Actual vs Potential Impacts under GRI: Definitions, Examples and Assessment Logic

Educational practitioner material. Requirements, GRI guidance and LRA implementation practice are distinguished throughout. Illustrative scenarios, scoring anchors and wording require adaptation to the organisation’s facts, sectors, locations, evidence and reporting context. This material is not legal or assurance advice.

Figure 1. Decision logic for negative impacts. A near miss is normally evidence of a potential pathway, while confirmed harm requires an actual-impact assessment.

A single event can contain several impacts, and one impact can arise from many events. “Chemical spill”, “supplier audit failure” or “product recall” describes an event or management response, not necessarily the impact. The assessment should state the effect and the affected party or environmental receptor.

The evidence should show that the defined effect has occurred, not merely that a hazard, control failure or legal breach exists. The threshold of evidence will vary by impact type, and uncertainty about scale or causation does not automatically convert an actual impact into a potential one. An organisation can record a confirmed core harm with uncertain extent and explain the uncertainty.

Identify the observed effect and reporting period, location, activity or business relationship.

Triangulate sources where possible: system data, complaints, affected-stakeholder evidence, expert findings and external records.

Separate the event from the consequences. A spill can create actual contamination, actual loss of access and potential long-term health effects.

Record attribution carefully. GRI asks whether the organisation is involved through its activities or as a result of business relationships; it does not require every causal uncertainty to be resolved before the impact can be investigated and reported.

Assess severity without applying likelihood. The frequency of similar events may inform wider potential impacts and management response, but it does not make the actual harm less significant.

A potential impact needs a credible pathway. It is not any imaginable harm. The organisation should connect an activity, product, service or business relationship to the affected person or environmental receptor, describe the mechanism and consider existing controls. The assessment can be qualitative where data are limited, provided assumptions and evidence confidence are transparent.

Define the hazard or pressure: unsafe equipment, water abstraction, discriminatory algorithm, labour-recruitment practice, product design or another source.

Define exposure: who or what could be affected, at which locations, through which product or value-chain pathway and over what period.

Define the consequence: the harm that could result, not only the business risk to the organisation.

Assess severity if the impact occurred, then assess likelihood. Do not reduce the credible severity because current controls are expected to work.

Review control evidence: design, implementation, coverage, operating effectiveness, monitoring and the consequences of failure.

1. Create a stable impact ID and write a precise effect statement.

2. Identify the activity, product, service or business relationship connected to the impact.

3. Identify affected people, groups, ecosystems or other receptors and the relevant location or pathway.

4. Classify the impact as negative or positive and as actual, potential or a combination of separate actual and potential effects.

5. Record the evidence status: confirmed, credible allegation, estimated, modelled, disputed or unknown.

6. For an actual negative impact, assess scale, scope and irremediable character.

7. For a potential negative impact, assess severity and likelihood, applying the severity-first rule for human-rights impacts.

8. Evaluate controls separately: intended control, coverage, test evidence, exceptions and residual pathway.

9. Determine significance relative to the organisation’s other impacts and retain assumptions or dissent.

10. Link the conclusion to action and disclosure: prevention/mitigation for potential impacts, remediation for actual impacts, and effectiveness tracking for both.

Disclosure 3-1 asks the organisation to describe how it identified actual and potential, negative and positive impacts and how it prioritised them. The methodology should therefore explain the classification logic and assumptions, not only present a final topic matrix. Disclosure 3-3 then requires a description of actual and potential impacts for each material topic, the organisation’s involvement, policies or commitments, actions, effectiveness tracking and stakeholder engagement.

Calling every hazard an impact without describing the effect and affected party.

Treating an incident as the impact and failing to separate its different consequences.

Applying likelihood to actual harm that has already occurred.

Treating no recorded incidents as evidence that there is no potential impact.

Assuming a policy, audit or certification eliminates the impact pathway without operating-effectiveness evidence.

Classifying allegations as confirmed facts or, conversely, excluding them entirely before investigation.

Merging actual and potential impacts into one score that cannot support the correct response or disclosure.

Next: Scale, Scope and Irremediable Character - How to Assess Severity under GRI.

Next: Human Rights Impacts under GRI - Why Severity Can Override Likelihood.

Next: GRI Materiality Thresholds - How to Set, Approve and Defend the Cut-Off.

GRI 3: Material Topics 2021 - Disclosure 3-3 on actual and potential impacts and actions.