April 8, 2025
As negotiations about the best way to simplify EU sustainability legislation progress, different levels of understanding about what risk-based due diligence means in practice may disrupt efforts to find a path to legal certainty that does not undermine the objectives of the regulation.
Drawing on over a decade of experience working with business to implement due diligence, here is Shift’s view about the basics of risk-based due diligence that EU policy makers should reinforce, and not lose sight of, in the weeks and months ahead.
Risk-based due diligence is about companies directing attention to their greatest sustainability risks. This is not about companies being overly broad in what they assess. But nor does it mean requiring companies to focus their efforts on parts of their supply chain they know are not the source of real risk.
At the core of risk-based due diligence is the idea that companies should identify and understand the most significant impacts on people and planet connected to their business. This means companies addressing the most pressing impacts particular to their operations, products or services. And company experience has shown that managing such impacts strengthens business and value chain resilience, can increase access to capital and markets, and contributes to tackling the dual challenges of climate change and inequality.
Risk-based due diligence always starts with the same simple steps. These are the same steps that companies need to take to determine the focus of reporting.
To identify impacts and make robust decisions about where to focus, companies follow these same initial steps:
1: Identifying, based on the best available information, which areas of the company’s operations and value chain are most likely connected to the most serious impacts.
2: Understanding more about the impacts in those areas, using various sources of information to build up that picture.
3: Establishing which issues merit most urgent attention based on the relative severity and likelihood of the impacts the company has identified.
The European Sustainability Reporting Standards and the Global Reporting Initiative point to exactly the same mapping of impacts and prioritization criteria as the basis for companies to work out what to include in their disclosures. And that mapping of impacts, together with dependencies, in turn sets the reference point for any financial materiality assessment.
In short, the same process serves all three purposes – management of risks, impact materiality and financial materiality – and the results can be built on iteratively. This means companies can streamline, and certainly not duplicate, business processes and decision-making.
Risk-based due diligence involves companies making good faith judgements based on reasonably available information. It is not about waiting for issues to materialize. But equally, it is not about burdensome entity-by-entity assessments and questionnaires in the mythical search for perfect information.
Risk-based due diligence is about being on the front foot in managing risks. This requires companies to make use of, and where necessary seek out, sustainability intelligence relevant to their business. At Shift, we have seen businesses use several methods including country-specific impact assessments, commodity specific studies, government and academic research as well as making use of relationships with civil society and trade unions.
Many industries use collaborative efforts to gather and share information about value chain risks, including with the involvement of partners of all sizes across different stages of that chain. By now the human rights issues that are most typically material for any one sector are widely known and a point of open discussion.
Precisely because sustainability information about global value chains is increasingly prevalent, it is not necessary for companies to indiscriminately blanket business partners with entity-by-entity assessments as part of risk identification.
The objective of risk-based due diligence is to find solutions with business partners and others, informed by evidence of what works. It is not about asking companies to control risks to zero. It is also not about policing the practice of direct partners under the pretense that they alone can solve problems.
For some issues, such as adverse impacts on the health of employees or local community members, a company may be able to adapt its own practices to address issues alone, even fully preventing or bringing impacts to an end. However, when risks are systemic or deep in value chains, companies need to work with others via collaborative industry efforts that pool resources, implement targeted capacity-building or tackle issues in partnership with trade unions, civil society and governments. In these situations, a company cannot be expected to control impacts on people and planet, and related business risks, to zero. What is reasonable to expect is that companies deploy credible mitigation strategies, monitor the effectiveness of the actions taken and adapt as necessary.
Deploying robust mitigations is very different from off-loading requirements onto first tier business partners, requiring them to cascade those requirements onto their own partners in turn and then remote policing of compliance. Instead, it’s about collaborative approaches that meet mutual needs and provide shared benefits in helping suppliers ensure decent conditions and fair wages for their workers.
Delivering legal certainty without unintended consequences
Companies’ legal counsels, compliance teams and executives clearly feel uncertain about how compliance with EU sustainability legislation will be judged. But certainty will not come from regulators setting arbitrary limits on where companies should look for risks then layering on confusing exceptions alongside over-prescribing what types of information companies can use.
Reducing sustainability due diligence within EU regulation to a set of “one size fits all” procedural rules and tick-box exercises will achieve little more than wasting resources by focusing companies where they are least needed. It will leave companies exposed more generally to legal and other consequences around the world because they have not identifed the risks that matter most, and which other governments and national legislation in countries, including the United States, are asking them to address.
Achieving simplification without compromising the objectives of EU regulation is not a straightforward task and will demand a mix of measures including providing more certainty in the legal text, delivering guidance on the first steps of due diligence as soon as possible; and specifying that administrative supervision should be used to incentivise better compliance over time.
Getting back to the basics of risk-based due diligence will ensure policy makers are off to the right start.
By Mark Hodge