Ethics, Governance, Sustainability and People Risk

Introduction and Context

International human resource management (IHRM) increasingly operates at the intersection of employment law, corporate governance, human rights, sustainability and enterprise risk. A multinational enterprise (MNE) may be legally incorporated in one jurisdiction, employ people through subsidiaries in several others, and source goods through tiers of suppliers governed by different legal and cultural systems. This creates ethical and managerial questions that cannot be resolved by applying headquarters policies mechanically.

People risk is the possibility that decisions, conduct, systems or external events involving workers will damage people, organizational performance, legal compliance, reputation or stakeholder trust. It includes risks arising from discrimination, unsafe work, forced or child labour, data misuse, corruption, retaliation against whistleblowers, industrial conflict, skill shortages, restructuring and failures of oversight. People risk is therefore broader than “HR risk”: it is an enterprise issue involving the board, executives, procurement, legal, information security, operations and investors.

Ethical IHRM asks not only whether an action is lawful, but also whether it is fair, respectful, transparent and defensible to affected stakeholders. Governance supplies the structures through which such judgments are made: authority, accountability, controls, reporting, assurance and remedy. Sustainability connects these responsibilities to long-term social, environmental and economic value, including the Sustainable Development Goals (SDGs), especially SDG 5 (gender equality), SDG 8 (decent work), SDG 10 (reduced inequalities), SDG 12 (responsible consumption) and SDG 16 (peace, justice and strong institutions).

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish legal compliance, ethics, governance, sustainability and people risk.
2. Apply ethical theories and human-rights due-diligence principles to IHRM decisions.
3. Assess privacy, corruption, supply-chain labour, whistleblowing and restructuring risks.
4. Design a practical people-risk and compliance assessment.
5. Evaluate how IHRM contributes to ESG performance and sustainable development.
6. Critically assess the limitations of audits, metrics, codes of conduct and AI-enabled controls.

1. Ethical Foundations for International HRM

Law, ethics and responsibility

Law establishes minimum enforceable standards, but lawful conduct can still be ethically questionable. For example, a firm may legally classify workers as contractors while transferring excessive risk to them, or may comply with local working-time rules that fall below the expectations of its global stakeholders. Conversely, ethical commitments cannot simply be imposed without regard to local law, worker voice or cultural context.

Three related responsibilities are useful:

• Compliance responsibility: obey applicable legislation, contracts, collective agreements and regulatory requirements.
• Ethical responsibility: respect dignity, fairness, autonomy, non-maleficence and honesty, including where law is weak or enforcement is limited.
• Accountability responsibility: explain decisions, enable challenge, investigate harm and provide remedy.

Ethical theories in managerial decisions

Several theories help managers identify what is at stake:

• Deontological ethics evaluates duties and rights. A worker must not be treated merely as a means to profit; coercion, discrimination and deception are objectionable even if they produce short-term benefits.
• Consequentialism evaluates outcomes. A restructuring decision may be justified if it prevents organizational collapse, but the analysis must include harms to workers, families, communities and future employees.
• Justice and fairness theories examine distribution, procedure and recognition. Similar cases should be treated consistently, decision processes should be impartial, and historically disadvantaged groups may require corrective support.
• Virtue ethics asks what a responsible organization would do and what character its practices express: integrity, courage, compassion and practical wisdom.
• Stakeholder theory treats employees, contractors, communities, customers, investors and regulators as parties with legitimate interests, not merely instruments of shareholder returns.

These theories do not produce automatic answers. They expose trade-offs and make managerial reasoning more transparent.

Human rights and decent work

The Universal Declaration of Human Rights, the International Labour Organization (ILO) Declaration on Fundamental Principles and Rights at Work, the UN Guiding Principles on Business and Human Rights (UNGPs), and the OECD Guidelines for Multinational Enterprises are influential reference points. Relevant principles include freedom from forced labour and child labour, freedom of association and collective bargaining, non-discrimination, safe and healthy work, fair treatment, privacy and access to remedy.

The UNGPs frame corporate responsibility around three pillars: the state duty to protect human rights, the corporate responsibility to respect human rights, and access to remedy. For business, respect requires a policy commitment, human-rights due diligence and processes to remediate adverse impacts. Due diligence is not a one-time certification exercise; it is ongoing, risk-based and responsive to changing circumstances.

2. Governance Architecture and Accountability

Governance converts values into decision rights and controls. An effective architecture normally includes:

1. Board oversight: approval of human-rights, ethics, data and sustainability strategy; review of material risks.
2. Executive ownership: a named executive accountable for implementation, supported by cross-functional leadership.
3. Policies and standards: global minimum standards, local adaptation rules and clear prohibited conduct.
4. Operational controls: recruitment checks, segregation of duties, access controls, supplier clauses, training and escalation routes.
5. Assurance: internal audit, independent assessments, worker feedback and transparent reporting.
6. Remedy and learning: investigation, protection from retaliation, restitution where appropriate and corrective action.

A code of conduct is a foundation, not a governance system. It becomes credible when workers understand it, managers are measured against it, suppliers can implement it, and violations produce proportionate consequences regardless of rank or location.

A useful control principle is the three lines model. Operational managers own risks and controls; specialist functions such as HR, legal, compliance and information security advise and monitor; internal audit independently evaluates governance and control effectiveness. The board and its committees provide oversight rather than replacing management responsibility.

Global consistency and local responsiveness

MNEs face a “global–local” tension. A global policy may prohibit discrimination and forced labour everywhere, while implementation must account for local language, institutions, collective representation and legal requirements. Local custom cannot justify violations of fundamental rights. At the same time, headquarters should avoid cultural imperialism, consultation-free rules and unrealistic supplier requirements. A sound approach establishes non-negotiable principles, permits contextual implementation, and documents the reasons for deviations.

3. Human-Rights Due Diligence and People-Risk Assessment

A practical assessment should examine both the probability of harm and its severity. Severity is often more important than financial likelihood: a low-frequency fatality or forced-labour incident may be a priority even when expected monetary loss is modest.

The process can be organized as follows:

1. Scope and map: identify entities, countries, worker categories, contractors, recruitment agencies and supply-chain tiers.
2. Identify impacts: consult workers and representatives; examine discrimination, safety, wages, working time, freedom of association, housing, recruitment debt and privacy.
3. Prioritize: consider scale, scope and irremediability of potential harm, as well as likelihood and business exposure.
4. Prevent and mitigate: redesign processes, improve contracts, train managers, strengthen safety, change purchasing practices and increase worker voice.
5. Track effectiveness: use evidence rather than activity counts alone.
6. Communicate: report material risks, progress and limitations accurately.
7. Remediate: provide accessible grievance channels and appropriate remedy when the organization caused or contributed to harm.

A simple qualitative risk matrix may classify likelihood and impact as low, medium or high. Such matrices support discussion but should not disguise uncertainty or imply mathematical precision. A more formal prioritization score can be used only when the organization defines and validates its scales. For example:

Here, likelihood and impact are ordinal ratings, such as 1–5, not physical measurements. The score is appropriate for comparing risks within the same assessment method; it is not a probability of harm and should not be compared across incompatible datasets. A separate “severity override” should elevate catastrophic or irreversible harms even when likelihood is rated low.

Evidence and indicators

Useful evidence includes grievance patterns, turnover, absenteeism, injury data, wage records, recruitment-fee complaints, disciplinary outcomes, pay-equity analysis, worker-survey results, collective-bargaining coverage, overtime, data-access logs and supplier corrective-action closure. Indicators should be disaggregated by gender, contract type, disability, migration status and other legally and ethically appropriate categories. Aggregation can conceal unequal exposure.

Metrics may be leading or lagging. Training completion is a leading activity indicator, whereas injury rates and substantiated retaliation are lagging outcome indicators. Neither is sufficient alone. A high number of complaints can indicate poor conduct, but it can also indicate trust in the reporting system; a low number may reflect fear.

4. Privacy, Technology and Artificial Intelligence

Employment data may include identity information, compensation, health data, biometrics, location, performance records and inferred characteristics. Privacy governance should follow principles such as purpose limitation, data minimization, accuracy, retention limitation, security, transparency and access rights. Organizations must determine the lawful basis for processing under applicable regimes, communicate uses clearly, restrict access and conduct impact assessments for high-risk processing.

Cross-border data transfers require attention to applicable national rules, contractual safeguards, localization requirements and the practical ability of individuals to exercise rights. Consent is not always freely given in employment because of power imbalance; it should not be treated as a universal solution.

AI creates additional people risks. Recruitment and performance systems can reproduce historical bias through training data, proxy variables or poorly chosen targets. Automated decisions can be opaque, difficult to challenge and prone to disparate impact. Appropriate controls include:

• documented purpose and prohibited uses;
• data-quality and bias testing before and after deployment;
• human review for significant employment decisions;
• notice, explanation and appeal mechanisms;
• role-based access, logging and retention controls;
• vendor due diligence and contractual audit rights.

Human oversight is meaningful only when reviewers have authority, competence and time to override a system. “Human in the loop” is not a safeguard if the reviewer merely rubber-stamps outputs.

5. Anti-Corruption and Ethical Conduct

Corruption includes bribery, facilitation payments, kickbacks, extortion, conflicts of interest, fraud and improper gifts or hospitality. IHRM is involved because recruitment, visas, payroll, expatriate assignments, incentives, investigations and supplier relationships can create opportunities for abuse.

A robust anti-corruption program combines risk assessment, leadership commitment, clear rules, training tailored to roles, third-party screening, accurate books and records, confidential reporting, investigation protocols and consistent discipline. Incentive systems should not reward impossible sales or production targets that encourage bribery or falsification. HR should ensure that disciplinary processes are fair and that seniority does not create immunity.

The distinction between a facilitating payment and a bribe may vary across legal systems, but organizational policy should be clear and employees should have a safe escalation route when confronted with coercion. Business pressure, local custom or competitive disadvantage does not remove responsibility to prevent corruption.

6. Supply-Chain Labour and Responsible Procurement

Labour conditions are shaped not only by suppliers but also by the buyer’s purchasing practices. Short lead times, sudden volume changes, late payments and price pressure can encourage excessive overtime, unauthorized subcontracting and labour violations. Therefore, supplier codes alone are inadequate.

A risk-based program should:

• map suppliers beyond the first tier where feasible;
• prioritize sectors and locations with heightened risks;
• prohibit recruitment fees charged to workers and passport retention;
• require safe work, lawful wages, freedom of association and non-discrimination;
• assess recruitment agencies and labour brokers;
• consult workers independently of management;
• use corrective action before termination when remediation is possible;
• terminate relationships where serious harm is concealed or uncorrected;
• align purchasing decisions with labour standards.

Social audits can identify documentary gaps, but announced audits may produce staged compliance and miss informal workers. Worker interviews, unannounced methods, grievance data, civil-society information and purchasing-data analysis should complement audits. The aim is improved conditions, not merely a favourable score.

7. Whistleblowing, Speak-Up Systems and Remedy

A whistleblowing system enables employees and external parties to report suspected wrongdoing. Effective systems offer multiple channels, confidentiality, anonymity where lawful and practicable, independence from implicated management, prompt triage, protection from retaliation and feedback about outcomes.

A report should be assessed for urgency, conflicts of interest, evidence preservation, potential harm and required escalation. Investigations must be impartial, proportionate and respectful of due process. Confidentiality should be explained honestly: absolute secrecy cannot always be guaranteed, particularly where law requires disclosure or safety demands action.

Retaliation may include dismissal, demotion, exclusion, threats, poor scheduling, harassment or subtle career disadvantage. Monitoring after a report is therefore essential. Remedy may include reinstatement, compensation, correction of records, medical or psychological support, policy change and public acknowledgment. A system that receives reports but never remedies harm is not an ethical governance system.

8. Responsible Restructuring and International Assignments

Restructuring raises conflicts among financial survival, continuity, fairness and dignity. Responsible restructuring begins with alternatives to dismissal: redeployment, reduced hours by agreement, voluntary separation, reskilling, job-sharing, natural attrition and temporary adjustments. Decisions should be based on legitimate, documented criteria rather than age, pregnancy, disability, union activity, nationality or other protected characteristics.

Managers should consult workers and representatives where required, provide accurate information, give reasonable notice, offer transition support and coordinate legal requirements across jurisdictions. Severance and support should reflect both statutory rules and the organization’s ethical responsibilities, especially where social protection is weak. Communication must avoid treating people as accounting entries.

International assignments add risks involving immigration status, tax, safety, family welfare, security, housing, healthcare, repatriation and unequal treatment between expatriate and local employees. Duty of care extends to foreseeable risks created by the assignment. Pre-departure assessment, emergency procedures, insurance, cultural preparation and repatriation planning are governance controls, not optional benefits.

9. ESG, Sustainability and the Strategic Role of IHRM

Environmental, social and governance (ESG) frameworks differ in purpose and measurement, but the “social” dimension is substantially people-related. IHRM contributes through decent work, inclusion, human-capital development, safety, responsible supply chains, employee voice and ethical leadership. Governance links these activities to oversight, controls and disclosure.

A strategic HR contribution has four stages:

1. Materiality: determine which people issues can significantly affect stakeholders and enterprise value.
2. Integration: embed objectives in strategy, procurement, risk registers, budgets and executive incentives.
3. Measurement: combine outcome, process and qualitative indicators, with transparent boundaries and disaggregation.
4. Learning: use worker voice, incident analysis and stakeholder feedback to improve systems.

A critical issue is the risk of “social-washing”: presenting training, donations or polished reports as evidence of responsible employment while underlying labour conditions remain unchanged. Credible sustainability claims require reliable data, clear methodology, balanced disclosure and attention to adverse impacts. HR professionals should challenge targets that reward appearance rather than outcomes.

10. Applied Case: Meridian Apparel Group

This is an illustrative fictional case.

Background

Meridian Apparel Group, headquartered in Europe, sells garments in 28 countries. It sources from factories in South and Southeast Asia through buying agents. Its sustainability report states that 96% of strategic suppliers passed annual social audits. The company also uses an algorithm to screen applicants for warehouse roles and operates an anonymous ethics hotline.

Problem

A worker organization alleges that migrant workers at a major supplier paid recruitment fees, worked excessive overtime and had identity documents retained. The supplier passed two announced audits. At headquarters, the algorithm rejects applicants with employment gaps, disproportionately excluding women returning from caregiving. A whistleblower claims that a regional manager discouraged complaints because unresolved cases would reduce a performance bonus.

Analysis

The issue is systemic rather than a single supplier violation. Meridian’s purchasing deadlines may contribute to overtime; the audit design may miss coercion; the recruitment algorithm creates potential indirect discrimination; and the bonus structure undermines speak-up governance. The board’s reliance on a pass rate is therefore a weak control. Priority should be given to forced-labour indicators and retaliation because the potential severity is high.

Approach and solution

Meridian should immediately protect affected workers, prohibit document retention and reimburse unlawful recruitment fees where responsibility is established. It should commission an independent investigation with worker interviews in safe settings, suspend the implicated agent pending facts, and create a remediation plan with worker representatives. Procurement should review lead times and pricing rather than simply threatening termination.

The algorithm should be paused for validation. Meridian should test selection rates across relevant groups, remove employment gaps unless demonstrably job-related, document decision logic and provide human review and appeal. The bonus plan should include verified speak-up protection and remediation quality, not merely low complaint counts. The board should receive a quarterly people-risk dashboard covering complaints, retaliation, recruitment fees, overtime, algorithmic disparity and corrective-action quality.

Outcome and learning points

Assume Meridian’s review finds evidence of recruitment-fee charging and document retention, but no evidence that all senior managers knew. The company reimburses affected workers, changes its purchasing calendar, replaces the audit-only model with worker-informed due diligence, and disciplines the manager for retaliation. The algorithm is redesigned and independently tested before limited reintroduction.

The case demonstrates five principles: audit pass rates are not outcomes; buyer conduct affects supplier labour; silence may indicate fear rather than safety; technology requires lifecycle governance; and remediation is part of responsibility, not an admission that governance has failed completely.

11. Implementation, Challenges and Best Practices

Implementation should begin with a materiality and maturity assessment. Organizations can then establish a risk register, assign owners, define escalation thresholds, train affected roles, pilot controls in high-risk locations and independently test results. Policies should be translated into local languages and designed with worker input.

Common failure modes include fragmented ownership, excessive reliance on certifications, unrealistic zero-risk claims, superficial consultation, weak data quality, retaliation, inconsistent discipline, audit fatigue and procurement incentives that contradict labour standards. There are also genuine tensions: disclosure may expose sensitive information; investigations must balance transparency with privacy; supplier termination may remove income without addressing root causes; and global standards may conflict with local law or institutional capacity.

Best practice is therefore not a universal checklist. It is a cycle of risk-sensitive governance: identify, prevent, listen, investigate, remedy, measure and learn. Senior leaders should model ethical conduct, protect challenge, resource controls and accept that responsible decisions may impose short-term costs. In the long term, trust, resilience, retention, license to operate and access to markets depend on credible treatment of people.

Chapter Summary

Ethics, governance, sustainability and people risk are integrated dimensions of strategic IHRM. Law provides minimum requirements, while ethical reasoning addresses dignity, fairness, consequences and stakeholder interests. Human-rights due diligence requires continuous identification, prioritization, prevention, tracking, communication and remedy. Governance depends on board oversight, operational ownership, independent assurance and effective grievance mechanisms.

Privacy and AI require purpose limitation, security, transparency, bias testing and meaningful human review. Anti-corruption controls must address incentives, third parties and retaliation. Supply-chain labour programs must examine purchasing practices and worker experience rather than rely solely on audits. Whistleblowing systems need independence and protection, while restructuring should combine business realism with procedural fairness and support. Finally, IHRM contributes directly to ESG and the SDGs when people outcomes are integrated into strategy, measurement and accountability rather than treated as public-relations claims.

Key Terms

Human rights due diligence: An ongoing process to identify, prevent, mitigate and remedy business-related human-rights impacts.

People risk: The possibility that people-related conduct, decisions or events will cause harm or organizational loss.

Corporate governance: Structures and processes through which organizations are directed, controlled and held accountable.

Stakeholder theory: The view that organizations owe legitimate consideration to groups affected by their activities.

Deontological ethics: Ethical reasoning based primarily on duties, rights and principles.

Consequentialism: Ethical reasoning that evaluates actions by their outcomes.

Distributive justice: Fairness in the allocation of benefits, burdens and opportunities.

Procedural justice: Fairness of decision-making processes.

Remedy: Action intended to repair or address an adverse impact.

Whistleblowing: Reporting suspected wrongdoing through internal or external channels.

Retaliation: Adverse treatment imposed because a person raised a concern or participated in an investigation.

Forced labour: Work exacted under threat or penalty without genuine freedom to leave.

Social audit: An assessment of labour or social conditions, usually against specified standards.

Purpose limitation: Collecting and using personal data only for specified legitimate purposes.

Data minimization: Limiting personal data to what is necessary for the stated purpose.

ESG: Environmental, social and governance considerations used in organizational evaluation and management.

Materiality: The significance of an issue to stakeholders, enterprise value or both.

Duty of care: The responsibility to take reasonable steps to prevent foreseeable harm.

Social-washing: Misleading presentation of social responsibility without corresponding substantive performance.

Review Questions

5 Short Answer Questions

1. Distinguish legal compliance from ethical responsibility in IHRM.
2. What are the three pillars of the UN Guiding Principles on Business and Human Rights?
3. Why are social-audit pass rates insufficient evidence of decent work?
4. Identify four controls for responsible use of AI in employment decisions.
5. What features make a whistleblowing system credible?

5 Long Answer Questions

1. Compare deontological, consequentialist and justice-based approaches to an international redundancy decision.
2. Explain how board oversight, operational ownership and internal audit interact in a people-risk governance system.
3. Discuss the relationship between purchasing practices and supply-chain labour conditions.
4. Evaluate the contribution and limitations of IHRM to ESG and the SDGs.
5. Design a human-rights due-diligence process for an MNE using labour brokers in several countries.

3 Analytical / Application Questions

1. An organization reports fewer complaints after introducing a hotline. Analyze whether this demonstrates improved ethical performance and identify additional evidence required.
2. A recruitment algorithm rejects applicants with career interruptions. Diagnose the governance risks and propose a validation, remediation and oversight plan.
3. A supplier is found to retain migrant workers’ passports, while termination would eliminate thousands of local jobs. Apply stakeholder, human-rights and risk-governance reasoning to recommend a course of action.

Multiple Choice Questions with Answers

Question 1

Which statement best describes human-rights due diligence?

A. A one-time supplier certification exercise

B. An ongoing process of identifying, preventing, mitigating and remedying impacts

C. A financial audit of employee costs

D. A voluntary public-relations activity

Correct Answer: B. An ongoing process of identifying, preventing, mitigating and remedying impacts

Question 2

What is the primary weakness of relying only on announced social audits?

A. They are always illegal

B. They cannot examine written records

C. They may encourage staged compliance and miss worker experience

D. They eliminate the need for worker consultation

Correct Answer: C. They may encourage staged compliance and miss worker experience

Question 3

Which practice most directly supports data minimization?

A. Retaining all employee data indefinitely

B. Collecting only data necessary for a specified legitimate purpose

C. Sharing personnel files with all managers

D. Using biometric data for every HR process

Correct Answer: B. Collecting only data necessary for a specified legitimate purpose

Question 4

Meaningful human oversight of an AI employment decision requires that reviewers can:

A. Accept every system recommendation

B. Override the system and investigate its reasoning

C. Avoid documenting decisions

D. Transfer accountability to the software vendor

Correct Answer: B. Override the system and investigate its reasoning

Question 5

Which action is most consistent with responsible restructuring?

A. Selecting employees informally by personal preference

B. Hiding the financial rationale until dismissals occur

C. Considering redeployment, consultation and documented fair criteria

D. Exempting senior managers from all selection rules

Correct Answer: C. Considering redeployment, consultation and documented fair criteria

Question 6

A low number of hotline complaints may indicate:

A. Certain absence of misconduct

B. Either improved conduct or lack of trust and fear of retaliation

C. That investigations are unnecessary

D. That the hotline is overfunded

Correct Answer: B. Either improved conduct or lack of trust and fear of retaliation

Question 7

Which is an example of a leading rather than a lagging indicator?

A. Recorded workplace fatalities

B. Substantiated retaliation cases

C. Completion of targeted ethics training

D. Confirmed wage theft

Correct Answer: C. Completion of targeted ethics training

Question 8

Under the three lines model, who primarily owns day-to-day people risks and controls?

A. Operational management

B. External media

C. Internal audit alone

D. The company’s customers

Correct Answer: A. Operational management

Question 9

Why should procurement practices be included in supply-chain labour assessments?

A. They can create pressure that contributes to overtime and unauthorized subcontracting

B. They replace all legal requirements

C. They determine employees’ personal beliefs

D. They make worker voice unnecessary

Correct Answer: A. They can create pressure that contributes to overtime and unauthorized subcontracting

Question 10

Which response best reflects the purpose of remedy?

A. Repairing or addressing harm suffered by affected people

B. Avoiding all public disclosure regardless of circumstances

C. Punishing every supplier immediately

D. Increasing complaint targets for managers

Correct Answer: A. Repairing or addressing harm suffered by affected people