From commitment to evidence: Putting the OECD MNE Guidelines into practice

Responsible business conduct commitments have become firmly embedded across corporate sustainability strategies, investment policies, and financial institutions' risk management frameworks. Yet having policies and commitments in place is only the beginning. The more difficult challenge is putting them into practice.

Organizations need to identify where adverse impacts may be occurring across clients, counterparties, investments, and business relationships. These may include human rights abuses, impacts on ecosystems and biodiversity, and money laundering. They must then determine which risks warrant closer attention and support their decisions with appropriate evidence.

The Organisation for Economic Co-operation and Development Guidelines for Multinational Enterprises on Responsible Business Conduct (OECD MNE Guidelines) provide an important benchmark for addressing these expectations. Translating their principles into consistent, scalable due diligence requires organizations to bridge the gap between commitment and implementation, and between policy and evidence.

# I. The global benchmark for responsible business conduct

First adopted in 1976 and most recently updated in 2023, the  OECD MNE Guidelines are government-backed recommendations for responsible business conduct covering human rights, employment and industrial relations, environment, bribery and other forms of corruption, disclosure, consumer interests, science and technology, competition, and taxation.

While observance of the OECD MNE Guidelines by enterprises is voluntary, matters they cover may also be regulated by national law or international commitments. They have become an authoritative international reference point for responsible business conduct.

Central to the OECD MNE Guidelines is the expectation that organizations undertake risk-based due diligence to identify and address actual and potential adverse impacts associated with their operations, products, services, investments, and business relationships.

The OECD Due Diligence Guidance for Responsible Business Conduct translates this expectation into a six-step due diligence framework. These interconnected steps form an ongoing process in which new information and changing circumstances can require organizations to revisit previous assessments and adjust their response.

# OECD six-step due diligence framework

Source: OECD, Due diligence for responsible business conduct. Adapted by RepRisk.

This is an adaptation of an original work by the OECD. The opinions expressed and arguments employed in this adaptation should not be reported as representing the official views of the OECD or of its Member countries.

# II. Closing the implementation gap

Effective due diligence requires more than knowing that risks exist. Organizations need to determine where to focus, what requires further investigation, when to escalate, and whether changing circumstances warrant reassessment.

In practice, organizations must assess potential impacts ranging from child labor and unsafe working conditions to local pollution, biodiversity loss, bribery, and money laundering across large and complex business relationships.

Applying the same level of manual review to every client, counterparty, investment, or holding may be neither practical nor aligned with a risk-based approach. Organizations need a way to distinguish higher-risk exposures and direct specialist resources towards the companies, relationships, and issues requiring closer attention. This creates several practical challenges:

1. Prioritization: Where are the most significant responsible business conduct risks?
2. Consistency: How can common due diligence criteria be applied across teams, portfolios, markets, and business units?
3. Evidence: What independent information supports an assessment, escalation, engagement, or other due diligence decision?
4. Scale: How can meaningful due diligence be conducted across large company universes?
5. Ongoing oversight: How can material changes be identified after an initial assessment?
6. Accountability: How can organizations demonstrate the basis for their decisions and actions?

Addressing these challenges requires turning large volumes of risk information into structured risk indicators and decision-ready evidence.

# III. From OECD expectations to operational due diligence

RepRisk’s core dataset provides the foundation for applying an OECD lens to business conduct risk. Every day, RepRisk screens more than 175,000 public sources and stakeholders in 100 languages, combining advanced AI with human analysis to identify, analyze, and curate risk incidents involving companies and projects worldwide.

The resulting outside-in data provides a perspective on business conduct risk beyond company self-disclosures. It covers public and private companies, projects, all countries and sectors, and includes information from local-language sources and emerging and frontier markets. Risk incidents are classified across 100+ environmental, social, governance, and cross-cutting risk factors, including topics addressed by the OECD MNE Guidelines such as child labor, local pollution, anti-competitive practices, bribery, and tax evasion.

Building on this foundation, RepRisk’s Due Diligence Scores (DDS) provide granular company-level scores across more than 200 business conduct risk factors including human rights, environmental impacts, governance failures, corruption, and more. They help organizations identify adverse-impact risk exposure and prioritize companies by highlighting the most severe and salient risk concentrations in line with OECD expectations.

The DDS OECD Guidelines for MNE Package brings together relevant scores through a focused OECD MNE lens. It provides a consistent basis for organizations to evaluate and prioritize companies against the responsible business conduct considerations covered by the OECD MNE Guidelines.

Organizations can then investigate what is driving the scores by accessing the underlying data, including relevant risk incidents, related risk factors, countries, severity, and source information. This transparency supports deeper investigation and helps organizations document how risks were identified, assessed, and prioritized.

Watchlists and alerts enable ongoing monitoring and review by highlighting new developments involving the companies, projects, and sectors most relevant to an organization’s due diligence process.

Together, these layers support four interconnected activities: identify and assess risk exposure, prioritize where attention is needed, investigate the underlying evidence, and monitor developments over time. The transparency of the underlying data also helps organizations document and demonstrate how risks were identified, assessed, prioritized, and monitored.

# OECD-aligned due diligence

---

Copyright 2026 RepRisk AG. All rights reserved. RepRisk AG owns all intellectual property rights to this report. This information herein is given in summary form and RepRisk AG and/or the third party contributors to this report make no representation or warranty that any data or information supplied to or by it or them is complete or free from errors, omissions, or defects. Without limiting the foregoing, in no event shall RepRisk AG and/or the third party contributors to this report have any liability (whether in negligence or otherwise) to any person in connection with the information contained herein. Any reference to or distribution of this report must include a link to the content to provide sufficient context. The information provided in this presentation does not constitute an offer or quote for our services or a recommendation regarding any investment or other business decision, and is not intended to constitute or to be used as a substitute for legal, tax, accounting, or other professional advice. Please note that the information may have become outdated since its publication. Should you wish to obtain a quote for our services, please contact us.