Skip to content
Executive Summary
In partnership with Ethics and Compliance Switzerland, Ethixbase360 hosted a webinar on one of the most pressing challenges facing the life sciences industry: how to effectively manage human rights and corruption risks across complex third-party networks — from clinical trial sites and distributors to manufacturers and logistics partners. The session featured Aditi Wanchoo, Director of Human Rights at Novartis; Patrick Wellens, Chairman of Ethics and Compliance Switzerland; and James Swenson, Managing Director at Ethixbase360.
Three insights emerged: different maturity levels drive different approaches, risk assessments are foundational, and a risk-based approach is essential for scalability. The discussion focused on how organisations can evolve their due diligence and monitoring programmes to meet shifting regulatory expectations, while remaining practical, proportionate, and aligned with business realities.
Risk Assessment Factors
Companies must first understand their inherent risk exposure by evaluating:
A clearly defined, risk-based approach may draw on indicators including:
Key Insights from the Discussion
Different maturity levels drive different approaches
There is no one-size-fits-all approach to human rights due diligence. Organisations are at varying stages of TPRM maturity, and this directly influences how they embed human rights considerations.
Some companies are integrating human rights into existing TPRM frameworks, leveraging established processes and infrastructure. Others are developing standalone workstreams depending on organisational structure and priorities. Ultimately, the approach depends on internal maturity, resources, and strategic priorities, but alignment and clarity are key to ensuring effectiveness.
Risk assessments are foundational
A strong risk assessment framework is critical to any human rights due diligence programme. While baseline models such as those based on jurisdiction or company type provide a useful starting point, they are not sufficient on their own. Internal factors, business models, and sector-specific nuances play an equally important role. A more tailored, holistic assessment enables organisations to prioritise efforts where they matter most.
However, efficiency is equally important. Asking third parties to complete extensive questionnaires at scale is neither practical nor effective. A more targeted approach, such as screening suppliers against relevant databases and deploying detailed questionnaires only for higher-risk entities, can significantly improve both response rates and data quality.
Equally, organisations should aim for a holistic view of third-party risk. Fragmented approaches where separate tools, methodologies, and assessments are used for human rights, sanctions, anti-corruption, and IT security can create inefficiencies and fatigue for suppliers. An integrated framework helps streamline processes while improving overall risk visibility.
A risk-based approach is essential for scalability
For large organisations, reviewing every third party is neither practical nor efficient. A clearly defined, risk-based approach allows companies to allocate resources strategically and scale their programmes effectively. This approach should be embedded in policy and applied consistently across the business. By focusing on higher-risk areas, organisations can enhance both efficiency and impact, without compromising on compliance.
Importantly, due diligence should not be viewed as a one-time exercise at onboarding. Ongoing monitoring across the lifecycle of the third-party relationship is essential to ensure risks are continuously identified and managed as circumstances evolve. Leveraging data-driven insights across suppliers and extended value chains, including N-1 and N-2 relationships, can further strengthen programmes. This enables organisations to proactively identify emerging risks, rather than relying solely on reactive assessments.
Key Concepts
- TPRM maturity
- The stage an organisation has reached in its third-party risk management programme — it directly influences whether human rights is integrated into existing TPRM frameworks or run as a standalone workstream.
- Inherent risk exposure
- The risk a company faces before controls are applied, understood by evaluating its operations, geographic footprint, and third-party ecosystem.
- Risk-based approach
- A clearly defined approach, embedded in policy and applied consistently, that allocates resources to higher-risk third parties using indicators such as geography, industry, nature of the relationship, and spend thresholds.
- Integrated risk framework
- A single framework covering human rights, sanctions, anti-corruption, and IT security, in place of separate tools and assessments that create inefficiency and supplier fatigue.
- Lifecycle monitoring
- Ongoing monitoring across the whole third-party relationship, rather than due diligence as a one-time exercise at onboarding.
Frequently Asked Questions
Key Takeaways & Actions
- ✓Match your human rights approach to your TPRM maturity — integrate into existing frameworks or run a standalone workstream, with alignment and clarity.
- ✓Start with inherent risk exposure — operations, geographic footprint, and third-party ecosystem — then add internal factors, business model, and sector nuances.
- ✓Screen suppliers against relevant databases and deploy detailed questionnaires only for higher-risk entities.
- ✓Move from fragmented tools to an integrated framework across human rights, sanctions, anti-corruption, and IT security.
- ✓Embed the risk-based approach in policy and apply it consistently across the business.
- ✓Monitor across the third-party lifecycle, using data-driven insights across extended value chains, including N-1 and N-2.