Human rights risk assessment and due diligence in the cobalt supply chain

The OECD Guidance for Multinational Companies sets out different due diligence requirements that stem from the different responsibilities companies have according to their location in the supply chain.

Expectations for downstream companies

Have a clear responsible sourcing policy in place that specifically includes cobalt . senior oversight, accountability mechanisms and systems to measure the effectiveness of the policy along with an explicit timeline for implementation.
Identify smelters or refiners in their supply chain and assess whether they conduct due diligence in compliance with international standards . should this not be the case, downstream companies must use leverage to pressure suppliers into taking the necessary steps.
Report at least annually on targets and progress in reaching them as well as reporting on both the socioeconomic (and expected) outcomes of actions by the company.

Key questions for downstream companies

Responsible sourcing policy and governance

Does the company have a responsible sourcing policy or equivalent for minerals, specifically cobalt, and is it aligned with relevant aspects of the OECD’s Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, the UN Guiding Principles on Business and Human Rights and the International Labour Organization (ILO) standards?
How has the company gone about implementing this policy and how is this communicated to and embedded in the relevant units/divisions of the company?
Has the company set some clear targets around this policy? What is the time horizon of these targets? Are there some internal accountability mechanisms should the targets be missed?

Traceability and human rights risk assessment

Does the company provide evidence to demonstrate that it appreciates the length and complexity of its cobalt supply chain?
Has the company mapped its supply chain at least down to the smelter level and ideally down to mine level? Has the company identified the cobalt smelters in its supply chain and does it disclose this list? If not, why? If yes, to what extent is this information disclosed (e.g. names of suppliers/smelters, geographical location)?
How frequently is this exercise undertaken and what combination of self-checks or reporting, third-party, or company audits are used to verify this information? How is it ensured that this process is viable over time?
Does the company know what proportion of its indirect cobalt supply is (a) of DRC origin and (b) artisanally sourced from the DRC? If no, why not? If yes, with what confidence is this information known and with what frequency is this assessed?
Using the OECD due diligence guidance, has the company assessed what percentage of DRC-origin cobalt in its supply chain is connected to ASM?
How does the company prioritise which risks to focus on in its human rights risk assessments?
Has the company conducted human rights risks assessments in its cobalt supply chain? Does the company disclose a summary of the findings of these assessments? If the company does not conduct human rights risks assessment or disclose the assessment results, is it able to explain why not?
What are the established procedures or guidelines that determine the response to finding human rights/child labour violations?

Supplier relationships (down to smelter/refiner level)

Has the company established a supplier code of conduct that reflects relevant international standards such as the ILO core standards (that covers child labour)? Does this supplier code of conduct apply to all suppliers and sub-suppliers?
Is the supplier code of conduct approved at senior level and is it reviewed on a regular basis to ensure it addresses all identified risks?
How does the company assess whether its suppliers comply with the expectations articulated in its supplier code of conduct? Does it check compliance via independent third-party audits? If not, why? If yes, how often?

Expectations for upstream companies

Trace cobalt back to mining sites and identify the circumstances of extraction, trade, handling and export of the mineral.
Provide the information resulting from due diligence and mapping of the supply chain to downstream customers and publicly disclose them.
Smelters/refiners should have a chain of custody or traceability system in place down to the mining sites.
Submit themselves to regular independent thirdparty audits to monitor compliance with international standards and disclose the results of these audits to downstream customers.

Key quesions for upstream companies

Supply chain mapping and due diligence

Has the company mapped its supply chain down to mine level? Has it identified a list of suppliers down to mine level and does it disclose this list? If yes, to what extent (e.g. only to customers or publicly available)? If no, why not?
Does the company know its exposure to cobalt sourced from the DRC? If no, why not? If yes, with what confidence is this information known and with what frequency is this assessed?

ASM and human rights risk assessment

Has the company identified salient and material human rights risks in its cobalt supply chain? If yes, what mechanisms has the company put in place to address and mitigate these risks?
Using the OECD due diligence guidance, has the company assessed what percentage of DRC-origin cobalt in its supply chain is connected to ASM?
Has the company engaged directly with traders or has it leveraged its suppliers to engage with them to identify the origin of cobalt and the circumstances in which it was mined?
What measures does the company take to ensure that the mining conditions are optimal and payment is regular and fair? Is this through receipt of certificates from suppliers, its own checks, third-party audits? How frequently and across what extent of the chain is this carried out? Responses may include work already done and to be done.

Monitoring supplier compliance

How does the company assess supplier compliance with its code of conduct? Is a third party involved in the monitoring?
How does the company address identified cases of non-compliance? Does the company support suppliers in adopting good practices (e.g. through training and capacity building)?