HR3.1: How to collect, prioritize, and escalate information on Human Rights issues

TABLE OF CONTENTS

• Why this matters
• What HR3.1 requires
• Step 1: Map existing information channels
• Step 2: Identify process gaps
• Step 3: Design a simple intake and logging process
• Step 4: Prioritize cases using severity and likelihood
• Step 5: Set a clear escalation path and timelines
• Step 6: Link the process to action, remediation and learning
• Step 7: Review the process regularly

Why this matters

HR3.1 is where human rights due diligence becomes part of day-to-day operations. It requires your company to have a clear and documented process to collect, prioritize, and escalate information on actual and potential negative human rights impacts across its own operations and value chain.

This matters because signs of harm can appear in many different ways. A worker may file a complaint. A community may raise an allegation. An NGO report may highlight a serious concern. An audit may uncover unsafe conditions or wage issues. Internal changes, such as entering a new sourcing country, changing suppliers, launching a new product, or acquiring another company, may also create new or increased human rights risks. 

HR3.1 asks whether your company has a practical system for handling that information when it appears. In simple terms, the requirement asks three questions: Does the information have somewhere to go? Is there a clear way to judge which cases are most serious for people? And do serious cases reliably reach the people with the authority to act? 

A strong HR3.1 process helps move a company from a reactive to a proactive approach. Rather than deciding how to act only once an issue has become public or escalated, the company has an established process to receive information, assess credibility and urgency, involve the right people, and decide how to respond. 

What HR3.1 requires

HR3.1 focuses on process. It is about making sure your company does not look away when signs of harm appear. Instead, it should collect relevant information, assess which cases are most serious, and escalate the most important issues so they can be addressed.

This process should cover both actual and potential negative human rights impacts. It should also cover your company’s own operations and value chain. Most importantly, prioritization should be based on impact on people, not only on legal, operational, or reputational risk. 

The process should also explain when and how the company will seek additional information about an actual or potential impact, including when to involve stakeholders or affected stakeholders. It should also identify what kinds of internal changes will prompt the company to proactively assess potential negative impacts. For example, if the company changes sourcing countries, it may need to assess potential human rights impacts before making or implementing that change. 

Step 1: Map existing information channels

Before creating a new process, take stock of what your company already does to identify, receive, and manage information about potential or actual impacts on people. Many companies already have relevant systems in place, even if they are not labelled as “human rights” processes. 

The aim is not necessarily to create unnecessary duplication or bring all information into one database. Instead, map the existing processes, teams, and channels through which relevant information is generated, received, assessed, or escalated. This will help you understand what is already working, where information may be fragmented, and where gaps may need to be addressed. 

What channels can feed into the process? 

Your company may collect information through several existing mechanisms, such as: 

• Grievance and complaints procedures for workers and communities

• Notification or whistleblowing mechanisms

• Local HR channels and people managers

• Supplier and procurement channels

• Existing incident reporting systems, such as health and safety, security, or ethics hotlines

• Audits, stakeholder engagement, and external reports

For each process, consider what type of human rights-related information it may capture, who is responsible for reviewing it, how serious concerns are escalated, and whether affected people can safely raise concerns.

Step 2: Identify process gaps

Once you have mapped the processes and information channels that already exist, identify where your company may be unprepared to receive, assess, escalate, or respond to human rights-related signals. 

Use your salient human rights issues as one starting point. Consider whether your existing processes would allow the company to detect and respond appropriately to specific impacts within those areas. For example, if labor rights in the supply chain are a salient issue, can the company receive and act on signals relating to forced labor, child labor, serious safety risks, unpaid wages, excessive overtime, or restrictions on freedom of association? 

You can also look at: 

• Issues the company has received in the past: What concerns, complaints, incidents, audit findings, or external allegations have previously arisen? How effectively were they handled?

• Issues the company could reasonably expect to receive in the future: Based on its operations, value chain, countries of operation, sectors, workforce, and stakeholder groups, where might concerns emerge even if none have been raised yet?

• Gaps in current processes: Are there areas where affected people, workers, communities, or external stakeholders may lack a safe or accessible way to raise concerns? Are responsibilities, escalation routes, or response expectations unclear?

• Triggers for proactive review: What internal changes should prompt the company to assess potential human rights impacts before they occur? Examples may include changing sourcing countries, onboarding high-risk suppliers, entering new markets, changing workforce models, launching new products or services, or acquiring another company.

The goal is to identify where stronger processes, clearer ownership, or better coordination may be needed so that the company is prepared when concerns arise.

Step 3: Design a simple intake and logging process

Once you know where information comes from, create a simple system to record relevant information.

A practical approach is to maintain a central human rights incidents log or tracker. This can be a secure spreadsheet, case tracker, or other case management tool. What matters is that relevant human rights information is recorded in a consistent way, regardless of which channel it came through. This helps your company move from scattered signals to a structured process.

Your log should capture a standard set of information for each case. For example:

• Date received

• Source of information

• Description of the issue

• Who may be affected

• Location

• Business unit, site, or supplier involved

• Whether the issue is actual or potential

• Any immediate action already taken

This structure makes it easier to compare cases, identify patterns, and decide what should happen next. 

In practice, the central log is often maintained by a Human Rights or ESG function. However, information usually comes from many parts of the business, including HR, procurement, health and safety, compliance, legal, sustainability, and local management. The process works best when ownership is clear, but information sharing is cross-functional.

Step 4: Prioritize cases using severity and likelihood

HR3.1 does not expect companies to treat every case as equally urgent. Some issues involve more serious harm to people and require faster action. That is why prioritization is an essential part of the process. 

Use a simple scoring method to help compare impacts consistently. Many companies use a 1 to 5 scale for severity and likelihood.

For severity, score according to:

• Scale: how serious is the harm?

• Scope: how many people are or could be affected?

• Remediability: how difficult would it be to restore affected people to their prior situation?

For likelihood, score according to: 

• Frequency of warning signs

• Strength of contextual risk factors

• Weakness of existing controls

• Whether similar issues have occurred before

You can calculate a simple score if helpful. However, do not rely only on the number. Use scoring as a guide, not a substitute for judgment. 

Any issue involving very severe harm should be flagged for urgent review, even if it does not have the highest combined score. Examples may include forced labor, child labor, death, serious injury, severe discrimination, retaliation against complainants, or threats to affected communities. These issues often require immediate escalation.

Your company should document why each case received its rating. This helps make the decision-making process traceable and consistent. For example, your log might note that a case was prioritized because it involved ongoing underpayment affecting a large number of workers, or because repeated complaints suggest a pattern in a particular supplier group or location. 

This kind of documentation supports internal learning and helps show that prioritization is based on harm to people, not guesswork.

Step 5: Set a clear escalation path and timelines

Collecting and prioritizing information is not enough. HR3.1 also requires serious issues to reach the right decision-makers in time. Your company should define a clear escalation process that explains who handles cases at each level, when additional information should be gathered, when stakeholders should be involved, and when more serious issues must be raised.

Many companies assign day-to-day triage to a Human Rights or ESG Manager. In some cases, this is handled by a cross-functional human rights committee. The important thing is that someone is clearly responsible for reviewing incoming cases, rating them, deciding whether more information is needed, and determining whether escalation is required.

How can you structure escalation?

A practical model is to set thresholds by case severity

• Low-priority cases: These may be handled locally by teams such as HR or procurement within a defined timeframe. A short summary should still be entered into the central log.

• Medium-priority cases: These may require review and approval by the Human Rights or ESG Manager, with periodic updates to senior leadership.

• High-severity cases: These should be escalated within a fixed timeframe, such as 48 to 72 hours, to a designated senior leader, committee, or C-level owner. There should be a clear person accountable for the response.

This kind of structure helps ensure that serious cases do not stay stuck at the local level. 

The escalation process should also explain when and how the company will seek additional information. This may include contacting the person or group that raised the concern, reviewing audit findings, speaking with local teams, engaging an independent investigator, consulting trade unions or worker representatives, or involving affected stakeholders where it is safe and appropriate to do so.

Step 6: Link the process to action, remediation and learning

HR3.1 is not only about collecting information. It should also help your company act on what it learns. Once a case is identified as serious, your company should create a clear case plan that sets out:

• What actions will be taken

• Who is responsible

• By when

• Whether remediation is needed

• Whether affected stakeholders should be consulted or involved

• How progress will be tracked

• When the case will be reviewed or closed

This connects HR3.1 to the wider HR3 requirement to prevent, mitigate, and remediate actual and potential negative human rights impacts. On how to respond to Human Rights impacts, please see the article HR3.2: How to respond to Human Rights impacts - prevent, mitigate, and remediate.

Because actual impacts involve ongoing or completed harm, your company should have a way to escalate them quickly. A strong HR3.1 process should not depend only on an annual review. It should allow serious issues to be raised and acted on whenever they appear.

Step 7: Review the process regularly

Priorities can change. New suppliers, new countries, new products, new clients, acquisitions, restructurings, workforce changes, or crises may create new human rights impacts or make existing ones more severe. Your company should review its prioritization regularly and update it when there is a significant change in context or operations.

This review should consider both information received through existing channels and internal changes that may require proactive assessment. For example, if the company plans to source from a new country, significantly change a supplier base, or introduce a new labor model, it should assess whether this could create or increase potential negative human rights impacts.

It is also helpful to document when the prioritization was last reviewed, what new information was considered, and what changes were made to the process or action plan.