HR2.1-2.3: How to identify and assess your company's salient human rights issues

TABLE OF CONTENTS

• Why this matters
• What are salient human rights issues?
• What does a compliant HR2.1 process look like?
• What is the link between HR2.1 and HR2.3? 
• Before you begin: choose your starting point
• Step 1: Map your business
• Step 2: Map your business relationships
• Step 3: Assess potential and actual human rights impacts 
  • What is the difference between potential and actual impacts? 
  • How should you assess impacts in practice? 
  • What risk factors should you consider? 
• Step 4: Identify and score your salient issues
  • How should you assess severity?
  • How should you assess likelihood?
  • How do you make your tracker HR2-ready?

Why this matters

Companies cannot address every human rights risk at once. HR2.1 helps your company identify the human rights issues that matter most now – the issues where people are at the greatest risk of serious harm through your operations and value chain. These are called your salient human rights issues.

Saliency matters because it helps your company focus its time, attention, and resources where they are needed most. It also creates the foundation for HR2.3, which requires your human rights strategy to reflect the issues you have identified as most significant. In practice, this means your assessment should guide what your company prioritizes, strengthens, monitors, and addresses first.

What are salient human rights issues?

Salient human rights issues are the human rights at greatest risk of severe negative impact through your company’s activities, products, services, and business relationships. This includes your own operations and your wider value chain, such as suppliers, contractors, clients, investors, and other business partners.

The goal is not to make a long list of every possible issue. The goal is to identify the issues where harm to people could be most serious or is already happening, so your company can act first where the stakes are highest. For example, an apparel company may identify forced labor and unsafe working conditions in factories in specific regions as its most salient issues. It can then reflect those priorities in its strategy, training, supplier engagement, and monitoring.

What does a compliant HR2.1 process look like?

A compliant HR2.1 process should be documented, practical, and current. In most cases, companies will conduct a human rights saliency assessment or integrate saliency into an existing risk or impact assessment. A strong process usually includes:

• Reviewing internal and external information

• Engaging relevant stakeholders

• Considering risks across the company’s operations and value chain

• Using internationally recognized human rights standards

• Identifying specific human rights issues, rather than relying on broad categories. For example, this could include forced labour, excessive working hours, discrimination, unsafe working conditions, or risks to indigenous people’s rights 

• Specifying where and in which parts of the business or value chain these issues are most salient. Identifying forced labour as a potential issue is not sufficient on its own; the assessment should clarify where the risk is most acute: for example, forced labour risks among migrant workers in construction supply chains in South-East Asia, or in a particular sourcing country, commodity, supplier tier, or operational site 

• Prioritizing issues based on severity, and also likelihood where relevant

• Updating the assessment within the last 36 months

Your company should also show how it considered information from the Risk Tool alongside other evidence, and how it used that information to prioritize issues.

What is the link between HR2.1 and HR2.3? 

HR2.1 is about identifying your salient human rights issues. HR2.3 is about making sure your human rights strategy reflects those findings. Once your company identifies its salient issues, those issues should guide:

• Which policies and procedures need to be strengthened

• What your human rights strategy focuses on

• How your due diligence processes are designed

• Where to focus  guidance for workers and supplier engagement

In other words, HR2.1 tells you what matters most. HR2.3 requires you to act on that knowledge strategically.

Before you begin: choose your starting point

The assessment should cover all individuals and communities who may be affected by the company’s operations and value chain. However, this does not mean that every area needs to be assessed with the same level of depth from the outset.

A practical approach is to first map the full scope of potential impacts across the business and value chain, then focus the most detailed assessment on the one or two areas where the most significant human rights questions or risks are likely to arise. Useful starting points may include procurement and supply chains, investments and investors, clients, or project activities. 

For each area you select, your company should do four things:

• Map how that part of the business works.

• Map the key business relationships.

• Assess potential and actual human rights impacts.

• Prioritize which issues are salient.

This makes the process more manageable and helps your company build a practical assessment over time.

Step 1: Map your business

As HR2.1 does not prescribe a specific methodology or set of steps, the approach below is a recommended starting point for building a robust human rights assessment process.

Start by building a simple picture of how your business is set up. The purpose is to understand where impacts might arise.

Bring together a small group of people who understand the business well. This may include colleagues from operations, procurement, HR, legal, sustainability, or country teams. In one page or in your tracker, document the basics of your business model.

What should you map? 

• Products and services

• Revenue streams

• Main customer groups

• Countries of operation

• Key sites and markets

• Subsidiaries or joint ventures

• Main business units or departments

Step 2: Map your business relationships

As HR2.1 does not prescribe a specific methodology or set of steps, the approach below is a recommended starting point for building a robust human rights assessment process.

Next, map the main relationships in your value chain. The goal is to make visible who your company is connected to and how those connections may relate to human rights risks.

Start with your own operations and internal functions. Then add your direct relationships, such as suppliers, customers, clients, investors, franchisees, contractors, or agents.

What should you capture? 

For each relationship group, record: 

• Name or category

• Relationship type

• Location or country

• Role in the value chain

You can then expand outward where information is available. This may include sub-suppliers, subcontractors, high-risk upstream tiers, or downstream distributors and stores.

It is also helpful to distinguish relationships inside your legal group, such as subsidiaries, from external business partners. This supports a clearer understanding of where impacts may sit across your own operations and chain of activities.

At this stage, focus on mapping only. Leave risk and saliency scoring for the next steps.

Step 3: Assess potential and actual human rights impacts 

Once you have mapped your business and relationships, assess what could go wrong for people and what is already going wrong. This step is central to HR2.1. It helps your company identify both potential negative human rights impacts and actual negative human rights impacts.

What is the difference between potential and actual impacts? 

• Potential impacts: Potential impacts are harms that have not happened yet, but could happen if the company does not act. These are forward-looking situations where people may be negatively affected through operations, products, services, or business relationships.

• Actual impacts: Actual impacts are harms that have already happened or are currently happening. These may result from the company’s own operations or from its value chain. 

How should you assess impacts in practice? 

Work through your tracker row by row for the scope you selected. For each business area or relationship group, ask three simple questions:

1. Who could be affected here? Think about workers, communities, consumers, human rights defenders, migrant workers, Indigenous Peoples, temporary workers, and other affected groups.

2. What could realistically go wrong? This helps you identify potential impacts. Focus on realistic situations, not only theoretical ones.

3. Do we already see signs of harm? This helps you identify actual impacts. Look for evidence from monitoring, complaints, incidents, or external reports.

What risk factors should you consider? 

To assess impacts well, look at the wider context around each relationship or activity.

• Country or context risk: Consider issues such as weak law enforcement, conflict, corruption, or high levels of informal work.

• Industry or sector risk: Some sectors face recurring human rights risks. These may include agriculture, apparel, extractives, construction, logistics, ICT, or security.

• Business model and practices: Business decisions can increase risk. For example, price pressure, short lead times, reliance on temporary labor, agency work, or piece-rate systems may increase the chance of harm.

• Product or service risk: Some products or services create specific risks, such as privacy concerns, surveillance, high-risk infrastructure, financial exclusion, or impacts on access to essential services.

• Known sector issues and vulnerable groups: Pay attention to recurring issues such as child labor, forced labor, wage theft, unsafe working conditions, discrimination, gender-based violence, threats to human rights defenders, or harms affecting migrant or informal workers.

Step 4: Identify and score your salient issues

After mapping impacts, prioritize the issues your company must focus on first. These are your salient human rights issues. The simplest way to do this is to score each issue using two columns: severity, and likelihood.

How should you assess severity?

Severity should be the main priority, meaning highly severe impacts — even if they are unlikely — should still be prioritized. This is consistent with due diligence practice and the UN Guiding Principles. When scoring severity, consider:

• Scale: How serious is the harm for each affected person?

• Scope: How many people could be or are affected?

• Remediability: How difficult would it be to restore people to their previous situation?

How should you assess likelihood?

Likelihood helps you understand how probable the issue is, especially for potential impacts. When scoring likelihood, consider:

• Whether the issue has already occurred

• Whether there are strong warning signs

• Whether controls are weak

• Whether the issue appears repeatedly or across multiple sites

For guidance on how to adequately process information about incoming human rights issues, you can consult this article: HR3.1: How to collect, prioritize, and escalate information on Human Rights issues.

How do you make your tracker HR2-ready?

Your tracker should become a practical working tool, not just a one-time document. To make it ready for HR2.1 and HR2.3, include:

• A short methodology section: Explain how you mapped the business and relationships, what risk criteria you used, and how you scored severity and likelihood.

• A clear statement on scope: Your assessment should state that it covers all individuals and communities affected by the company’s own operations and value chain.

• A date and review plan: The assessment should be current. It should have been completed or updated within the last 36 months. It should also include a plan for review, such as every three years or sooner when there is a major change like a new market, product, acquisition, or crisis.