Human Rights Impacts under GRI: Why Severity Can Override Likelihood

Educational practitioner material. Requirements, GRI guidance and LRA implementation practice are distinguished throughout. Illustrative scenarios, scoring anchors and wording require adaptation to the organisation’s facts, sectors, locations, evidence and reporting context. This material is not legal or assurance advice.

A conventional risk matrix often multiplies consequence by probability. That can be useful for operational and enterprise risk management, but it creates a dangerous result when applied mechanically to people: a catastrophic harm can be scored as moderate because the organisation believes it is unlikely. GRI avoids that outcome by stating that severity takes precedence when assessing a potential negative human-rights impact.

The rule is consistent with human-rights due-diligence logic. The purpose is to prevent and address harm to people, not only to protect enterprise value. A low number of recorded cases, a distant supply-chain tier or a formal control does not by itself demonstrate that the severe pathway is immaterial. The assessment should ask what could happen to people, how grave and widespread it could be, how difficult remedy would be and whether the organisation is connected to the impact through its activities or business relationships.

Figure 1. A severity-first escalation model for potential human-rights impacts. The relationship categories support response analysis; they do not determine legal liability.

1. Define the human-rights impact. State the right or interest affected, the people or group exposed, the activity, product, service or business relationship and the credible harm pathway.

2. Determine whether the impact is actual or potential. Use severity for an actual negative impact. Use severity and likelihood for a potential impact, with severity taking precedence.

3. Assess scale, scope and irremediable character. Do not average an extreme dimension into a moderate composite without review.

4. Consider vulnerability or marginalisation. Existing disadvantage, dependency, discrimination, insecure status, language barriers, remoteness or lack of remedy can increase the gravity or practical reach of harm.

5. Assess the organisation’s involvement: cause, contribute or directly linked through a business relationship. Record uncertainty and obtain specialist input where the distinction is contested.

6. Apply escalation rules before the reporting threshold. Severe pathways receive senior review even where likelihood data are low, controls are considered strong or only a small group is exposed.

7. Define the response. Prevention, mitigation, leverage, remediation and relationship decisions depend on the facts and involvement, not only on the materiality score.

8. Protect affected people and evidence. Apply confidentiality, informed-engagement and data-minimisation controls before drafting public disclosure.

GRI 3 asks the organisation to report whether it is involved with negative impacts through its activities or as a result of its business relationships. Its guidance draws on international due-diligence instruments and explains three relationship categories. These categories help analyse the appropriate response, but should not be treated as a one-line legal conclusion.

Likelihood remains useful after escalation. It can inform the urgency, breadth and sequencing of preventive action; the design of monitoring; the choice of scenarios; and the level of residual exposure. The control is that likelihood should not be used as an arithmetic veto on severe human-rights impacts.

Do not allow a low likelihood score, strong policy score or low number affected to close the assessment automatically.

Require an evidence-quality challenge: what supports the probability estimate, and does the data cover hidden, under-reported or retaliatory contexts?

Require relationship analysis and proposed response, not only a materiality conclusion.

Set a senior owner and response deadline proportional to the severity and immediacy of the pathway.

Preserve the impact in the decision log even where it remains below the public-reporting cut-off after review.

Reopen the decision on complaints, credible allegations, incidents, supplier change, new geography, product redesign or loss of control effectiveness.

A construction group uses a labour supplier in a country where migrant workers commonly pay recruitment fees. The supplier contract prohibits fees, annual audits have found no cases and management therefore assigns likelihood 1/5. Worker interviews are limited, conducted at the workplace and translated by a supervisor. External reports describe debt-financed fees and passport retention in the same recruitment corridor.

GRI defines stakeholders to include vulnerable groups and expects organisations to consider affected stakeholders when identifying and assessing impacts. Vulnerability is not a separate score added mechanically. It can change scale, scope, likelihood, evidence quality and irremediability. For example, the same wage deduction may be more severe for a worker whose immigration status depends on the employer and who cannot access an independent grievance channel.

Ask who may be missing from ordinary engagement and data: agency workers, children, informal workers, remote communities, minority-language groups or users without digital access.

Test whether grievance channels are safe, confidential, accessible and trusted, and whether retaliation or dependency suppresses evidence.

Assess remedy outcomes, not only the existence of a mechanism. A case-closure count does not show that harm was made good.

Engage legitimate representatives and human-rights experts where direct engagement is unsafe or inappropriate.

Document when confidentiality limits public detail and retain restricted evidence under controlled access.

Using only incidents, litigation or audit non-conformities to identify human-rights impacts.

Treating a low probability estimate as permission to exclude severe harm.

Assuming a code of conduct or certification proves implementation and effectiveness.

Limiting “directly linked” to first-tier suppliers or direct contracts.

Using cause, contribute or directly linked as a simplistic liability label without examining facts and response implications.

Ignoring vulnerable or marginalised groups because the ordinary survey or grievance channel did not reach them.

Publishing detailed case information that exposes affected people or complainants.

Reporting activities - training, audits or hotline counts - as proof that harm was prevented or remedied.

Prerequisite: Actual vs Potential Impacts under GRI - Definitions, Examples and Assessment Logic.

Prerequisite: Scale, Scope and Irremediable Character - How to Assess Severity under GRI.

Next: GRI Materiality Thresholds - How to Set, Approve and Defend the Cut-Off.

GRI 2: General Disclosures 2021 - policy commitments, embedding, remediation and mechanisms for raising concerns.

GRI 3: Material Topics 2021 - Disclosure 3-3 on involvement, prevention, mitigation, remediation and effectiveness.