The working group on Due Diligence is responsible for developing due diligence tools and templates, analysing due diligence actions and reports, and ensuring that the process is in line with recognised international due diligence processes and guidelines. Furthermore, the working group is responsible for supporting due diligence-related obligations arising from the Agreement. The working group also organises due diligence knowledge sessions for the Parties.

The first step in implementing due diligence is embedding responsible business conduct into policies and management systems. The maturity assessment tool helps companies understand the status of their due diligence implementation within their company.

The average maturity score out of thirteen companies in Year 3 was 36%. There are five different levels of maturity that a company can achieve: ‘basic’ (0-20%), ‘improving’ (20-40%), ‘established’ (40-60%), ‘advanced’ (60-80%) and ‘mature’ (80-100%). Within the Agreement, three companies achieved a ‘basic’ level of maturity, while five companies were ‘improving’, three companies were ‘established’ and two companies achieved an ‘advanced’ level of maturity. A quantitative comparison with the previous year is not possible, as the scoring system has since been updated. This is a self-assessment questionnaire, and has not been verified by an independent external party.

Both in absolute numbers and percentage-wise, the amount of companies that published an international RBC policy rose substantively in Year 3. During Year 2, six out of eleven companies published their policy. This year, ten out of thirteen companies published a policy.

Out of nine companies, seven publicly disclosed their due diligence efforts. Most of them disclosed these in 2021, whereas one of them had already done that in 2020. One other company reported to the Secretariat, but has not published its report yet. Four companies do not have to report on their due diligence activities yet, as they are starting their first due diligence cycle this year.

A due diligence action plan sets out the plan of a company which is aimed at preventing, mitigating and accountability for existing and potential risks and violations to people and the environment in their supply chains. Two examples of courses of action planned by some companies are:

• One company wants to be operating CO₂ neutral within 3 years. The first step that the company will take is to agree on a roadmap with its suppliers for a CO₂-neutral supply.
• Another company wants to increase transparency within its value chain and have a broader perspective beyond the first links in the chain. The company expects to identify more clearly where and what kind of risks occur in its value chain. The company will discuss this with its suppliers and raise the issue of its membership of the Agreement with them.

The original companies conducted a due diligence risk assessment for the second time with the aim of developing a due diligence action plan. This provided an opportunity for the various Parties to collaborate. One area for improvement here is that the companies could seek more help from the various civil society organisations within the Agreement. However, the few companies that did reach out to the civil society organisations, very much appreciated the collaboration and are satisfied with their action plans.

In the first half of the Agreement year, the Secretariat and various Parties to the Agreement worked hard to launch a due diligence webtool and transfer all existing due diligence tools and templates to it. Companies use this tool to complete their maturity assessments, map out their value chain and associated risks, draw up an action plan and write a due diligence report. In addition, the webtool features a page with a range of useful resources for exercising due diligence, which can be accessed by anyone who is interested.

In Year 3, companies received two separate knowledge sessions on due diligence. The first session focused on the way to approach public disclosure of international RBC action. The companies were inspired by examples from other companies to start working on public disclosure. The second session showed how different data sources can be used in risk analysis, which helps make the individual heat maps more insightful and trustworthy.