Why policies are not enough for HREDD

Regulators and buyers are no longer asking whether a policy exists. They are asking how risks were identified, what was done about them, and what changed as a result. A policy answers the first question. It says nothing about the other two.

This shift matters because due diligence is judged on process and outcome, not intent. An organisation can have a strong, well-written policy and still be unable to demonstrate that it knows where its highest risks sit, or that it has taken proportionate action in response.

The UN Guiding Principles, and the OECD Due Diligence Guidance that builds on them, describe due diligence as an ongoing cycle rather than a one-off exercise. It starts with identifying where human rights and environmental risks are most likely to arise across operations and supply chains, then moves to preventing and mitigating those risks through changes to practice, contracts, and supplier engagement.

From there, organisations need to track whether their response is actually working, using evidence rather than assumption, communicate what has been found and done in a way that can withstand scrutiny, and provide or enable remedy where harm has occurred.

A policy commitment sits above all of this. It sets the direction. On its own, it does not produce any of these activities - and it is these activities, not the policy, that regulators, buyers, and civil society now look for.

In practice, the gap between policy and process tends to show up in a few recurring places. Risk assessments exist but are not updated often enough to reflect changing operations or supplier relationships. Action plans are agreed after an audit but are not tracked through to completion. Evidence of action is scattered across departments, formats, and systems, making it hard to produce a coherent account when one is requested.

None of these gaps are unusual, and none of them mean the underlying commitment is not genuine. They are usually a sign that the policy was put in place before the supporting structure was - which is the normal order of things. The risk is leaving it there.

Closing the gap does not require starting from zero. Most organisations already generate the information a credible due diligence process needs - through audits, grievance channels, supplier data, and field reporting. What is usually missing is the structure that connects this information to the policy commitment: a clear view of where risk sits, a record of what has been done in response, and a way of showing that the response is making a difference over time.

That structure is what turns a policy from a statement of intent into something that can be defended, reported on, and improved. It is also where Strategine focuses its work - helping organisations build the connective layer between commitment and evidence, using the information they already have.