Regulation, Standards and Responsible Business Requirements

Introduction

Corporate social responsibility (CSR) and corporate ethics operate within a layered system of law, international standards, industry expectations and voluntary commitments. A responsible organisation must therefore ask two different questions:

1. What is legally required?
2. What conduct is expected even when it is not legally compulsory?

The distinction is important. A company may comply with environmental, labour and company law yet still cause serious harm through its supply chain. Conversely, a company may publicly support a global standard without having an effective system for implementation. Modern responsible business practice seeks to connect legal compliance, risk-based due diligence, stakeholder engagement, remedy and transparent reporting.

This chapter introduces major international frameworks, explains the difference between voluntary and mandatory requirements, and shows how organisations can build a practical compliance and responsibility system. National laws differ by jurisdiction; organisations must obtain current legal advice and consult the legislation applicable to their activities, size, sector and locations.

Learning Objectives

By the end of this chapter, learners should be able to:

• distinguish law, regulation, standards, principles and voluntary commitments;
• explain the purpose and structure of the UN Global Compact, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines and ISO 26000;
• identify typical national requirements relating to labour, environment, anti-corruption, modern slavery, supply chains and disclosure;
• distinguish voluntary sustainability reporting from mandatory due diligence and disclosure;
• describe the main stages of a risk-based responsible-business due-diligence process; and
• apply these ideas to a practical organisational case.

1. The Regulatory Architecture of Responsible Business

Responsible business requirements come from several sources. They are related but not interchangeable.

A standard can become practically compulsory when it is incorporated into a contract, tender condition, stock-exchange rule, financing agreement or national regulation. For example, a supplier code may be voluntary for the company that drafted it but contractually binding for a supplier that accepts it.

Compliance and responsibility

Compliance means meeting applicable legal and contractual requirements. Responsible business conduct is broader: it includes identifying and addressing actual and potential adverse impacts on people, the environment and society. Compliance is a minimum threshold, not a guarantee of ethical performance.

A company should maintain a legal register identifying the laws that apply to each facility and activity. It should also maintain a responsibility register covering wider risks, such as forced labour several tiers down a supply chain or pollution affecting a community that is not a direct contractual partner.

2. National Laws: Common Areas of Obligation

Because no single national legal system applies everywhere, professionals should understand recurring categories rather than memorise one country’s legislation.

2.1 Company, governance and director duties

Company law commonly regulates incorporation, financial records, director responsibilities, conflicts of interest, shareholder rights and financial reporting. Directors may be required to act in the company’s interests, exercise care and manage conflicts. In some jurisdictions, this includes considering employees, communities, environmental effects or long-term consequences; in others, such considerations arise through specific statutes or governance codes.

Boards should receive reliable information about significant social and environmental risks. A board cannot discharge its oversight role merely by approving a CSR statement without reviewing controls, performance and complaints.

2.2 Labour and employment law

Typical requirements concern minimum wages, working time, health and safety, non-discrimination, freedom of association, collective bargaining, leave, social security and protection from child or forced labour. National law may provide weaker protection than international expectations in some locations. A multinational company should comply with local law while also establishing a consistent global baseline where feasible.

2.3 Environmental law

Environmental regulation may require permits, impact assessments, pollution controls, waste management, chemical controls, water-use permissions, biodiversity protection, remediation and climate-related reporting. Liability can arise from a direct discharge, negligence, failure to maintain equipment or inaccurate environmental information.

2.4 Anti-corruption and economic crime

Anti-bribery laws commonly prohibit offering, promising, giving, requesting or accepting an improper advantage. Some laws apply extraterritorially and cover agents, intermediaries, joint ventures or subsidiaries. Effective systems include due diligence on intermediaries, approval controls, accurate books and records, conflict-of-interest declarations, training and protected reporting channels.

2.5 Consumer, data and competition law

Responsible business also includes truthful marketing, product safety, fair competition and lawful processing of personal data. Misleading environmental claims may breach consumer-protection law even when the underlying product has some environmental benefit. Artificial intelligence systems may create additional risks involving discrimination, privacy, explainability, safety and accountability.

2.6 Supply-chain and modern-slavery laws

Several jurisdictions require organisations to publish statements about steps taken to address forced labour or human trafficking in supply chains. Other regimes impose more substantive duties, including risk assessment, prevention, mitigation, remediation and board accountability. The legal scope may depend on revenue, employee numbers, sector, place of incorporation or business conducted in the jurisdiction.

Examples of approaches found internationally include:

• the United Kingdom’s Modern Slavery Act transparency provisions;
• France’s duty of vigilance law for certain large companies;
• Germany’s Supply Chain Due Diligence Act, applying defined human-rights and environmental duties to qualifying enterprises;
• the European Union’s corporate sustainability reporting requirements under the CSRD for entities within its scope; and
• emerging or proposed national measures addressing forced labour, deforestation, minerals, climate transition and sustainability claims.

These examples should not be treated as interchangeable. Their thresholds, covered impacts, reporting duties, enforcement mechanisms and effective dates differ and change over time.

3. The UN Global Compact

The United Nations Global Compact is a voluntary initiative asking participating organisations to align strategies and operations with ten principles in four areas:

1. Human rights: respect and support internationally recognised human rights;
2. Labour: freedom of association and collective bargaining, elimination of forced labour, abolition of child labour, and elimination of discrimination in employment;
3. Environment: precaution, environmental responsibility and development of environmentally friendly technologies; and
4. Anti-corruption: work against corruption in all forms, including extortion and bribery.

The principles are derived from widely recognised international instruments, including the Universal Declaration of Human Rights, ILO principles, the Rio Declaration and the UN Convention against Corruption.

Participation does not replace law. Nor does joining prove that an organisation has achieved good performance. Its value lies in providing a common language, leadership commitment and a platform for communicating progress. Credible participation requires governance, objectives, performance data and honest discussion of shortcomings.

4. The UN Guiding Principles on Business and Human Rights

The UN Guiding Principles on Business and Human Rights (UNGPs), endorsed by the UN Human Rights Council in 2011, are organised around the Protect, Respect and Remedy framework.

4.1 The state duty to protect

States must protect individuals from human-rights abuse by third parties, including business enterprises, through appropriate laws, policies, regulation, investigation and adjudication. States should also promote policy coherence in state-owned enterprises, procurement and trade-related institutions.

4.2 The corporate responsibility to respect

Businesses should respect human rights. This means avoiding infringing the rights of others and addressing adverse impacts with which they are involved. The responsibility applies to all enterprises, regardless of size, sector, ownership or structure, although the means of implementation will vary.

Human-rights due diligence under the UNGPs generally includes:

• assessing actual and potential human-rights impacts;
• integrating findings into relevant functions and processes;
• tracking the effectiveness of responses; and
• communicating how impacts are addressed.

The process should be ongoing, proportionate to the enterprise’s size and context, and informed by meaningful consultation with potentially affected people. Priority should normally be given to the most severe impacts, considering scale, scope and how difficult it would be to remedy them.

4.3 Access to remedy

Where a company causes or contributes to harm, it should provide for or cooperate in remediation. Where it is merely linked to harm through a business relationship, it should use leverage and consider appropriate action. Remedy may include apology, restitution, compensation, rehabilitation, guarantees of non-repetition or changes to policy and controls.

Grievance mechanisms should be legitimate, accessible, predictable, equitable, transparent, rights-compatible and a source of learning. A hotline alone is not a complete remedy system.

5. OECD Guidelines for Multinational Enterprises on Responsible Business Conduct

The OECD Guidelines are recommendations addressed by governments to multinational enterprises. The 2023 edition covers responsible business conduct across areas including:

• human rights;
• labour rights;
• environment;
• bribery and other forms of corruption;
• consumer interests;
• disclosure;
• science, technology and innovation;
• competition; and
• taxation.

The Guidelines promote risk-based due diligence across operations, supply chains and other business relationships. Their due-diligence cycle can be summarised as:

1. embed responsible business conduct into policies and management systems;
2. identify and assess actual and potential adverse impacts;
3. cease, prevent or mitigate impacts;
4. track implementation and results;
5. communicate how impacts are addressed; and
6. provide for or cooperate in remediation where appropriate.

National Contact Points established by adhering governments may handle complaints about alleged non-observance. They generally provide a non-judicial mechanism, not a criminal court. The process can nevertheless influence reputation, investor confidence and commercial relationships.

The OECD approach emphasises that due diligence is not simply a certification exercise. A company is not automatically responsible for every impact in its value chain, but it should assess its involvement and use its influence responsibly.

6. ISO 26000: Guidance on Social Responsibility

ISO 26000 is an international guidance standard, not a certifiable management-system standard. It is intended for all types of organisations and identifies seven core subjects:

1. organisational governance;
2. human rights;
3. labour practices;
4. the environment;
5. fair operating practices;
6. consumer issues; and
7. community involvement and development.

It also identifies principles such as accountability, transparency, ethical behaviour, respect for stakeholder interests, respect for the rule of law, respect for international norms of behaviour and respect for human rights.

ISO 26000 can help an organisation map issues, engage stakeholders and develop policies. It should not be presented as an ISO-certified achievement. Claims such as “ISO 26000 certified” are misleading because ISO 26000 was designed as guidance rather than a conformity-certification standard.

7. Voluntary Commitments versus Mandatory Duties

The distinction is best understood through four questions:

A voluntary report may explain performance, but it does not necessarily satisfy a statutory disclosure obligation. A supplier audit may reveal risk, but it does not automatically constitute due diligence. A policy promising “zero tolerance” may be less credible than a risk-based policy that explains prevention, escalation and remedy.

Mandatory disclosure

Mandatory disclosure rules normally require specified entities to publish information according to defined subject matter, reporting periods and assurance requirements. They may address governance, strategy, material impacts, risks, metrics, targets and value-chain information. The information must be accurate, complete and supportable. Greenwashing can occur through selective presentation, vague claims or omission of significant adverse information.

Mandatory due diligence

A disclosure obligation asks an organisation to report information. A due-diligence obligation asks it to operate a process to identify, prevent, mitigate, monitor and address adverse impacts. Some laws require both. Disclosure without action is inadequate where substantive due diligence is required; action without reliable records may also fail a reporting obligation.

8. A Practical Due-Diligence Model

A diploma-level CSR professional should be able to translate principles into a management process.

Step 1: Establish governance and policy

Assign board oversight, executive responsibility and operational ownership. Adopt policies covering human rights, labour, environment, anti-corruption, procurement, speak-up channels and remedy. Policies should identify prohibited conduct, decision rights and escalation routes.

Step 2: Map operations and relationships

Identify facilities, contractors, agents, distributors, raw materials, logistics providers, joint ventures and other business relationships. Mapping should extend beyond first-tier suppliers where risk indicates deeper investigation.

Step 3: Assess impacts and legal exposure

Use country, sector, product and relationship information. Consult workers, communities, Indigenous Peoples, consumers and civil-society organisations where relevant. Separate:

• actual impacts, which have already occurred;
• potential impacts, which may occur; and
• risk to people, which should not be reduced to financial risk to the company.

Step 4: Prioritise

Prioritise severity and likelihood, but do not allow a low-probability catastrophic harm to disappear merely because it is unlikely. Severe human-rights impacts may require priority even where the company’s financial exposure is modest.

Step 5: Integrate and act

Assign corrective actions, budgets, deadlines and responsible managers. Responses may include redesigning a product, changing purchasing practices, improving worker representation, suspending a hazardous process, supporting supplier improvement or ending a relationship as a last resort.

Step 6: Track and communicate

Use evidence such as injury data, wage records, worker feedback, environmental measurements, grievance outcomes and supplier improvement results. Communicate meaningful information while protecting personal data and vulnerable complainants.

Step 7: Remedy and learn

Investigate complaints independently where necessary. Prevent retaliation. Provide or cooperate with remedy and use root-cause analysis to prevent recurrence.

9. Applied Case: The Riverbend Electronics Supply Chain

This is an illustrative case, not a report of an actual company.

Background

Riverbend Electronics, a medium-sized manufacturer, sells products in several markets. It has adopted the UN Global Compact principles and publishes an annual sustainability statement. Its main assembly supplier, located in another country, uses labour agencies to recruit workers.

Problem

A worker organisation alleges that recruited workers paid excessive fees, worked excessive hours and had identity documents retained. Riverbend’s first-tier supplier denies direct responsibility and provides a recent social-audit certificate. Riverbend’s sustainability statement says its supply chain is “free from modern slavery.”

Analysis

The audit certificate is evidence, but not proof that harm is absent. The allegations indicate potential forced-labour and labour-rights risks. Riverbend may be linked to the impacts through its business relationship. Its absolute public claim may also be misleading if it lacks adequate evidence.

Under a UNGP- and OECD-informed approach, Riverbend should:

• investigate confidentially and consult affected workers;
• examine recruitment contracts, wage deductions, working-time records and document-retention practices;
• assess whether its purchasing prices or delivery schedules contributed to excessive overtime;
• require the supplier and labour agencies to stop unlawful practices;
• ensure repayment of improper recruitment fees and return of documents;
• protect complainants from retaliation;
• monitor outcomes through worker-centred verification rather than document review alone; and
• revise its public claim to communicate the risk, response and progress accurately.

If Riverbend’s actions contributed to harm, it should cooperate in remedy. If it is only linked to the harm, it should use leverage, support corrective action and consider suspension or disengagement if serious abuse continues and responsible influence is unsuccessful.

Outcome

After investigation, Riverbend requires ethical recruitment, bans worker-paid recruitment fees, changes purchasing lead times, establishes a worker grievance channel and funds repayment. It retains the supplier under a time-bound improvement plan because immediate termination would leave workers without income and reduce Riverbend’s leverage. An independent review confirms progress after six months, while unresolved issues remain subject to escalation.

Learning points

• Certification is not a substitute for due diligence.
• Responsible purchasing practices affect supply-chain outcomes.
• Remedy must benefit affected people, not merely improve company documentation.
• Public claims must be proportionate to evidence.
• Disengagement is not always the first or most responsible response.

10. Professional Implementation and Evidence

A credible system normally includes:

• a legal and regulatory register;
• board-approved policies and delegated responsibilities;
• risk-based supplier and partner screening;
• training tailored to job roles;
• contractual clauses linked to realistic implementation;
• worker and stakeholder engagement;
• incident, grievance and whistleblowing procedures;
• internal audit and independent assurance where appropriate;
• documented corrective and preventive actions; and
• accurate, balanced public reporting.

Digital tools can support supplier mapping, document analysis, emissions data collection and case management. However, automated risk scores may reproduce biased or incomplete data. AI should support—not replace—human judgment, worker consultation, privacy safeguards and accountability. Sensitive grievance data require access controls, retention rules and protection from retaliation.

11. Challenges and Limitations

Fragmentation

Different jurisdictions may define due diligence, materiality, modern slavery, human rights and assurance differently. Multinational companies need a legal matrix and a process for monitoring amendments.

Audit limitations

Short announced audits may miss coercion, informal work, discrimination or community impacts. Worker interviews, unannounced methods, triangulation and continuous engagement are often more informative.

Conflicting incentives

Low prices, urgent delivery schedules and unstable orders can undermine supplier improvements. Responsible procurement must be integrated with commercial decision-making.

Small-business capacity

Small suppliers may lack systems and specialist staff. Requirements should be proportionate and accompanied by training, technical assistance and realistic timelines.

Measuring what matters

The number of audits or training hours is an activity measure, not proof of improved conditions. Organisations should track outcomes, including reduced injuries, repayment of unlawful deductions, improved wages, resolved grievances and reduced environmental harm.

Greenwashing and ethics-washing

A company may use broad commitments to create an impression of responsibility without changing conduct. Claims should be specific, evidence-based, current and balanced, with limitations disclosed.

Contemporary Direction of Travel

Responsible-business regulation is moving from broad voluntary statements toward combinations of mandatory disclosure, risk-based due diligence, supply-chain transparency, climate transition planning and access to remedy. Investors, public procurers and large customers increasingly request comparable information. At the same time, litigation and regulatory scrutiny are testing whether corporate statements are accurate and whether governance systems operate in practice.

The practical lesson is not that voluntary initiatives have become irrelevant. They remain useful for setting expectations, building capability and encouraging improvement. Their role is strongest when they are connected to legal compliance, accountable governance, stakeholder participation, measurable action and remedy.

Chapter Summary

Responsible business is governed by a layered architecture of national law, international instruments, voluntary standards, contracts and market expectations. Legal compliance is essential but does not exhaust corporate responsibility. The UN Global Compact offers ten voluntary principles in human rights, labour, environment and anti-corruption. The UN Guiding Principles establish the Protect, Respect and Remedy framework and describe corporate human-rights due diligence. The OECD Guidelines provide broad responsible-business recommendations and a practical due-diligence cycle. ISO 26000 offers guidance across seven core subjects but is not a certifiable standard.

Mandatory disclosure requires specified information to be reported; mandatory due diligence requires an operational process to identify, prevent, mitigate, monitor and address impacts. A credible system maps operations and relationships, prioritises severe risks, engages affected stakeholders, implements corrective action, tracks outcomes, communicates accurately and provides remedy. Professional judgment is necessary because audits, certifications and automated tools cannot by themselves prove responsible conduct.

Key Terms

Corporate social responsibility: Organisational responsibility for impacts on society and the environment.

Corporate human-rights responsibility: The expectation that businesses respect human rights and address adverse impacts.

Due diligence: An ongoing, risk-based process to identify, prevent, mitigate, track and communicate responses to adverse impacts.

Mandatory disclosure: Legally required publication of specified organisational information.

Voluntary commitment: A self-selected pledge or standard not directly imposed by law.

Soft law: Non-binding principles or recommendations that influence conduct and interpretation.

UN Global Compact: A voluntary UN initiative based on ten principles covering human rights, labour, environment and anti-corruption.

UN Guiding Principles: The UN framework organised around the state duty to protect, corporate responsibility to respect and access to remedy.

Protect, Respect and Remedy: The three pillars of the UN Guiding Principles.

OECD Guidelines: Government-backed recommendations for multinational enterprises on responsible business conduct.

ISO 26000: Voluntary guidance on social responsibility across seven core subjects.

Stakeholder: A person or group affected by, or able to affect, an organisation’s decisions and activities.

Actual impact: An adverse effect that has occurred.

Potential impact: An adverse effect that may occur.

Remedy: Action taken to correct or compensate for an adverse impact.

Leverage: The ability of an organisation to influence another party’s conduct.

Modern slavery: Severe exploitation involving coercion, threats or inability to leave, including forced labour and trafficking.

Greenwashing: Misleading communication about environmental performance or benefit.

Materiality: The significance of information or an impact for decisions, accountability or affected stakeholders.

Review Questions

Short Answer Questions

1. What is the difference between legal compliance and responsible business conduct?
2. Identify the four subject areas of the UN Global Compact principles.
3. What are the three pillars of the UN Guiding Principles on Business and Human Rights?
4. Why is ISO 26000 not normally described as a certifiable standard?
5. Distinguish mandatory disclosure from mandatory due diligence.

Long Answer Questions

1. Explain the purpose, scope and limitations of the UN Guiding Principles on Business and Human Rights.
2. Compare the UN Global Compact, OECD Guidelines and ISO 26000.
3. Discuss how national laws can convert voluntary expectations into practical business requirements.
4. Describe the stages of a risk-based responsible-business due-diligence process.
5. Explain why supplier audits and certifications cannot, by themselves, demonstrate responsible business conduct.

Analytical / Application Questions

1. A company publishes a statement saying that its entire supply chain is free from forced labour, but it has mapped only first-tier suppliers. Assess the ethical, governance and disclosure risks.
2. A supplier is accused of retaining migrant workers’ passports. Using the UN Guiding Principles and OECD due-diligence approach, recommend an appropriate response.
3. Design a one-year implementation plan for a medium-sized company seeking to align its CSR programme with ISO 26000 while preparing for possible mandatory sustainability reporting.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes compliance from responsible business conduct?

A. Compliance is voluntary, while responsible conduct is always legally required.

B. Compliance concerns applicable requirements, while responsible conduct also addresses wider adverse impacts and stakeholder expectations.

C. Compliance applies only to environmental issues, while responsibility applies only to labour issues.

D. There is no meaningful distinction between the two concepts.

Correct Answer: B. Compliance concerns applicable requirements, while responsible conduct also addresses wider adverse impacts and stakeholder expectations.

Question 2

Which topic is NOT one of the four UN Global Compact principle areas?

A. Human rights

B. Labour

C. Environment

D. Corporate taxation

Correct Answer: D. Corporate taxation

Question 3

What does the “Protect, Respect and Remedy” framework describe?

A. The three stages of financial auditing

B. The central framework of the UN Guiding Principles on Business and Human Rights

C. The seven core subjects of ISO 26000

D. The enforcement structure of the OECD

Correct Answer: B. The central framework of the UN Guiding Principles on Business and Human Rights

Question 4

Which statement about ISO 26000 is correct?

A. It is a mandatory national law.

B. It is a certifiable environmental management standard.

C. It provides guidance on social responsibility and is not designed for certification.

D. It applies only to multinational corporations.

Correct Answer: C. It provides guidance on social responsibility and is not designed for certification.

Question 5

Which activity is most clearly part of human-rights due diligence?

A. Publishing only positive CSR achievements

B. Identifying, preventing, mitigating and tracking adverse impacts

C. Replacing stakeholder engagement with automated scoring

D. Ending every supplier relationship immediately after a complaint

Correct Answer: B. Identifying, preventing, mitigating and tracking adverse impacts

Question 6

What is the primary character of the OECD Guidelines for Multinational Enterprises?

A. Government-backed recommendations on responsible business conduct

B. A criminal code enforced by an international court

C. A product-safety testing protocol

D. A financial accounting standard

Correct Answer: A. Government-backed recommendations on responsible business conduct

Question 7

Why can a supplier audit fail to prove that forced labour is absent?

A. Audits are prohibited under international standards.

B. Audits may miss coercion, informal work, retaliation and impacts beyond the audit period.

C. Audits can assess only financial statements.

D. Supplier audits are legally binding court judgments.

Correct Answer: B. Audits may miss coercion, informal work, retaliation and impacts beyond the audit period.

Question 8

Which statement best describes mandatory disclosure?

A. A legally required publication of specified information by entities within defined scope.

B. A private promise made by a supplier.

C. An informal conversation with investors.

D. A voluntary training programme.

Correct Answer: A. A legally required publication of specified information by entities within defined scope.

Question 9

In the illustrative Riverbend case, why was immediate supplier termination not automatically the best response?

A. Termination is never permitted under responsible-business standards.

B. Termination could remove leverage and harm workers, so a time-bound improvement plan and remedy could be more responsible.

C. The allegation concerned only financial reporting.

D. The supplier had already proved compliance conclusively.

Correct Answer: B. Termination could remove leverage and harm workers, so a time-bound improvement plan and remedy could be more responsible.

Question 10

Which claim is most likely to create greenwashing or ethics-washing risk?

A. “We identified recruitment-fee risks and are repaying affected workers.”

B. “Our programme covers suppliers representing 70% of procurement expenditure.”

C. “Our entire supply chain is completely free from all abuse,” without adequate evidence.

D. “We are investigating a complaint and will report verified findings.”

Correct Answer: C. “Our entire supply chain is completely free from all abuse,” without adequate evidence.