ISO 26000:2010: Requirements for Documentation and Compliance

ISO 26000:2010 provides guidance on social responsibility. It helps organisations understand how their decisions and activities affect people, society, the economy and the environment.

This document explains, section by section, what an organisation should do and what evidence can demonstrate that it is doing it.

It is not simply a checklist. A checklist asks, “Do you have this document?” This approach asks a more useful question:

“What are you doing, and what evidence shows that you are actually doing it?”

ISO 26000 covers social responsibility across several important areas, including governance, human rights, labour practices, the environment, fair business practices, consumers and communities.

________________________________________

4. The Seven Principles of Social Responsibility

Accountability

An organisation should take responsibility for the impact of its decisions and activities on society, the economy and the environment.

Evidence may include:

• Clear responsibility assigned to people or departments.

• Records showing how the organisation manages its social, economic and environmental impacts.

• Evidence that responsibility goes beyond simply achieving profits.

Transparency

An organisation should be open about decisions and activities that may affect people.

Evidence may include:

• Public information about the organisation's purpose, ownership and governance.

• Information about activities and performance.

The organisation should communicate both positive and negative results, not only its successes.

Evidence may include:

• Reports that also explain problems, failures or areas requiring improvement.

Ethical Behaviour

The organisation should behave honestly, fairly and ethically.

Evidence may include:

• A code of conduct or ethics policy.

• Records showing that unethical behaviour is addressed.

• A safe mechanism for employees to report wrongdoing.

Respect for Stakeholder Interests

An organisation should consider the interests of people who may be affected by its activities, not only owners and customers.

Evidence may include:

• Records showing that stakeholder concerns were considered.

• Examples where stakeholder feedback influenced a decision.

Respect for the Rule of Law

The organisation should comply with applicable laws and regulations wherever it operates.

Evidence may include:

• A legal and regulatory compliance system.

• A register of applicable legal requirements for different countries or locations.

If local laws are weaker than internationally recognised standards, the organisation should consider and respect those international norms.

Evidence may include:

• A documented approach for dealing with such situations.

• Examples of how conflicts between local law and international expectations were handled.

Respect for International Norms of Behaviour

The organisation should consider internationally accepted standards of responsible behaviour, especially where local requirements may not provide adequate protection.

Respect for Human Rights

The organisation should respect internationally recognised human rights.

Evidence may include:

• A human rights policy or commitment.

• Evidence that human rights considerations apply to the organisation's own activities and business relationships.

________________________________________

5. Understanding Responsibility and Engaging Stakeholders

An organisation should identify the social responsibility issues that are relevant to its activities.

Identify Important Issues

The organisation should assess the social responsibility issues that apply to its business.

Evidence may include:

• An assessment covering the relevant social responsibility subjects and issues.

• Clear criteria explaining why particular issues are considered important or less relevant.

Consider the Entire Value Chain

The organisation should look beyond its own offices and operations.

It should consider impacts across its suppliers, contractors, business partners, customers and other parts of the value chain.

Evidence may include:

• Assessments of both upstream and downstream impacts.

Document Issues That Are Not Relevant

If an issue is considered not relevant, the organisation should record the reason.

Evidence may include:

• A documented list of excluded issues and the reasons for excluding them.

Identify Stakeholders

The organisation should identify people and groups who may be affected by its activities.

These may include:

• Employees

• Customers

• Suppliers

• Contractors

• Local communities

• Government authorities

• Supply-chain workers

• Future generations

Evidence may include:

• A stakeholder identification or stakeholder map.

Engage with Stakeholders

Stakeholder engagement should be meaningful. People should have a genuine opportunity to share their views before important decisions are made.

Evidence may include:

• Meeting and consultation records.

• Feedback received.

• Examples where stakeholder feedback resulted in a change.

The organisation should also remove barriers that prevent people from participating, such as:

• Language

• Cost

• Distance

• Literacy

• Fear of retaliation

The organisation should explain what it did with the feedback received.

________________________________________

6.2 Organisational Governance

The organisation's governance system should make it possible to manage social responsibility effectively.

Clear Responsibility

There should be clear decision-making authority and accountability.

Evidence may include:

• Organisation charts.

• Assigned responsibilities.

• Decision-making processes that consider the seven principles.

Pay and Incentives

The organisation should check whether salary, bonuses and incentive systems encourage responsible behaviour or create pressure for irresponsible behaviour.

Evidence may include:

• Reviews of remuneration and incentive systems.

Stakeholder Communication

There should be two-way communication with people affected by organisational decisions.

Resources

The organisation should provide sufficient people, time and financial resources for social responsibility activities.

Evidence may include:

• Budgets.

• Assigned employees or teams.

• Resources allocated to relevant programmes.

________________________________________

6.3 Human Rights

Organisations should identify, prevent and address actual or potential human rights impacts.

Human Rights Due Diligence

The organisation should regularly assess human rights risks in:

• Its own operations

• Supply chains

• Business relationships

Evidence may include:

• Human rights due-diligence assessments.

• Identified risks.

• Corrective actions.

• Follow-up records.

The organisation should identify specific human rights risks, rather than making only general statements.

High-Risk Situations

Extra attention should be given to areas where human rights risks are higher, such as conflict-affected or high-risk locations.

Avoid Complicity

The organisation should make sure that its business relationships do not contribute to human rights abuses.

Complaints and Remedy

People whose rights may be affected should have a way to raise complaints and seek appropriate remedies.

Evidence may include:

• Grievance mechanisms.

• Complaint records.

• Investigation results.

• Corrective actions and remedies.

• Protection against retaliation.

Non-Discrimination

The organisation should prevent discrimination and consider the needs of vulnerable groups.

Evidence may include:

• Non-discrimination policies.

• Recruitment, salary, promotion and training data.

• Analysis of differences between employee groups.

Civil and Political Rights

The organisation should respect rights such as:

• Freedom of expression

• Freedom of association

• Peaceful assembly

Economic, Social and Cultural Rights

The organisation should consider how its activities affect:

• Education

• Health

• Living standards

• Other basic social and economic rights

Fundamental Rights at Work

The organisation should address:

• Forced labour

• Child labour

• Discrimination

• Freedom of association

It should also check that suppliers follow similar expectations.

________________________________________

6.4 Labour Practices

Organisations should provide fair and responsible working conditions.

Employment Relationships

Employment arrangements should be clear and fair for:

• Permanent employees

• Contract workers

• Agency workers

• Other indirect workers

Evidence may include:

• Employment contracts.

• Terms and conditions.

• Comparison of treatment between direct and contract workers.

Wages and Working Hours

Employees should receive fair wages and reasonable working hours, rest periods and leave.

Evidence may include:

• Salary and working-hour records.

• Comparison with legal requirements and applicable wage commitments.

Social Protection

Workers should receive appropriate social protection.

Evidence may include:

• Details of benefits and protection provided to different categories of workers.

Worker Consultation

Employees and their representatives should have opportunities to discuss matters that affect them.

Evidence may include:

• Consultation records.

• Worker meetings.

• Feedback and resulting actions.

Health and Safety

Workplace health and safety should be properly managed and should also cover contractors.

Evidence may include:

• Accident and incident records.

• Occupational health information.

• Safety performance trends.

• Worker participation.

• Contractor safety arrangements.

If the organisation has an ISO 45001 system, it can support this area.

Employee Development

Organisations should support employee development through:

• Training

• Career development

• Skill development

• Employability programmes

Evidence may include:

• Training plans.

• Training completion records.

• Development opportunities.

• Analysis to ensure fair access.

________________________________________

6.5 Environment

Organisations should understand and reduce their environmental impacts.

Pollution Prevention

The organisation should prevent and reduce pollution.

Evidence may include:

• Identification of pollution sources.

• Emission and waste data.

• Measurements and trends.

• Reduction programmes.

Sustainable Use of Resources

Resources such as:

• Energy

• Water

• Raw materials

should be used responsibly.

Evidence may include:

• Consumption data.

• Efficiency improvement measures.

• Use of recycled or renewable materials.

Climate Change

Organisations should measure and reduce greenhouse gas emissions and prepare for climate-related risks.

Evidence may include:

• Greenhouse gas data.

• Emission trends.

• Reduction targets.

• Climate-risk assessments.

• Adaptation measures.

Any public climate-related claim should be supported by reliable data.

Biodiversity and Natural Habitats

The organisation should consider how its activities affect:

• Land

• Water

• Ecosystems

• Biodiversity

• Natural habitats

Evidence may include:

• Environmental impact assessments.

• Measures to prevent or reduce damage.

• Restoration activities where necessary.

________________________________________

6.6 Fair Operating Practices

Organisations should conduct business fairly, ethically and responsibly.

Anti-Corruption

The organisation should prevent bribery and corruption through:

• Policies

• Risk assessments

• Controls

• Employee training

Evidence may include:

• Anti-corruption procedures.

• Training records.

• Investigation and complaint records.

An ISO 37001 system, where applicable, can support this area.

Political Involvement and Lobbying

Organisations should be transparent about political involvement, lobbying and contributions.

Fair Competition

The organisation should comply with applicable competition laws.

Evidence may include:

• Competition-law policies.

• Training records.

• Compliance arrangements.

• Corrective actions where problems occurred.

Responsible Supply Chains

Organisations should encourage responsible behaviour among suppliers.

Evidence may include:

• Supplier codes of conduct.

• Supplier assessments.

• Monitoring records.

• Percentage of suppliers covered.

Suppliers should also be supported in improving their performance, rather than simply being audited and removed.

Responsible Purchasing

Organisations should review whether their own purchasing practices allow suppliers to behave responsibly.

For example, extremely short delivery times, very low prices or delayed payments may make responsible practices difficult for suppliers.

Evidence may include:

• Review of supplier pricing.

• Payment terms.

• Delivery requirements.

• Supplier feedback.

Property Rights

The organisation should respect:

• Intellectual property

• Copyright

• Patents

• Traditional knowledge

• Other property rights

Evidence may include:

• Relevant agreements and controls.

• Records showing fair treatment or compensation where applicable.

________________________________________

6.7 Customers and Consumers

Organisations should treat customers fairly and protect their interests.

Honest Marketing and Fair Contracts

Marketing information should be accurate and contracts should be fair.

Evidence may include:

• Review of advertisements and marketing claims.

• Contract reviews.

Product and Service Safety

Products and services should not create unnecessary health or safety risks.

Evidence may include:

• Safety testing.

• Product warnings.

• Recall procedures.

• Post-market monitoring.

Sustainable Consumption

Customers should receive information that helps them make responsible choices.

Products can also be designed with factors such as:

• Durability

• Repairability

• Energy efficiency

• Resource efficiency

Complaints and Customer Support

Customers should have a clear way to:

• Ask for support

• Raise complaints

• Resolve disputes

Evidence may include:

• Complaint procedures.

• Complaint records.

• Response times.

• Resolution outcomes.

Customer Privacy

Customer information and personal data should be protected.

Evidence may include:

• Privacy policies.

• Data protection controls.

• Relevant privacy management systems.

Access to Essential Services

Where an organisation provides essential services, it should consider people who may face:

• Financial

• Physical

• Language

• Geographic

barriers.

Consumer Education

Organisations should provide useful information so customers can make informed decisions.

________________________________________

6.8 Community Involvement and Development

Organisations should understand and contribute positively to the communities where they operate.

Community Engagement

The organisation should consult communities about their actual needs and priorities.

Evidence may include:

• Community consultation records.

• Feedback.

• Examples of actions based on community priorities.

Education and Culture

Organisations can contribute to local:

• Education

• Skills

• Culture

Local Employment

Organisations should consider opportunities to create local employment and develop local skills.

Evidence may include:

• Local employment data.

• Training programmes.

Technology and Knowledge Sharing

Organisations should consider opportunities to share technology, skills and knowledge.

Local Economic Development

Organisations can contribute through:

• Local purchasing

• Fair payment practices

• Local employment

• Appropriate tax contributions

Community Health

Organisations should consider opportunities to support community health.

Social Investment

Community investment should be developed with community participation and should complement, rather than replace, government responsibilities.

Evidence may include:

• Community involvement in programme design.

• Programme results and outcomes.

________________________________________

7. Making Social Responsibility Part of Everyday Business

Social responsibility should not be treated as a separate activity or occasional project. It should become part of normal business decisions.

Set Priorities

The organisation should identify which social responsibility areas are most important and document why.

Evidence may include:

• Documented priorities.

• Stakeholder feedback.

• Impact assessments.

• Consideration of international norms.

Understand Your Sphere of Influence

The organisation should understand where it has influence and where it can encourage responsible behaviour.

This may include:

• Suppliers

• Contractors

• Business partners

• Customers

• Other stakeholders

Integrate Social Responsibility

Social responsibility should be included in normal business processes such as:

• Strategy

• Procurement

• Human resources

• Product development

• Risk management

• Operations

Management Responsibility

Responsibility should not sit only with a specialist CSR or sustainability team.

Managers across the organisation should understand and apply these principles in their decisions.

Awareness and Training

Employees should understand the responsibilities relevant to their roles.

For example:

• Procurement teams should understand responsible purchasing.

• HR should understand labour and human rights.

• Sales teams should understand honest marketing.

• Operations should understand environmental and safety responsibilities.

Evidence may include:

• Awareness programmes.

• Training records.

• Employee interviews.

Communication

The organisation should communicate its social responsibility activities clearly, accurately and in a balanced manner.

Information should be understandable and accessible to the intended audience.

Credible Claims

Organisations should be able to support their social responsibility claims with evidence.

Evidence may include:

• Independent assurance.

• Stakeholder involvement.

• Third-party verification.

• Participation in recognised initiatives.

If the organisation discovers that a public claim cannot be supported, correcting the claim is strong evidence of transparency and credibility.

Monitor Performance

Performance should be measured using data rather than only written descriptions.

Evidence may include:

• Performance indicators.

• Baseline data.

• Targets.

• Results over time.

• Management reviews.

The organisation should focus not only on how many activities were completed, but also on whether those activities produced meaningful improvements.

Voluntary Initiatives

If an organisation joins voluntary social responsibility initiatives, it should:

1. Assess the initiative before joining.

2. Understand its commitments.

3. Meet the requirements.

4. Complete any required reporting.

Membership itself should not be presented as proof of good performance.

________________________________________

How to Use This Information

ISO 26000 does not mean that an organisation needs to create a huge collection of manuals, procedures and forms.

The main focus is on making responsible decisions and being able to demonstrate those decisions with evidence.

A long procedure does not automatically mean compliance.

In fact, a procedure that nobody follows can create a bigger problem because it shows a gap between what the organisation says and what it actually does.

The practical question is:

Can the people responsible for the work recognise their actual activities and responsibilities in the organisation's documented approach?

The objective should therefore be to create a practical system that reflects what the organisation really does, rather than producing documents simply to satisfy an audit.

In simple terms:

ISO 26000 is about responsible behaviour, stakeholder engagement, evidence-based decisions and continuous improvement — not about creating paperwork for the sake of paperwork.