What data do investors need to manage human rights risks?

This paper outlines the challenges investors face in understanding and addressing how portfolio companies manage human rights risks within their operations and value chains.

In a 2020 consultation, PRI signatories highlighted data as the primary challenge in doing this analysis effectively, particularly in global, diversified portfolios where the number of companies exceed hundreds or even thousands.

To better understand the investor data challenge on human rights, we worked with the not-for-profit organisation Shift to identify: 

• Demand: the different types of human rights data and information (both quantitative and qualitative) that investors need to: a) gain insight into portfolio companies’ practices regarding respect for human rights in line with the UN Guiding Principles on Business and Human Rights (UNGPs), and the OECD Guidelines for Multinational Enterprises; and b) enable investors to better meet their own responsibilities in line with these standards.
• Supply: i.e., the challenges faced by investors in accessing data and information, along with investor and data provider perspectives and good practices for overcoming those challenges.

Shift interviewed two commercial data providers and 15 asset owner and asset manager PRI signatories, and reviewed existing research about a) the strengths and weaknesses of information currently disclosed by companies about their human rights / social performance; and b) the types of indicators and metrics that investors and data providers use to assess ESG and social issues. Shift also mapped and analysed recent developments in regulation, and new or draft disclosure standards, to understand how these may impact the demand and supply of data around companies’ human rights performance.

The terms ‘social’ information or ‘social’ performance have varied definitions; however, in our paper, they refer to companies’ management of human rights issues. In the context of regulatory change, aligning practices with recognised international human rights frameworks leads corporates and investors to more effectively and proactively manage a range of complex environmental, social and governance (ESG) issues. Among social issues, we find for example employee relations, diversity issues, health and safety, community relations and forced labour – each of which are reflected in well-established international human rights instruments.

Our Investor Data Needs project will further analyse how geographic location, asset type, strategy, and / or size shape investor data needs. The results of the project in 2023 will complement the findings and recommendations in this report. 

All investors interviewed wanted to access more data that would allow them to gain a more complete view of relevant and potential human rights issues that could affect investees. Interviewees specified that information about an entity’s business model, the location of its business activities and its value chain relationships would be most useful.

Data challenges

Interviewees shared that only a small number of facts about a company tend to be publicly available: its industry; where it is headquartered; and the location of its offices, sites, or facilities. Investors noted that focusing on where a company is headquartered or owns sites runs the risk of skewing investors’ attention too far towards companies based in developing or lesser developed markets, hence missing human rights risks connected to companies headquartered in developed economies.

Promising practices

• Value chain mapping: Multiple investors have been attempting to map portfolio companies’ value chains to ascertain a more granular understanding of where, and with whom, that company does business. Mapping appears difficult given that, except for some companies in the apparel, electronics and agricultural sectors, this information is not yet widely in the public domain.
• Business model risks: One investor is experimenting with analysing business model-driven risks to people as part of its screening process. This has involved combining a proprietary data set that classifies over 14,000 companies based on declared sources of revenue with a publicly available list of business model features that increase risks to human rights. A well-understood example is the so-called fast-fashion business model, which typically perpetuates purchasing practices that increase labour rights risks within a company’s supply chain. A more recent phenomenon that investors, as well as regulators, are focusing on is data-driven business models, which increase privacy risks and associated financial, reputational, and legal risks.
• Joining up ESG and investment manager expertise: multiple investors noted that there is growing collaboration between sustainability analysts, who specialise in ESG issues, and more traditional investment analysts with in-depth company and industry subject-matter expertise because they often have complementary insight into business strategies, business models and shifting value chain dynamics. 

All investors interviewed emphasised the need for information about whether boards and management are engaged in how the company identifies and addresses the most severe risks to, and impacts on, human rights across the company’s operations and value chains. Such information can provide insight about whether a company’s human rights commitments are likely to be embedded across the organisation, including whether the ‘hardware’ of processes and systems is being supported by the ‘software’ or culture needed to ensure these are implemented as intended.

Data challenges

Investors welcomed the increasing number of disclosures relating to companies’ human rights policies and processes that are in line with international standards – and they appreciated that these disclosures are increasingly incorporated by ESG ratings agencies. However, investors were also concerned that indicators of policy and process – such as whether a company has a publicly available policy that mentions the UNGPs, has allocated a board member to have formal oversight of policies and trains employees on such policies – are too prevalent in social assessment methodologies,⁵  given that they are at best weak signals of whether the company is identifying and addressing human rights risks and impacts effectively.

Moreover, as these ‘observable basics’ of companies’ engagement with human rights issues become increasingly demanded by regulations, benchmarks and ratings, this reduces their value for evaluating and comparing companies’ seriousness in delivering change. 

Promising practices

Interviewees gravitate in their engagement with investees towards the same small set of characteristics that signal a company has the necessary commitment and culture to address impacts on people. This suggests that it may be possible to arrive at, and advocate for widespread use of, a small set of indicators of embeddedness that will be far less amenable to tick-box approaches or virtue signalling than current policy-focused information. The areas of common interest that emerged via interviews were:

• How frequently the board is updated on, and meaningfully engages with, the company’s salient human rights risks.
• Whether the board includes, or has access to, the necessary expertise and information to scrutinise company responses to these risks. For example, one investor mentioned the importance of appointing independent directors with social sustainability expertise who are tasked with holding the board to account.
• Whether the board – or relevant sub-committee – has met with affected stakeholders, their representatives and / or other experts to hear their perspectives on human rights issues connected to the company’s operations and value chain.⁶
• Whether compensation for senior leaders is linked to the company’s performance against strategic social indicators, alongside financial and environmental metrics.
• The presence of executive sponsored, cross-functional committees or groups tasked with maximising coherence and coordination in how the company assesses and acts on human rights risks.

Interviewees said that even though the above information tends to only be accessed via engagement, it is common practice to analyse and score these governance features as part of that engagement process. Some interviewees noted this practice was easier if they had experience in analysing and scoring other types of governance-related, qualitative information.

Investors raised the importance of gaining insight into the maturity or quality of companies’ HRDD efforts. Without such insight, it is very difficult for investors to know if a company is identifying and addressing the most significant risks to people, and associated risks to the business. Investors were remarkably aligned as to wanting to know whether the company:

• Has a clear understanding of risks and impacts i.e., has the company sufficiently identified risks to people across its operations and value chain, and assessed and prioritised those that are most severe? To what extent does the company regularly review risks and impacts to ensure that its understanding is up to date?
• Is taking appropriate action on risks and impacts identified i.e., is the company acting on identified issues in ways that have a reasonable prospect of mitigating or remediating adverse impacts to people?
• Is engaging with affected stakeholders and credible experts as part of its HRDD i.e., does the company consistently engage with experts, NGOs and at-risk stakeholders and identify, assess and address human rights risks based on these insights?

Data challenges

Several investors noted that indicators and analysis of companies’ HRDD practices are limited in a variety of ways, including:

• A focus on evidence of a company identifying risks to the business, rather than risks to people, as international standards expect. An example is positive scoring for companies if they disclose that they have undertaken a business materiality assessment that includes social issues, regardless of whether there is evidence of a company having considered the most significant risks to people.
• Not paying attention to whether companies are engaging with affected stakeholders. For example, a company may score highly on an indicator about the number of human rights-focused engagements with external stakeholders even if the company only provides evidence of engagement with investors, regulators or the management of their suppliers, but is silent on whether it has engaged with credible experts and affected workers, communities or end-users / consumers.
• A narrow focus on mitigation that places compliance requirements on suppliers, business partners and customers. Examples include setting out human rights expectations in contracts or addressing social compliance issues with policies and processes. These methods do not offer insight as to whether a company is addressing its own contribution to harms (such as via purchasing practices) or increasing its leverage to achieve change (such as through industry-wide collaboration), as is expected by the UNGPs.
• Using indicators that stop short of offering insight about whether company practices work for affected stakeholders. A typical example is an indicator about the number of grievances that have been ’resolved’ but says nothing about whether grievances have been resolved through processes that are satisfactory to affected stakeholders.

In particular, interviewees shared their concerns about two types of information below. In the EU, these concerns will be exacerbated as many investors are required to report this data under the SFDR:

• Information about allegations of companies’ involvement in human rights harms (usually defined as ‘violations’ of the UN Global Compact Principles). Interviewees were concerned that third-party scoring agencies’ information relating to company action to remediate allegations is often not up to date, due to the time required to research allegations and company responses, and so lacks important insight about the quality of a company’s due diligence. In addition, the allegations that show up in scoring tend to focus on risks to the company in the short term, potentially missing issues that may become a business risk over the medium and long term.
• So-called ‘risk prevalence’ indicators, such as the number or percentage of operations and suppliers considered to pose significant risk for incidents of forced labour or child labour. Without context, including whether the risks are endemic to a geography or commodity, and whether the company is acting in ways that exacerbate the risk, this type of indicator fails to offer insight into the quality of a company’s HRDD. A high figure from one company may, for example, suggest: a) that serious human rights issues are ingrained in the company and its value chain; b) that it has just acquired a new business in a geography with a prevalence of forced labour or child labour; or c) that it has robust practices to surface these human rights risks so the company can act to address them. A low figure from another company may suggest that it has made significant progress in tackling forced labour or that it has not even done the important work of trying to discover whether and where the problem exists in its value chain. Anecdotally, this has led some companies to fear that data analysts and investors may downgrade their social performance if they report high or increasing prevalence numbers which in turn may incentivise some businesses to conclude it is better not to do proper due diligence or provide appropriate disclosures to the market.

Promising practices

• Comparing disclosed human rights risks with an investor’s own analysis. One investor shared that they commonly compare what an investee lists as priority human rights issues (in disclosures or as part of engagement) to the issues that the investor has identified via their own in-house research. Gaps or blind spots can then become the focus of follow-up questions or actions.
• Focusing engagement on higher quality HRDD practices. Some investors agree KPIs with investees as part of action plans to move companies from high to lower risk thresholds. Such KPIs sometimes reflect an agreement that the company will take HRDD steps that investors see as meaningful, such as: conducting a deep dive assessment into a high-risk operation, context, product, or service; connecting with relevant and credible experts such as the International Labour Organisation, trade unions or local community leaders; or engaging with industry and multi-stakeholder initiatives focused on root causes of harms.
• Making more sense of action on, and learning from, allegations. Many investors interviewed are digging deeper into media stories, allegations, and data provider controversy scores to form a judgement about companies’ social / human rights credentials. At least in the case of large investors that are publicly committed to address human rights risks and have allocated adequate human resources, the norm appears that incidents / allegations trigger deeper analysis of a company. The exact dimensions and mechanics of this analysis merit further attention, but broadly seem to include a focus on what action the company has taken around the case, and whether company policies, processes, and disclosures signal that the incident is an outlier event. Some investors expressed frustration that information from data providers about previously flagged incidents / allegations can be outdated, often under-representing positive actions taken by a company. One data provider interviewee said they also attempt to provide context to controversies⁷  and have introduced more systematic assessments of how companies react to allegations and incidents. This direction of travel is especially important given that a vast majority of investors lack in-house analytical resources to conduct their own analysis.
• Upgrading typically used but flawed indicators. No metric formulation is without risks, but solutions are being found. These efforts focus on minor adaptations to indicators that spotlight the role that a company has played or tried to play in addressing problems. For example, the 2022 Johannesburg Stock Exchange’s Sustainability and Climate Disclosure Guidance includes the following metric formulations:

1. Instead of the commonly used metric “% or # of operations and suppliers considered to have significant risk for incidents of child labour, forced or compulsory labour”, the JSE uses “% or # of identified child labour of forced and compulsory labour incidents in its operations or value chain; and the % of these where the reporting entity has played a role in securing remedy for those affected”; and
2. Instead of the “# and type of community grievances related to salient human rights issue, and % of these resolved”, the JSE uses “# and type of grievances reported associated with community impacts related to a salient human rights issue in the reporting period, and an explanation and % of these that are remedied in agreement with those who expressed the grievance.”

Several interviewees said there is a major lack of quantitative information about improvements in outcomes or impacts on people that can be, in part or in full, attributed to a company’s actions. Interviewees noted the lack of social metrics for which there are robust, scientific, and accepted means of data collection and measurement, and the need for criteria to allow companies to report such data in ways that contextualise numbers.

Some interviewees noted that when a company has a clear plan to address a particular human rights risk or impact in specific parts of its operations or value chain, and then demonstrates progress against that plan, this provides a good signal that the company is taking seriously the issues concerned. Some investors mentioned that, in their engagements, they often want to see evidence that a company measures and assesses the effectiveness of its efforts, including that the company is setting and reporting against targets.

The desire to have quantified information about outcomes that can be more easily attributable to a company’s due diligence activities seems to be driven by numerous motivations, including that this information could help investors to: 

• compare a company’s performance year-on-year;
• make comparisons – likely around a small number of metrics – between companies;
• evaluate if risks to people that carry significant financial, reputational, and increasingly legal risks are being reduced; and
• form a picture of the impact that investors’ own stewardship activities are having on outcomes for people.

Data challenges

The key challenges shared by interviewees, borne out by desk research, are that: 

• Investors, data providers and companies tend to be: a) counting policies, processes, or corrective actions as proxies for outcome metrics; or b) only focusing on metrics of impact in highly regulated, narrow, employee-focused areas such as health, safety, and diversity.
• Commonly used metrics about outcomes for affected stakeholders tend to be formulated in ways that give limited insight into the role of a company in perpetuating or tackling those challenges. As noted above, this is the case for the metric formulations that many regulators and data providers use concerning forced labour and child labour.
• Data provider analysis seems to focus on whether the company says that it has targets and metrics for human rights issues, even if these targets are not about outcomes. A company may score highly because it sets targets, for example, to conduct social audits across 100% of its first-tier suppliers and 50% of its second-tier suppliers by a certain date. Such a target lacks any insight about outcomes for workers.
• Even in highly regulated areas, such as health and safety, and diversity and inclusion, where outcome metrics are well established, these metrics tend to be focused on business risk or reporting figures rather than outcomes. This has the benefit that an investor has more chance of accessing data for thousands of companies. But it has the drawback that many well-established metrics open space for companies to count in ways that obscure outcomes for people. For example, research⁸  shows that the safety metric of Lost Time Injuries (LTI) can be ‘gamed’ by companies through putting people back to work in different jobs for which a certain level of physical mobility may not be necessary. Such practices can result in worse outcomes for injured workers but reduce a company’s LTI rate.

Promising practices

Interviewees advocated two promising practices: setting out what constitutes a credible social target and / or KPI, and focusing on inequality-related workforce metrics. 

1. Criteria for credible social targets and KPIs

This approach is gaining some traction regarding recent corporate disclosure frameworks, where ‘criteria’ or ‘principles’ have begun to be articulated for target-setting on social issues.⁹  These criteria include that a target should be:

• Focused on the company’s salient human rights risks.
• Outcome-oriented, meaning that it should be either: a) a direct measure of outcomes for people such as the number of employees covered by collective bargaining agreements, or the extent to which indigenous communities can exercise their right to free, prior and informed consent or b) a measure of systemic changes aimed at improving outcomes for people such as achieving industry-wide commitment to collective bargaining, or embedding land rights in local laws in high-risk contexts.
• Clear about the timescale, including interim milestones, and whether the target applies to the consolidated group, a single entity, its upstream or downstream value chain, or specific geographic regions.
• Supported by information about measurement methods and underlying assumptions.
• Developed with input from internal or external subject-matter experts and, wherever possible, affected stakeholders and / or their legitimate representatives.
• Accompanied by qualitative information to provide context, including, for example, information about the operating contexts in which outcomes are being measured.

2. Focusing on inequality-oriented workforce metrics

Interviewees and desk research suggested it may be possible to overcome common challenges by measuring outcomes for at least one stakeholder group: a company’s own workforce. This is a key part of managing human rights issues.

Most companies and data providers already focus on data relating to workers in a company’s operations, consistent with regulators’ growing attention to human capital management. Every company – regardless of its industry, location, and size – has a workforce and, in principle, should be able to collect, assess and disclose data about that workforce. Moreover, tracking workforce metrics is increasingly recognised by business to add value to its internal decision-making, which may reduce barriers to investing resources in data collection. Information garnered from interviews, and publicly available information about data provider methodologies, suggests that most, if not all, data providers address labour rights issues as part of their social analysis. Still, the focus in many cases is on a limited set of issues such as health and safety.

PRI resources: How investors can advance decent work

Evaluating a company based on a small number of workplace metrics focused on decent work and equality will not cover a company’s entire social performance, but may offer insight into: 

• outcomes for an important set of any company’s affected stakeholders: its workforce;
• a company’s culture, lack of safeguards and / or adverse employment relationships with regards to vulnerable and at-risk people; and
• whether a company’s workplace practices are tackling or exacerbating pre-existing decent work issues (such as forced labour, the digital divide and gender pay gap amongst others) that are intrinsically linked to economic inequality.

Investors and data providers preferred that analysis of companies’ social performance was based on company disclosures that align with standardised reporting frameworks, as it increases the comparability of data for many companies. However, the content of company reporting needs to address the four categories of information set out in the previous section. Otherwise, it will remain impossible for data providers and investors to conduct more incisive analyses of companies’ practices and performance.

Interviewees said the data investors are seeking are only accessible via engagement with portfolio companies rather than via disclosures. However, a review of the disclosures of companies that are leaders in implementing the UNGPs suggests that there is no barrier, in principle, to companies reporting the kinds of information that investors require.

Moreover, a close analysis of new and evolving international reporting standards offers cause for cautious optimism that there will be increasing disclosures.

This analysis involved cataloguing specific questions that interviewees shared as important for assessing companies’ social performance, and then evaluating whether the principles and requirements of two significant reporting standards and one reporting framework are likely to elicit company disclosures in response to those questions. We focused on Categories 2 (how the board and leadership help embed commitments in company culture and practice) and 3 (the quality of HRDD), and reviewed the GRI Universal Standards, the Draft European Sustainability Reporting Standards and the CDSB framework for reporting environmental and social information. (See footnote¹¹  for an explanation of why these standards are important.)Table 2 below presents the results of this analysis: 

• Disclosure standards appear to be converging with the same data needs that interviewees identified. This convergence is clearest in the EU standards, but also holds true with others.
• This convergence is positive news for commercial and civil society data providers seeking to improve their own social ratings and rankings, but their efforts can be frustrated by a lack of company disclosure that goes beyond data about policies, processes and activities.

Table 2: The overlap of investor data needs andinternational reporting standards

The PRI signatories interviewed for this project consistently noted the importance of stakeholder involvement – in particular that of civil society – in their responsible investment activities. Several investors shared that they involve civil society voices directly in their own analysis of portfolio human rights risks, and when deciding on time-limited (usually annual) thematic priorities for engagement. One investor said that they have experience in engaging with workers’ organisations to gain insight about specific companies of concern.

With regard to the potential for stakeholder insight to inform analysis and investment decisions, interviewees focused on three distinct types of information: 

• Civil society benchmarks and rankings: Investors find the research, underlying raw data and analysis conducted by benchmarks and ratings to be a useful source of information, most notably in engagement. Commonly referenced were Know the Chain; Ranking Digital Rights; the WDI; and the World Benchmarking Alliance’s Social Transformation Framework and Corporate Human Rights Benchmark. For more background on these initiatives see: Human rights benchmarks for investors: an overview.
• NGO research: Investors regularly seek out and review NGO reports and articles for insight about human rights risks or impacts in a specific sector or geography and / or company. Multiple interviewees mentioned that the Business and Human Rights Resource Centre¹²  is a particularly important resource.
• Social media and other online resources: Some investors are beginning to use social media platforms to understand employee and other stakeholders’ perspectives about a specific company or issue in a local context. One investor mentioned Glassdoor as an example of where investors can attempt to gain insight into the workplace practices and culture of a specific company.¹³

The most significant issue raised by investors is the form in which information exists (largely PDF or Word documents, online news reports, Excel files, social media posts) as well as the lack of digital tagging, which makes such information very difficult to use and integrate with internal data management systems.

Some experimentation and innovation to address this challenge is underway. One investor mentioned that they are, along with peers, talking to the Business and Human Rights Resource Centre about an investor-focused Application Programme Interface (API), a software tool that would allow the centre’s web-based information to integrate with the investor’s internal information systems. 

A final issue raised by interviewees was the importance of having confidence in the content that companies report and the analysis of that content by third-party data providers. Increasing the volume of meaningful information and data in the public domain about companies’ social performance is a significant challenge. If the capability to verify, evaluate and make sense of that information is lacking, investors and other stakeholders will likely draw vastly different conclusions. This can in turn disincentivise companies from disclosing more meaningful information that requires more expert interpretation.

As such, central to creating a virtuous cycle of data supply and demand is that assurance providers and analysts are capable of, and even accountable for, conducting good quality analysis of corporate disclosures.

Regarding assurance providers, there are professional bodies that could be tasked with building and possibly accrediting the competence needed to assure more mature human rights reporting. Guidance for assurance providers in this area already exists.¹⁴  The demand for service providers to have the skills to assure sustainability reporting is set to grow given moves, most notably in the EU, to require all sustainability information to be assured.

The pathway to ensuring high quality and consistent analysis of corporate reporting is less clear. There is some political momentum to regulate ESG data providers.¹⁵  Larger investors interviewed for this project shared that they tend to use data provider scoring as a trigger for their own in-house analysis, suggesting a degree of distrust. But this is not a viable solution that will work for the wider marketplace, in particular for mid-sized and smaller firms without that internal resource.

The role of technology to scale analysis of information is a much-explored issue. Interviewees mentioned efforts to replace or supplement analysts with technology, such as artificial intelligence and natural language processing.¹⁶  These tools may allow an investor to analyse hundreds of thousands of companies in real time and at a fraction of the cost.

However, experimenting with such tools has yet to deliver. A recent Danish Institute of Human Rights report addresses key barriers to using technology to analyse company reporting, including the format and presentation of data and the limitations of algorithms. The report noted “there is a clear need to acknowledge the limits of what this kind of algorithm-assisted analysis can tell us about the data, in that it cannot assess the quality of reporting, only whether text is relevant to an indicator”.