Disclosure focus
This disclosure asks an organisation to explain where, in its own operations and in its supply chain, there is a meaningful risk of forced or compulsory labour. The focus is not on every site or every supplier in equal detail, but on identifying the parts of the business and the supplier base where the risk is significant and therefore needs attention.
In practice, the report should make clear how the organisation has identified those higher-risk areas and what parts of the business they cover. Readers should be able to see whether the assessment is broad or limited to certain geographies, activities, business units, or supplier categories, rather than only highlighting a few flagship sites.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show GRI 409-1 sub-elements (LRA working checklist)
Set out the actions taken during the reporting period to help end forced or compulsory labour.
Identify the operations that present a material risk of forced or compulsory labour, whether because of the kind of activity or the places where they operate.
Identify the suppliers that present a material risk of forced or compulsory labour, whether because of the kind of supplier or the places where they operate.
How to prepare it
1Set the reporting boundary first: decide which parts of your own operations and which supplier relationships you will assess for forced-labour risk, using a clear and consistent basis for the period.
2Define what counts as higher risk in practical terms. Use the nature of the activity, the country or area involved, and any other internal risk indicators you already rely on, so the same logic is applied across the disclosure.
3Gather the supporting records for each risk area you identify. Keep the underlying evidence that shows why a site, activity, supplier, country, or region was treated as higher risk.
4Compile the disclosure content in two parts: list the higher-risk operations and higher-risk suppliers, then describe the actions taken during the reporting period that were meant to help remove forced labour in any form.
5Record any exclusions, boundary changes, or shifts in your risk approach so readers can see what was left out and why, and can compare the current period with prior reporting on a like-for-like basis.
6Check the final draft against the source material and your evidence file. Confirm that the scope, the risk basis, and the actions described all match the underlying records and the official reporting source.
Request the data
Request the high-risk site and supplier evidence
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
Which sites, supplier groups, and risk-reduction actions should we pull together for the reporting period?
Use your organisation’s own terms first, then map them to the reporting question. For example, use your usual labels for sites, vendors, regions, risk flags, and remediation actions rather than framework language.
Weak request
Please provide the GRI 409-1 data for the evidence needed for GRI 409:GRI 409-1, including measures taken to contribute to the elimination of all forms of forced or compulsory labor.
Why it fails: This uses framework wording that many internal owners will not recognise, and it does not tell them which internal lists, systems, or labels to pull from. It also does not separate the site list, supplier list, and action log in a way that is easy to answer.
Better request
Please send the current list of higher-risk sites and supplier groups for labour abuse concerns for [reporting period], with the reason each one is flagged and the actions taken in the period to reduce the risk. Use your usual site, supplier, and risk labels, and include the source system, last-updated date, and any gaps.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Explain how the business defined a higher-risk operation or supplier, including the criteria used to assess location, activity type, or other relevant factors, and state the basis used to decide which items were included.
Context note
Set out what the figures indicate about where the business sees the greatest exposure to forced-labour risk, and summarise the main prevention or remediation steps taken during the period.
Fluctuation statement
If the profile changed materially from the prior period, explain whether that was driven by changes in the business footprint, supplier mix, risk assessment approach, or the actions taken to address the issue.
Content index entry
GRI 409-1 Operations and suppliers at significant risk for incidents of forced or compulsory labor — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for GRI 409-1 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
The information is presented without a date or as-at point.The scope or boundary of the statement is left undefined.Key terms are used inconsistently across the report.Material changes since the previous period are not disclosed.Assertions are made without supporting detail or a source record.Boilerplate is used that does not actually answer what is asked.
Common gaps
Mistakes to avoid when collecting the data
Wrong owner
The request goes to the wrong team, so the list is built from a desk that does not hold the operational or supplier risk records.
Framework language used in the ask
The data request is written in reporting jargon instead of the organisation’s own terms, and the person answering cannot map it to their working files.
Scope not pinned down
No one states which parts of the business, supplier base, or locations are in scope, so different teams send different populations.
Timing basis mixed up
The team pulls figures from a different period than the one being reported, which makes the evidence set and the reporting window inconsistent.
Counting basis gets blended
One file mixes site counts, supplier counts, and other tallies without saying which basis each figure uses, so the numbers cannot be compared cleanly.
Source labels are lost
Original tags from the source register are stripped out during consolidation, so the reviewer cannot trace each line back to the underlying record.
Separate populations merged
Operations and suppliers are rolled into one list even though they need to stay distinct, which hides where each risk sits.
Evidence details missing
The pack contains the headline list but not the supporting metadata, such as source date, owner, or file reference, so the trail is incomplete.
No sign-off trail
The draft moves forward without a clear review and approval record, so nobody can show who checked the data before it was used.
Where judgement is often needed
Setting the risk cut-off for sites and suppliers
Use one documented rule for what counts as a meaningful risk flag across your own sites and supplier base, then explain the basis you used and any exceptions where local conditions led to a different call.
Handling acquisitions, disposals, and newly added locations
Decide whether to include bought, sold, or newly opened operations and suppliers from the point they enter your control or relationship, and state the timing rule you applied so readers can see why the list changed.
Dealing with different country rules and local labour practices
Where legal definitions or labour-market conditions vary by country or region, apply a consistent internal screen but note any local adjustments made to identify higher-risk places or activities.
Classifying borderline activities and indirect relationships
If a site, business line, agent, broker, or other intermediary sits close to the boundary of your scope, explain the judgement used to include or exclude it and why that treatment is reasonable.
Choosing the population basis for suppliers
Be clear whether the supplier list is built from active spend, contracted vendors, critical suppliers, or another internal population, and disclose the basis so users can understand what is and is not covered.
Using estimates where full checks are not practical
If complete review is not possible, use a documented estimate or proxy, say how it was derived, and separate estimated coverage from directly checked cases where that distinction matters.
Aggregating sensitive information to protect people and counterparties
When naming specific sites or suppliers could expose individuals or commercial relationships, group the information at a higher level and explain the aggregation approach and any limits it creates.
Rounding and presentation of counts
If you present numbers of at-risk operations or suppliers, apply one rounding method consistently, make sure the rounded figures still make sense against the underlying totals, and note the method used.
Explaining changes from the prior period
If the set of flagged operations or suppliers moves materially from last year because your screening method, boundary, or source data changed, describe the reason for the movement rather than leaving the change unexplained.
Linking risk identification to the actions taken in the year
Keep the list of higher-risk operations and suppliers separate from the measures taken during the period, and explain how the actions you describe relate to the risks you identified.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — Apparel manufacturing
*Synthetic illustration only.* During the year, we focused our labour-rights checks on cut-and-sew sites and labour brokers in higher-risk sourcing countries, and we reviewed 18 direct suppliers and 42 subcontracted facilities flagged by geography or business model. - The main exposure areas were garment assembly, fabric finishing, and labour agencies operating in two overseas sourcing corridors where migrant labour is common. - We also ran supplier audits, worker interviews, contract reviews, and corrective-action follow-up to help remove practices linked to coercion, debt bondage, or restriction of worker freedom.
Illustrative only; shows how a reporter can describe risk hotspots by operation and supplier type, then summarise actions taken in the period without naming the organisation.
Illustrative (synthetic) example — Food processing and logistics
*Synthetic illustration only.* Our review identified elevated labour-abuse risk in seasonal packing lines, third-party transport, and labour providers in three countries where temporary migrant work is prevalent; in total, 9 operating sites and 27 suppliers were treated as higher-risk. - We carried out unannounced site visits, refreshed supplier due-diligence checks, updated contract clauses, and escalated any findings for remediation and worker support. - These steps were intended to reduce the chance of any forced-work practices remaining in our own operations or in the supply chain.
Illustrative only; shows a second plausible reporter using different risk settings and different wording while covering the same three disclosure points.
Company reports
How companies report GRI 409-1
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
Sands China Ltd.
Hotels, Restaurants, Leisure, Tourism Services · Macao · 2025
Sands China Ltd.’s 2025 ESG Report provides detailed coverage of supplier risk assessment, noting that 63% of suppliers were assessed and 72 critical suppliers were identified for social or environmental risks (p.49). The report also mentions specific ESG risk factors related to suppliers, including direct and indirect suppliers, and references third-party audits assessing compliance with laws and issues such as child labor and forced labor (p.49). However, the report does not clearly specify the outcomes of these assessments or the measures taken in response, and some data on management representation targets are mentioned without direct linkage to supplier risk management (p.41).
Cogna Educação S.A.
Education Services · Brazil · 2024
Cogna Educação S.A.'s 2024 Relato Integrado report includes specific disclosures on suppliers at significant risk for forced or compulsory labor, with relevant information found on page 149. The report also covers suppliers screened using environmental criteria (p.139) and mentions legal actions related to unfair competition (p.155). However, while there are references to risks of child labor and forced labor, the extent of detailed data or comprehensive risk assessments on these issues remains unclear from the provided extracts.
London Luton Airport Operations Ltd.
Air Transportation — Airport Services · United Kingdom · 2024
London Luton Airport Operations Ltd.'s Sustainability Report 2024 provides specific data on suppliers at significant risk for incidents of child labor, referencing GRI 409 on forced or compulsory labor (p.71). The report also details that 60% of total spend is with suppliers located within 25 miles of the airport (p.30), and mentions legal actions related to anti-competitive behavior under GRI 206 (p.70). However, the report does not clearly disclose the extent of incidents or outcomes related to these risks, nor does it provide comprehensive information on measures taken to address them.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get a practical answer for your reporting context. Your first answer is free — create a free account to continue the conversation.
TryHow do I prepare GRI 409-1?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
1 free answer
Check your understanding
Scenarios to work through
A manufacturer has factories in two countries and also uses a labour broker for seasonal packing staff. Its review shows the brokered workforce and one overseas site need closer attention because of the way work is arranged and the locations involved.
QShould the disclosure name both the at-risk sites and the at-risk supplier arrangement, or only one of them?
Reveal model answer →Hide answer ↑It should cover both if both are identified as higher risk. The point is to list the operations that present a meaningful risk and also the suppliers that present a meaningful risk, using the reasons that led to that judgement, such as the kind of activity or the places involved.
Why this matters · Separate the risk view for own operations from the risk view for suppliers, and explain each on its own merits.
A retailer has no direct production sites in a high-risk country, but several imported product lines come from suppliers there. The team is unsure whether to mention the country only under suppliers or also under operations because the buying office is elsewhere.
QHow should the preparer decide where to place the country-based risk information?
Reveal model answer →Hide answer ↑The country or area should be linked to whichever part of the business is actually exposed. If the risk sits with suppliers in that place, it belongs in the supplier section; if the organisation’s own activities in that place are exposed, it belongs in the operations section. Do not blur the two just because the head office is elsewhere.
Why this matters · Tie the location of the risk to the relevant part of the value chain, not to where the group is managed from.
A company has introduced worker hotlines, supplier audits and contract clauses during the year. The sustainability lead wants to describe these actions as proof that the issue has been solved, even though the risk review still flags some sites and vendors as higher risk.
QShould the disclosure present these actions as eliminating the risk, or as steps taken during the year to help reduce it?
Reveal model answer →Hide answer ↑They should be presented as actions taken in the period that are intended to help remove forced or compulsory labour, not as proof that the problem has already disappeared. The risk list and the action list are related but separate: one identifies where exposure remains, the other explains what was done about it.
Why this matters · Report the steps taken in the year as mitigation efforts, without overstating their effect.
A group has a long list of low-risk suppliers and only two labour agencies in one region that were flagged after a review. The reporting team is tempted to include every supplier and every country where the group buys from, to be safe.
QWhat should the preparer include in the risk disclosure: every supplier and location, or only those judged to have meaningful exposure?
Reveal model answer →Hide answer ↑Only the operations and suppliers that have been judged to carry significant exposure should be named. The disclosure is about the higher-risk parts of the business, not a full inventory of all sites and vendors. The basis for the judgement should be clear enough for a reader to understand why those items were singled out.
Why this matters · Keep the focus on the material risk set, not on every relationship in the supply chain.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
Primary
Related & explore
FAQ
Questions this page answers
For GRI 409-1, what data do I need to gather before I start drafting the disclosure?+−
The page says to prepare three datapoints: high-risk operations, high-risk suppliers, and forced-labour actions. Use those as the starting point for your data request and evidence pack.
How do I scope GRI 409-1 in practice if I am the ESG manager or HR data owner?+−
Use the page’s step-by-step preparation section to define the reporting boundary, then map the three datapoints to the relevant parts of the business and supply chain. The page is designed to help you turn that scoping into a draft disclosure.
What should I ask operations and procurement teams for to support GRI 409-1?+−
Ask for information that supports the three prepared datapoints: where high-risk operations sit, which suppliers are high-risk, and what actions have been taken on forced labour. The page also points you to an evidence pack so you can collect supporting documents alongside the data.
What does the page mean by an evidence pack for GRI 409-1, and what should go in it?+−
The page includes an evidence pack with five items to support assurance readiness. Use it to assemble the documents and records that back up the claim, the risk assessment, and the actions reported.
Which assurance checks should I be ready to answer for GRI 409-1?+−
The page lists five assurance claims to verify, each framed around a claim, the related risk, and the evidence. That helps you test whether the disclosure is supported before it goes to review.
What are the most common mistakes people make when reporting GRI 409-1?+−
The page has a section on common reporting gaps and mistakes, which you can use as a pre-submission check. It is there to help you avoid missing data, weak evidence, or an unclear narrative.
How can I use the synthetic example on the GRI 409-1 page without copying it into my report?+−
The example is there to show how a disclosure can be structured, including a quantitative table where relevant. Treat it as a model for format and level of detail, not as a template to copy word-for-word.
What should the draft output for GRI 409-1 look like on this page?+−
The page gives draft-output guidance with visualisation ideas, narrative starters, and a GRI content-index line. Use those to turn your prepared data into a first-pass disclosure for internal review.
How do I use the Prep & Assurance workbook for GRI 409-1?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format. Use it to organise the preparation steps, evidence, and assurance checks before drafting the disclosure.
What is the printable Library Card for GRI 409-1 used for?+−
The Download Centre also includes a printable Library Card in .pdf format. It is a quick-reference aid for working through the disclosure and supporting materials.
Can I use the 'From company reports' table to see how other companies disclose GRI 409-1?+−
Yes. The page includes a table linking to real published reports where the topic is disclosed, which can help you see how the disclosure is presented in practice.
More questions this page can help with
What are the three datapoints to prepare for GRI 409-1?How do I build an assurance-ready evidence pack for GRI 409-1?What should I include in a draft GRI 409-1 narrative?How do I use the GRI 409-1 workbook step by step?What are the common gaps to check before finalising GRI 409-1?Where can I find real company report examples for GRI 409-1?How do I turn the GRI 409-1 preparation notes into a content-index line?What visualisation ideas does the GRI 409-1 page suggest?How should I assign ownership for GRI 409-1 data collection?What should an HR or procurement data owner provide for GRI 409-1?How do I check whether my GRI 409-1 disclosure is ready for assurance review?Does the page give an ESRS or IFRS mapping for GRI 409-1?
Free · LRA Community
Get your GRI 409-1 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →