Legal, Regulatory and International CSR Frameworks

Introduction

Corporate social responsibility (CSR) is not merely voluntary philanthropy. It is the way an organisation identifies, prevents, manages and accounts for its effects on people, the environment and society. In contemporary business, CSR operates within a layered system of law, regulation, international standards, investor expectations and stakeholder pressure.

A company may be legally incorporated in one country, manufacture in another, sell globally and obtain finance from international institutions. Its CSR responsibilities therefore arise from several sources: company law, labour law, environmental regulation, consumer protection, human-rights law, contractual obligations and internationally recognised standards. These sources do not always have the same legal status. A statute may be binding, whereas ISO 26000 provides guidance and the UN Global Compact is a voluntary commitment. Nevertheless, voluntary frameworks can become commercially significant through procurement requirements, reporting expectations, lender conditions and reputational consequences.

This chapter explains how these layers interact and how CSR professionals can translate them into practical organisational systems. It also distinguishes legal compliance from responsible business conduct. Compliance is the minimum requirement; responsible conduct often requires an organisation to address foreseeable harm even where the law is incomplete, weakly enforced or silent.

Learning Objectives

By the end of this chapter, learners should be able to:

1. distinguish legal obligations from voluntary CSR frameworks;
2. identify the relevance of company, labour, environmental, consumer and human-rights law;
3. explain the purpose and application of ISO 26000, the UN Global Compact, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines and the Sustainable Development Goals;
4. apply a risk-based due-diligence process to a business problem;
5. evaluate the limitations and governance implications of international CSR frameworks; and
6. recommend practical controls, reporting arrangements and remediation measures.

1. The Architecture of CSR Governance

CSR governance can be understood as a hierarchy and network rather than as a single rulebook. Four broad layers are important.

The same issue may appear in all four layers. For example, forced labour may be prohibited by national law, forbidden by a customer contract, addressed by the UN Guiding Principles and prohibited by a company supplier code. A CSR manager must therefore ask four questions:

• What is legally required?
• What has the organisation promised stakeholders?
• What international expectations apply to the sector and supply chain?
• What action is necessary to prevent or remedy adverse impacts?

A useful principle is “comply, prevent, explain and improve.” The organisation must comply with law, prevent harm where possible, explain decisions transparently and improve performance through monitoring and corrective action.

Figure: CSR governance operates through interacting legal, contractual, international and organisational layers.

2. Company Law and Corporate Governance

Company law establishes the legal identity, authority and accountability of the organisation. It commonly regulates incorporation, directors’ duties, shareholder rights, financial reporting, audits, insolvency and related-party transactions. The exact rules differ by jurisdiction, but CSR is increasingly connected to core governance rather than treated as an external public-relations activity.

Directors and the corporate interest

Directors generally owe duties such as care, skill, loyalty, good faith and avoidance of conflicts of interest. In many systems, the interests of the company may be interpreted broadly enough to include long-term sustainability, employees, creditors, communities and environmental consequences. Even where directors primarily owe duties to the company or shareholders, environmental and social risks can create clear financial, legal and reputational risks for the company.

Examples include:

• approving a factory despite known safety defects;
• ignoring bribery or human-trafficking risks in a supply chain;
• publishing sustainability claims unsupported by evidence;
• failing to disclose a material climate or human-rights risk; and
• allowing conflicts of interest in charitable donations or procurement.

The board should set the organisation’s purpose, approve material policies, allocate resources, oversee risk and verify that management has effective controls. A CSR committee can assist, but responsibility should not be isolated in that committee. Human rights, safety, climate and ethical conduct should be integrated into enterprise risk management, internal audit and performance evaluation.

Disclosure and accountability

Company law and securities regulation may require disclosure of information that is material to investors. Sustainability reporting rules in several jurisdictions increasingly require information on climate, workforce, human rights and value-chain impacts. A report should be accurate, balanced, comparable and supported by evidence. Selectively highlighting achievements while omitting serious adverse impacts can produce misleading communication and possible liability.

3. Labour and Employment Obligations

Labour law gives practical meaning to the social dimension of CSR. Relevant obligations commonly include employment contracts, wages, working time, leave, occupational health and safety, equality, freedom of association, collective bargaining, protection from harassment and termination procedures.

International labour expectations are strongly associated with the International Labour Organization’s fundamental principles and rights at work. These include freedom of association and collective bargaining, elimination of forced labour, abolition of child labour and elimination of discrimination in employment. National law may provide stronger or more detailed protection.

Occupational health and safety

An employer’s responsibility extends beyond issuing a safety policy. It normally includes hazard identification, risk assessment, training, personal protective equipment where appropriate, emergency preparedness, incident investigation and continuous improvement. A useful control cycle is:

1. identify hazards;
2. assess likelihood and severity;
3. eliminate or control the risk using the hierarchy of controls;
4. monitor incidents and near misses; and
5. review controls after changes or failures.

Contracting out work does not automatically remove responsibility. A principal company may face legal, contractual or ethical exposure where it selects an unsafe contractor, sets unrealistic production targets or ignores credible warnings.

Supply-chain labour

Risks may arise from recruitment fees, retention of identity documents, debt bondage, excessive working hours, child labour, discrimination and suppression of worker representation. Social audits can help, but they are not sufficient by themselves. Effective due diligence combines worker interviews, grievance channels, purchasing-practice review, supplier engagement and remediation.

4. Environmental Law and Corporate Responsibility

Environmental law seeks to prevent, control and remedy harm to air, water, land, biodiversity and climate systems. Common regulatory areas include environmental impact assessment, permits, pollution control, waste management, hazardous substances, water use, conservation and restoration.

Important legal principles include the precautionary principle, the polluter-pays principle, prevention at source and intergenerational equity. Their precise legal force varies by jurisdiction. Organisations should never assume that absence of a specific prohibition means absence of responsibility.

An environmental management system normally links legal registers, objectives, operational controls, monitoring, emergency response, audits and corrective action. It should cover direct operations and, where material, the value chain and product life cycle. ISO 14001 is a management-system standard, whereas ISO 26000 is broader CSR guidance; they should not be confused.

Environmental claims also create consumer and investor risks. Statements such as “carbon neutral,” “eco-friendly” or “fully sustainable” should have a defined scope, reliable evidence and transparent treatment of limitations. Offsetting does not automatically eliminate operational emissions or justify an unqualified claim.

5. Consumer Protection and Responsible Markets

Consumer law typically addresses product safety, quality, labelling, pricing, advertising, privacy, unfair contract terms and redress. CSR requires organisations to treat consumers as rights-holders rather than merely as market segments.

Key practices include:

• testing products against applicable safety requirements;
• providing clear, accurate and accessible information;
• avoiding deceptive environmental, health or social claims;
• protecting personal data and obtaining valid consent where required;
• designing accessible complaint and refund procedures; and
• considering vulnerable consumers in product design and marketing.

Digital platforms and artificial intelligence create additional issues, including opaque recommendation systems, discriminatory outcomes, surveillance, cybersecurity and automated exclusion. Governance should include human review for high-impact decisions, data minimisation, security controls, explanation appropriate to the context and a route for correction or appeal.

6. Human Rights and Business Responsibility

Human rights are inherent rights recognised in international instruments and national constitutions or laws. Business activities may affect rights including life, liberty, privacy, health, adequate living standards, freedom from discrimination, freedom of association, land and cultural rights, and access to remedy.

The UN Guiding Principles on Business and Human Rights (UNGPs), endorsed by the UN Human Rights Council in 2011, are organised around three pillars:

1. The state duty to protect: states must protect people from human-rights abuse by business through appropriate laws, policies and enforcement.
2. The corporate responsibility to respect: businesses should avoid infringing human rights and address adverse impacts with which they are involved.
3. Access to remedy: victims should have access to effective judicial and non-judicial remedies.

The corporate responsibility applies even where a state has failed to enforce its own law. Human-rights due diligence should be risk-based and proportionate. It includes identifying and assessing actual and potential impacts, integrating findings into decisions, tracking responses, communicating how impacts are addressed and enabling or cooperating in remediation.

A crucial distinction is between cause, contribution and direct linkage. A company causes an impact through its own conduct; contributes when its conduct substantially assists or incentivises another party’s impact; and may be directly linked through a business relationship. The appropriate response differs. Stopping conduct may be necessary where the company causes harm; prevention and leverage may be central where it is linked through a supplier; remediation is required where the company caused or contributed to harm.

7. ISO 26000: Guidance for Social Responsibility

ISO 26000 provides guidance rather than a certifiable management-system standard. Its seven core subjects are:

1. organisational governance;
2. human rights;
3. labour practices;
4. the environment;
5. fair operating practices;
6. consumer issues; and
7. community involvement and development.

It also identifies principles such as accountability, transparency, ethical behaviour, respect for stakeholder interests, respect for the rule of law, respect for international norms of behaviour and respect for human rights.

The standard encourages organisations to understand their impacts, identify stakeholders, integrate responsibility throughout the organisation and communicate performance. It is useful for structuring a CSR programme, but a company should not claim “ISO 26000 certified” in the same way it might claim certification to a certifiable standard. A responsible implementation uses ISO 26000 as a diagnostic and integration guide, not as a substitute for law or independent assurance.

8. The UN Global Compact

The UN Global Compact is a voluntary initiative based on ten principles in four areas: human rights, labour, environment and anti-corruption. Participants are expected to support and implement these principles and communicate progress.

The initiative is valuable because it gives organisations a common language and encourages alignment between policies, operations and reporting. However, participation is not evidence that an organisation has eliminated violations. A credible communication of progress should describe governance, actions, performance, setbacks and future priorities rather than rely on membership as a reputational badge.

9. OECD Guidelines for Multinational Enterprises on Responsible Business Conduct

The OECD Guidelines provide recommendations to multinational enterprises on responsible business conduct. Their themes include human rights, labour, environment, bribery, consumer interests, disclosure, science and technology, competition and taxation. The Guidelines are particularly important for supply-chain and cross-border due diligence.

They promote a six-stage due-diligence logic:

1. embed responsible business conduct into policies and management systems;
2. identify and assess actual and potential adverse impacts;
3. cease, prevent or mitigate impacts;
4. track implementation and results;
5. communicate how impacts are addressed; and
6. provide for or cooperate in remediation where appropriate.

National Contact Points can promote the Guidelines and handle complaints about alleged non-observance. Their procedures are generally non-judicial, but they can generate public statements, mediation and significant reputational pressure.

10. The Sustainable Development Goals

The 17 Sustainable Development Goals (SDGs), adopted by UN Member States in 2015 as part of the 2030 Agenda, provide a shared global development framework. Relevant goals may include SDG 5 on gender equality, SDG 8 on decent work, SDG 12 on responsible consumption and production, SDG 13 on climate action and SDG 16 on peace, justice and strong institutions.

The SDGs are not a licence to label any activity as sustainable. Organisations should begin with their material impacts, map them to relevant targets and define indicators. For example, a manufacturing company may connect worker-safety improvements with SDG 8, energy reduction with SDG 12 and emissions reduction with SDG 13. It should disclose both positive and negative effects and avoid claiming contribution merely because its normal commercial activity can be associated with a goal.

11. Applying Due Diligence in Practice

A practical CSR compliance and responsibility system can follow this sequence:

Scope. Identify entities, sites, products, workers, communities and business relationships.

Map obligations. Create a legal and commitments register covering jurisdictions, permits, contracts, policies and international frameworks.

Prioritise risks. Consider severity, scale, scope and the possibility of remedy. Human-rights salience should not be determined solely by financial materiality.

Engage stakeholders. Consult affected workers, communities, consumers, regulators, suppliers and civil-society organisations. Engagement should be safe, accessible and free from retaliation.

Integrate controls. Assign responsibility, revise procurement and production decisions, train personnel and establish escalation procedures.

Monitor and communicate. Use meaningful indicators, internal audit, worker feedback and independent assurance where appropriate.

Remedy. Provide or cooperate with legitimate grievance mechanisms and repair harm through apology, restitution, compensation, rehabilitation, guarantees of non-repetition or other suitable measures.

12. Illustrative Case: Electronics Supply-Chain Risk

Background

A fictional electronics company, BrightCircuit Ltd., sources batteries from a supplier in another country. Its procurement team discovers recruitment fees charged to migrant workers and working hours exceeding local limits. The supplier passes a social audit conducted six months earlier.

Problem

The audit did not detect the problem because workers were interviewed in the presence of supervisors and procurement records were not examined. BrightCircuit must determine whether to terminate the supplier, continue purchasing while seeking improvement, or take another approach.

Analysis

The recruitment fees may create debt bondage and therefore a forced-labour risk. Excessive hours may breach labour law and create health and safety risks. BrightCircuit may be directly linked to the impacts through its supplier. If its prices, delivery schedules or purchasing practices encouraged the supplier’s conduct, it may also have contributed to the harm.

The company should examine worker testimony, contracts, recruitment records, wage statements, production targets and grievance data. It should assess whether workers face retaliation and provide a confidential channel independent of the supplier.

Approach and solution

BrightCircuit should require immediate protection for affected workers, repayment of unlawful recruitment fees, correction of working-time records and access to remedy. It should revise purchasing forecasts and delivery expectations, because terminating the relationship without protecting workers may worsen their situation. A time-bound improvement plan should include worker participation, independent verification and escalation criteria. Severe abuse or refusal to remedy may justify suspension or termination, but responsible exit planning is essential.

Outcome

After four months, the supplier has repaid verified fees, reduced excessive hours, changed recruitment contracts and established a worker-elected committee. BrightCircuit continues monitoring and publishes a summary of the issue and corrective action without exposing workers’ identities.

Learning points

A passed audit is not proof of respect for human rights. Due diligence must be continuous, worker-centred and connected to purchasing practices. The appropriate response depends on whether the company caused, contributed to or is directly linked to harm. Remediation and prevention are more responsible than simply protecting the company’s reputation.

13. Challenges and Limitations

International CSR frameworks have important limitations. First, many are voluntary and lack direct enforcement. Second, different jurisdictions may impose conflicting requirements or different levels of protection. Third, supply-chain information can be incomplete, especially beyond first-tier suppliers. Fourth, audits may become procedural, predictable and subject to manipulation. Fifth, reporting can encourage selective disclosure or “SDG washing.” Sixth, small enterprises may lack the resources needed for sophisticated due diligence.

Frameworks can also reflect power imbalances. A global buyer may impose a supplier code while maintaining prices and deadlines that make compliance unrealistic. Effective CSR therefore requires attention to commercial incentives, worker voice and remedy, not just policies and questionnaires.

14. Best Practices for CSR Professionals

A credible programme should:

• maintain a current legal and obligations register;
• assign board and executive accountability;
• integrate CSR into procurement, finance, human resources, operations and risk management;
• prioritise impacts on people and ecosystems, not only reputational risk;
• use stakeholder-informed indicators and reliable evidence;
• protect whistle-blowers and prohibit retaliation;
• provide accessible grievance and remedy mechanisms;
• train employees and business partners according to role;
• communicate limitations, incidents and progress honestly; and
• review the programme after regulatory, technological or operational change.

Legal advice may be necessary for jurisdiction-specific questions. International frameworks guide responsible conduct but do not replace professional legal interpretation, regulator engagement or affected-community participation.

Chapter Summary

CSR is governed by a combination of binding law, contracts, market rules, international guidance and organisational commitments. Company law connects CSR with directors’ duties, risk management, disclosure and accountability. Labour law protects decent work, safety, equality and freedom of association. Environmental law regulates pollution, resources, waste and ecological harm. Consumer law requires safe products, accurate information, privacy protection and effective redress. Human-rights responsibility requires businesses to avoid infringement, conduct due diligence and participate in remediation.

ISO 26000 offers broad guidance across seven core subjects but is not a certifiable standard. The UN Global Compact provides ten voluntary principles. The UN Guiding Principles establish the state duty to protect, the corporate responsibility to respect and access to remedy. The OECD Guidelines provide a detailed due-diligence approach for responsible business conduct. The SDGs provide a global development framework, but organisations must connect them to material impacts rather than use them for superficial claims.

Effective CSR is continuous and risk-based. It requires stakeholder engagement, integration into business decisions, credible monitoring, transparent communication and remedy. Compliance is the foundation; responsible business conduct requires prevention and accountability beyond minimum legal requirements.

Key Terms

Corporate social responsibility: Organisational responsibility for impacts on society and the environment.

Due diligence: A process of identifying, preventing, mitigating, tracking and communicating responses to adverse impacts.

Human-rights impact: An actual or potential effect of business activity on a recognised human right.

Cause: Directly producing an adverse impact through one’s own conduct.

Contribution: Substantially assisting or incentivising another party’s adverse impact.

Direct linkage: Connection to an impact through products, services or business relationships.

Remediation: Action to correct, repair or compensate for harm.

Stakeholder: A person or group that affects, or is affected by, an organisation.

Materiality: Significance of an issue for decisions, impacts or reporting purposes.

ISO 26000: International guidance on social responsibility across seven core subjects.

UN Global Compact: Voluntary initiative based on ten principles concerning human rights, labour, environment and anti-corruption.

UN Guiding Principles on Business and Human Rights: Framework based on protect, respect and remedy.

OECD Guidelines: Recommendations for responsible business conduct by multinational enterprises.

Sustainable Development Goals: Seventeen global goals adopted in the UN 2030 Agenda.

Greenwashing: Misleading presentation of environmental performance or benefits.

Social audit: Assessment of labour or social conditions against specified criteria.

Grievance mechanism: A process through which concerns can be raised and addressed.

Soft law: Non-binding principles or guidance that influence conduct and expectations.

Review Questions

Short Answer Questions

1. Why is legal compliance considered the minimum level of CSR?
2. Identify the three pillars of the UN Guiding Principles on Business and Human Rights.
3. What are the seven core subjects of ISO 26000?
4. Distinguish between an actual and a potential human-rights impact.
5. Why can a social audit fail to identify supply-chain labour abuse?

Long Answer Questions

1. Explain how company law and corporate governance can integrate CSR into board-level decision-making.
2. Compare ISO 26000, the UN Global Compact and the OECD Guidelines in terms of purpose and practical use.
3. Discuss the relationship between labour law, human-rights due diligence and supply-chain management.
4. Explain how environmental and consumer-protection obligations influence responsible marketing.
5. Evaluate the role and limitations of the SDGs in corporate CSR reporting.

Analytical / Application Questions

1. A company discovers that a supplier uses migrant workers who paid recruitment fees and work excessive hours. Analyse the company’s possible relationship to the harm and recommend a due-diligence and remediation plan.
2. A firm advertises its product as “100% sustainable” while disclosing only its recyclable packaging. Identify the legal, ethical and governance concerns and propose a more accurate communication approach.
3. Design a one-year CSR governance plan for a medium-sized manufacturer that integrates legal compliance, ISO 26000, the UNGPs and two relevant SDGs.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the relationship between legal compliance and CSR?

A. CSR replaces the need to comply with national law.

B. Legal compliance is generally the minimum foundation of responsible conduct.

C. CSR applies only when no law exists.

D. Legal compliance and CSR are identical in every jurisdiction.

Correct Answer: B. Legal compliance is generally the minimum foundation of responsible conduct.

Question 2

Which of the following is one of the three pillars of the UN Guiding Principles on Business and Human Rights?

A. Mandatory corporate taxation

B. State duty to protect

C. Universal product certification

D. Shareholder primacy

Correct Answer: B. State duty to protect

Question 3

ISO 26000 is best described as:

A. A criminal code for multinational enterprises

B. A certifiable environmental management standard

C. Guidance on social responsibility

D. A treaty governing labour migration

Correct Answer: C. Guidance on social responsibility

Question 4

Which response is most consistent with risk-based human-rights due diligence?

A. Relying permanently on a single announced audit

B. Assessing impacts, integrating controls, tracking results and addressing remedy

C. Ending every supplier relationship after any complaint

D. Measuring only the financial cost of the risk

Correct Answer: B. Assessing impacts, integrating controls, tracking results and addressing remedy

Question 5

A company contributes to a human-rights impact when it:

A. Has no relationship with the activity

B. Substantially assists or incentivises another party’s impact

C. Publishes a sustainability report

D. Operates in a country with environmental laws

Correct Answer: B. Substantially assists or incentivises another party’s impact

Question 6

Which topic is included among the seven core subjects of ISO 26000?

A. Organisational governance

B. Exchange-rate control

C. Patent valuation

D. Monetary policy

Correct Answer: A. Organisational governance

Question 7

The OECD Guidelines are particularly useful for:

A. Replacing all national labour legislation

B. Providing recommendations on responsible business conduct and due diligence

C. Certifying products as carbon neutral

D. Determining company share prices

Correct Answer: B. Providing recommendations on responsible business conduct and due diligence

Question 8

Which practice is most likely to constitute greenwashing?

A. Defining the boundary of an emissions claim

B. Disclosing both achievements and limitations

C. Using an unqualified sustainability claim supported only by recyclable packaging

D. Publishing independently verified environmental data

Correct Answer: C. Using an unqualified sustainability claim supported only by recyclable packaging

Question 9

Why should a company avoid treating SDG membership or alignment as proof of positive impact?

A. The SDGs apply only to governments.

B. The SDGs are unrelated to social issues.

C. Alignment requires evidence of meaningful contribution and management of adverse impacts.

D. The SDGs prohibit corporate reporting.

Correct Answer: C. Alignment requires evidence of meaningful contribution and management of adverse impacts.

Question 10

Which action best supports access to remedy?

A. Removing all complaint channels

B. Providing an accessible grievance process with protection against retaliation

C. Requiring workers to complain only through their supervisor

D. Publishing the names of complainants

Correct Answer: B. Providing an accessible grievance process with protection against retaliation