The Norwegian Transparency Act (Prop.150L (2020-2021) - Act on business transparency and work with fundamental human rights and decent working conditions) has been adopted by the Norwegian Parliament (June 2021) and this means that approximately 8830 Norwegian companies must conduct due diligence on human rights in value chains. It is important to note that stakeholders now have the right to information about conditions at production sites related to a specific product or service offered by the company. If this happens, stakeholders must receive a response within 3 (three) weeks of the request being sent (see section on obligations below). The law enters into force on July 1, 2022.
Increased accountability is expected
The legal requirement is based on a draft law developed by the government-appointed Ethics Information Committee, with some adjustments. The law was adopted as a result of increased expectations from authorities, civil society and consumers that companies act with increased accountability in their value chains. At the same time, similar legislation is being developed in the EU and several European countries.
Scope and obligations of the law
In addition to the 8830 companies that must comply with the legal requirement, we can expect that smaller companies will be affected indirectly, as larger companies will continue to impose requirements on them. The Act covers both private and state-owned companies that offer goods or services. Large enterprises are defined as enterprises that are covered by section 1-5 of the Accounting Act, or that on the balance sheet date meet two of the following:
- Sales revenue: over SEK 70 million
- Balance sheet total: over SEK 35 million
- Average number of employees in the financial year: over 50
The key duties in the law include performing due diligence. What is this?
At the core of the Act is the obligation to conduct due diligence on fundamental human rights and decent work, in line with OECD guidelines. According to the law, this must be carried out regularly and be proportionate to the size of the business, the nature of the business, the context in which the business takes place, and the severity and likelihood of adverse impacts on fundamental human rights and decent working conditions.
Due diligence assessments consist of six steps (OECD NCP for Responsible Business Conduct, 2019):
Embed accountability in policies and management systems
- Map and assess negative impact/damage based on your own operations, supply chain and business relationships (= send self-report from Factlines)
- Stop, prevent or reduce negative impact/damage (= analyze and define improvement activities where required (in Factlines))
- Monitor implementation and results (= Follow up - (also in Factlines))
- Communicate how the impact has been managed (export overviews from Factlines and compile your own report for internal and external use).
- Provide or collaborate on recovery where required (you can document everything in Factlines as an important proof of collaboration)
In short, due diligence is about prioritising risks based on severity and potential impact. An important component of ensuring the right prioritization is dialogue with stakeholders, especially those affected.
The key obligations in the law are as follows:
§Section 4: Duty to conduct due diligence: All businesses covered by the Act must conduct due diligence on fundamental human rights and decent working conditions, in line with the OECD Guidelines for Multinational Enterprises.
Section 5: Duty to report on due diligence: Businesses must publish a report on due diligence, which must include, among other things:
- Description of how the work on due diligence is organised.
- Information on actual adverse impacts and significant risks of adverse impacts that have been identified through its due diligence
- Information about measures that the company has implemented or plans to implement to stop actual negative consequences or limit significant risks.
The report shall be updated and published by June 30 each year and otherwise in the event of significant changes in the company's risk assessments. It shall be signed in accordance with the rules in section 3-5 of the Accounting Act.
§6. Right to information: Affected businesses are obliged to respond to requests from the general public based on the due diligence assessment they have carried out. This includes both general information and information related to a specific product or service offered by the company.
§7. The companies' processing of information requirements: Information must be in writing and must be provided within a reasonable time, and no later than three weeks after the information requirement has been received.
§9. Control and enforcement: The Consumer Authority will supervise and may impose coercive fines and infringement fees on businesses in the event of a breach of the Act.
The requirement for due diligence and the obligation to provide information will probably lead to an increased need for traceability and transparency. At the same time, an evaluation of the law is planned, where the need for an extended requirement for transparency regarding the place of production will be assessed.
What are due diligence assessments?
At the core of the Act is the obligation to conduct due diligence on fundamental human rights and decent work, in line with OECD guidelines. According to the law, this must be carried out regularly and be proportionate to the size of the business, the nature of the business, the context in which the business takes place, and the severity and likelihood of adverse impacts on fundamental human rights and decent working conditions.
Due diligence assessments consist of six steps (OECD NCP for Responsible Business Conduct, 2019):
Embed accountability in policies and management systems
6. Map and assess negative impact/damage based on own operations, supply chain and business relationships (= send self-report from Factlines)
7. Stop, prevent or reduce negative impact/damage (= analyse and define improvement activities where required (in Factlines))
8. Monitor implementation and results (= Follow up - (also in Factlines))
9. Communicate how the impact has been managed (export summaries from Factlines and compile your own report for internal and external use).
10. Provide or collaborate on recovery where required (you can document everything in Factlines as an important proof of collaboration)
In short, due diligence is about prioritising risks based on severity and potential impact. An important component of ensuring the right prioritisation is dialogue with stakeholders, especially those affected.
Are Norwegian businesses ready for new requirements?
Experience shows that some companies are already well underway in preparing for the new legislation, while others still have some way to go in establishing or adapting their work to be in line with the requirements of the law. The work requires the involvement of both management and several departments internally. The resources this requires will depend on the company's maturity within sustainability in general and due diligence in particular.
It is essential that the management of the company is made aware of the law and its obligations at an overall level. This is to ensure that sufficient resources are allocated to the work. An analysis of how existing policies, systems and procedures respond to both legal requirements and the actual methodology for due diligence, as defined by the OECD and the UN Guiding Principles on Business and Human Rights, will provide a good starting point for identifying where action is needed. It is particularly important to include departments and functions related to supply chain; procurement, product and service development, compliance, quality, sustainability, logistics, etc.
Companies that have not carried out a due diligence assessment will need to do so. A number of companies will probably need to update existing risk assessments, which form the basis for the due diligence assessment. Internal training may be required on the role of different functions in the due diligence assessments.
It must be ensured that information on the website, and potentially in the annual sustainability report, meets the requirements of the law.
Due diligence in annual sustainability reporting
An important part of the due diligence assessment is the communication of prioritized risks, measures and their effects. The Global Reporting Initiative is in the process of revising both the universal standards and the topic-specific standards on human rights.
The purpose of the updates is to strengthen reporting related to due diligence and human rights reporting to reflect international instruments such as the UN Guiding Principles on Business and Human Rights and guidance from the OECD.
For companies that report on sustainability, it should be ensured that the reporting structure meets both legal requirements and stakeholder expectations for due diligence on human rights, society and the environment.
Developments in Europe
The obligation to perform due diligence is in line with developments in Europe. Germany has recently passed a law with several similarities, and several countries, including Finland and the Netherlands, are considering similar legislation.
At the same time, the European Commission is preparing a draft directive under the EU Sustainable Corporate Governance Initiative, which will require companies to conduct due diligence assessments covering human and labor rights, climate change, the environment, anti-corruption, money laundering and other financial irregularities in their own operations and in their supply chain. The draft legislation is expected in the fall of 2021 and will likely set clear expectations for how due diligence should be conducted. For example, the European Parliament has proposed an obligation to involve affected stakeholders.
