A grievance mechanism is a way for people to raise a concern about your company's activities, for example a worker who is not paid for overtime or a neighbor affected by pollution from your site. Your stakeholders often ask whether you have one, because it is how problems that audits and questionnaires miss come to light.
This article explains what a grievance mechanism is, what it should include, and how to set one up step by step. It is written for companies of any size, including companies that are setting one up for the first time.
⚡️ Quick summary
A grievance mechanism lets employees, workers in your value chain, and other stakeholders raise concerns, confidentially and without fear of retaliation.
Set it up in 6 steps: decide who can use it, choose the channels, protect the people who use it, define how concerns are handled, tell people it exists, and review it.
The UN Guiding Principles on Business and Human Rights (UNGPs) list 8 criteria for an effective grievance mechanism. You can use them as a checklist.
In the EU, companies with 50 or more workers must already have an internal whistleblowing channel under the EU Whistleblowing Directive. A grievance mechanism usually goes further.
Many assessments ask about it, e.g. the Baseline assessment asks "Does your company have a grievance mechanism in place?"
Why stakeholders ask about a grievance mechanism
Stakeholders ask about a grievance mechanism because it shows that your company can find out about problems and act on them. The Baseline assessment asks whether your company has a grievance mechanism in place.
Several of Worldfavor's assessments also ask about it for their own topic, e.g. "Does your company have a process for stakeholders to raise concerns related to child labor?" One grievance mechanism can cover all of these topics. You do not need a separate channel for each one.
🤔 Grievance mechanism or whistleblowing channel: what's the difference?
A whistleblowing channel is usually for employees who report a breach of the law or of company rules. A grievance mechanism is broader: it is also open to people outside your company, such as workers at your suppliers and local communities, and it covers harm to people as well as rule breaches. Many companies use one system for both.
What a grievance mechanism should include
A grievance mechanism should include clear channels, protection for the people who use it, and a defined process for handling concerns. The UNGPs (Principle 31) say that an effective mechanism is:
Legitimate: trusted by the people it is meant for
Accessible: known to everyone who may need it, with help for those who face barriers, e.g. language
Predictable: with clear steps and time frames
Equitable: giving people fair access to information and advice
Transparent: keeping the people involved informed about progress
Rights-compatible: with outcomes that respect human rights
A source of continuous learning: used to prevent future harm
Based on engagement and dialogue: designed together with the people who will use it
You do not need to meet every criterion perfectly from the start. Use them to check where your mechanism can improve.
Set up a grievance mechanism step by step
Setting up a grievance mechanism takes 6 steps. A small company can often do this with tools it already has, such as an email address and a named person.
1. Decide who can use it
Decide which groups can raise a concern. At a minimum, include your own employees. Where your risks are in the value chain, also include workers at your suppliers, local communities, and other external stakeholders.
2. Choose the channels
Choose at least one channel that people can use without asking a manager, e.g.:
A web form or an online reporting system
A dedicated email address
A phone line
A named person or team, e.g. HR or the compliance function
An external hotline run by a third party
Make the channels available in the languages that the users speak. For workers at production sites, a phone line or a person they can talk to often works better than a web form.
3. Protect the people who use it
People only use a grievance mechanism if they trust it. Make sure that:
Concerns are handled confidentially
People can report anonymously, where the law allows
Nobody faces retaliation for raising a concern in good faith, and retaliation itself is treated as a breach
4. Define how concerns are handled
Write down what happens after a concern is raised, so that every concern is handled the same way. A common process is:
Receive and acknowledge the concern, e.g. within 7 days.
Assess it: is it within scope, how serious is it, and who should handle it?
Investigate, with someone who is independent of the people involved.
Respond and remediate: tell the person what you found and what you will do, and provide or cooperate in remedy where your company caused or contributed to harm.
Follow up and learn: check that the remedy worked, and change your processes to prevent the same problem.
Keep a record of every concern, how it was handled, and the outcome. The records show that the mechanism works, and they help you see patterns.
5. Tell people it exists
A mechanism nobody knows about does not work. Publish it on your website, include it in your policies and your Supplier Code of Conduct, explain it in onboarding, and post information at your sites.
6. Review it regularly
Review the mechanism at least once a year. Check how many concerns came in, how long they took to handle, and what users say about it. Few or no concerns can mean that people do not know about the mechanism or do not trust it, not that there are no problems.
Frequently asked questions
Do we need a grievance mechanism if we are a small company?
Yes, a small company also benefits from a grievance mechanism, but it can be simple. A dedicated email address, a named person who handles concerns, a written process, and a promise of no retaliation are a good start. The OECD Due Diligence Guidance for Responsible Business Conduct says that the effort should match the size of the company and its risks.
Is our whistleblowing channel enough?
Whether your whistleblowing channel is enough depends on who can use it. If only employees can report breaches of the law, it covers the requirement in the EU Whistleblowing Directive but not the wider purpose of a grievance mechanism. Opening the same channel to workers at your suppliers, communities, and other external stakeholders, and to concerns about harm to people, often closes the gap.
What does the EU Whistleblowing Directive require?
The EU Whistleblowing Directive ((EU) 2019/1937) requires companies with 50 or more workers to have an internal reporting channel. Receipt of a report must be acknowledged within 7 days, and the person must get feedback within 3 months. Each EU country has its own law that applies the directive, so check the rules in the countries where you operate.
How do we give workers at our suppliers access?
You can give workers at your suppliers access in 2 ways. You can open your own mechanism to them and tell them about it, e.g. through your suppliers. Or you can require your suppliers to have their own grievance mechanism, e.g. in your Supplier Code of Conduct, and check that it works. Many companies use both.
Does following this guide make our company compliant with the law?
No, following this guide does not by itself make your company compliant with any law. The guide describes good practice from the UNGPs and the OECD guidance, for inspiration and general guidance only. Check the legal requirements in the countries where you operate, and consider asking a legal advisor.