the availability of jurisdiction and enforceability of judgments, and then consider the substantive question of whether a court would possibly judge that the corporation’s involvement amounts to a violation of human rights. In the absence of access to justice, the relevant uncertainty that needs to be managed is, as mentioned above, the possible reaction by stakeholders to corporate activity (violent resistance by local communities, negative public exposure with possible loss of sales and brand value etc). At most, a social risk management system would assess whether social risks increase just because stakeholders come to the normative conclusion that corporate activity has adverse human rights impacts. The corporation does not have an interest in conducting its own assessment of the human rights situation, but will instead estimate stakeholder perceptions of its involvement. Supposing there is no practical access to justice for rights-holders, the corporation would identify and then, as a risk reduction measure, influence the perceptions of those who could effectively sanction the corporation extra-legally. For example, the corporation would negotiate compensation for victims not with the victims themselves but with influential NGOs so that the latter will change their perceptions about the corporation, resulting in less animosity. Alternatively, the corporation might offer positive measures that benefit influential groups in local communities in order to offset their negative perceptions of the corporation’s presence (for example by supporting local medical coverage and education). These measures would reduce the corporation’s social risk. They may in an ancillary manner promote human rights and help rights-holders. However, these measures can be carried out without necessarily remedying the failure to respect human rights in the first place.Footnote ⁶⁵

To conclude, under a social risk management model it is generally possible for a corporation to succeed in reducing social risk by managing perceptions without improving the situation for rights-holders. In other words, social risk reduction measures are not equivalent to measures that would prevent or mitigate a business enterprise’s adverse human rights impacts.Footnote ⁶⁶

VIII. Different Approach to Managing Opportunities and Unacceptable Trade-Offs

The final step in a risk management process would be to establish risk costs, which are a function of losses, risk reduction costs and opportunity costs. The social risk management model implies that priorities are attributed according to the value at risk. Therefore any social risk management scheme that seeks to reduce risk costs must balance losses against risk reduction costs and opportunity costs. This means that losses are acceptable for the corporation if they are outweighed by opportunity costs and anticipated risk reduction costs.

The concept of ‘strategic risk taking’ is that risk management should encompass risk-tolerance and risk-taking to the extent that this serves the organization’s goals.Footnote ⁶⁷ The ISO 31000:2009 risk management standard also clarifies that risk prevention and mitigation are only alternatives to a more positive attitude towards risk.Footnote ⁶⁸ Strategic risk management approaches are usually adopted to deal with financial risk so that their application might be questionable in fields where active risk-taking is morally less tolerable, as in the human rights context. Therefore, we could assume that not all business corporations managing human rights issues as social risk will actually engage in rational behaviour that is as crude as being involved in the violation of human rights when it pays.Footnote ⁶⁹ However, it is not unrealistic that business corporations willingly incur human rights risks that can hardly be managed, as long as the operation results in profitable activity. Consider a mining company that operates a high-yield gold, silver, and copper mine, in a joint-venture with a company owned by a state that is ruled by an authoritarian regime and that imposes indefinite military conscription implying forced labour of a large part of the population. Suppose the mining company has little leverage over its governmental partner and can hardly access information about forced labour actually used for the joint-venture’s operations. Under such circumstances the company is barely in a position to conduct human rights due diligence under the UNGPs. If the company continues to operate the mine, it has to put up with the fact that its activities are potentially linked to human rights violations that cannot be assessed, or still less, be prevented or mitigated. It could well be, however, that this situation does not weigh all too heavily as it neither impairs the profitability of the mine nor affects the financial performance of the company.

Moreover, to the extent that business corporations manage social risk based on cost-benefit considerations, those that excel in social risk management could—in extremis—increase risks to right-holders: when a corporation is able to minimize losses due to optimal knowledge about stakeholder reactions, its investments in projects that are controversial and may typically pose a threat to human rights eventually become less costly. This increases the likelihood that the corporation will not shy away from activities with potentially adverse human rights impacts.

Finally, expressing human rights impacts in terms of financial costs introduces trade-offs that are unacceptable for fulfilling corporate responsibility under the UNGPs. The UNGPs principally do not allow human rights to be weighed up against an economic interest for a business. According to UNGP 19, economic interests are only taken into account the more remote a corporation’s links to human rights violations become.Footnote ⁷⁰

IX. Elevation of Human Rights Respect to a Corporate Goal

The main conclusion put forward in the preceding sections is that the integration of the UNGPs human rights due diligence process into corporate risk management systems, in particular ERM systems, requires an elevation of human rights respect to a corporate goal that determines a business corporation’s strategy.

Such an integration of human rights due diligence into an ERM system would become a prime embodiment of what Peter Muchlinski has named ‘constitutionalizing’ concern over human rights in the ‘corporate psyche and culture’.Footnote ⁷¹ The due diligence process would be guided by the corporate objective to respect human rights. However, to the extent that the motivation for human rights due diligence does not become clear or is lumped together with business concerns such as avoiding business disruption or improving brand reputation, business corporations may tend to conduct human rights due diligence hardly any differently than they would manage social risk. When, in addition, corporate communications translate social risks into human rights language, it becomes very difficult for the outside observer to tell the two apart. The two following examples may serve as an illustration for these points:

1. (1) When a company hires private security forces in order to protect its employees and assets, in particular, in places where public security is poor, it is clearly mitigating its social risk. The company could moreover present the employment of security forces as a measure to prevent human rights risks of the company’s employees. Indeed, social risk and human rights risk largely overlap in this respect. However, the use of private security forces in zones where public security is inadequate, typically results in severe human rights risks for other people than employees. A diligent selection and supervision of security forces according to international standardsFootnote ⁷² as well as obtaining guarantees for the proportionate use of force may complicate the job to effectively protect the company’s assets and personnel on the ground. In such cases, social risk and human rights risk could well fall apart. When proper human rights due diligence results in higher costs and less efficient security, and if human rights respect is not part of corporate strategy that guides the company’s actions, the company will be inclined to lend priority to effective social risk management.

2. (2) Consider a coffee retailer that has been emphasizing its ‘ethical sourcing’ model in order to distinguish itself from competitors, and to attract consumers who react sensitively to how the coffee they drink is produced. To implement its sourcing model, the company uses a scorecard system that helps evaluate suppliers’ and coffee farmers’ work practices and respect for the environment. Depending on the degree of compliance with the scorecard’s policies, farmers and suppliers may gain points and become privileged partners with the retailer. Some policies, such as child labour or forced labour have so called ‘zero tolerance’ status. Non-compliance with these provisions disqualifies someone from becoming a business partner. Other policies, for example related to workplace safety, wage discrimination, maximum working hours, or freedom of association are mentioned but could not be complied with. Depending on the context, any of these issues could present severe human rights risks within the company’s value chain. Nevertheless, the company systematically treats forced labour and child labour as more important than other human rights problems. From a social risk perspective, such a priority could be justified, because occurrences of child labour and forced labour in the value chain may have a stronger negative impact on the brand’s reputation than other human rights violations. Conducting human rights due diligence, by contrast, may require that the coffee retailer considers how its sourcing activities interact with each and every human right. Priorities are made not with regard to which human right is concerned, but with regard to the likelihood that a human right will be violated and the severity of the consequences in the concrete case. If the coffee retailer shifts to strategically motivated human rights respect, it probably would have to review its sourcing policy, as commendable as it may otherwise be.

A further significant implication of elevating concern for human rights to strategic level is that human rights risks are taken into account prior to an investment in a project and not only once the investment has taken place.Footnote ⁷³ More precisely, the recognition of human rights as a strategic issue requires an anticipation of the scenarios described in UNGP 19 with regard to risk prevention and mitigation.Footnote ⁷⁴ If, when analyzing a project’s prospects, the company comes to the conclusion that it will be largely unable to prevent or mitigate human rights risks directly related to the anticipated operations, then the project should not be worth the investment in the first place. In the above mentioned example of the mining company’s joint venture that can hardly prevent forced labour being linked to its activities, strategic human rights respect would probably recommend not exploiting the mine despite its large potential.

X. Conclusions and Outlook

The first conclusion of this article is that the UNGPs human rights due diligence requirement is hardly compatible with the management of social risk. In this light it could be said that the UNGPs prescribe a very ambitious implementation program. With regard to the motivation, a reference to the business case is no sufficient basis for managers to take the UNGPs at face value. The reason for this is that a ‘business case’ would merely provide a reason for conducting social risk management, which, as has been argued here, deviates from human rights due diligence at each step of the risk management process (identifying, assessing and reducing risk). This being said, a persuasion strategy that emphasizes the notion that business-related human rights violations may represent costs to a business enterprise not yet accounted for could have some initial success, since some costs may indeed be unrevealed through greater attention paid to human rights. However, the more we have empirical certainty about discrepancies between social risk and human rights risk, the less appealing the ‘business case’ becomes. In this light, talking about the business case is a gamble on whether or not future research can confirm a convergence between social and human rights risk. Alternative motivations to conduct human rights due diligence (in the absence of legally enforceable obligations) could build on the development of empirically tested methods of assessing and measuring human rights risk. If these methods were readily available and practicable, business corporations would have to defend their decision not to use them.Footnote ⁷⁵ The underlying consideration here would be ‘moral’ rather than a ‘business case’ for human rights respect. In this sense a moral justification for corporate responsibility to respect human rights could prove to be more robust than one based on enlightened value maximization.Footnote ⁷⁶

The second conclusion is that if business corporations managed human rights risk in order to serve the goal of respecting human rights and not to address possible repercussions of human rights violations on the corporation’s value, they would effectively alter the corporate purpose, or at least place the sole objective of value maximization within the confines of adequate human rights respect.Footnote ⁷⁷ Value maximization would become subject to the responsibility to respect human rights and not vice versa.

While this article has argued that proper implementation of human rights due diligence requires a modification of goals and strategy, the costs and risks of such human rights due diligence for the business corporation may create impediments that most business corporations are presumably not willing to surmount: human rights impact assessments would require burdensome data collection and, likewise, could recommend financially onerous reduction measures. If business corporations apply available analysis tools thoroughly and attempt to provide satisfactory answers to the questions these tools raise (instead of box-ticking selected issues), they might need to make considerable investigative efforts. Many corporations already deal with processes that require a profound investigation into the effects of corporate activity, for example in the field of combating corruption, money-laundering or securities fraud. Since human rights issues, supposedly, are not less intricate than these matters, we could assume that human rights assessment efforts, taken seriously, would impose uncomfortable decisions and be as costly as anti-corruption measures. Further, the investigation into facts that are relevant for the assessment of a corporation’s adverse human rights impacts could produce or uncover sensitive information that a corporation would prefer to keep confidential. For example, identifying and assessing risk could lead to the creation of an information record that third parties could use against the corporation in litigation.Footnote ⁷⁸

Under these obvious constraints, without a strong moral commitment from the corporation and its agents to properly conduct effective human rights due diligence, there might be a tendency to implement the process only to the extent that it can be plausibly documented and disclosed in order to satisfy an audience that is content with disclosures containing plausible but essentially unverified information. In this light, it is not fanciful to suppose that some business corporations feel tempted to mount a façade of implementing human rights due diligence, when serious human rights due diligence is too costly, produces an information record that could be used against the corporation, or imposes decisions that conflict with its financial objectives. If voluntary human rights due diligence remained impractical for these reasons, the alternative to make human rights due diligence effective would be to artificially increase the social risk of business-related human rights violations.