A human rights impact assessment is useful only if it changes decisions that may harm people. The gold standard asks which rights could be affected, who might bear the costs, whether they can participate safely, what the organisation can change and how any harm will be remedied. It is not a reputation report designed primarily to make a company look ethical.
The UN Guiding Principles on Business and Human Rights and OECD responsible-business guidance emphasise identifying adverse impacts, preventing or mitigating them, tracking results, communicating responsibly and enabling remedy where appropriate. Those international standards must be distinguished from applicable domestic law. This guide explains how to use them to evaluate a real project without pretending to issue a legal judgment.
A quick quality check begins with the human outcome, not a corporate slogan: Can the assessment identify people who were excluded from consultation? Can it trace a serious concern to a decision owner? Does its proposed fix improve an affected person’s everyday access or safety? And is there a route for someone to say the fix did not work?
The subject here is impact assessment and accountable decisions, not the broader The Gold Standard of International Humanitarian Law Compliance in armed conflict, the The Gold Standard of Whistleblower Protection Systems reporting-channel design or The Gold Standard of Victim and Witness Support direct support in justice processes. These are connected, but their primary reader tasks are different.
Find the information you need
The first six chapters identify people, rights and business relationships; the middle chapters turn evidence into prevention; the last chapters examine remedy, communication and improvement.
Open the 17-chapter guide
- Start with harm to people, not risk to the company’s image
- Decide when the assessment has enough influence to matter
- Map all people affected, including people who are hard to reach
- Make participation safe, accessible and genuinely voluntary
- Understand which rights are plausibly affected
- Distinguish cause, contribution and business linkage
- Examine actual working conditions, not just supplier paperwork
- Consider technology and accessibility as human rights questions
- Assess severity to people, not just cost to the enterprise
- Test prevention options before claiming mitigation
- Keep grievance channels distinct from the assessment interview
- Write findings that show evidence and uncertainty
- Link each recommendation to a real decision owner
- Track whether people actually experience improvement
- Communicate findings without putting participants at risk
- Treat remedy as a real outcome, not a public-relations gesture
- Repeat the assessment when the real world changes
1. Start with harm to people, not risk to the company’s image
A human rights impact assessment asks how an activity may affect people who live, work, travel, learn or depend on a service. That is different from asking whether negative publicity will affect an organisation’s revenue. A development proposal might make headlines because of displaced residents, but the human rights question is not how to prevent the headline. It is what could happen to the people involved, whether their rights are respected and what decisions could prevent or reduce harm.
Write the assessment purpose in ordinary language. Identify the business activity, affected people and plausible rights-related impacts. Distinguish actual harm from foreseeable risk and legal obligations from voluntary international frameworks. The United Nations Guiding Principles on Business and Human Rights, explained through the UN Global Compact, frame corporate responsibility to respect human rights through due diligence. Their importance does not make every principle a directly enforceable domestic law. The actual legal position must be checked by jurisdiction.
2. Decide when the assessment has enough influence to matter
An assessment delivered after construction, deployment or contract signing may document a problem but have little opportunity to prevent it. A useful process begins before irreversible decisions are made and is revisited when the project changes. The timing should be linked to decisions that can still be altered, not merely to the organisation’s annual reporting calendar.
Map planning, procurement, design, launch, operation, expansion and exit. Assign decision owners and identify what they are allowed to change. If all material decisions have already been finalised, the assessment should say so, recommend appropriate corrective and remedial routes, and avoid claiming prevention was achieved. Good governance gives the assessor access to decision-makers and affected people early enough for evidence to affect the outcome.
3. Map all people affected, including people who are hard to reach
Stakeholder lists often contain the groups easiest to invite: management, the main supplier, a recognised community leader and the people who already have internet access. That is not the same as understanding who bears the impact. Shift workers, subcontractors, migrants, disabled residents, children, older people and informal service users may have very different exposure and ability to speak openly.
Create an affected-person map rather than only an institutional contact list. Ask where decisions fall disproportionately on people with less bargaining power. Include indirect effects through suppliers or contractors when there is a credible link. Protect private identities when participation would create fear or vulnerability. A meaningful assessment can explain how it sought viewpoints beyond the most vocal participants and what it could not obtain.
4. Make participation safe, accessible and genuinely voluntary
A public meeting is not meaningful consultation when a participant must criticise an employer in front of a supervisor or reveal personal circumstances to the whole room. People may disagree, worry about losing income or need translation, childcare or accessible transport to participate. The assessment process itself can create harm if it exposes people to retaliation or public identification.
Design suitable confidential channels, accessible formats and respectful language support. Explain the purpose of the assessment, what influence participants have and how information will be protected. Do not promise that every suggestion will be adopted. Where sensitive allegations arise, ensure the appropriate professional reporting route rather than treating the assessor as an investigator without mandate. Record participation limits honestly, including groups whose consent or safe participation was not obtained.
5. Understand which rights are plausibly affected
Human rights are not a single undifferentiated label. A project may raise concerns about non-discrimination, privacy, safe working conditions, participation, accessibility, health, housing, freedom of expression or other rights depending on facts and applicable frameworks. A long list copied from a declaration can look impressive while failing to examine the issues actually raised by the activity.
Begin with a reasoned rights map showing the activity, affected person, potential harm, evidence and possible preventive decision. Seek relevant legal and human rights expertise when needed. Consider relationships between impacts: losing access to a service may make other participation or livelihood difficulties worse. Avoid claiming to resolve contested legal questions by assigning an arbitrary score. The rights map is a tool for serious enquiry, not a shortcut to adjudication.
6. Distinguish cause, contribution and business linkage
An organisation may directly cause harm, contribute to it or become linked to it through a business relationship. Those situations are not identical, and the responses expected under due-diligence frameworks can differ. The UN Global Compact discusses the responsibility to respect rights across operations and relationships, while OECD guidance outlines processes to prevent, mitigate, account for and, where appropriate, enable remedy.
Build a transparent relationship map: who controls the activity, who contracts with whom, where the potential impact arises and which parties can influence correction. Do not assume contracting out a service removes responsibility to examine foreseeable harm. Equally, do not attribute every distant social problem to one organisation without evidential basis. The goal is to identify realistic influence, relevant duties and defensible actions.
7. Examine actual working conditions, not just supplier paperwork
A supplier can sign an ethics code while workers experience unpaid hours, inaccessible grievance routes or unsafe pressure. Policies are useful but do not prove daily practice. Rights assessment should therefore include suitable evidence from operations and affected people, not simply management statements and attractive documents.
Use appropriate records, interviews, independent expertise and lawful workplace information. Consider whether workers can speak without management monitoring and whether pay, rest, safety and freedom to raise concerns are experienced as described. Avoid collecting unnecessary personal information or creating a list of complainants for employers to inspect. Where formal labour law applies, separate statutory compliance from broader due-diligence expectations. A genuine evidence packet can show contradictions and how they were resolved.
8. Consider technology and accessibility as human rights questions
Automated decisions, identification checks, digital-only booking and inaccessible interfaces can exclude people even where no one intended discrimination. A system may achieve its average performance target while failing consistently for users with particular disabilities, languages, devices or access limitations. The impact becomes visible only when the assessment observes the human experience rather than merely reports technical uptime.
Test the service journey with relevant and consenting affected users. Examine whether errors can be corrected, what alternative routes exist, how personal information is handled and who has authority to restore access. Do not manufacture demographic findings from unrepresentative samples. If a platform cannot provide a lawful accessible path for a group, that is a real design issue for decision-makers to address, not a communications problem to solve with a reassuring slogan.
9. Assess severity to people, not just cost to the enterprise
Risk ranking can become distorted when a company gives the highest priority to matters likely to generate large fines and ignores a serious impact on a small, politically weak group. Human rights due diligence considers the significance of adverse impacts for people. Size, scope and the difficulty of putting harm right may be relevant, but the exact assessment should follow an appropriate framework and evidence rather than a self-invented universal score.
Describe what would happen if the harm occurred, how many could be affected, whether consequences are reversible and what information remains uncertain. Do not dilute severe harm by multiplying it by an attractive probability estimate from no reliable data. Prioritisation under the OECD framework is intended to guide preventive work, not excuse indefinite inaction for less visible people. The audit should show the chosen response and reasons.
10. Test prevention options before claiming mitigation
Some risks can be avoided by redesigning an activity; others require changing contracts, introducing safeguards or abandoning a harmful option. A policy that merely tells affected people to be careful may shift the burden onto those least able to protect themselves. The assessment must show what the organisation can change and whether the proposed measure would actually make life safer or fairer.
Compare practical alternatives using the available evidence. Assign owners, resources, deadlines and tests of effectiveness. Consult affected people about whether the remedy makes sense in daily use. Where the organisation lacks direct control over a supplier, investigate lawful leverage and collaborative options rather than claiming there is nothing to do. Keep promises realistic: a measure is a proposal until its implementation and effect are verified.
11. Keep grievance channels distinct from the assessment interview
An assessor may hear a complaint about wages, harassment, discrimination or a serious personal injury. Recording it in a workshop note is not necessarily an adequate response. People need a competent, safe route for seeking help, while assessors must respect consent, confidentiality and limitations of their role.
Explain how concerns can be referred to the appropriate internal or external mechanism, including urgent routes where needed. Do not pressure participants into formal complaints as a condition of being heard. A grievance mechanism should be accessible, appropriately independent and capable of providing a response; this article does not substitute for legal action or professional safeguarding. Follow up only in a manner that respects the person’s choice and safety.
12. Write findings that show evidence and uncertainty
A polished impact assessment can still be unreliable if it labels assumptions as facts or hides disagreements in an appendix. A serious document should identify affected groups, the nature and source of evidence, the limits of consultation, material contrary information and the reason for the conclusions. The reader should be able to tell whether a harm was documented, reported but unverified or merely foreseeable.
Use a clear evidence matrix and preserve source confidentiality. Distinguish facts, stakeholder experiences and professional judgements. Avoid reproducing identifiable private stories without lawful purpose and meaningful consent. Where an impact is plausible but not established, explain the precautionary choice rather than inventing certainty. Good reporting makes it possible to improve decisions while protecting people who contributed information.
13. Link each recommendation to a real decision owner
Recommendations often fail because they say ‘enhance accessibility’ or ‘engage stakeholders’ without specifying who must act. An assessment is not a substitute for management. It creates value when decision-makers accept or explain responses to specific findings, resource the changes and provide a route for independent scrutiny.
Turn each material impact into a decision log: proposed prevention or remedy, responsible owner, due point, resources, verification evidence and communication to affected people. If leadership rejects an option, record the reasons and assess whether serious adverse effects remain. Public reports should not present a recommendation as a completed correction. The commitment becomes credible when someone can show what changed in the relevant process.
14. Track whether people actually experience improvement
The number of assessments completed is a weak measure of whether harm has been prevented. So is the count of training sessions or a statement that every supplier signed a policy. Outcome-focused monitoring asks whether affected people’s conditions improved, whether previously excluded users can now access the service and whether complaints are resolved fairly.
Choose indicators appropriate to the harm: successful access after an alternative route is introduced, paid wages after a correction, reduced exposure to a specific hazard or meaningful restoration for someone harmed. Use privacy-preserving evidence, document limitations and seek feedback from the relevant people. Avoid declaring success from a small convenience sample. The UN Global Compact and OECD both emphasise continuing due diligence rather than a one-time report.
15. Communicate findings without putting participants at risk
Stakeholders deserve an understandable account of what was identified and what will be done. Yet publishing names, exact household locations, witness narratives or sensitive employment details can cause further harm. An organisation should not demand unlimited public disclosure as proof that it respects rights, nor hide every difficult finding behind confidentiality.
Prepare separate communication routes for the people directly affected, responsible institutions and the wider public. Say what can be verified, what remains unresolved and when progress will be reviewed. Use appropriate languages and accessible formats. For sensitive matters, describe the control and remedial process without revealing personal details. Transparency is valuable when it helps people act and hold decision-makers accountable safely.
16. Treat remedy as a real outcome, not a public-relations gesture
Where an organisation caused or contributed to harm, appropriate remediation should be considered under the applicable framework and law. A generic apology may be important but insufficient if people still lack wages, services, safety or meaningful access. Equally, an assessment should not promise legal compensation or dictate a remedy without understanding responsibilities and individual circumstances.
Work with competent people and affected stakeholders to identify proportionate options. Respect choices and lawful grievance or judicial routes. Record what the organisation offered, what was accepted and whether it addressed the harm without coercion. The OECD due-diligence framework includes providing for or cooperating in remediation where appropriate. The gold standard is an improvement people can experience, supported by fair and accountable process.
17. Repeat the assessment when the real world changes
Human rights risks do not remain frozen after publication. A supplier may change, an app may introduce mandatory biometric checks, a factory may expand, or a community may experience new barriers after a road closure. A report accurate at launch may no longer describe the activity. Treating its date as a permanent stamp of approval is poor management.
Set review triggers tied to material changes and credible new concerns. Maintain versioned findings, source records, governance decisions and feedback channels. Independent review may be useful where conflicts or major consequences exist. A closing assessment should explain the work’s limits and unresolved obligations, not declare that a project is ‘human-rights safe’ for all time. Responsible due diligence is a continuing learning system.
Original scenario: a digital queue that everyone can use, except the people it overlooks
A fictional public-facing private service introduces a smartphone-only appointment process. Management reports a 92% reduction in administrative handling time. Some residents with limited digital access, certain disabilities and unreliable data connectivity struggle to obtain appointments. The organisation’s first impact assessment interviews customers who successfully used the app and concludes that the service is popular. It has surveyed only the people who made it through the new gate. That is a selection problem, not proof that excluded users are satisfied.
A stronger assessment maps the route from first attempt to completed appointment, including unsuccessful attempts. It seeks safe input from affected people, observes why they cannot use the current process and tests lawful, accessible alternative routes. It separates privacy questions from accessibility concerns and checks whether a proposed workaround imposes extra financial, time or dignity costs. The team may discover that a telephone booking channel or assisted digital access restores meaningful service for people the app excluded. The exact remedy must be tested with the people concerned and the applicable law, rather than announced as a universal fix.
A decision log then names the owner of the alternate route, a realistic implementation point, how access will be measured and who can receive complaints. The organisation should publish a careful account of the issue without revealing identifiable details of participants. After launch, the team checks real successful access rather than the number of people who clicked a help page. The achievement is not an attractive annual chart. It is a system that works better for the people who were previously invisible.
Impact assessment evidence matrix
| Assessment component | Useful evidence | Weak substitute |
|---|---|---|
| Affected people | Inclusive mapping and safe participation | Only interviewing existing customers |
| Actual and potential impact | Documented experience and qualified analysis | Company reputation scores |
| Prevention | Assigned changes and tested alternatives | A new policy statement alone |
| Remedy | Accessible and lawful response to harm | An unverified apology |
| Follow-up | Evidence that outcomes improved | Counting how many reports were written |
Twelve questions for a credible assessment
- Whose lived experience is missing from the current evidence?
- Were people able to participate freely and safely?
- What rights may be affected by the actual activity?
- Which impacts are established, which are plausible and which remain unknown?
- Does the assessment separate risk to people from business reputation risk?
- Are operations, suppliers and relevant business relationships covered?
- What can decision-makers change before avoidable harm occurs?
- Do severe harms receive attention even when politically or commercially inconvenient?
- Does the recommendation have an owner, resources and a verification method?
- Is there an appropriate, accessible grievance and remedy route?
- Can affected people understand the outcome without losing privacy?
- Will a future material change trigger a new review?
Frequently asked questions
Is a human rights impact assessment the same as a company ESG report?
No. ESG reporting may include human rights topics, but the assessment focuses on actual and potential adverse effects on people and actions to prevent or remedy those harms.
Does a voluntary international framework automatically create domestic legal liability?
No. International standards and applicable local laws must be distinguished. Seek qualified legal advice about enforceable duties in a particular jurisdiction.
Can a company rely entirely on supplier questionnaires?
Questionnaires may help, but meaningful assessment should examine credible evidence and affected people’s experiences where appropriate and safe.
What if people are afraid to speak publicly?
Provide safer, accessible and confidential channels. Do not use the absence of complaints as evidence that nobody is harmed.
Do companies have to fix every social problem in a country?
An assessment should examine impacts linked to the organisation’s operations and relationships using the applicable due-diligence framework. Responsibility, influence and legal duties are context-specific.
Does a high rights-risk score prove unlawful discrimination?
No. Risk assessment is not a court finding. It is a way to identify and respond to potential harm; legal conclusions require competent examination of facts and law.
What makes the assessment useful to the affected person?
A clear explanation of potential impact, a way to participate safely, decisions that change the harmful process and an accessible route to seek remedy.
What the gold standard looks like in practice
A mature assessment is honest about uncertainty, interested in the experience of people who cannot easily be heard and willing to recommend changes before harm becomes entrenched. Its strongest result may be a project redesign, a better supplier contract, an accessible alternative or an effective remedial process. Success is the quality of those consequences, not the number of polished charts in the report.
Human rights due diligence is a continuing responsibility within the appropriate international framework and applicable domestic law. Repeated consultation should not become an endless demand for vulnerable people to retell their difficulties. The organisation must act on credible information, measure improvement and accept accountability for unresolved effects. That is how a rights assessment becomes more than a document.
Official and institutional reference material
UN Global Compact: Principles for Human Rights in Business
UN Global Compact: Guide to Human Rights Impact Assessment and Management
UN Global Compact: 2025 Embedding Human Rights Due Diligence
OECD: Recommendation on Responsible Business Conduct Due Diligence
OECD: 2023 Guidelines for Multinational Enterprises on Responsible Business Conduct
UN Global Compact: Principles and Complicity Risks
Connected eduKate Gold Standard reading
The Gold Standard of Whistleblower Protection Systems
The Gold Standard of Victim and Witness Support
The Gold Standard of International Humanitarian Law Compliance
The Gold Standard of Legal Research
Featured image is an illustrative Singapore National Library building scene and does not depict participants in this fictional human rights impact assessment.
Editorial review: 18 October 2026. This is general educational guidance on assessment quality, not a legal opinion or a finding that any organisation violated human rights. Domestic legal duties, individual circumstances and remedy options require appropriate professional examination.