Skip to main content
Governance Authority
Category: Sustainability and ESG

Responsible Business Conduct

Also known as: RBC, Corporate Social Responsibility, CSR
Simply put

Responsible business conduct (RBC) refers to the expectation that companies and investors align their activities with the needs of society, contribute positively to sustainable development, and respect human rights while managing and avoiding harm to people, communities, and the environment. It generally covers a range of voluntary practices and policies, rather than a single binding legal requirement. What a business is expected to do in practice depends on its sector, jurisdiction, and the specific standards it commits to.

Formal definition

Responsible Business Conduct (RBC) is a policy and governance concept, promoted internationally by bodies such as the OECD, describing the practices and policies through which enterprises and investors seek to align their operations with societal needs, contribute to sustainable development, respect human rights, and manage or avoid adverse impacts arising from their activities and business relationships. RBC is closely related to, and in some usages treated as synonymous with, Corporate Social Responsibility (CSR), though the two terms are not identical in all contexts. Based on the evidence available, RBC is generally articulated as a set of expectations and non-binding standards rather than a uniform statutory obligation; the specific requirements, enforcement mechanisms, and scope vary by jurisdiction, sector, and the frameworks an entity adopts. This entry is educational and does not constitute legal, audit, or compliance advice, and it does not detail the specific provisions of any particular instrument or national law, which are out of scope of the evidence provided.

Why it matters

Responsible business conduct has become a central reference point in the governance conversation because it captures a set of societal expectations that increasingly influence how boards frame strategy, oversee risk, and steward corporate reputation. Even where RBC is articulated as a non-binding standard rather than a statutory obligation, the expectations it represents, aligning business activities with the needs of society, contributing to sustainable development, and respecting human rights, shape stakeholder trust, investor engagement, and the social license under which enterprises operate. For governance professionals, RBC matters less as a checklist and more as a lens through which adverse impacts on people, communities, and the environment are identified and managed.

Because RBC is promoted internationally by bodies such as the OECD, it also functions as a common vocabulary across jurisdictions and sectors, allowing enterprises, investors, labor groups, and non-governmental organizations to engage around a shared concept even where legal requirements differ. This is significant for organizations operating across borders or within complex business relationships, where expectations articulated as voluntary standards in one setting may inform, or converge with, emerging legal duties in another. Boards and management that treat RBC purely as a reputational or public-relations matter risk overlooking the governance and risk dimensions embedded in it.

The practical importance of RBC therefore depends heavily on context. What a business is expected to do turns on its sector, the jurisdictions in which it operates, the frameworks it commits to, and the nature of its own activities and business relationships. Governance professionals should be cautious about assuming a single, uniform obligation; instead, the value of RBC lies in prompting structured attention to how corporate activity affects society and how adverse impacts are avoided or mitigated.

Who it's relevant to

Boards and their committees
Directors are generally responsible for overseeing, rather than executing, how the enterprise addresses societal expectations and manages adverse impacts on people, communities, and the environment. RBC provides a framework for board-level discussion of reputational, social, and sustainability-related risks, though the specific oversight responsibilities depend on the entity's sector, jurisdiction, and the standards it has adopted.
General counsel and compliance officers
Legal and compliance functions help interpret how voluntary RBC standards intersect with binding legal requirements that vary by jurisdiction and sector. Because RBC is generally non-binding, a key task is distinguishing genuine legal obligations from expectations and best practice, and advising on where commitments to particular frameworks may create accountability.
Risk officers
RBC connects to enterprise risk management by directing attention to adverse impacts arising from an entity's activities and business relationships. Risk functions can help management identify, assess, and mitigate these impacts, recognizing that the relevant standards and their enforcement vary across jurisdictions and the frameworks the organization elects to follow.
Investors
RBC expectations extend to investors, who are encouraged to align their activities with the needs of society and to consider how the enterprises they finance manage and avoid harm. This is relevant to engagement, stewardship, and diligence practices, though the specific expectations depend on the frameworks investors adopt.
Internal auditors and assurance functions
Assurance providers may be asked to evaluate whether policies and controls supporting an entity's RBC commitments are designed and operating as intended. Scope depends on the standards the organization has adopted; this entry does not detail any particular framework's requirements and is not audit advice.

Inside RBC

Human Rights Due Diligence
A process by which an enterprise identifies, prevents, mitigates, and accounts for how it addresses actual and potential adverse impacts on human rights across its operations and business relationships. Under certain frameworks, such as the OECD Guidelines for Multinational Enterprises and the UN Guiding Principles on Business and Human Rights, this is presented as an expectation of conduct rather than a universally binding legal requirement, though some jurisdictions have enacted mandatory due diligence statutes. Scope and enforceability vary by jurisdiction, sector, and entity type.
Supply Chain and Business Relationship Responsibility
The expectation that an enterprise consider adverse impacts connected to its products, services, and operations through its business relationships, not only those it causes directly. Whether and how far this extends depends on the applicable framework and any implementing law; non-binding guidance and binding statutes may set different boundaries.
Stakeholder Engagement
The practice of identifying and engaging with affected stakeholders, including workers, communities, and rightsholders, to inform the identification and management of impacts. This is generally treated as a component of credible responsible conduct under principles-based instruments rather than a prescriptive rules-based obligation.
Governance and Accountability Structures
The allocation of oversight and operational responsibility for responsible business conduct. Typically, the board provides oversight of the enterprise's approach and its alignment with strategy and stated commitments, while management is responsible for designing and operating the underlying processes and controls. Assurance functions may provide independent evaluation of design and operating effectiveness.
Remediation and Grievance Mechanisms
Processes intended to enable the enterprise to provide for or cooperate in the remediation of adverse impacts it has caused or contributed to, and to receive and address concerns. The existence and form of any legal obligation depend on jurisdiction and framework; many instruments address this as an expectation of conduct.
Transparency and Reporting
Communication about how impacts are identified and addressed, ranging from voluntary disclosure under codes and frameworks to mandatory reporting where law requires it. Requirements differ significantly by jurisdiction, sector, and entity type.

Common questions

Answers to the questions practitioners most commonly ask about RBC.

Is responsible business conduct the same as corporate social responsibility (CSR)?
Not quite. The two concepts overlap but are generally distinguished in practice. CSR is often framed as voluntary, discretionary activity that a company chooses to undertake, sometimes emphasizing philanthropy or community initiatives beyond core operations. Responsible business conduct (RBC), as articulated in instruments such as the OECD Guidelines for Multinational Enterprises, is typically framed as an expectation that enterprises avoid and address adverse impacts of their own operations, supply chains, and business relationships, embedded in how the business is run rather than added on top of it. Treating RBC as interchangeable with discretionary CSR risks understating the due diligence expectations attached to it. That said, the terminology varies across organizations and jurisdictions, and this entry is educational rather than a definitive delineation.
Does adopting responsible business conduct expectations mean they are legally binding on the company?
Not automatically. Many RBC expectations originate in non-binding instruments and frameworks, international guidance, industry codes, or voluntary standards, which set out what is expected but do not themselves create legal obligations. However, the picture is jurisdiction-specific: in some jurisdictions and sectors, elements associated with RBC (for example, certain human rights, environmental, or supply-chain due diligence and disclosure duties) have been incorporated into binding law, and the scope of those laws varies considerably. Whether a given RBC expectation is a legal requirement or a voluntary standard depends on the applicable jurisdiction, sector, entity type, and the specific obligation in question. Companies should obtain jurisdiction-specific legal advice rather than assume any single answer.
Who within the organization owns responsible business conduct, the board or management?
Accountability is generally shared but differentiated by role. The board typically holds an oversight responsibility: setting tone, approving relevant policies and risk appetite, and monitoring how RBC-related risks and impacts are managed. Management generally owns the operational implementation, embedding due diligence into processes, allocating resources, and executing controls day to day. Assurance functions, such as internal audit, may provide independent evaluation of whether those arrangements are designed and operating as intended. The precise allocation depends on the entity's governance structure, size, sector, and any applicable legal requirements, and it is often documented in charters and delegation frameworks.
How can a company begin embedding responsible business conduct into existing risk management processes?
In many organizations, RBC-related risks are integrated into the enterprise risk management approach rather than managed in isolation. Common steps include identifying where the enterprise may cause, contribute to, or be linked to adverse impacts across its own operations and business relationships; assessing those exposures using consistent criteria such as likelihood and severity of impact; and prioritizing where due diligence and controls are most needed. This can leverage existing risk registers, control frameworks, and reporting lines rather than building parallel structures. The appropriate depth and method depend on the entity's size, sector, risk profile, and applicable expectations, and involve professional judgment; this is a general description, not a prescriptive methodology.
What role does due diligence play in responsible business conduct, and how does it differ from a one-time assessment?
Due diligence is generally described in RBC-related guidance as an ongoing, risk-based process rather than a single event. It typically involves identifying and assessing actual and potential adverse impacts, acting to prevent or mitigate them, tracking whether those actions are effective, and communicating how impacts are addressed. The distinction from a one-time assessment matters: exposures change as operations, suppliers, and external conditions evolve, so due diligence is usually expected to be periodic and responsive. The specific scope, frequency, and formality that are appropriate depend on the enterprise's circumstances and any applicable legal or framework expectations, and should be informed by professional judgment.
How can an organization monitor and report on the effectiveness of its responsible business conduct efforts?
Monitoring generally distinguishes between whether relevant policies and controls are well designed and whether they are operating effectively in practice, these are separate questions. Organizations often use a combination of internal monitoring by management, independent assurance from functions such as internal audit, and outcome-oriented indicators tied to the impacts the program is intended to address. Reporting may flow to relevant board committees and, where applicable, to external stakeholders through disclosure. The nature and extent of any external reporting can depend on jurisdiction-specific disclosure requirements and voluntary frameworks the entity has adopted. What constitutes adequate monitoring is context-dependent and a matter of professional judgment; this entry is educational and not audit, compliance, or legal advice.

Common misconceptions

Responsible business conduct is a voluntary reputational matter with no legal dimension.
While many responsible business conduct instruments are non-binding guidance or expectations of conduct, some jurisdictions have enacted binding due diligence and reporting statutes. Whether a given obligation is legally binding depends on the jurisdiction, sector, and entity type, and this distinction should be assessed for each situation rather than assumed.
Adopting an internationally recognized framework, such as the OECD Guidelines or the UN Guiding Principles, satisfies all applicable legal requirements.
These instruments describe expectations of conduct and are not universally mandatory. Adopting a framework does not, on its own, discharge binding legal obligations that may apply under local law, and conversely a framework may address matters beyond what any single law requires.
Responsible business conduct is owned and delivered by the board.
The board generally provides oversight of the enterprise's approach and its alignment with commitments, whereas management is responsible for designing and operating the relevant due diligence processes and controls. Attributing the operational delivery to the board, or the oversight duty solely to management, misstates where accountability typically sits.

Best practices

Clarify which responsible business conduct expectations arise from binding law in each relevant jurisdiction versus non-binding frameworks or codes, and document that distinction so it drives compliance obligations appropriately.
Define and separate board oversight responsibilities from management's operational responsibility for due diligence processes, and record this allocation in charters, mandates, or delegations of authority.
Establish a due diligence process that identifies, prevents, mitigates, and accounts for adverse impacts across operations and business relationships, scaled to the enterprise's size, sector, and risk profile.
Engage affected stakeholders in a manner appropriate to the identified impacts, and use that input to inform how impacts are prioritized and addressed.
Provide for or cooperate in credible remediation and grievance mechanisms for impacts the enterprise causes or contributes to, and evaluate both the design and operating effectiveness of those mechanisms over time.
Align public commitments and disclosures with what the enterprise actually does, distinguishing voluntary reporting from any mandatory reporting required by applicable law, and consulting legal and compliance advisors where obligations are uncertain.