flag 14

Does Not Make Information on Audits, Complaints, or Compliance Public

Reputational risk

What this means

Why investors should care

What to look for

Public disclosure of audit methodology, compliance, and complaints lodged enables public monitoring and generates accountability and trustworthiness of the scheme. The International Organization for Standardization (ISO) addresses transparency in standard ISO 17021, which outlines requirements for bodies providing audit and certification of management systems. The standard requires certification bodies to be transparent in their operations, including the disclosure of their audit processes, the criteria used for certification, and the qualifications of their auditors.

The OECD Guidelines do not explicitly require companies to make their audit reports public. However, the Guidelines emphasize transparency, accountability, and disclosure as key principles for responsible business conduct. For example, the Guidelines encourage enterprises to disclose timely and accurate information on all material matters regarding their activities, structure, financial situation, performance, ownership, and governance. This includes both financial and non-financial information. Specifically, Chapter III on Disclosure recommends that companies ensure that their disclosure policies are transparent and provide information that is relevant for different stakeholders.

Unfortunately, transparency has yet to become a standard. In 2019, the Clean Clothes Campaign (CCC) reported on multiple standards that did not have the necessary transparency mechanisms.¹ One of those was Social Accountability Accreditation Services (SAAS), a division of Social Accountability International (SAI), the owner of the SA8000 standard. The CCC asserts that SAAS “audit reports, including identified and documented risks and any corrective actions taken, are not accessible to the public, workers, unions or labour rights organisations.”² SAI contests the point about public disclosure of audits since it often has the opposite effect: It tends to discourage transparency and can encourage obfuscation and audit deception by organizations seeking certification. Not publicizing audits is also important to protect workers’ confidentiality.

Nonetheless, when affected stakeholders do not have access to the external audits, they cannot corroborate their validity nor can they measure progress and improvements.³ While care needs to be taken to ensure that making audits public does not harm rights holders, some level of transparency is necessary for stakeholders to know how well the certification is working to improve human rights protections in workplaces. Workers know their own workplaces best, just as communities understand their community dynamics and ownership rights best. Rights holders have unique insight into the intricacies of their work environments and are well positioned to validate or contest the findings of auditing reports. Re:Structure Lab’s Social Auditing and Ethical Certification brief notes that “[r]esearchers have highlighted the need for workers to have access to audit reports, as well as feedback mechanisms to report disputes and ideally seek remedy.”⁴

While rarely an MSI requirement, civil society organizations and affected communities are increasingly calling for access to audit information before reports are finalized. This can include sharing draft findings with communities or disclosing corrective action plans during any pre-publication period.

The fire at Ali Enterprises in Pakistan in 2012 that killed over 250 workers exposed severe failures in the auditing and certification processes there. The factory had been certified as safe under the SA8000 standard by the Italian auditing company RINA just weeks before the fire, despite significant safety issues such as blocked emergency exits and barred windows, which contributed to the high death toll as workers were unable to escape the blaze.¹ RINA’s certification signaled that the factory met international safety standards, which was not the case. A lack of transparency and accountability with the audit created the conditions for the disaster. According to OECD Watch, the fact that these audit reports were not made available to affected rights holders preventing independent verification and undermining the credibility of the certifications, exacerbated the situation.² An examination of factory conditions five years after the tragedy revealed that little had changed to genuinely improve worker safety.³

In September 2018, Ali Enterprises Factory Fire Affectees Association, composed of several unions and NGOs, filed a complaint against RINA to the Italian OECD National Contact Point for breach of the OECD Guidelines. In the complaint, they called upon RINA to provide for the “public disclosure of future audit reports, at least to the relevant trade union, workers at the audited factory and relevant government agencies.”⁴

→ Demonstrates: Reputational risk

Investors can examine the initiative’s policy documents to understand whether audit reports are shared with affected workers or community members who can verify or dispute report findings. They can also check whether the initiative has a complaints database with detailed information provided.

➔ World Wildlife Fund’s Certification Assessment Tool (WWF CAT) includes the following stipulations:¹

Certification bodies will post information about upcoming scheduled certification and surveillance audits on a common national and/or international scheme-operated website or mailing list.
Summary reports of certification and surveillance audits (including dates, locations, scope of auditing, team composition, main findings, and corrective action requests) are publicly available in a UN language and a common local language on a website.
Summary reports of certification and surveillance audits are made publicly available within 90 days after completion of the audit (see Red Flag 11).

➔ The Worker-Driven Social Responsibility (WSR) Network requires members to provide detailed annual reports that include data on complaint volume and resolution time frames, overall supplier compliance levels over time, and qualitative worker feedback on the WSR program’s effectiveness.²

➔ The Fair Labor Association publishes the results of audits “to encourage an open and honest dialogue about the conditions that workers face, ensure brand accountability, and help consumers make more informed decisions about the products they buy.”³

➔ Fairtrade International requires audit results to be shared with workers. It mandates that “company shares audit results with workers following each audit in a format and language accessible to workers.”⁴

➔ The Initiative for Responsible Mining Assurance (IRMA):⁵

Publicly announces the start of every third-party assessment and the planned dates for on-site audits.
Publishes a summary audit report on their website, within 15 days of the achievement decision.
Limits redactions to confidential business information or individual safety risks.
Requires audit reports be published in English and up to two additional languages representing the dominant languages of identified stakeholder groups.

Checklist for Red Flag 14

Does the scheme require certified entities (members) to publicly disclose their audits and remedial action plans?

Ready to assess an initiative?

GO TO THE CHECKLIST ↗

← Flag 13 End of flags

Red Flags in Sustainability Initiatives

Does Not Make Information on Audits, Complaints, or Compliance Public