No human rights, no real risk management

The most costly business crises, such as labour strikes, supply chain scandals, and environmental disasters, often trace back to failures in human rights and environmental due diligence. Companies may genuinely not know what is happening deep in their supply chains. Worker concerns may be raised but aren’t heard or taken seriously. Systems for listening might exist on paper yet fail when problems arise.

Think of Boohoo, where share value fell by over £1 billion and major retailers cut ties with the fashion brand after labour abuses in UK supplier factories hit the headlines. Or Sime Darby Plantation, the world’s largest certified palm oil producer, which was excluded from the US market through a CBP import ban for several years after forced labour was found in its supply chain, forcing the company to spend millions on compliance improvements and worker remediation. These cases show how overlooked social risks can quickly become expensive problems.

These crises were not inevitable. They resulted from systems that didn’t identify the right risks, failed to include the perspectives of those most affected, or didn’t act before problems escalated. Many companies still overlook human rights in their risk registers or grossly underestimate their significance. Listing human rights as a potential risk is not enough. Without robust, ongoing human rights due diligence (HRDD) that identifies risks and engages affected people, businesses remain exposed and unprepared. If human rights risks are missing from your core management processes, or your HRDD system lacks credibility, you jeopardise your strategic partnerships, your reputation, and your licence to operate.

HRDD can sound abstract, but in principle it’s pretty straightforward. It flips traditional risk management: instead of asking “what threatens our business?”, HRDD asks “who does our business threaten, and in what ways?” HRDD is ongoing. Companies must identify where their activities may threaten people’s rights across their operations and value chains, such as safe working conditions, fair wages, non-discrimination, freedom to organize, and a healthy environment. Acting on what you find means preventing harm, reducing risks, and correcting harms when they occur. Businesses must track what works and adapt when it doesn’t. HRDD only works when those most impacted (rights-holders) actually have a voice in the process, not just experts or managers. 

For a deeper look at the principles and frameworks behind HRDD, read my colleague Krista Sormunen’s blog.

Despite recent delays brought about by the Omnibus package, particularly the EU’s ‘Stop-the-Clock’ Directive affecting the Corporate Sustainability Due Diligence Directive (CSDDD) and Corporate Sustainability Reporting Directive (CSRD), the direction is clear: voluntary guidance is turning into law. Once the CSDDD enters into force, it will be a legal requirement across the EU, with fines reaching up to 5% of global turnover.

But for many companies, the bar is already set. Switzerland’s Ordinance on Due Diligence, Germany’s Supply Chain Act, Norway’s Transparency Act, France’s Duty of Vigilance Law (Loi de Vigilance), and, already in 2015, the UK Modern Slavery Act all require meaningful human rights risk management. The new EU Forced Labour Regulation will go even further, banning all products made with forced labour from the EU market starting in 2027.

Europe has taken the lead in recent years, but global regulatory momentum is growing. Landmark non-European laws such as Australia’s Modern Slavery Act (2018) and the California Transparency in Supply Chains Act (CTSCA) reflect the worldwide push for supply chain transparency and human rights due diligence. International frameworks like the UN Guiding Principles (UNGPs) and the OECD Guidelines have set business norms. In practice, supplier labour standards are already your responsibility in many jurisdictions and to many stakeholders, not just when the CSDDD arrives (a point explored in more detail in Krista Sormunen’s recent piece on sustainability due diligence). 

With double materiality assessments becoming standard under frameworks like the CSRD, companies are reviewing their impacts more systematically and with greater structure. For those used to sustainability assessments, this has raised the bar, making reviews more rigorous and requiring real consideration of effects on people and planet. Still, a key challenge remains: those whose lives are most affected by company decisions are not consistently heard. Companies consult broadly, including investors, management, experts, and NGOs, yet supply chain workers, nearby communities, and vulnerable groups are too often underrepresented.

Recent research among Finnish companies confirmed this, finding that while 34% identify their most significant human rights risks in Tier 3+ suppliers, only 2–3% actually monitor or address issues at that level. Rights-holders remain consulted least where risks are highest. This is understandable, as reaching these groups requires cultural sensitivity, language skills, local knowledge, and resources many companies simply do not have.

Even when companies do consult and actively seek input from rights-holders, it is hard to get it right. Often, one or two articulate representatives “explain the situation,” but without disaggregated engagement (by gender, employment status, nationality, etc.) critical voices go missing. This is especially critical for investment projects, where understanding local conditions and building relationships with local people from the get-go can prevent conflicts that derail projects entirely. Desk studies and brief consultations rarely capture local power dynamics, cultural sensitivities, or tensions that shape how people experience a company’s operations.

For example, female seasonal workers’ concerns differ from those of local male permanent staff. The result is familiar: risks such as indigenous land rights, forced labour, and unsafe conditions go undetected not because they don’t exist, but because assessments rely on desk research and selective interviews rather than real ground-level engagement. Blind spots often emerge later through media, investigations, or shareholder pressure, after people and their communities have already been harmed. 

Technology can help. Digital platforms, mobile surveys, and secure grievance channels are reaching workers who might never attend formal meetings, making engagement more accessible and scalable, especially when solutions account for illiteracy, unreliable electricity, and cultural context. Yet technology also creates new complexities. AI-driven recruitment, monitoring, and digital grievance tools can amplify voices while also introducing surveillance, bias, and discrimination. The question is not whether to use technology, but how it is designed and governed. Are these tools truly empowering rights-holders, or mostly serving company compliance?

Beyond identification, this is about what companies do with uncomfortable truths. Real HRDD means listening when it’s uncomfortable and acting even when it’s difficult. Nordic companies have a global reputation for stakeholder engagement, environmental responsibility, and values-based leadership. That reputation is worth protecting, and it is also a chance to stand out. Companies like Lush, Nudie Jeans, and Ben & Jerry’s have shown that authentic commitment to human rights and rigorous due diligence can build loyalty in ways traditional marketing cannot.

There’s space for Nordic companies to lead, not just by meeting legal requirements but by showing genuine commitment through human rights due diligence that goes beyond compliance. This includes authentic engagement with rights-holders, transparency about challenges, meaningful action on findings, and communicating openly about what has been learned. There is real competitive advantage in knowing how to communicate about human rights processes, outcomes, and issues, beyond what is required.

Three questions your leadership team should be able to answer:

1. Who are the most vulnerable people in your value chain, and when did you last hear directly from them?
2. If a worker three tiers down your supply chain wanted to raise a safety concern tomorrow, would they know how, and would they trust the system enough to use it?
3. When your team identified your material human rights risks, whose lived experience informed that assessment?

Understanding human impacts isn’t optional anymore. It’s competitive advantage.