ISO 26000:2010: documentation and compliance requirements

This is what ISO 26000:2010 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 73 requirements across 10 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 26000:2010 readiness assessment, which scores you out of 100.

4 The seven principles

Clauses 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8.

You must accept responsibility for the effect you have on society, the economy and the environment.

Evidence: Who is accountable, and for what. Evidence of accepting responsibility for impacts, not only for profit.

You must be open about the decisions and activities that affect other people.

Evidence: Published information on purpose, ownership, governance, activities and performance.

You must disclose the bad news as well as the good.

Evidence: Reports that include what went wrong. This is the usual test of whether openness is real.

You must behave honestly and fairly, and act when someone in the organisation does not.

Evidence: A code of conduct. Evidence of enforcement. A route to report dishonesty without fear.

You must take account of the interests of people affected by what you do, beyond your owners and customers.

Evidence: Evidence that other people's interests were considered and changed a decision.

You must comply with the law everywhere you operate.

Evidence: Compliance arrangements per country. A register of legal duties.

Where local law is weaker than international norms, you must still follow the norms.

Evidence: A written position on this, and an example of how a conflict was actually handled.

You must respect internationally recognised human rights.

Evidence: A policy commitment. Evidence it applies to your own operations and your relationships.

5 Recognising your responsibility and involving people

Clauses 5.2, 5.3.

You must have worked out which social responsibility issues actually matter to your organisation.

Evidence: An assessment of each core subject and issue against what you do, with the criteria you used.

You must have look across your whole value chain, not just inside your own walls.

Evidence: Impacts considered upstream and downstream.

You must have recorded the issues you judged not relevant, and why.

Evidence: The list with the reasoning.

You must have identified the people and groups affected by what you do.

Evidence: A stakeholder map with how each was identified.

That include must people with no formal relationship to you — communities, future generations, workers in your supply chain.

Evidence: Those groups named.

You must actually engage with them, in a way that lets their views change your decisions.

Evidence: Engagement records showing it happened before decisions were made. An example where a decision changed as a result.

You must have removed the things that stop people taking part — language, cost, distance, literacy, fear.

Evidence: What you changed to make participation possible.

You must tell people what you did with what they told you.

Evidence: Feedback given after engagement.

6.2 How you are governed

Clause 6.2.

Your governance must let you actually act on social responsibility — with clear decision-making and accountability.

Evidence: Governance structure showing where responsibility sits. Decision-making processes applying the seven principles.

You must have checked whether your pay and incentive schemes reward or undermine responsible behaviour.

Evidence: A review of remuneration and incentives.

There must be two-way communication with the people affected by your decisions, built into governance.

Evidence: Engagement built into governance, not bolted on.

Resources must be allocated to social responsibility.

Evidence: Budget and people assigned.

6.3 Human rights

Clauses 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10.

You must carry out human rights due diligence — looking for actual and potential harm.

Evidence: A due diligence process covering your own operations, your supply chain and your business relationships, repeated at intervals.

It must name the specific rights at risk, rather than talking generally.

Evidence: Rights named. Findings acted on and tracked.

You must take extra care in places where the risk of abuse is higher.

Evidence: Heightened due diligence in conflict-affected or high-risk contexts.

You must avoid being complicit in abuses committed by others.

Evidence: Assessment of relationships where you could be implicated. Action taken.

There must be a way for people whose rights may be affected to complain and get a remedy.

Evidence: A grievance mechanism reachable by workers, communities and supply chain workers. Records of grievances, outcomes and remedies. Protection from retaliation.

You must avoid discrimination, and take account of vulnerable groups.

Evidence: Non-discrimination policy applied in recruitment, pay, promotion, training and dismissal. Workforce and pay data analysed for disparity.

You must respect civil and political rights, such as freedom of expression and assembly.

Evidence: A policy position and how it applies in practice.

You must respect economic, social and cultural rights — education, health, an adequate standard of living.

Evidence: How your activities affect these, and what you do about it.

You must respect the fundamental rights at work — no forced labour, no child labour, freedom of association, no discrimination.

Evidence: Policies and supply chain assurance on forced and child labour, with the verification method. Freedom of association respected in practice, including where local law restricts it.

6.4 How you treat the people who work for you

Clauses 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7.

Employment relationships fair and must be properly established, including for agency and contract workers.

Evidence: Contracts and terms. Comparison of how direct and indirect workers are treated. Evidence responsibility is not avoided by disguising employment as a commercial arrangement.

Wages, hours, rest and leave decent — and must be benchmarked against something meaningful.

Evidence: Terms benchmarked against legal minima and, where you have committed to it, a living wage.

Workers must have social protection.

Evidence: What is provided, and to whom.

You must talk to workers or their representatives about things that affect them.

Evidence: Consultation and dialogue records with outcomes.

Health and safety at work must be managed, and it must cover contractors too.

Evidence: Incident and ill-health data with trends. Worker participation. Contractor coverage. Refer to your ISO 45001 system if you have one.

You must develop your people — training, career development and employability.

Evidence: Training plans and completion. Access to development analysed for fairness across groups.

6.5 The environment

Clauses 6.5.3, 6.5.4, 6.5.5, 6.5.6.

You must prevent and reduce pollution, and you must be able to show it with measurements.

Evidence: Sources of pollution identified. Measured emissions, discharges and waste, with trends. Reduction measures and their effect.

You must use resources sustainably — energy, water, materials.

Evidence: Consumption data with efficiency measures and results. Use of recycled and renewable inputs.

You must measure and reduce your greenhouse gas emissions, and prepare for climate impacts.

Evidence: A greenhouse gas inventory with trends and targets. An assessment of your vulnerability to climate impacts and the adaptation measures taken.

Your public climate claims must be supported by the underlying data.

Evidence: The data behind any claim. Unsupported claims carry legal as well as reputational risk.

You must protect the environment, biodiversity and natural habitats affected by what you do.

Evidence: Land, water and ecosystem effects considered, including in your supply chain. Measures to avoid, reduce or restore.

6.6 How you do business

Clauses 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7.

You must prevent corruption — with a policy, a risk assessment, controls and training.

Evidence: The anti-corruption arrangements, and records of concerns raised and investigated. Refer to your ISO 37001 system if you have one.

You must be open about political involvement, lobbying and contributions.

Evidence: A policy and disclosure. Safeguards against undue influence.

You must compete fairly.

Evidence: Competition law compliance arrangements and training. Any enforcement history and what changed.

You must promote responsible behaviour through your supply chain.

Evidence: A supplier code or equivalent expectations. How they are communicated, assessed and monitored. The proportion of suppliers or spend covered.

You must support suppliers to improve, rather than only auditing and dropping them.

Evidence: Support and capability-building given.

You must have checked whether your own buying practices make it possible for suppliers to behave responsibly.

Evidence: A review of your pricing, lead times and payment terms. Squeezing a supplier and then requiring good labour practice is a contradiction auditors and NGOs both notice.

You must respect property rights, including intellectual property and traditional knowledge.

Evidence: Arrangements covering both. Fair compensation for property acquired or used.

6.7 Your customers and consumers

Clauses 6.7.3, 6.7.4, 6.7.5, 6.7.6, 6.7.7, 6.7.8, 6.7.9.

Your must be marketing accurate, and are your contract terms fair.

Evidence: Marketing material reviewed for misleading or unfair claims. Contract terms reviewed for fairness.

You must protect the health and safety of the people who use your product or service.

Evidence: Safety testing, warnings, recall arrangements and post-market monitoring.

You must help people consume sustainably — through product information and design.

Evidence: Information given. Durability, repairability and efficiency considered in design.

Customers must be able to get support and resolve a complaint or dispute.

Evidence: A complaints and dispute process with records, timeliness and outcomes.

You must protect customer data and privacy.

Evidence: Privacy arrangements. Refer to your privacy system if you have one.

You must make sure people who face barriers can still get your essential services.

Evidence: Provision for those facing money, physical, language or geographic barriers. N/A with a reason if you supply no essential services.

You must educate and inform customers so they can make good choices.

Evidence: Consumer education activity.

6.8 The communities you operate in

Clauses 6.8.3, 6.8.4, 6.8.5, 6.8.6, 6.8.7, 6.8.8, 6.8.9.

You must engage with the communities where you operate, on their priorities rather than yours.

Evidence: Consultation records with community representatives, and evidence their priorities shaped what you did.

You must contribute to education and culture locally.

Evidence: The activity and its outcomes.

You must create employment and develop skills locally.

Evidence: Local employment and training data.

You must help develop and share technology and know-how.

Evidence: Technology access or transfer activity.

You must create wealth and income locally — through local buying, fair payment terms and taxes paid.

Evidence: Local procurement data. Payment terms to small suppliers. Tax approach.

You must contribute to health in the community.

Evidence: Health-related activity.

Your must be social investment designed with the community, and it must avoid taking over what government should do.

Evidence: Social investment records showing community involvement in design, with outcomes.

7 Making it part of how you work

Clauses 7.3, 7.4, 7.4.3, 7.5, 7.6, 7.7, 7.8.

You must have set your own priorities across the core subjects, and written down the reasoning.

Evidence: Documented priorities, showing how you weighed stakeholder views, your impacts, and international norms.

You must have worked out how far your influence reaches, and where you can use it.

Evidence: An assessment of your sphere of influence.

You must be able to answer: Is social responsibility part of your purpose, strategy and everyday processes — not a separate programme?

Evidence: Social responsibility in policies, objectives, procurement, product development, HR and risk processes.

Responsibility must be held by line managers, not only by a specialist team.

Evidence: Accountability assigned within the business. Evidence people outside the specialist function apply it in their decisions.

People must be across the organisation aware of it, and competent in the parts relevant to their job.

Evidence: Awareness and training records, differentiated for roles with most influence — buying, HR, sales, operations. Ask staff.

You must communicate about social responsibility clearly, completely, accurately and in a balanced way.

Evidence: Reports and communications assessed against those qualities, particularly balance. Accessibility to the intended audience.

You must be able to make your claims credible to someone who is sceptical.

Evidence: Independent assurance, stakeholder involvement in reporting, third-party verification or participation in recognised initiatives.

You must have ever corrected a claim you found you could not support.

Evidence: An example. This is the strongest evidence of credibility there is.

You must monitor performance and review progress with data, not narrative.

Evidence: Indicators with baselines, targets and results over time. Senior review of performance.

You must be able to show outcomes improving, rather than just more activity.

Evidence: Trends in outcomes. Shortfalls identified and acted on.

Where you have joined voluntary initiatives, you must have assess them first, and you must meet what they require.

Evidence: The list of initiatives joined. An assessment of each before joining. Evidence you meet the commitments, including any reporting duty.

You must avoid presenting membership of an initiative as if it were performance.

Evidence: How membership is described in your material.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.