Skip to content

Evidence request lists

ISO 26000:2010

Evidence request list. 60 controls, 60 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.

Clause 4: Principles of Social Responsibility

ISO-26000-4.1
General

Introduces the seven principles of social responsibility that organizations should adopt.

Artefacts an auditor will ask for
  • human rights impact analysis
  • community involvement programme
  • sustainability report
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
ISO-26000-4.2
Accountability

Organizations should be accountable for their impacts on society, the economy, and the environment.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
ISO-26000-4.3
Transparency

Organizations should be transparent in decisions and activities that impact society and the environment.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-4.4
Ethical behaviour

Organizations should behave ethically, basing behaviour on values of honesty, equity, and integrity.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
ISO-26000-4.5
Respect for stakeholder interests

Organizations should respect, consider, and respond to the interests of their stakeholders.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
ISO-26000-4.6
Respect for the rule of law

Organizations should accept that respect for the rule of law is mandatory in all jurisdictions.

Artefacts an auditor will ask for
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
Where this commonly fails
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-4.7
Respect for international norms of behaviour

Organizations should respect international norms of behaviour while adhering to the rule of law.

Artefacts an auditor will ask for
  • human rights impact analysis
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
ISO-26000-4.8
Respect for human rights

Organizations should respect human rights and recognize their importance and universality.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification

Clause 5: Recognizing Social Responsibility and Engaging Stakeholders

ISO-26000-5.1
General

Provides guidance on recognizing social responsibility and identifying and engaging with stakeholders.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-5.2
Recognizing social responsibility

Guidance on how organizations can recognize their social responsibility through identifying issues and impacts.

Artefacts an auditor will ask for
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
ISO-26000-5.3
Stakeholder identification and engagement

Guidance on identifying stakeholders, understanding their expectations, and engaging them meaningfully.

Artefacts an auditor will ask for
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
  • sustainability report
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics

Clause 6: Core Subject - Human Rights (6.3)

ISO-26000-6.3.1
Due diligence

Requires organizations to conduct human rights due diligence to identify, prevent, and address human rights impacts.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-6.3.2
Human rights risk situations

Guidance on identifying and addressing situations where human rights may be at risk due to organizational activities.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-6.3.3
Avoidance of complicity

Organizations should avoid being complicit in human rights abuses including direct, beneficial, and silent complicity.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-6.3.4
Resolving grievances

Organizations should establish mechanisms for addressing and resolving human rights grievances.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
ISO-26000-6.3.5
Discrimination and vulnerable groups

Organizations should ensure non-discrimination and give special attention to vulnerable groups.

Artefacts an auditor will ask for
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence

Clause 6: Core Subject - Labour Practices (6.4)

ISO-26000-6.4.1
Employment and employment relationships

Guidance on ensuring fair employment practices and responsible management of employment relationships.

Artefacts an auditor will ask for
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
ISO-26000-6.4.2
Conditions of work and social protection

Guidance on ensuring fair wages, reasonable working hours, rest periods, and social protection for workers.

Artefacts an auditor will ask for
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
ISO-26000-6.4.3
Social dialogue

Guidance on engaging workers in dialogue and recognizing their right to freedom of association and collective bargaining.

Artefacts an auditor will ask for
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-6.4.4
Health and safety at work

Guidance on ensuring a safe and healthy working environment and preventing occupational illness and injury.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
ISO-26000-6.4.5
Human development and training in the workplace

Guidance on promoting human development through training, career development, and skill enhancement.

Artefacts an auditor will ask for
  • human rights impact analysis
  • community involvement programme
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics

Clause 6: Core Subject - Organizational Governance (6.2)

ISO-26000-6.2
Organizational governance

Decision-making frameworks and processes that enable the organization to pursue its objectives for social responsibility.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics

Clause 6: Core Subject - The Environment (6.5)

ISO-26000-6.5.1
Prevention of pollution

Guidance on minimizing pollution by implementing sustainable practices in emissions, effluent discharge, and waste management.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
ISO-26000-6.5.2
Sustainable resource use

Guidance on sustainable use of energy, water, and materials including resource efficiency and conservation.

Artefacts an auditor will ask for
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
ISO-26000-6.5.3
Climate change mitigation and adaptation

Guidance on reducing greenhouse gas emissions and adapting to the impacts of climate change.

Artefacts an auditor will ask for
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-6.5.4
Protection of the environment and biodiversity

Guidance on protecting and restoring natural habitats and ecosystems and valuing biodiversity.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics

Clause 6: Core Subjects - Fair Operating Practices, Consumer Issues, Community Involvement (6.6-6.8)

ISO-26000-6.6
Fair operating practices

Guidance on ethical conduct including anti-corruption, responsible political involvement, fair competition, and responsible supply chain management.

Artefacts an auditor will ask for
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
  • sustainability report
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-6.7
Consumer issues

Guidance on fair marketing, product safety, sustainable consumption, consumer data protection, and access to essential services.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
ISO-26000-6.8
Community involvement and development

Guidance on community engagement, education, employment creation, technology development, wealth creation, and social investment.

Artefacts an auditor will ask for
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics

Clause 7: Guidance on Integrating Social Responsibility Throughout an Organization

ISO-26000-7.1
General

Provides guidance on integrating social responsibility throughout the organization.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence
ISO-26000-7.2
Understanding the social responsibility of the organization

Guidance on the relationship between the organization's characteristics and social responsibility.

Artefacts an auditor will ask for
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
  • sustainability report
Where this commonly fails
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-7.3
Integrating social responsibility throughout an organization

Guidance on embedding social responsibility into governance, systems, policies, and practices.

Artefacts an auditor will ask for
  • community involvement programme
  • sustainability report
  • social responsibility policy
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
ISO-26000-7.4
Communication on social responsibility

Guidance on communicating social responsibility activities and performance to stakeholders.

Artefacts an auditor will ask for
  • human rights impact analysis
  • community involvement programme
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
Where this commonly fails
  • incomplete stakeholder identification
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-7.5
Enhancing credibility regarding social responsibility

Guidance on building stakeholder trust through transparency, verification, and engagement.

Artefacts an auditor will ask for
  • human rights impact analysis
  • community involvement programme
  • sustainability report
Where this commonly fails
  • missing due diligence evidence
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
ISO-26000-7.6
Reviewing and improving social responsibility actions

Guidance on reviewing progress, evaluating performance, and improving social responsibility practices.

Artefacts an auditor will ask for
  • sustainability report
  • social responsibility policy
  • stakeholder engagement plan
  • due diligence assessment
  • human rights impact analysis
  • community involvement programme
Where this commonly fails
  • weak human rights impact tracking
  • insufficient community programme metrics
  • gaps in transparent reporting
  • incomplete stakeholder identification
  • missing due diligence evidence

Core Subject 1

ISO26000-6.2
Organizational Governance

Implement decision making structures and processes that apply principles of accountability, transparency, ethical behaviour, and respect for stakeholder interests.

Artefacts an auditor will ask for
  • Governance charter
  • Board terms of reference
  • Decision logs
  • Code of ethics
Where this commonly fails
  • No documented decision rights
  • Ethics code not adopted
  • Stakeholder voice absent from governance

Core Subject 2

ISO26000-6.3.3
Human Rights Due Diligence

Conduct due diligence to identify, prevent, and address actual and potential human rights impacts arising from the organization's activities and relationships.

Artefacts an auditor will ask for
  • Human rights policy
  • Due diligence procedure
  • Impact assessment reports
  • Remediation log
Where this commonly fails
  • No human rights policy
  • Due diligence not performed
  • Supply chain impacts ignored
ISO26000-6.3.4
Human Rights Risk Situations

Identify situations of elevated human rights risk and apply enhanced safeguards in conflict affected or high risk operating contexts.

Artefacts an auditor will ask for
  • High risk geography list
  • Enhanced safeguards procedure
  • Conflict sensitivity assessment
  • Monitoring reports
Where this commonly fails
  • Risk geographies not identified
  • No enhanced safeguards
  • Conflict context ignored
ISO26000-6.3.5
Avoidance of Complicity

Avoid complicity in human rights abuses by third parties through screening, contractual safeguards, and remedial action.

Artefacts an auditor will ask for
  • Third party screening procedure
  • Contractual clauses
  • Remediation records
  • Withdrawal decisions
Where this commonly fails
  • No screening
  • Clauses missing
  • No remediation pathway
ISO26000-6.3.6
Resolving Grievances

Provide accessible grievance mechanisms enabling affected parties to raise concerns and receive timely remedy.

Artefacts an auditor will ask for
  • Grievance procedure
  • Case register
  • Resolution metrics
  • Accessibility assessment
Where this commonly fails
  • No grievance channel
  • Cases unresolved
  • Mechanism not accessible
ISO26000-6.3.7
Discrimination and Vulnerable Groups

Identify and address discrimination, with attention to vulnerable groups including women, persons with disabilities, indigenous peoples, and migrants.

Artefacts an auditor will ask for
  • Anti discrimination policy
  • Vulnerable group identification
  • Workforce demographics
  • Inclusion programme outcomes
Where this commonly fails
  • No policy
  • Vulnerable groups not identified
  • Demographics not tracked

Core Subject 3

ISO26000-6.4.3
Employment and Employment Relationships

Provide stable, lawful employment relationships, avoiding disguised employment and ensuring decent terms of work.

Artefacts an auditor will ask for
  • Employment contract templates
  • Worker classification policy
  • Disguised employment review
  • Labour audit results
Where this commonly fails
  • Misclassification of workers
  • No contract template
  • Labour audit absent
ISO26000-6.4.4
Conditions of Work and Social Protection

Provide wages, hours, leave, and benefits that meet or exceed legal and industry norms and contribute to workers wellbeing.

Artefacts an auditor will ask for
  • Wage policy
  • Working time records
  • Benefits documentation
  • Living wage analysis
Where this commonly fails
  • Wage gap to living standard
  • Excessive overtime
  • Benefits gaps
ISO26000-6.4.5
Social Dialogue

Recognize and support freedom of association and the right to collective bargaining, fostering constructive worker representation.

Artefacts an auditor will ask for
  • Freedom of association policy
  • Union recognition records
  • Collective bargaining agreements
  • Worker representation forums
Where this commonly fails
  • Union recognition denied
  • No bargaining process
  • Representation absent
ISO26000-6.4.6
Health and Safety at Work

Provide a safe and healthy workplace, with hazard identification, control, and worker participation in safety arrangements.

Artefacts an auditor will ask for
  • OHS policy
  • Hazard register
  • Incident log
  • Safety committee minutes
Where this commonly fails
  • No hazard register
  • Incidents underreported
  • Safety committee absent
ISO26000-6.4.7
Human Development and Training

Invest in worker development through training, education access, and career progression opportunities.

Artefacts an auditor will ask for
  • Training plan
  • Completion records
  • Skills matrix
  • Career progression policy
Where this commonly fails
  • No training plan
  • Skills matrix absent
  • Limited progression

Core Subject 4

ISO26000-6.5.3
Prevention of Pollution

Prevent and reduce pollution to air, water, and land arising from organizational activities, products, and services.

Artefacts an auditor will ask for
  • Pollution inventory
  • Emission permits
  • Reduction targets
  • Monitoring data
Where this commonly fails
  • Emissions untracked
  • No reduction targets
  • Permit lapses
ISO26000-6.5.4
Sustainable Resource Use

Use materials, energy, and water efficiently, prioritizing renewable and circular alternatives.

Artefacts an auditor will ask for
  • Resource use inventory
  • Efficiency targets
  • Renewable share metrics
  • Circular economy initiatives
Where this commonly fails
  • Resource use unmeasured
  • No efficiency targets
  • Renewables absent
ISO26000-6.5.5
Climate Change Mitigation and Adaptation

Measure greenhouse gas emissions, set reduction commitments, and prepare for climate adaptation.

Artefacts an auditor will ask for
  • GHG inventory
  • Reduction targets
  • Adaptation plan
  • Climate risk assessment
Where this commonly fails
  • GHG not measured
  • No targets
  • Adaptation absent
ISO26000-6.5.6
Protection of the Environment and Biodiversity

Protect natural habitats and biodiversity through impact assessment and restoration where feasible.

Artefacts an auditor will ask for
  • Biodiversity assessment
  • Site sensitivity maps
  • Restoration plan
  • Land use records
Where this commonly fails
  • No biodiversity baseline
  • Sensitive sites unmapped
  • No restoration

Core Subject 5

ISO26000-6.6.3
Anti Corruption

Establish and enforce anti corruption policies, training, and reporting channels covering all forms of bribery.

Artefacts an auditor will ask for
  • Anti corruption policy
  • Training records
  • Whistleblower channel
  • Investigation files
Where this commonly fails
  • Training not delivered
  • No reporting channel
  • Investigations not closed
ISO26000-6.6.4
Responsible Political Involvement

Engage in political activity transparently, avoiding undue influence and disclosing contributions and lobbying.

Artefacts an auditor will ask for
  • Political activity policy
  • Contribution disclosures
  • Lobbying register
  • Approval records
Where this commonly fails
  • No disclosures
  • Policy absent
  • Lobbying unregistered
ISO26000-6.6.5
Fair Competition

Conduct business in a manner consistent with fair competition law and avoid anti competitive practices.

Artefacts an auditor will ask for
  • Competition policy
  • Training records
  • Compliance reviews
  • Investigation outcomes
Where this commonly fails
  • No competition training
  • Reviews absent
  • Practices not assessed
ISO26000-6.6.6
Promoting Social Responsibility in the Value Chain

Extend social responsibility expectations to suppliers and partners through procurement, contracts, and monitoring.

Artefacts an auditor will ask for
  • Supplier code of conduct
  • Procurement policy
  • Audit results
  • Supplier scorecards
Where this commonly fails
  • No supplier code
  • Audits not conducted
  • Scorecards missing

Core Subject 6

ISO26000-6.7.3
Fair Marketing and Contractual Practices

Provide truthful information, fair contracts, and honest marketing communications to consumers.

Artefacts an auditor will ask for
  • Marketing review process
  • Contract templates
  • Complaints log
  • Truthfulness audit
Where this commonly fails
  • Marketing not reviewed
  • Contracts opaque
  • Complaints unanswered
ISO26000-6.7.4
Protecting Consumers Health and Safety

Provide products and services that are safe to use under reasonable conditions and respond promptly to safety issues.

Artefacts an auditor will ask for
  • Safety testing records
  • Recall procedure
  • Warning label policy
  • Incident response log
Where this commonly fails
  • No recall procedure
  • Testing absent
  • Incidents underreported
ISO26000-6.7.6
Consumer Service, Support, and Complaint Resolution

Provide accessible support and complaint resolution mechanisms for consumers.

Artefacts an auditor will ask for
  • Support channel inventory
  • Complaint procedure
  • Resolution metrics
  • Customer satisfaction data
Where this commonly fails
  • Channels limited
  • Resolution slow
  • Metrics absent
ISO26000-6.7.7
Consumer Data Protection and Privacy

Protect consumer personal data through lawful collection, secure storage, and respect for privacy rights.

Artefacts an auditor will ask for
  • Privacy policy
  • Data inventory
  • Security controls evidence
  • Subject rights handling
Where this commonly fails
  • No inventory
  • Rights not handled
  • Security gaps

Core Subject 7

ISO26000-6.8.3
Community Involvement

Engage with communities affected by operations, including indigenous and vulnerable groups, in a respectful and continuous manner.

Artefacts an auditor will ask for
  • Community engagement plan
  • Stakeholder mapping
  • Meeting records
  • Consent documentation
Where this commonly fails
  • No engagement plan
  • Indigenous consent absent
  • Records not kept
ISO26000-6.8.9
Social Investment

Make social investments that address community priorities and contribute to long term local development.

Artefacts an auditor will ask for
  • Investment strategy
  • Project portfolio
  • Outcome metrics
  • Community feedback
Where this commonly fails
  • Investments ad hoc
  • No outcome metrics
  • Feedback ignored
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does.