A/HRC/17/31 Internal communication of the statement and of related policies and procedures should make clear what the lines and systems of accountability will be, and should be supported by any necessary training for personnel in relevant business functions. Just as States should work towards policy coherence, so business enterprises need to strive for coherence between their responsibility to respect human rights and policies and procedures that govern their wider business activities and relationships. This should include, for example, policies and procedures that set financial and other performance incentives for personnel; procurement practices; and lobbying activities where human rights are at stake. Through these and any other appropriate means, the policy statement should be embedded from the top of the business enterprise through all its functions, which otherwise may act without awareness or regard for human rights. Human rights due diligence 17. In order to identify, prevent, mitigate and account for how they address their adverse human rights impacts, business enterprises should carry out human rights due diligence. The process should include assessing actual and potential human rights impacts, integrating and acting upon the findings, tracking responses, and communicating how impacts are addressed. Human rights due diligence: (a) Should cover adverse human rights impacts that the business enterprise may cause or contribute to through its own activities, or which may be directly linked to its operations, products or services by its business relationships; (b) Will vary in complexity with the size of the business enterprise, the risk of severe human rights impacts, and the nature and context of its operations; (c) Should be ongoing, recognizing that the human rights risks may change over time as the business enterprise’s operations and operating context evolve. Commentary This Principle defines the parameters for human rights due diligence, while Principles 18 through 21 elaborate its essential components. Human rights risks are understood to be the business enterprise’s potential adverse human rights impacts. Potential impacts should be addressed through prevention or mitigation, while actual impacts – those that have already occurred – should be a subject for remediation (Principle 22). Human rights due diligence can be included within broader enterprise risk-management systems, provided that it goes beyond simply identifying and managing material risks to the company itself, to include risks to rights-holders. Human rights due diligence should be initiated as early as possible in the development of a new activity or relationship, given that human rights risks can be increased or mitigated already at the stage of structuring contracts or other agreements, and may be inherited through mergers or acquisitions. Where business enterprises have large numbers of entities in their value chains it may be unreasonably difficult to conduct due diligence for adverse human rights impacts across them all. If so, business enterprises should identify general areas where the risk of adverse human rights impacts is most significant, whether due to certain suppliers’ or clients’ operating context, the particular operations, products or services involved, or other relevant considerations, and prioritize these for human rights due diligence. 16