Quick Read
ISO/DIS 37200 Clauses 8.4 and 9 establish a structured approach to remediation and audit when modern slavery risks materialize, requiring organizations to exhaust commercial leverage and escalation before terminating supplier relationships, and distinguishing between disengagement and actual harm remedy—a distinction that aligns with EU FLR guidance and converts into a certifiable system under SPK DDMS2000:2026. The standard introduces the "intolerable risk" threshold as a last-resort trigger for termination, positioning effective remediation as a sequenced process rather than a reactive compliance measure. This framework ensures organizations demonstrate genuine due diligence through documented escalation efforts rather than immediate severance when risks are identified.
Executive Summary
Prevention will not always work. ISO/DIS 37200's Clause 8.4, Responding to modern slavery risk, and Clause 9, Performance and evaluation, together set out what an organization should do once a concern is raised, an incident occurs, or an audit finding confirms forced labour is present — covering risk controls, whistleblowing, incident investigation, and a remediation methodology detailed enough to function as an operating manual rather than a policy statement. This is also the area of clearest convergence with the European Commission's own FLR guidance, which draws the same sharp distinction between disengaging from a supplier and actually remedying harm to affected workers.
This final paper in the series works through Clause 8.4 and Clause 9 in detail, and closes the series by setting out how SPK DDMS2000:2026's remediation and audit requirements convert this guidance into a certifiable, evidenced system.
1. Risk Controls and the "Intolerable Risk" Threshold
Clause 8.4.2 sets out the risk controls organizations should establish for their supply chain: contractual requirements that cascade modern slavery expectations further down the supply chain; contractual rights to periodic supplier self-assessment; contractual rights to onsite inspection, audit, and other verification, including unannounced visits; and ongoing evaluation of supplier performance indicators and statistics. The clause also introduces a specific threshold concept — "intolerable" risk — defined, via a note, as the point reached after extensive efforts to support a supplier where the residual risk cannot be tolerated in relation to the organization's own values, at which point termination of the business relationship and sourcing from an alternate supplier becomes the appropriate response.
The clause frames termination explicitly as a last resort reached only after commercial leverage has been exhausted, and suggests organizations consider escalating leverage before reaching that point — lobbying national government, engaging industry associations and civil society organizations, or building leverage through multi-stakeholder collaboration — rather than treating termination as the default first response to a confirmed risk finding. This sequencing matters for FLR purposes specifically: an organization that can demonstrate a genuine escalation process before any termination decision, rather than an immediate severance the moment a risk surfaces, is better positioned to show a functioning due diligence system rather than a reactive compliance posture built around minimizing the organization's own exposure.
2. Operational Due Diligence: Where Clause 5 Becomes Action
Clause 8.4.3 defines operational due diligence as the due diligence variant focused on specific targets — as distinct from the broader risk assessment covered in Clause 5 — informed by the organization's overall risk assessment and the context of a specific activity or decision. It should assess modern slavery risk in relation to five categories: specific categories of transactions, projects, products, services, and procurement or own operations; planned or ongoing relationships with business associates, including suppliers, contractors, and subcontractors; specific categories of workers in positions carrying particular modern slavery exposure, both within and outside the organization; locations and sectors with known modern slavery prevalence; and the controls in place for recruitment, employment, and worker welfare, accounting for possible exploitation or inconsistency between workforce composition, demographics, nationality, and accommodation relative to the organization's actual operations and physical location.
That last category — inconsistency between workforce demographics and the organization's actual physical operations — is a genuinely useful practical screening heuristic. A worksite whose worker nationality profile or accommodation arrangements do not plausibly match the organization's stated recruitment and operational footprint is, in itself, a risk signal worth investigating, independent of any specific complaint or indicator from Clause 5.4.2 having been raised.
The clause requires operational due diligence to be updated at a defined frequency and fully documented, including sources, while also permitting organizations to conclude — where justified by risk assessment — that more detailed due diligence on certain categories of worker or business associate is unnecessary, unreasonable, or disproportionate. This proportionality allowance is important: it confirms that ISO/DIS 37200 does not expect uniform maximum-intensity due diligence applied indiscriminately across an entire operation, but rather calibrated effort matched to assessed risk — the same proportionality logic that underpins DDMS2000's tiering methodology.
3. Whistleblowing as a Detection Channel, Not Just a Compliance Feature
Clause 8.4.4 requires the modern slavery policy and processes to include provision for whistleblowing, supported by a whistleblowing management system covering the full lifecycle: receiving reports of wrongdoing; protecting, consulting, and supporting the whistleblower throughout the process; assessing how best to deal with reports; addressing reports through direction, guidance, disciplinary action, or penalties as warranted, alongside protection and support for those involved; and concluding cases with enough disclosure about the mechanism's own performance to build confidence in its effectiveness and address any public interest at stake.
The clause is candid about a real barrier to effectiveness: persons working on an organization's behalf may fear that raising concerns will lead to retaliation from colleagues or employers, and organizations should actively encourage those working on its behalf, in its supply chain, or for its business associates to voice concerns despite that fear, with the whistleblowing channel specifically prepared to receive modern slavery reports rather than only generic financial or conduct-related complaints. Clause 8.4.4 also requires organizations to communicate to those working on their behalf, who have reasonable belief that dangerous, unethical, or illegal conduct has occurred, their right to report anonymously — both internally and, importantly, externally to appropriate authorities.
That last point — the explicit right to report externally, not merely internally — is a meaningful marker of a whistleblowing system built for genuine detection rather than reputational containment. A channel that only accepts internal reports, with no acknowledgment of workers' right to escalate externally, tends in practice to function as much to manage disclosure as to surface wrongdoing.
4. Incident Response and Investigation
Clause 8.4.5 sets out incident response as a structured process: receiving and assessing reports of wrongdoing for completeness and relevance; addressing reports impartially and in a timely manner; and acting upon and closing reports with a documented process for how recommendations are reviewed, agreed, and instigated. Investigations should prioritize the health and safety of affected workers, other potential victims, and those conducting the investigation itself, and should aim to determine what happened, why, and what can be done to prevent recurrence — focusing analysis on prevention rather than blame or punishment when determining root cause.
The clause draws a distinction worth preserving carefully: not every reportable incident is itself an occurrence of modern slavery. Its own examples of "minor" incidents include mandated training simply not having occurred, or workers having been incorrectly paid — matters that are nonconformities with the organization's own modern slavery risk management process rather than confirmed instances of forced labour, but which should still be investigated and corrected precisely because under-reporting or ignoring smaller nonconformities is how they escalate into more serious incidents over time. Clause 8.4.5 also recommends, where practicable, that investigations be led by someone independent of the activities being investigated, with expertise in labour rights and modern slavery specifically, and include a worker or worker representative — a composition requirement that meaningfully changes the credibility of investigation findings relative to a purely internal, management-led review.
5. Remediation: The Document's Most Detailed Clause
Clause 8.4.6 is, by content density, the most detailed operational clause in ISO/DIS 37200, and it draws precisely the same distinction the European Commission's own FLR guidance draws between disengagement and remedy. Clause 8.4.6.1 states remediation involves two distinct activities: remedial actions and processes aimed at identifying and stopping modern slavery that is occurring, and separately, processes and actions aimed at providing remedy to individuals or groups already harmed. Remedial actions and processes should be legitimate, accessible, predictable, equitable, transparent, rights-compatible, and a source of continuous learning — a six-part quality standard drawn from the UN Guiding Principles' own effectiveness criteria for non-judicial grievance mechanisms.
Clause 8.4.6.2 sets out what an effective remediation programme actually contains: improved victim identification; preventing exploitative practices; protecting workers from exploitative practices through appropriate safeguards; working with authorities and other relevant stakeholders for effective remedies; establishing root causes and undertaking appropriate preventative action; and providing access to appropriate and effective remedies themselves. The clause is explicit that remedial procedures should prioritize victims' needs and concerns, that workers should be trained to recognize and address violations and actively participate in remediation, and — a genuinely distinctive point — that decisions about what constitutes appropriate remedy should not be made solely by a more powerful party such as a buyer or supplier based on what that party believes is in workers' best interest, without the workers themselves determining the appropriateness of the remedy offered.
The clause then sets out an eight-point remediation process standard that deserves listing in full given how directly it addresses the disengagement-versus-remedy distinction: enabling victims and stakeholders to determine the appropriateness of remedies themselves; going beyond standard corrective action plans such as supplier termination, focusing instead on mechanisms to engage and support suppliers; fostering trust with suppliers to encourage them to identify issues and pursue continual improvement; adopting a bottom-up approach using on-the-ground support such as collaboration with local NGOs; focusing on worker-driven monitoring to ensure workers have genuine voice and representation; focusing on worker empowerment, including supporting workers' realization of their rights and their ability to organize collectively and bargain freely throughout the supply chain; collaborating with other stakeholders to establish appropriate remedy forms and enable access to legal representation; and demonstrating clearly how whistleblowing allegations specifically will be addressed, to encourage continued reporting.
Concrete restoration measures the clause identifies include medical and mental health support, return of confiscated documentation, reimbursement of recruitment fees, and legal and financial assistance — offered as promptly and fully as possible. Where full restoration is not possible, the clause endorses compensation, reparation, or other redress including apology, monetary compensation, or punitive sanctions against a responsible supplier or manager, paired with correction of the underlying nonconformity. Critically, Clause 8.4.6.2 states that workers should not be required to provide evidence of harm — such as receipts for recruitment fees paid — as a precondition for remedy, placing the evidentiary burden on the organization rather than the worker, and recommends inviting relevant stakeholders to independently monitor both the calculation of monetary reimbursement and the effectiveness of remedies actually used.
6. Disseminating Remedial Procedures
Clause 8.4.6.3 addresses how remediation procedures themselves should be communicated, distinguishing internal communication (top management's commitment, how workers can raise concerns, practical policy meaning for specific roles, protective actions taken, progress updates, and incident investigation findings) from external communication (previous performance and incidents, actions to take and who to inform if an incident occurs, additional consultation needs for high-risk partners, incident investigation and corrective action processes, and arrangements for ongoing communication).
The clause makes an important clarifying point about what actually constitutes a "modern slavery incident" for reporting purposes: it need not be an actual occurrence of modern slavery, but can be the failure of a party to carry out actions necessary to prevent it — mandated annual awareness training simply not being conducted, or contractual flow-down clauses not actually being included in subcontracts. These are not modern slavery in themselves, but they are acts or omissions that measurably increase the probability of an actual occurrence, and Clause 8.4.6.3 treats them as reportable on that basis — a meaningfully lower threshold for internal reporting than "wait until harm is confirmed," designed to catch systemic weakness before it produces a victim.
7. Performance, Measurement, and Auditing: Clause 9
Clause 9.1.1 requires organizations to establish metrics aligned to the priorities in their modern slavery policy and strategy, using both quantitative and qualitative indicators — the clause's own examples include the percentage of suppliers trained, the number of victims supported, and the number of incidents identified — and to determine what needs to be monitored and why, who is responsible, when monitoring and measurement occur, when results are analysed and reported, to whom, and by what method. Clause 9.1.1 also offers a useful proportionality principle through example: routinely verifying that suppliers pay workers correctly is important and warrants ongoing monitoring, while verifying that shareholder dividends are paid correctly is not a modern slavery risk indicator at all — a reminder that measurement effort should track actual risk relevance, not simply track whatever data is easiest to collect.
Clause 9.1.2 addresses auditing as a complementary activity to risk assessment, to be conducted at planned intervals across suppliers, the supply chain, and business associates, prioritized using the risk assessment process where full audit resourcing is unavailable. It sets out ten specific audit focus areas: worker profile including migrant worker presence; recruitment and grievance procedures, including third-party agency fee practices; documentary review of employment contracts, permits, visas, payment records, and leave records; policy review across human rights, modern slavery, grievance, occupational health and safety, and recruitment; document retention practices, particularly passport and identity document handling; pay and employment terms including recruitment fees; termination of employment review; worker file inspection; management interviews on policy and procedure; and worker interviews covering recruitment, fees, document retention, freedom of movement, grievance procedure, and wages.
Clause 9.1.2 makes a practical point about auditor composition worth noting: workers can and should be involved in audits without needing formal auditor qualification, provided they meet the organization's own competence requirements and receive appropriate guidance and training, though ideally they should not audit processes or activities they are directly involved in to preserve objectivity — with an explicit acknowledgment that in a small organization this separation is not always achievable, and a worker auditing their own work can be acceptable in that context.
8. Continual Improvement: Clause 10
Clause 10 closes the operational cycle with eight continual improvement activities: reinforcing organizational commitment to tackling modern slavery across operations, supply chains, and the wider operating environment; incorporating lessons learned into the risk management approach; regularly reviewing policies and procedures against changes in external and internal context; updating training for evolving roles and responsibilities; engaging in regular dialogue with expert stakeholders; communicating with suppliers to promote best practice; engaging with victims and workers so that risk management genuinely reflects lived experience; and benchmarking against sector and broader good practice to identify gaps.
The instruction to engage with victims and workers so that risk management processes take into account lived experience, listed as a distinct continual improvement activity rather than folded into stakeholder engagement generally, reinforces a theme running through the whole document: modern slavery risk management is treated throughout ISO/DIS 37200 as something that must be informed by the people actually at risk, not designed in isolation by the organization managing the risk on their behalf.
9. Mapping to DDMS2000: Making Remediation Auditable
SPK DDMS2000:2026's remediation and monitoring provisions convert this guidance into certifiable, evidenced requirements. Where ISO/DIS 37200's Clause 8.4.6 recommends the eight-point remediation process described above, DDMS2000 requires organizations to maintain a standalone, auditable remediation-for-affected-persons process — distinct from general corrective action or supplier de-listing — precisely because, as this series has noted from its first paper onward, remediation folded into general corrective action tends to be quietly dropped once a supplier relationship ends and the organization's own commercial exposure is resolved.
DDMS2000's monitoring and performance clauses similarly operationalize Clause 9's measurement and audit guidance, requiring documented metrics proportionate to assessed risk, an audit programme covering the same ten focus areas Clause 9.1.2 sets out, and — critically, for the evidentiary purposes this series has returned to repeatedly — independent verification by an accredited certification body rather than internal self-assessment alone. This is the point at which ISO/DIS 37200's detailed guidance, and the FLR's insistence that due diligence quality matters even though it is not a formal legal requirement, converge on a single practical conclusion: a system built to this level of detail is worth very little as legal or commercial evidence unless it can be independently verified.
Conclusion to the Series
Across five papers, this series has worked through ISO/DIS 37200 clause by clause against the EU Forced Labour Regulation and against SPK DDMS2000:2026: the fundamental gap between binding law and voluntary guidance; the risk assessment and supply chain mapping foundation; the governance structure and criminal liability exposure that make this a board issue; the operational recruitment and procurement controls where forced labour is actually created or prevented; and finally the remediation, whistleblowing, and audit systems that close the loop when prevention fails.
The throughline across all five papers is consistent. ISO/DIS 37200, once finalized, will be the most detailed publicly available guidance on what a modern slavery risk management system should contain — but as guidance, it cannot on its own give an organization anything to show a regulator, an investor, or a customer. The EU Forced Labour Regulation creates severe consequences with almost no prescribed process. SPK DDMS2000:2026 and Speeki Sentinel exist to convert the detailed practice described across ISO/DIS 37200's ten clauses into a certifiable system, independently verified, positioned to withstand exactly the kind of scrutiny an FLR investigation — or a customer, or an investor — will eventually apply.
Speeki is an accredited certification body providing independent assurance and certification of due diligence management systems, including against SPK DDMS2000:2026. Current accreditation scope and certification details are available at speeki.com.
References
ISO/DIS 37200:2025(en), Managing the risk of modern slavery — Guidance for the prevention, identification and response to human trafficking and forced labour, ISO/TC 309 Governance of organizations, Secretariat: BSI, Clause 8.4 (Responding to modern slavery risk), Clause 9 (Performance and evaluation), and Clause 10 (Improvement). Version dated 2025-12-08, Draft International Standard status; content subject to change prior to publication.
ISO 37002, Whistleblowing management systems — Guidelines, as referenced in ISO/DIS 37200 Clause 8.4.4.
UN Guiding Principles on Business and Human Rights (2011), effectiveness criteria for non-judicial grievance mechanisms.
European Commission, Guidelines on Regulation (EU) 2024/3015, published 30 June 2026, remediation and responsible disengagement provisions.
Regulation (EU) 2024/3015 of the European Parliament and of the Council of 27 November 2024.
SPK DDMS2000:2026, Speeki Due Diligence Management System Standard, remediation and monitoring provisions (internal Speeki standard).