Templates and records · ISO 26000:2010 · Clause 6.3.3

Human rights due diligence assessment template

How to spot early the harm that the business or its supply chain may do to people’s rights, and how to prevent or remedy it.

In one sentence

The human rights due diligence assessment identifies actual and potential risks to people in the company’s own operations and across its value chain, the measures to prevent or mitigate them, how they are monitored and the remedy mechanisms available; it is good practice under ISO 26000 (6.3.3) and aligned with the United Nations Guiding Principles.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 26000:2010 · Clause 6.3.3 Clauses are cited using the numbering of ISO 26000:2010, the only edition published. As it is a guidance standard, no template is mandatory: all are listed as good practice.
Type of information: Good practice Good practice: ISO 26000 is a guidance standard (clause 6.3.3)
Who fills it in: Social responsibility lead with purchasing and people It helps to involve organisations that know the affected groups
When: Before new high-risk activities or suppliers Plus a periodic review, at least once a year
How long it is kept: Decided by the organisation As a guidance standard, ISO 26000 sets no retention periods. Keeping several years’ worth lets you show progress over time, which is what stakeholders value most.

What the standard requires

What ISO 26000:2010 demands and what it leaves to your judgement

The guidance recommends a due diligence process comprising a human rights policy, an assessment of how current and planned activities may affect rights, integration of that assessment throughout the organisation, performance tracking and action to address negative impacts.

The 2011 United Nations Guiding Principles describe the same cycle: identify, prevent, mitigate, account for and remedy. SGE 21 requires a similar procedure as a certifiable requirement (6.2.1).

What is assessed is the risk to people, not to the company: a minor risk for the business can be severe for whoever suffers it.

Read it in context: Human rights, in the ISO 26000:2010 Academy

Structure

Fields the template should include

Activity, site or supplier assessed
Right potentially affected
Affected group and its vulnerability
Severity and likelihood of the impact
Whether the company causes it, contributes to it or is linked to it
Prevention or mitigation measures
Monitoring and outcome
Grievance and remedy mechanism available

Example

Example: seasonal harvest workers (fictitious organisation)

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Activity	Harvest season with 220 seasonal workers, some hired through a temporary employment agency
Right affected	Decent working and living conditions
Risk	Overcrowded accommodation and transport fees charged by intermediaries
Relationship	The cooperative contributes: it hires the temporary employment agency and houses some of the workers
Measures	Contract clause banning fees, social audit of the temporary employment agency, occupancy limit
Grievance and remedy	Helpline run by a local NGO, in three languages · refund of improper charges
Monitoring	2026 harvest: 3 complaints, 2 resolved with a refund, 1 under investigation

At the audit

Mistakes auditors commonly flag

Only the company’s own workforce is assessed and the supply chain is forgotten.
Risks are rated from the company’s point of view, not that of the people affected.
There is no grievance mechanism that those affected can actually use.
The assessment leads to no concrete measures.

In Kimobox

How this record is kept in Kimobox

1The human rights risk analysis is kept as a versioned record.
2The Kimobox whistleblowing channel can also be used for this subject.
3Social responsibility criteria are included in supplier evaluation.
4The non-discrimination policy and how it is communicated are documented.

Frequently asked questions

What people ask us before getting started

Is human rights due diligence mandatory?

Under ISO 26000, no: it is a recommendation. In the European Union, Directive (EU) 2024/1760 on due diligence applies to large companies, as amended by Directive (EU) 2026/470; for most SMEs it remains voluntary, even if their large customers ask for it.

What do cause, contribute and be linked mean?

It is the distinction drawn in the Guiding Principles: the company causes an impact if it brings it about directly, contributes if it facilitates it together with others, and is linked if it happens in its value chain without its direct involvement. The expected response differs in each case.

Keep your ISO 26000:2010 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 26000:2010 — Guidance on social responsibility ISO · 2010 ed.
Guiding Principles on Business and Human Rights United Nations (OHCHR) · 2011
SGE 21. Sistema de Gestión Ética, Sostenible y Responsable (Ethical, Sustainable and Responsible Management System) Forética · October 2024 version